# Flog Txt Version 1 # Analyzer Version: 2.3.2 # Analyzer Build Date: Feb 15 2019 13:52:06 # Log Creation Date: 26.02.2019 01:56:33.307 Process: id = "1" image_name = "recibo.pdf.exe" filename = "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\recibo.pdf.exe" page_root = "0x72819000" os_pid = "0x9b4" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "analysis_target" parent_id = "0" os_parent_pid = "0x0" cmd_line = "\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\recibo.pdf.exe\" " cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e814" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 1 start_va = 0x10000 end_va = 0x2ffff entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 2 start_va = 0x30000 end_va = 0x31fff entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 3 start_va = 0x40000 end_va = 0x40fff entry_point = 0x40000 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 4 start_va = 0x50000 end_va = 0x53fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000050000" filename = "" Region: id = 5 start_va = 0x60000 end_va = 0x60fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000060000" filename = "" Region: id = 6 start_va = 0xf0000 end_va = 0x12ffff entry_point = 0x0 region_type = private name = "private_0x00000000000f0000" filename = "" Region: id = 7 start_va = 0x1d0000 end_va = 0x1304fff entry_point = 0x1d0000 region_type = mapped_file name = "recibo.pdf.exe" filename = "\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\recibo.pdf.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\recibo.pdf.exe") Region: id = 8 start_va = 0x1450000 end_va = 0x154ffff entry_point = 0x0 region_type = private name = "private_0x0000000001450000" filename = "" Region: id = 9 start_va = 0x77860000 end_va = 0x77a08fff entry_point = 0x77860000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 10 start_va = 0x77a40000 end_va = 0x77bbffff entry_point = 0x77a40000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 11 start_va = 0x7efb0000 end_va = 0x7efd2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efb0000" filename = "" Region: id = 12 start_va = 0x7efdb000 end_va = 0x7efddfff entry_point = 0x0 region_type = private name = "private_0x000000007efdb000" filename = "" Region: id = 13 start_va = 0x7efde000 end_va = 0x7efdefff entry_point = 0x0 region_type = private name = "private_0x000000007efde000" filename = "" Region: id = 14 start_va = 0x7efdf000 end_va = 0x7efdffff entry_point = 0x0 region_type = private name = "private_0x000000007efdf000" filename = "" Region: id = 15 start_va = 0x7efe0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 16 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 17 start_va = 0x7fff0000 end_va = 0x7fffffeffff entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 150 start_va = 0x1710000 end_va = 0x178ffff entry_point = 0x0 region_type = private name = "private_0x0000000001710000" filename = "" Region: id = 151 start_va = 0x74f80000 end_va = 0x74f87fff entry_point = 0x74f80000 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 152 start_va = 0x74f90000 end_va = 0x74febfff entry_point = 0x74f90000 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 153 start_va = 0x74ff0000 end_va = 0x7502efff entry_point = 0x74ff0000 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 154 start_va = 0x1950000 end_va = 0x1a4ffff entry_point = 0x0 region_type = private name = "private_0x0000000001950000" filename = "" Region: id = 155 start_va = 0x773b0000 end_va = 0x774bffff entry_point = 0x773b0000 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 156 start_va = 0x775f0000 end_va = 0x77635fff entry_point = 0x775f0000 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 157 start_va = 0x77640000 end_va = 0x77739fff entry_point = 0x0 region_type = private name = "private_0x0000000077640000" filename = "" Region: id = 158 start_va = 0x77740000 end_va = 0x7785efff entry_point = 0x0 region_type = private name = "private_0x0000000077740000" filename = "" Region: id = 159 start_va = 0x10000 end_va = 0x1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 160 start_va = 0x70000 end_va = 0xd6fff entry_point = 0x70000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 161 start_va = 0x74f70000 end_va = 0x74f72fff entry_point = 0x74f70000 region_type = mapped_file name = "api-ms-win-core-synch-l1-2-0.dll" filename = "\\Windows\\SysWOW64\\api-ms-win-core-synch-l1-2-0.dll" (normalized: "c:\\windows\\syswow64\\api-ms-win-core-synch-l1-2-0.dll") Region: id = 162 start_va = 0x75210000 end_va = 0x75212fff entry_point = 0x75210000 region_type = mapped_file name = "api-ms-win-crt-utility-l1-1-0.dll" filename = "\\Windows\\SysWOW64\\api-ms-win-crt-utility-l1-1-0.dll" (normalized: "c:\\windows\\syswow64\\api-ms-win-crt-utility-l1-1-0.dll") Region: id = 163 start_va = 0x75220000 end_va = 0x75222fff entry_point = 0x75220000 region_type = mapped_file name = "api-ms-win-crt-environment-l1-1-0.dll" filename = "\\Windows\\SysWOW64\\api-ms-win-crt-environment-l1-1-0.dll" (normalized: "c:\\windows\\syswow64\\api-ms-win-crt-environment-l1-1-0.dll") Region: id = 164 start_va = 0x75230000 end_va = 0x75232fff entry_point = 0x75230000 region_type = mapped_file name = "api-ms-win-crt-filesystem-l1-1-0.dll" filename = "\\Windows\\SysWOW64\\api-ms-win-crt-filesystem-l1-1-0.dll" (normalized: "c:\\windows\\syswow64\\api-ms-win-crt-filesystem-l1-1-0.dll") Region: id = 165 start_va = 0x75240000 end_va = 0x75242fff entry_point = 0x75240000 region_type = mapped_file name = "api-ms-win-crt-time-l1-1-0.dll" filename = "\\Windows\\SysWOW64\\api-ms-win-crt-time-l1-1-0.dll" (normalized: "c:\\windows\\syswow64\\api-ms-win-crt-time-l1-1-0.dll") Region: id = 166 start_va = 0x75250000 end_va = 0x75254fff entry_point = 0x75250000 region_type = mapped_file name = "api-ms-win-crt-multibyte-l1-1-0.dll" filename = "\\Windows\\SysWOW64\\api-ms-win-crt-multibyte-l1-1-0.dll" (normalized: "c:\\windows\\syswow64\\api-ms-win-crt-multibyte-l1-1-0.dll") Region: id = 167 start_va = 0x75260000 end_va = 0x75264fff entry_point = 0x75260000 region_type = mapped_file name = "api-ms-win-crt-math-l1-1-0.dll" filename = "\\Windows\\SysWOW64\\api-ms-win-crt-math-l1-1-0.dll" (normalized: "c:\\windows\\syswow64\\api-ms-win-crt-math-l1-1-0.dll") Region: id = 168 start_va = 0x75270000 end_va = 0x75272fff entry_point = 0x75270000 region_type = mapped_file name = "api-ms-win-crt-locale-l1-1-0.dll" filename = "\\Windows\\SysWOW64\\api-ms-win-crt-locale-l1-1-0.dll" (normalized: "c:\\windows\\syswow64\\api-ms-win-crt-locale-l1-1-0.dll") Region: id = 169 start_va = 0x75280000 end_va = 0x75283fff entry_point = 0x75280000 region_type = mapped_file name = "api-ms-win-crt-convert-l1-1-0.dll" filename = "\\Windows\\SysWOW64\\api-ms-win-crt-convert-l1-1-0.dll" (normalized: "c:\\windows\\syswow64\\api-ms-win-crt-convert-l1-1-0.dll") Region: id = 170 start_va = 0x75290000 end_va = 0x75293fff entry_point = 0x75290000 region_type = mapped_file name = "api-ms-win-crt-stdio-l1-1-0.dll" filename = "\\Windows\\SysWOW64\\api-ms-win-crt-stdio-l1-1-0.dll" (normalized: "c:\\windows\\syswow64\\api-ms-win-crt-stdio-l1-1-0.dll") Region: id = 171 start_va = 0x752a0000 end_va = 0x752a2fff entry_point = 0x752a0000 region_type = mapped_file name = "api-ms-win-crt-heap-l1-1-0.dll" filename = "\\Windows\\SysWOW64\\api-ms-win-crt-heap-l1-1-0.dll" (normalized: "c:\\windows\\syswow64\\api-ms-win-crt-heap-l1-1-0.dll") Region: id = 172 start_va = 0x752b0000 end_va = 0x752b3fff entry_point = 0x752b0000 region_type = mapped_file name = "api-ms-win-crt-string-l1-1-0.dll" filename = "\\Windows\\SysWOW64\\api-ms-win-crt-string-l1-1-0.dll" (normalized: "c:\\windows\\syswow64\\api-ms-win-crt-string-l1-1-0.dll") Region: id = 173 start_va = 0x752c0000 end_va = 0x752c2fff entry_point = 0x752c0000 region_type = mapped_file name = "api-ms-win-core-file-l1-2-0.dll" filename = "\\Windows\\SysWOW64\\api-ms-win-core-file-l1-2-0.dll" (normalized: "c:\\windows\\syswow64\\api-ms-win-core-file-l1-2-0.dll") Region: id = 174 start_va = 0x752d0000 end_va = 0x752d2fff entry_point = 0x752d0000 region_type = mapped_file name = "api-ms-win-core-processthreads-l1-1-1.dll" filename = "\\Windows\\SysWOW64\\api-ms-win-core-processthreads-l1-1-1.dll" (normalized: "c:\\windows\\syswow64\\api-ms-win-core-processthreads-l1-1-1.dll") Region: id = 175 start_va = 0x752e0000 end_va = 0x752e2fff entry_point = 0x752e0000 region_type = mapped_file name = "api-ms-win-core-localization-l1-2-0.dll" filename = "\\Windows\\SysWOW64\\api-ms-win-core-localization-l1-2-0.dll" (normalized: "c:\\windows\\syswow64\\api-ms-win-core-localization-l1-2-0.dll") Region: id = 176 start_va = 0x752f0000 end_va = 0x752f2fff entry_point = 0x752f0000 region_type = mapped_file name = "api-ms-win-core-file-l2-1-0.dll" filename = "\\Windows\\SysWOW64\\api-ms-win-core-file-l2-1-0.dll" (normalized: "c:\\windows\\syswow64\\api-ms-win-core-file-l2-1-0.dll") Region: id = 177 start_va = 0x75300000 end_va = 0x75302fff entry_point = 0x75300000 region_type = mapped_file name = "api-ms-win-core-timezone-l1-1-0.dll" filename = "\\Windows\\SysWOW64\\api-ms-win-core-timezone-l1-1-0.dll" (normalized: "c:\\windows\\syswow64\\api-ms-win-core-timezone-l1-1-0.dll") Region: id = 178 start_va = 0x75310000 end_va = 0x753ebfff entry_point = 0x75310000 region_type = mapped_file name = "ucrtbase.dll" filename = "\\Windows\\SysWOW64\\ucrtbase.dll" (normalized: "c:\\windows\\syswow64\\ucrtbase.dll") Region: id = 179 start_va = 0x753f0000 end_va = 0x753f3fff entry_point = 0x753f0000 region_type = mapped_file name = "api-ms-win-crt-runtime-l1-1-0.dll" filename = "\\Windows\\SysWOW64\\api-ms-win-crt-runtime-l1-1-0.dll" (normalized: "c:\\windows\\syswow64\\api-ms-win-crt-runtime-l1-1-0.dll") Region: id = 180 start_va = 0x75400000 end_va = 0x75413fff entry_point = 0x75400000 region_type = mapped_file name = "vcruntime140.dll" filename = "\\Windows\\SysWOW64\\vcruntime140.dll" (normalized: "c:\\windows\\syswow64\\vcruntime140.dll") Region: id = 181 start_va = 0x75420000 end_va = 0x7548bfff entry_point = 0x75420000 region_type = mapped_file name = "msvcp140.dll" filename = "\\Windows\\SysWOW64\\msvcp140.dll" (normalized: "c:\\windows\\syswow64\\msvcp140.dll") Region: id = 182 start_va = 0x7efe0000 end_va = 0x7f0dffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 183 start_va = 0x7f0e0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 184 start_va = 0x1a50000 end_va = 0x2b7dfff entry_point = 0x0 region_type = private name = "private_0x0000000001a50000" filename = "" Region: id = 185 start_va = 0x20000 end_va = 0x20fff entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Thread: id = 1 os_tid = 0x9b8 [0062.094] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x154fe44 | out: lpSystemTimeAsFileTime=0x154fe44*(dwLowDateTime=0xa22c7ab0, dwHighDateTime=0x1d4cd76)) [0062.094] GetCurrentThreadId () returned 0x9b8 [0062.094] GetCurrentProcessId () returned 0x9b4 [0062.094] QueryPerformanceCounter (in: lpPerformanceCount=0x154fe3c | out: lpPerformanceCount=0x154fe3c*=16338973574) returned 1 [0062.094] IsProcessorFeaturePresent (ProcessorFeature=0xa) returned 1 [0062.094] _set_app_type (_Type=0x2) [0062.094] _set_fmode (_Mode=16384) returned 0x0 [0062.094] __p__commode () returned 0x753e2410 [0062.094] _crt_atexit (_Function=0x1d29b1) returned 0 [0062.094] _configure_narrow_argv (mode=0x1) returned 0x0 [0062.094] RtlInitializeSListHead (in: ListHead=0x1d5408 | out: ListHead=0x1d5408) [0062.094] _controlfp_s (in: _CurrentState=0x0, _NewValue=0x10000, _Mask=0x30000 | out: _CurrentState=0x0) returned 0x0 [0062.095] _configthreadlocale () returned 0x2 [0062.095] _initialize_narrow_environment () returned 0 [0062.095] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x1d279a) returned 0x0 [0062.095] _set_new_mode () returned 0x0 [0062.095] _crt_atexit (_Function=0x1d2b00) returned 0 [0062.095] GetStartupInfoW (in: lpStartupInfo=0x154fde0 | out: lpStartupInfo=0x154fde0*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\recibo.pdf.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0)) [0062.095] _get_narrow_winmain_command_line () returned="" [0062.095] FindResourceA (hModule=0x0, lpName=0x1, lpType=0xa) returned 0x1d60a0 [0062.098] LoadResource (hModule=0x0, hResInfo=0x1d60a0) returned 0x1d60d0 [0062.098] SizeofResource (hModule=0x0, hResInfo=0x1d60a0) returned 0x2 [0062.098] GetModuleHandleA (lpModuleName="cmdvrt32.dll") returned 0x0 [0062.098] GetModuleHandleA (lpModuleName="SxIn.dll") returned 0x0 [0062.098] GetModuleHandleA (lpModuleName="SbieDll.dll") returned 0x0 [0062.098] GetModuleHandleA (lpModuleName="Sf2.dll") returned 0x0 [0062.098] GetModuleHandleA (lpModuleName="snxhk.dll") returned 0x0 [0062.098] FindResourceA (hModule=0x0, lpName=0x2, lpType=0xa) returned 0x1d60b0 [0062.098] LoadResource (hModule=0x0, hResInfo=0x1d60b0) returned 0x1d60d4 [0062.098] SizeofResource (hModule=0x0, hResInfo=0x1d60b0) returned 0x112d880 [0062.793] GetModuleFileNameA (in: hModule=0x0, lpFilename=0x1969c10, nSize=0x104 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\recibo.pdf.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\recibo.pdf.exe")) returned 0x34 [0062.793] CreateProcessA (in: lpApplicationName="C:\\WINDOWS\\System32\\attrib.exe", lpCommandLine=0x0, lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x8000004, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x154fd68*(cb=0x0, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x154fd58 | out: lpCommandLine=0x0, lpProcessInformation=0x154fd58*(hProcess=0x34, hThread=0x30, dwProcessId=0x9c4, dwThreadId=0x9c8)) returned 1 [0062.840] VirtualAlloc (lpAddress=0x0, dwSize=0x4, flAllocationType=0x1000, flProtect=0x4) returned 0x20000 [0062.840] GetThreadContext (in: hThread=0x30, lpContext=0x20000 | out: lpContext=0x20000*(ContextFlags=0x10007, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, FloatSave.ControlWord=0x0, FloatSave.StatusWord=0x0, FloatSave.TagWord=0x0, FloatSave.ErrorOffset=0x0, FloatSave.ErrorSelector=0x0, FloatSave.DataOffset=0x0, FloatSave.DataSelector=0x0, FloatSave.RegisterArea=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0), FloatSave.Cr0NpxState=0x0, SegGs=0x2b, SegFs=0x53, SegEs=0x2b, SegDs=0x2b, Edi=0x0, Esi=0x0, Ebx=0x7efde000, Edx=0x0, Ecx=0x0, Eax=0xae2989, Ebp=0x0, Eip=0x77a501c4, SegCs=0x23, EFlags=0x202, Esp=0xaf940, SegSs=0x2b, ExtendedRegisters=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0, [192]=0x0, [193]=0x0, [194]=0x0, [195]=0x0, [196]=0x0, [197]=0x0, [198]=0x0, [199]=0x0, [200]=0x0, [201]=0x0, [202]=0x0, [203]=0x0, [204]=0x0, [205]=0x0, [206]=0x0, [207]=0x0, [208]=0x0, [209]=0x0, [210]=0x0, [211]=0x0, [212]=0x0, [213]=0x0, [214]=0x0, [215]=0x0, [216]=0x0, [217]=0x0, [218]=0x0, [219]=0x0, [220]=0x0, [221]=0x0, [222]=0x0, [223]=0x0, [224]=0x0, [225]=0x0, [226]=0x0, [227]=0x0, [228]=0x0, [229]=0x0, [230]=0x0, [231]=0x0, [232]=0x0, [233]=0x0, [234]=0x0, [235]=0x0, [236]=0x0, [237]=0x0, [238]=0x0, [239]=0x0, [240]=0x0, [241]=0x0, [242]=0x0, [243]=0x0, [244]=0x0, [245]=0x0, [246]=0x0, [247]=0x0, [248]=0x0, [249]=0x0, [250]=0x0, [251]=0x0, [252]=0x0, [253]=0x0, [254]=0x0, [255]=0x0, [256]=0x0, [257]=0x0, [258]=0x0, [259]=0x0, [260]=0x0, [261]=0x0, [262]=0x0, [263]=0x0, [264]=0x0, [265]=0x0, [266]=0x0, [267]=0x0, [268]=0x0, [269]=0x0, [270]=0x0, [271]=0x0, [272]=0x0, [273]=0x0, [274]=0x0, [275]=0x0, [276]=0x0, [277]=0x0, [278]=0x0, [279]=0x0, [280]=0x0, [281]=0x0, [282]=0x0, [283]=0x0, [284]=0x0, [285]=0x0, [286]=0x0, [287]=0x0, [288]=0x0, [289]=0x0, [290]=0x0, [291]=0x0, [292]=0x0, [293]=0x0, [294]=0x0, [295]=0x0, [296]=0x0, [297]=0x0, [298]=0x0, [299]=0x0, [300]=0x0, [301]=0x0, [302]=0x0, [303]=0x0, [304]=0x0, [305]=0x0, [306]=0x0, [307]=0x0, [308]=0x0, [309]=0x0, [310]=0x0, [311]=0x0, [312]=0x0, [313]=0x0, [314]=0x0, [315]=0x0, [316]=0x0, [317]=0x0, [318]=0x0, [319]=0x0, [320]=0x0, [321]=0x0, [322]=0x0, [323]=0x0, [324]=0x0, [325]=0x0, [326]=0x0, [327]=0x0, [328]=0x0, [329]=0x0, [330]=0x0, [331]=0x0, [332]=0x0, [333]=0x0, [334]=0x0, [335]=0x0, [336]=0x0, [337]=0x0, [338]=0x0, [339]=0x0, [340]=0x0, [341]=0x0, [342]=0x0, [343]=0x0, [344]=0x0, [345]=0x0, [346]=0x0, [347]=0x0, [348]=0x0, [349]=0x0, [350]=0x0, [351]=0x0, [352]=0x0, [353]=0x0, [354]=0x0, [355]=0x0, [356]=0x0, [357]=0x0, [358]=0x0, [359]=0x0, [360]=0x0, [361]=0x0, [362]=0x0, [363]=0x0, [364]=0x0, [365]=0x0, [366]=0x0, [367]=0x0, [368]=0x0, [369]=0x0, [370]=0x0, [371]=0x0, [372]=0x0, [373]=0x0, [374]=0x0, [375]=0x0, [376]=0x0, [377]=0x0, [378]=0x0, [379]=0x0, [380]=0x0, [381]=0x0, [382]=0x0, [383]=0x0, [384]=0x0, [385]=0x0, [386]=0x0, [387]=0x0, [388]=0x0, [389]=0x0, [390]=0x0, [391]=0x0, [392]=0x0, [393]=0x0, [394]=0x0, [395]=0x0, [396]=0x0, [397]=0x0, [398]=0x0, [399]=0x0, [400]=0x0, [401]=0x0, [402]=0x0, [403]=0x0, [404]=0x0, [405]=0x0, [406]=0x0, [407]=0x0, [408]=0x0, [409]=0x0, [410]=0x0, [411]=0x0, [412]=0x0, [413]=0x0, [414]=0x0, [415]=0x0, [416]=0x0, [417]=0x0, [418]=0x0, [419]=0x0, [420]=0x0, [421]=0x0, [422]=0x0, [423]=0x0, [424]=0x0, [425]=0x0, [426]=0x0, [427]=0x0, [428]=0x0, [429]=0x0, [430]=0x0, [431]=0x0, [432]=0x0, [433]=0x0, [434]=0x0, [435]=0x0, [436]=0x0, [437]=0x0, [438]=0x0, [439]=0x0, [440]=0x0, [441]=0x0, [442]=0x0, [443]=0x0, [444]=0x0, [445]=0x0, [446]=0x0, [447]=0x0, [448]=0x0, [449]=0x0, [450]=0x0, [451]=0x0, [452]=0x0, [453]=0x0, [454]=0x0, [455]=0x0, [456]=0x0, [457]=0x0, [458]=0x0, [459]=0x0, [460]=0x0, [461]=0x0, [462]=0x0, [463]=0x0, [464]=0x0, [465]=0x0, [466]=0x0, [467]=0x0, [468]=0x0, [469]=0x0, [470]=0x0, [471]=0x0, [472]=0x0, [473]=0x0, [474]=0x0, [475]=0x0, [476]=0x0, [477]=0x0, [478]=0x0, [479]=0x0, [480]=0x0, [481]=0x0, [482]=0x0, [483]=0x0, [484]=0x0, [485]=0x0, [486]=0x0, [487]=0x0, [488]=0x0, [489]=0x0, [490]=0x0, [491]=0x0, [492]=0x0, [493]=0x0, [494]=0x0, [495]=0x0, [496]=0x0, [497]=0x0, [498]=0x0, [499]=0x0, [500]=0x0, [501]=0x0, [502]=0x0, [503]=0x0, [504]=0x0, [505]=0x0, [506]=0x0, [507]=0x0, [508]=0x0, [509]=0x0, [510]=0x0, [511]=0x0))) returned 1 [0062.941] ReadProcessMemory (in: hProcess=0x34, lpBaseAddress=0x7efde008, lpBuffer=0x154fd54, nSize=0x4, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x154fd54*, lpNumberOfBytesRead=0x0) returned 1 [0062.941] VirtualAllocEx (hProcess=0x34, lpAddress=0x400000, dwSize=0x9000, flAllocationType=0x3000, flProtect=0x40) returned 0x400000 [0062.941] WriteProcessMemory (in: hProcess=0x34, lpBaseAddress=0x400000, lpBuffer=0x1a50040*, nSize=0x400, lpNumberOfBytesWritten=0x0 | out: lpBuffer=0x1a50040*, lpNumberOfBytesWritten=0x0) returned 1 [0062.942] WriteProcessMemory (in: hProcess=0x34, lpBaseAddress=0x401000, lpBuffer=0x1a50440*, nSize=0x1800, lpNumberOfBytesWritten=0x0 | out: lpBuffer=0x1a50440*, lpNumberOfBytesWritten=0x0) returned 1 [0062.942] WriteProcessMemory (in: hProcess=0x34, lpBaseAddress=0x403000, lpBuffer=0x1a51c40*, nSize=0xa00, lpNumberOfBytesWritten=0x0 | out: lpBuffer=0x1a51c40*, lpNumberOfBytesWritten=0x0) returned 1 [0062.942] WriteProcessMemory (in: hProcess=0x34, lpBaseAddress=0x404000, lpBuffer=0x1a52640*, nSize=0x600, lpNumberOfBytesWritten=0x0 | out: lpBuffer=0x1a52640*, lpNumberOfBytesWritten=0x0) returned 1 [0062.943] WriteProcessMemory (in: hProcess=0x34, lpBaseAddress=0x408000, lpBuffer=0x1a52c40*, nSize=0x400, lpNumberOfBytesWritten=0x0 | out: lpBuffer=0x1a52c40*, lpNumberOfBytesWritten=0x0) returned 1 [0062.943] WriteProcessMemory (in: hProcess=0x34, lpBaseAddress=0x7efde008, lpBuffer=0x1a500f4*, nSize=0x4, lpNumberOfBytesWritten=0x0 | out: lpBuffer=0x1a500f4*, lpNumberOfBytesWritten=0x0) returned 1 [0062.943] SetThreadContext (hThread=0x30, lpContext=0x20000*(ContextFlags=0x10007, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, FloatSave.ControlWord=0x0, FloatSave.StatusWord=0x0, FloatSave.TagWord=0x0, FloatSave.ErrorOffset=0x0, FloatSave.ErrorSelector=0x0, FloatSave.DataOffset=0x0, FloatSave.DataSelector=0x0, FloatSave.RegisterArea=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0), FloatSave.Cr0NpxState=0x0, SegGs=0x2b, SegFs=0x53, SegEs=0x2b, SegDs=0x2b, Edi=0x0, Esi=0x0, Ebx=0x7efde000, Edx=0x0, Ecx=0x0, Eax=0x4021d1, Ebp=0x0, Eip=0x77a501c4, SegCs=0x23, EFlags=0x202, Esp=0xaf940, SegSs=0x2b, ExtendedRegisters=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0, [192]=0x0, [193]=0x0, [194]=0x0, [195]=0x0, [196]=0x0, [197]=0x0, [198]=0x0, [199]=0x0, [200]=0x0, [201]=0x0, [202]=0x0, [203]=0x0, [204]=0x0, [205]=0x0, [206]=0x0, [207]=0x0, [208]=0x0, [209]=0x0, [210]=0x0, [211]=0x0, [212]=0x0, [213]=0x0, [214]=0x0, [215]=0x0, [216]=0x0, [217]=0x0, [218]=0x0, [219]=0x0, [220]=0x0, [221]=0x0, [222]=0x0, [223]=0x0, [224]=0x0, [225]=0x0, [226]=0x0, [227]=0x0, [228]=0x0, [229]=0x0, [230]=0x0, [231]=0x0, [232]=0x0, [233]=0x0, [234]=0x0, [235]=0x0, [236]=0x0, [237]=0x0, [238]=0x0, [239]=0x0, [240]=0x0, [241]=0x0, [242]=0x0, [243]=0x0, [244]=0x0, [245]=0x0, [246]=0x0, [247]=0x0, [248]=0x0, [249]=0x0, [250]=0x0, [251]=0x0, [252]=0x0, [253]=0x0, [254]=0x0, [255]=0x0, [256]=0x0, [257]=0x0, [258]=0x0, [259]=0x0, [260]=0x0, [261]=0x0, [262]=0x0, [263]=0x0, [264]=0x0, [265]=0x0, [266]=0x0, [267]=0x0, [268]=0x0, [269]=0x0, [270]=0x0, [271]=0x0, [272]=0x0, [273]=0x0, [274]=0x0, [275]=0x0, [276]=0x0, [277]=0x0, [278]=0x0, [279]=0x0, [280]=0x0, [281]=0x0, [282]=0x0, [283]=0x0, [284]=0x0, [285]=0x0, [286]=0x0, [287]=0x0, [288]=0x0, [289]=0x0, [290]=0x0, [291]=0x0, [292]=0x0, [293]=0x0, [294]=0x0, [295]=0x0, [296]=0x0, [297]=0x0, [298]=0x0, [299]=0x0, [300]=0x0, [301]=0x0, [302]=0x0, [303]=0x0, [304]=0x0, [305]=0x0, [306]=0x0, [307]=0x0, [308]=0x0, [309]=0x0, [310]=0x0, [311]=0x0, [312]=0x0, [313]=0x0, [314]=0x0, [315]=0x0, [316]=0x0, [317]=0x0, [318]=0x0, [319]=0x0, [320]=0x0, [321]=0x0, [322]=0x0, [323]=0x0, [324]=0x0, [325]=0x0, [326]=0x0, [327]=0x0, [328]=0x0, [329]=0x0, [330]=0x0, [331]=0x0, [332]=0x0, [333]=0x0, [334]=0x0, [335]=0x0, [336]=0x0, [337]=0x0, [338]=0x0, [339]=0x0, [340]=0x0, [341]=0x0, [342]=0x0, [343]=0x0, [344]=0x0, [345]=0x0, [346]=0x0, [347]=0x0, [348]=0x0, [349]=0x0, [350]=0x0, [351]=0x0, [352]=0x0, [353]=0x0, [354]=0x0, [355]=0x0, [356]=0x0, [357]=0x0, [358]=0x0, [359]=0x0, [360]=0x0, [361]=0x0, [362]=0x0, [363]=0x0, [364]=0x0, [365]=0x0, [366]=0x0, [367]=0x0, [368]=0x0, [369]=0x0, [370]=0x0, [371]=0x0, [372]=0x0, [373]=0x0, [374]=0x0, [375]=0x0, [376]=0x0, [377]=0x0, [378]=0x0, [379]=0x0, [380]=0x0, [381]=0x0, [382]=0x0, [383]=0x0, [384]=0x0, [385]=0x0, [386]=0x0, [387]=0x0, [388]=0x0, [389]=0x0, [390]=0x0, [391]=0x0, [392]=0x0, [393]=0x0, [394]=0x0, [395]=0x0, [396]=0x0, [397]=0x0, [398]=0x0, [399]=0x0, [400]=0x0, [401]=0x0, [402]=0x0, [403]=0x0, [404]=0x0, [405]=0x0, [406]=0x0, [407]=0x0, [408]=0x0, [409]=0x0, [410]=0x0, [411]=0x0, [412]=0x0, [413]=0x0, [414]=0x0, [415]=0x0, [416]=0x0, [417]=0x0, [418]=0x0, [419]=0x0, [420]=0x0, [421]=0x0, [422]=0x0, [423]=0x0, [424]=0x0, [425]=0x0, [426]=0x0, [427]=0x0, [428]=0x0, [429]=0x0, [430]=0x0, [431]=0x0, [432]=0x0, [433]=0x0, [434]=0x0, [435]=0x0, [436]=0x0, [437]=0x0, [438]=0x0, [439]=0x0, [440]=0x0, [441]=0x0, [442]=0x0, [443]=0x0, [444]=0x0, [445]=0x0, [446]=0x0, [447]=0x0, [448]=0x0, [449]=0x0, [450]=0x0, [451]=0x0, [452]=0x0, [453]=0x0, [454]=0x0, [455]=0x0, [456]=0x0, [457]=0x0, [458]=0x0, [459]=0x0, [460]=0x0, [461]=0x0, [462]=0x0, [463]=0x0, [464]=0x0, [465]=0x0, [466]=0x0, [467]=0x0, [468]=0x0, [469]=0x0, [470]=0x0, [471]=0x0, [472]=0x0, [473]=0x0, [474]=0x0, [475]=0x0, [476]=0x0, [477]=0x0, [478]=0x0, [479]=0x0, [480]=0x0, [481]=0x0, [482]=0x0, [483]=0x0, [484]=0x0, [485]=0x0, [486]=0x0, [487]=0x0, [488]=0x0, [489]=0x0, [490]=0x0, [491]=0x0, [492]=0x0, [493]=0x0, [494]=0x0, [495]=0x0, [496]=0x0, [497]=0x0, [498]=0x0, [499]=0x0, [500]=0x0, [501]=0x0, [502]=0x0, [503]=0x0, [504]=0x0, [505]=0x0, [506]=0x0, [507]=0x0, [508]=0x0, [509]=0x0, [510]=0x0, [511]=0x0))) returned 1 [0062.944] ResumeThread (hThread=0x30) returned 0x1 [0062.963] rand () returned 41 [0062.963] rand () returned 18467 [0062.963] rand () returned 6334 [0062.963] rand () returned 26500 [0062.963] rand () returned 19169 [0062.964] rand () returned 15724 [0062.964] rand () returned 11478 [0062.964] rand () returned 29358 [0062.964] rand () returned 26962 [0062.964] rand () returned 24464 [0062.964] rand () returned 5705 [0062.964] rand () returned 28145 [0062.964] rand () returned 23281 [0062.964] rand () returned 16827 [0062.964] rand () returned 9961 [0062.964] rand () returned 491 [0062.964] rand () returned 2995 [0062.964] rand () returned 11942 [0062.964] rand () returned 4827 [0062.964] rand () returned 5436 [0062.964] rand () returned 32391 [0062.965] rand () returned 14604 [0062.965] rand () returned 3902 [0062.965] rand () returned 153 [0062.965] rand () returned 292 [0062.965] rand () returned 12382 [0062.965] rand () returned 17421 [0062.965] rand () returned 18716 [0062.965] rand () returned 19718 [0062.965] rand () returned 19895 [0062.976] rand () returned 5447 [0062.976] VirtualProtect (in: lpAddress=0x1d12b3, dwSize=0x2cc, flNewProtect=0x40, lpflOldProtect=0x154fe04 | out: lpflOldProtect=0x154fe04*=0x20) returned 1 [0062.976] rand () returned 21726 [0062.976] rand () returned 14771 [0062.976] rand () returned 11538 [0062.976] rand () returned 1869 [0062.976] rand () returned 19912 [0062.976] rand () returned 25667 [0062.976] rand () returned 26299 [0062.976] rand () returned 17035 [0062.976] rand () returned 9894 [0062.976] rand () returned 28703 [0062.976] rand () returned 23811 [0062.976] rand () returned 31322 [0062.976] rand () returned 30333 [0062.977] rand () returned 17673 [0062.977] rand () returned 4664 [0062.977] rand () returned 15141 [0062.977] rand () returned 7711 [0062.977] rand () returned 28253 [0062.977] rand () returned 6868 [0062.977] rand () returned 25547 [0062.977] rand () returned 27644 [0062.977] rand () returned 32662 [0062.977] rand () returned 32757 [0062.977] rand () returned 20037 [0062.977] rand () returned 12859 [0062.977] rand () returned 8723 [0062.977] rand () returned 9741 [0062.977] rand () returned 27529 [0062.977] rand () returned 778 [0062.977] rand () returned 12316 [0062.977] rand () returned 3035 [0062.977] rand () returned 22190 [0062.977] rand () returned 1842 [0062.977] rand () returned 288 [0062.977] rand () returned 30106 [0062.977] rand () returned 9040 [0062.977] rand () returned 8942 [0062.977] rand () returned 19264 [0062.977] rand () returned 22648 [0062.977] rand () returned 27446 [0062.977] rand () returned 23805 [0062.977] rand () returned 15890 [0062.977] rand () returned 6729 [0062.977] rand () returned 24370 [0062.977] rand () returned 15350 [0062.977] rand () returned 15006 [0062.977] rand () returned 31101 [0062.977] rand () returned 24393 [0062.977] rand () returned 3548 [0062.977] rand () returned 19629 [0062.977] rand () returned 12623 [0062.977] rand () returned 24084 [0062.977] rand () returned 19954 [0062.977] rand () returned 18756 [0062.977] rand () returned 11840 [0062.977] rand () returned 4966 [0062.977] rand () returned 7376 [0062.977] rand () returned 13931 [0062.977] rand () returned 26308 [0062.977] rand () returned 16944 [0062.977] rand () returned 32439 [0062.977] rand () returned 24626 [0062.977] rand () returned 11323 [0062.977] rand () returned 5537 [0062.977] rand () returned 21538 [0062.977] rand () returned 16118 [0062.977] rand () returned 2082 [0062.977] rand () returned 22929 [0062.977] rand () returned 16541 [0062.977] rand () returned 4833 [0062.977] rand () returned 31115 [0062.977] rand () returned 4639 [0062.977] rand () returned 29658 [0062.977] rand () returned 22704 [0062.977] rand () returned 9930 [0062.977] rand () returned 13977 [0062.978] rand () returned 2306 [0062.978] rand () returned 31673 [0062.978] rand () returned 22386 [0062.978] rand () returned 5021 [0062.978] rand () returned 28745 [0062.978] rand () returned 26924 [0062.978] rand () returned 19072 [0062.978] rand () returned 6270 [0062.978] rand () returned 5829 [0062.978] rand () returned 26777 [0062.978] rand () returned 15573 [0062.978] rand () returned 5097 [0062.978] rand () returned 16512 [0062.978] rand () returned 23986 [0062.978] rand () returned 13290 [0062.978] rand () returned 9161 [0062.978] rand () returned 18636 [0062.978] rand () returned 22355 [0062.978] rand () returned 24767 [0062.978] rand () returned 23655 [0062.978] rand () returned 15574 [0062.978] rand () returned 4031 [0062.978] rand () returned 12052 [0062.978] rand () returned 27350 [0062.978] rand () returned 1150 [0062.978] rand () returned 16941 [0062.978] rand () returned 21724 [0062.978] rand () returned 13966 [0062.978] rand () returned 3430 [0062.978] rand () returned 31107 [0062.978] rand () returned 30191 [0062.978] rand () returned 18007 [0062.978] rand () returned 11337 [0062.978] rand () returned 15457 [0062.978] rand () returned 12287 [0062.978] rand () returned 27753 [0062.978] rand () returned 10383 [0062.978] rand () returned 14945 [0062.978] rand () returned 8909 [0062.978] rand () returned 32209 [0062.978] rand () returned 9758 [0062.978] rand () returned 24221 [0062.978] rand () returned 18588 [0062.978] rand () returned 6422 [0062.979] rand () returned 24946 [0062.979] rand () returned 27506 [0062.979] rand () returned 13030 [0062.979] rand () returned 16413 [0062.979] rand () returned 29168 [0062.979] rand () returned 900 [0062.979] rand () returned 32591 [0062.979] rand () returned 18762 [0062.979] rand () returned 1655 [0062.979] rand () returned 17410 [0062.979] rand () returned 6359 [0062.979] rand () returned 27624 [0062.979] rand () returned 20537 [0062.979] rand () returned 21548 [0062.979] rand () returned 6483 [0062.979] rand () returned 27595 [0062.979] rand () returned 4041 [0062.979] rand () returned 3602 [0062.979] rand () returned 24350 [0062.979] rand () returned 10291 [0062.979] rand () returned 30836 [0062.979] rand () returned 9374 [0062.979] rand () returned 11020 [0062.979] rand () returned 4596 [0062.979] rand () returned 24021 [0062.979] rand () returned 27348 [0062.979] rand () returned 23199 [0062.979] rand () returned 19668 [0062.979] rand () returned 24484 [0062.979] rand () returned 8281 [0062.979] rand () returned 4734 [0062.979] rand () returned 53 [0062.979] rand () returned 1999 [0062.979] rand () returned 26418 [0062.979] rand () returned 27938 [0062.979] rand () returned 6900 [0062.979] rand () returned 3788 [0062.979] rand () returned 18127 [0062.979] rand () returned 467 [0062.979] rand () returned 3728 [0062.979] rand () returned 14893 [0062.979] rand () returned 24648 [0062.979] rand () returned 22483 [0062.979] rand () returned 17807 [0062.979] rand () returned 2421 [0062.979] rand () returned 14310 [0062.979] rand () returned 6617 [0062.979] rand () returned 22813 [0062.979] rand () returned 9514 [0062.979] rand () returned 14309 [0062.979] rand () returned 7616 [0062.979] rand () returned 18935 [0062.979] rand () returned 17451 [0062.979] rand () returned 20600 [0062.979] rand () returned 5249 [0062.979] rand () returned 16519 [0062.979] rand () returned 31556 [0062.979] rand () returned 22798 [0062.979] rand () returned 30303 [0062.979] rand () returned 6224 [0062.980] rand () returned 11008 [0062.980] rand () returned 5844 [0062.980] rand () returned 32609 [0062.980] rand () returned 14989 [0062.980] rand () returned 32702 [0062.980] rand () returned 3195 [0062.980] rand () returned 20485 [0062.980] rand () returned 3093 [0062.980] rand () returned 14343 [0062.980] rand () returned 30523 [0062.980] rand () returned 1587 [0062.980] rand () returned 29314 [0062.980] rand () returned 9503 [0062.980] rand () returned 7448 [0062.980] rand () returned 25200 [0062.980] rand () returned 13458 [0062.980] rand () returned 6618 [0062.980] rand () returned 20580 [0062.980] rand () returned 19796 [0062.980] rand () returned 14798 [0062.980] rand () returned 15281 [0062.980] rand () returned 19589 [0062.980] rand () returned 20798 [0062.980] rand () returned 28009 [0062.980] rand () returned 27157 [0062.980] rand () returned 20472 [0062.980] rand () returned 23622 [0062.980] rand () returned 18538 [0062.980] rand () returned 12292 [0062.980] rand () returned 6038 [0062.980] rand () returned 24179 [0062.980] rand () returned 18190 [0062.980] rand () returned 29657 [0062.980] rand () returned 7958 [0062.980] rand () returned 6191 [0062.980] rand () returned 19815 [0062.980] rand () returned 22888 [0062.980] rand () returned 19156 [0062.980] rand () returned 11511 [0062.980] rand () returned 16202 [0062.980] rand () returned 2634 [0062.980] rand () returned 24272 [0062.980] rand () returned 20055 [0062.980] rand () returned 20328 [0062.980] rand () returned 22646 [0062.980] rand () returned 26362 [0062.980] rand () returned 4886 [0062.980] rand () returned 18875 [0062.980] rand () returned 28433 [0062.980] rand () returned 29869 [0062.980] rand () returned 20142 [0062.980] rand () returned 23844 [0062.980] rand () returned 1416 [0062.980] rand () returned 21881 [0062.980] rand () returned 31998 [0062.980] rand () returned 10322 [0062.980] rand () returned 18651 [0062.980] rand () returned 10021 [0062.980] rand () returned 5699 [0062.980] rand () returned 3557 [0062.981] rand () returned 28476 [0062.981] rand () returned 27892 [0062.981] rand () returned 24389 [0062.981] rand () returned 5075 [0062.981] rand () returned 10712 [0062.981] rand () returned 2600 [0062.981] rand () returned 2510 [0062.981] rand () returned 21003 [0062.981] rand () returned 26869 [0062.981] VirtualProtect (in: lpAddress=0x1d12b3, dwSize=0x2cc, flNewProtect=0x20, lpflOldProtect=0x154fe08 | out: lpflOldProtect=0x154fe08*=0x40) returned 1 [0063.070] GetModuleHandleW (lpModuleName=0x0) returned 0x1d0000 [0063.079] exit (_Code=1) Process: id = "2" image_name = "attrib.exe" filename = "c:\\windows\\syswow64\\attrib.exe" page_root = "0x21968000" os_pid = "0x9c4" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "1" os_parent_pid = "0x9b4" cmd_line = "\"C:\\WINDOWS\\System32\\attrib.exe\"" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e814" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 186 start_va = 0x10000 end_va = 0x2ffff entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 187 start_va = 0x30000 end_va = 0x31fff entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 188 start_va = 0x40000 end_va = 0x40fff entry_point = 0x40000 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 189 start_va = 0x50000 end_va = 0x53fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000050000" filename = "" Region: id = 190 start_va = 0x60000 end_va = 0x60fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000060000" filename = "" Region: id = 191 start_va = 0x70000 end_va = 0xaffff entry_point = 0x0 region_type = private name = "private_0x0000000000070000" filename = "" Region: id = 192 start_va = 0xd0000 end_va = 0x10ffff entry_point = 0x0 region_type = private name = "private_0x00000000000d0000" filename = "" Region: id = 193 start_va = 0xae0000 end_va = 0xae6fff entry_point = 0xae0000 region_type = mapped_file name = "attrib.exe" filename = "\\Windows\\SysWOW64\\attrib.exe" (normalized: "c:\\windows\\syswow64\\attrib.exe") Region: id = 194 start_va = 0x77860000 end_va = 0x77a08fff entry_point = 0x77860000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 195 start_va = 0x77a40000 end_va = 0x77bbffff entry_point = 0x77a40000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 196 start_va = 0x7efb0000 end_va = 0x7efd2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efb0000" filename = "" Region: id = 197 start_va = 0x7efdb000 end_va = 0x7efddfff entry_point = 0x0 region_type = private name = "private_0x000000007efdb000" filename = "" Region: id = 198 start_va = 0x7efde000 end_va = 0x7efdefff entry_point = 0x0 region_type = private name = "private_0x000000007efde000" filename = "" Region: id = 199 start_va = 0x7efdf000 end_va = 0x7efdffff entry_point = 0x0 region_type = private name = "private_0x000000007efdf000" filename = "" Region: id = 200 start_va = 0x7efe0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 201 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 202 start_va = 0x7fff0000 end_va = 0x7fffffeffff entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 203 start_va = 0x400000 end_va = 0x408fff entry_point = 0x0 region_type = private name = "private_0x0000000000400000" filename = "" Region: id = 204 start_va = 0x2a0000 end_va = 0x31ffff entry_point = 0x0 region_type = private name = "private_0x00000000002a0000" filename = "" Region: id = 205 start_va = 0x74f80000 end_va = 0x74f87fff entry_point = 0x74f80000 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 206 start_va = 0x74f90000 end_va = 0x74febfff entry_point = 0x74f90000 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 207 start_va = 0x74ff0000 end_va = 0x7502efff entry_point = 0x74ff0000 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 208 start_va = 0x10000 end_va = 0x1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 209 start_va = 0x110000 end_va = 0x176fff entry_point = 0x110000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 210 start_va = 0x5a0000 end_va = 0x69ffff entry_point = 0x0 region_type = private name = "private_0x00000000005a0000" filename = "" Region: id = 211 start_va = 0x773b0000 end_va = 0x774bffff entry_point = 0x773b0000 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 212 start_va = 0x775f0000 end_va = 0x77635fff entry_point = 0x775f0000 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 213 start_va = 0x77640000 end_va = 0x77739fff entry_point = 0x0 region_type = private name = "private_0x0000000077640000" filename = "" Region: id = 214 start_va = 0x77740000 end_va = 0x7785efff entry_point = 0x0 region_type = private name = "private_0x0000000077740000" filename = "" Region: id = 215 start_va = 0x7efe0000 end_va = 0x7f0dffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 216 start_va = 0x7f0e0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 217 start_va = 0x75180000 end_va = 0x75203fff entry_point = 0x75180000 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\\comctl32.dll") Region: id = 218 start_va = 0x75590000 end_va = 0x7559bfff entry_point = 0x75590000 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 219 start_va = 0x755a0000 end_va = 0x755fffff entry_point = 0x755a0000 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 220 start_va = 0x75660000 end_va = 0x7570bfff entry_point = 0x75660000 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 221 start_va = 0x75710000 end_va = 0x75719fff entry_point = 0x75710000 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\SysWOW64\\lpk.dll" (normalized: "c:\\windows\\syswow64\\lpk.dll") Region: id = 222 start_va = 0x75a60000 end_va = 0x75a78fff entry_point = 0x75a60000 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 223 start_va = 0x75a80000 end_va = 0x75b0ffff entry_point = 0x75a80000 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll") Region: id = 224 start_va = 0x75b10000 end_va = 0x75bfffff entry_point = 0x75b10000 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 225 start_va = 0x75cc0000 end_va = 0x76909fff entry_point = 0x75cc0000 region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\SysWOW64\\shell32.dll" (normalized: "c:\\windows\\syswow64\\shell32.dll") Region: id = 226 start_va = 0x76f90000 end_va = 0x7702ffff entry_point = 0x76f90000 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll") Region: id = 227 start_va = 0x771d0000 end_va = 0x772cffff entry_point = 0x771d0000 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll") Region: id = 228 start_va = 0x77350000 end_va = 0x773a6fff entry_point = 0x77350000 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\SysWOW64\\shlwapi.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll") Region: id = 229 start_va = 0x77550000 end_va = 0x775ecfff entry_point = 0x77550000 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\SysWOW64\\usp10.dll" (normalized: "c:\\windows\\syswow64\\usp10.dll") Region: id = 230 start_va = 0x540000 end_va = 0x54ffff entry_point = 0x0 region_type = private name = "private_0x0000000000540000" filename = "" Region: id = 231 start_va = 0x6a0000 end_va = 0x827fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000006a0000" filename = "" Region: id = 232 start_va = 0x76b30000 end_va = 0x76bfbfff entry_point = 0x76b30000 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\SysWOW64\\msctf.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll") Region: id = 233 start_va = 0x76c00000 end_va = 0x76c5ffff entry_point = 0x76c00000 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 234 start_va = 0x20000 end_va = 0x20fff entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 235 start_va = 0x30000 end_va = 0x30fff entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 236 start_va = 0x220000 end_va = 0x22ffff entry_point = 0x0 region_type = private name = "private_0x0000000000220000" filename = "" Region: id = 237 start_va = 0x830000 end_va = 0x9b0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000830000" filename = "" Region: id = 238 start_va = 0xaf0000 end_va = 0x1eeffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000af0000" filename = "" Region: id = 239 start_va = 0x1ef0000 end_va = 0x209dfff entry_point = 0x0 region_type = private name = "private_0x0000000001ef0000" filename = "" Region: id = 240 start_va = 0x20a0000 end_va = 0x236efff entry_point = 0x20a0000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Thread: id = 2 os_tid = 0x9c8 [0065.369] FindResourceA (hModule=0x0, lpName=0xe, lpType=0x2) returned 0x408090 [0065.369] SizeofResource (hModule=0x0, hResInfo=0x408090) returned 0x225 [0065.369] LoadResource (hModule=0x0, hResInfo=0x408090) returned 0x4080f0 [0065.369] LockResource (hResData=0x4080f0) returned 0x4080f0 [0065.369] RtlMoveMemory (in: Destination=0x406db9, Source=0x4080f0, Length=0x10 | out: Destination=0x406db9) [0065.369] RtlMoveMemory (in: Destination=0x5b4820, Source=0x408104, Length=0x166 | out: Destination=0x5b4820) [0065.369] RtlMoveMemory (in: Destination=0x5b4990, Source=0x40826e, Length=0x5c | out: Destination=0x5b4990) [0065.369] RtlMoveMemory (in: Destination=0x5b49f8, Source=0x4082ce, Length=0x2 | out: Destination=0x5b49f8) [0065.369] RtlMoveMemory (in: Destination=0x406dc9, Source=0x4082d0, Length=0x10 | out: Destination=0x406dc9) [0065.370] RtlMoveMemory (in: Destination=0x407529, Source=0x4082e0, Length=0x5 | out: Destination=0x407529) [0065.370] RtlMoveMemory (in: Destination=0x406dd9, Source=0x4082e5, Length=0x10 | out: Destination=0x406dd9) [0065.370] RtlMoveMemory (in: Destination=0x406de9, Source=0x4082f5, Length=0x10 | out: Destination=0x406de9) [0065.370] RtlMoveMemory (in: Destination=0x407525, Source=0x408305, Length=0x4 | out: Destination=0x407525) [0065.370] RtlMoveMemory (in: Destination=0x4065a5, Source=0x408309, Length=0x4 | out: Destination=0x4065a5) [0065.370] RtlMoveMemory (in: Destination=0x4065a9, Source=0x40830d, Length=0x4 | out: Destination=0x4065a9) [0065.370] RtlMoveMemory (in: Destination=0x4065ad, Source=0x408311, Length=0x4 | out: Destination=0x4065ad) [0065.370] FreeResource (hResData=0x4080f0) returned 0 [0065.370] GetTempPathA (in: nBufferLength=0x200, lpBuffer=0x404e50 | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0065.370] lstrcpyA (in: lpString1=0x405950, lpString2="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\" | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\" [0065.370] GetModuleFileNameA (in: hModule=0x0, lpFilename=0x405450, nSize=0x500 | out: lpFilename="C:\\WINDOWS\\SysWOW64\\attrib.exe" (normalized: "c:\\windows\\syswow64\\attrib.exe")) returned 0x1e [0065.371] GetWindowsDirectoryA (in: lpBuffer=0x40755e, uSize=0x200 | out: lpBuffer="C:\\Windows") returned 0xa [0065.371] PathAddBackslashA (in: pszPath="C:\\Windows" | out: pszPath="C:\\Windows\\") returned="" [0065.371] lstrcatA (in: lpString1="C:\\Windows\\", lpString2="explorer.exe" | out: lpString1="C:\\Windows\\explorer.exe") returned="C:\\Windows\\explorer.exe" [0065.371] CreateFileA (lpFileName="C:\\Windows\\explorer.exe" (normalized: "c:\\windows\\explorer.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x74 [0065.372] GetFileTime (in: hFile=0x74, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556 | out: lpCreationTime=0x407546*(dwLowDateTime=0x90cd4312, dwHighDateTime=0x1cb892b), lpLastAccessTime=0x40754e*(dwLowDateTime=0x90cd4312, dwHighDateTime=0x1cb892b), lpLastWriteTime=0x407556*(dwLowDateTime=0x90d6c893, dwHighDateTime=0x1cb892b)) returned 1 [0065.372] CloseHandle (hObject=0x74) returned 1 [0065.372] lstrcatA (in: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\", lpString2="0Uocyxv8V4p4rX9" | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\0Uocyxv8V4p4rX9") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\0Uocyxv8V4p4rX9" [0065.372] lstrcatA (in: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\0Uocyxv8V4p4rX9", lpString2=".exe" | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\0Uocyxv8V4p4rX9.exe") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\0Uocyxv8V4p4rX9.exe" [0065.372] CopyFileA (lpExistingFileName="C:\\WINDOWS\\SysWOW64\\attrib.exe" (normalized: "c:\\windows\\syswow64\\attrib.exe"), lpNewFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\0Uocyxv8V4p4rX9.exe" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\0uocyxv8v4p4rx9.exe"), bFailIfExists=1) returned 1 [0065.391] CreateFileA (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\0Uocyxv8V4p4rX9.exe" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\0uocyxv8v4p4rx9.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x78 [0065.392] SetFileTime (hFile=0x78, lpCreationTime=0x407546, lpLastAccessTime=0x40754e, lpLastWriteTime=0x407556) returned 1 [0065.392] CloseHandle (hObject=0x78) returned 1 [0065.392] RegCreateKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run", Reserved=0x0, lpClass="REG_SZ", dwOptions=0x0, samDesired=0x2001f, lpSecurityAttributes=0x0, phkResult=0xaf8bc, lpdwDisposition=0xaf8c0 | out: phkResult=0xaf8bc*=0x78, lpdwDisposition=0xaf8c0*=0x2) returned 0x0 [0065.392] lstrlenA (lpString="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\0Uocyxv8V4p4rX9.exe") returned 56 [0065.392] RegSetValueExA (in: hKey=0x78, lpValueName="Alcmeter", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\0Uocyxv8V4p4rX9.exe", cbData=0x38 | out: lpData="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\0Uocyxv8V4p4rX9.exe") returned 0x0 [0065.393] RegCloseKey (hKey=0x78) returned 0x0 [0065.393] lstrcpyA (in: lpString1=0x4065b9, lpString2="." | out: lpString1=".") returned="." [0065.393] lstrcatA (in: lpString1=".", lpString2="\xa0" | out: lpString1=". ") returned=". " [0065.393] RegCreateKeyExA (in: hKey=0x80000000, lpSubKey=". ", Reserved=0x0, lpClass="REG_SZ", dwOptions=0x0, samDesired=0x2001f, lpSecurityAttributes=0x0, phkResult=0xaf8b8, lpdwDisposition=0xaf8bc | out: phkResult=0xaf8b8*=0x7e, lpdwDisposition=0xaf8bc*=0x1) returned 0x0 [0065.394] lstrlenA (lpString="LORKXAWNXPWYZLE") returned 15 [0065.394] RegSetValueExA (in: hKey=0x7e, lpValueName="", Reserved=0x0, dwType=0x1, lpData="LORKXAWNXPWYZLE", cbData=0xf | out: lpData="LORKXAWNXPWYZLE") returned 0x0 [0065.395] RegCloseKey (hKey=0x7e) returned 0x0 [0065.395] RegCreateKeyExA (in: hKey=0x80000000, lpSubKey="LORKXAWNXPWYZLE", Reserved=0x0, lpClass="REG_SZ", dwOptions=0x0, samDesired=0x2001f, lpSecurityAttributes=0x0, phkResult=0xaf8b8, lpdwDisposition=0xaf8bc | out: phkResult=0xaf8b8*=0x76, lpdwDisposition=0xaf8bc*=0x1) returned 0x0 [0065.395] lstrlenA (lpString="CRYPTED!") returned 8 [0065.395] RegSetValueExA (in: hKey=0x76, lpValueName="", Reserved=0x0, dwType=0x1, lpData="CRYPTED!", cbData=0x8 | out: lpData="CRYPTED!") returned 0x0 [0065.396] RegCloseKey (hKey=0x76) returned 0x0 [0065.396] lstrcpyA (in: lpString1=0x4065b9, lpString2="LORKXAWNXPWYZLE" | out: lpString1="LORKXAWNXPWYZLE") returned="LORKXAWNXPWYZLE" [0065.396] lstrcatA (in: lpString1="LORKXAWNXPWYZLE", lpString2="\\DefaultIcon" | out: lpString1="LORKXAWNXPWYZLE\\DefaultIcon") returned="LORKXAWNXPWYZLE\\DefaultIcon" [0065.396] lstrcatA (in: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\0Uocyxv8V4p4rX9.exe", lpString2=",0" | out: lpString1="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\0Uocyxv8V4p4rX9.exe,0") returned="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\0Uocyxv8V4p4rX9.exe,0" [0065.396] RegCreateKeyExA (in: hKey=0x80000000, lpSubKey="LORKXAWNXPWYZLE\\DefaultIcon", Reserved=0x0, lpClass="REG_SZ", dwOptions=0x0, samDesired=0x2001f, lpSecurityAttributes=0x0, phkResult=0xaf8b8, lpdwDisposition=0xaf8bc | out: phkResult=0xaf8b8*=0x7e, lpdwDisposition=0xaf8bc*=0x1) returned 0x0 [0065.396] lstrlenA (lpString="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\0Uocyxv8V4p4rX9.exe,0") returned 58 [0065.397] RegSetValueExA (in: hKey=0x7e, lpValueName="", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\0Uocyxv8V4p4rX9.exe,0", cbData=0x3a | out: lpData="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\0Uocyxv8V4p4rX9.exe,0") returned 0x0 [0065.397] RegCloseKey (hKey=0x7e) returned 0x0 [0065.397] lstrcpyA (in: lpString1=0x4065b9, lpString2="LORKXAWNXPWYZLE" | out: lpString1="LORKXAWNXPWYZLE") returned="LORKXAWNXPWYZLE" [0065.397] lstrcatA (in: lpString1="LORKXAWNXPWYZLE", lpString2="\\shell\\open\\command" | out: lpString1="LORKXAWNXPWYZLE\\shell\\open\\command") returned="LORKXAWNXPWYZLE\\shell\\open\\command" [0065.397] lstrlenA (lpString="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\0Uocyxv8V4p4rX9.exe,0") returned 58 [0065.397] RegCreateKeyExA (in: hKey=0x80000000, lpSubKey="LORKXAWNXPWYZLE\\shell\\open\\command", Reserved=0x0, lpClass="REG_SZ", dwOptions=0x0, samDesired=0x2001f, lpSecurityAttributes=0x0, phkResult=0xaf8b8, lpdwDisposition=0xaf8bc | out: phkResult=0xaf8b8*=0x82, lpdwDisposition=0xaf8bc*=0x1) returned 0x0 [0065.398] lstrlenA (lpString="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\0Uocyxv8V4p4rX9.exe") returned 56 [0065.398] RegSetValueExA (in: hKey=0x82, lpValueName="", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\0Uocyxv8V4p4rX9.exe", cbData=0x38 | out: lpData="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\0Uocyxv8V4p4rX9.exe") returned 0x0 [0065.399] RegCloseKey (hKey=0x82) returned 0x0 [0065.399] SetErrorMode (uMode=0x1) returned 0x0 [0065.399] GetLogicalDrives () returned 0x4 [0065.399] FindFirstFileA (in: lpFileName="C:\\*.*", lpFindFileData=0xaf788 | out: lpFindFileData=0xaf788) returned 0x5b4a08 [0065.399] lstrcmpA (lpString1=".", lpString2="$Recycle.Bin") returned 1 [0065.740] lstrcmpA (lpString1="..", lpString2="$Recycle.Bin") returned 1 [0065.740] PathFindFileNameA (pszPath="C:\\*.*") returned="*.*" [0065.740] lstrcatA (in: lpString1="C:\\", lpString2="$Recycle.Bin" | out: lpString1="C:\\$Recycle.Bin") returned="C:\\$Recycle.Bin" [0065.740] lstrlenA (lpString="C:\\$Recycle.Bin") returned 15 [0065.740] FindFirstFileA (in: lpFileName="C:\\$Recycle.Bin\\*.*", lpFindFileData=0xaf638 | out: lpFindFileData=0xaf638) returned 0x5b4bf8 [0065.740] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0065.741] FindNextFileA (in: hFindFile=0x5b4bf8, lpFindFileData=0xaf638 | out: lpFindFileData=0xaf638) returned 1 [0065.741] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0065.741] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0065.741] FindNextFileA (in: hFindFile=0x5b4bf8, lpFindFileData=0xaf638 | out: lpFindFileData=0xaf638) returned 1 [0065.741] lstrcmpA (lpString1=".", lpString2="S-1-5-21-3388679973-3930757225-3770151564-1000") returned -1 [0065.741] lstrcmpA (lpString1="..", lpString2="S-1-5-21-3388679973-3930757225-3770151564-1000") returned -1 [0065.741] PathFindFileNameA (pszPath="C:\\$Recycle.Bin\\*.*") returned="*.*" [0065.741] lstrcatA (in: lpString1="C:\\$Recycle.Bin\\", lpString2="S-1-5-21-3388679973-3930757225-3770151564-1000" | out: lpString1="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000") returned="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000" [0065.741] lstrlenA (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000") returned 62 [0065.741] FindFirstFileA (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\*.*", lpFindFileData=0xaf4e8 | out: lpFindFileData=0xaf4e8) returned 0x5b5cd0 [0065.741] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0065.741] FindNextFileA (in: hFindFile=0x5b5cd0, lpFindFileData=0xaf4e8 | out: lpFindFileData=0xaf4e8) returned 1 [0065.741] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0065.741] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0065.741] FindNextFileA (in: hFindFile=0x5b5cd0, lpFindFileData=0xaf4e8 | out: lpFindFileData=0xaf4e8) returned 1 [0065.741] PeekMessageA (in: lpMsg=0xaf4c4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf4c4) returned 0 [0065.741] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="desktop.ini") returned 1 [0065.741] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="desktop.ini") returned 1 [0065.741] lstrcmpiA (lpString1="", lpString2="desktop.ini") returned -1 [0065.741] PathFindFileNameA (pszPath="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\*.*") returned="*.*" [0065.741] lstrcatA (in: lpString1="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\", lpString2="desktop.ini" | out: lpString1="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini" [0065.741] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini", pszSpec="*.zip") returned 0 [0065.787] lstrlenA (lpString="*.zip") returned 5 [0065.787] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini", pszSpec="*.rar") returned 0 [0065.787] lstrlenA (lpString="*.rar") returned 5 [0065.787] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini", pszSpec="*.7z") returned 0 [0065.787] lstrlenA (lpString="*.7z") returned 4 [0065.787] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini", pszSpec="*.tar") returned 0 [0065.787] lstrlenA (lpString="*.tar") returned 5 [0065.787] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini", pszSpec="*.gzip") returned 0 [0065.787] lstrlenA (lpString="*.gzip") returned 6 [0065.787] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini", pszSpec="*.jpg") returned 0 [0065.787] lstrlenA (lpString="*.jpg") returned 5 [0065.787] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini", pszSpec="*.jpeg") returned 0 [0065.787] lstrlenA (lpString="*.jpeg") returned 6 [0065.787] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini", pszSpec="*.psd") returned 0 [0065.787] lstrlenA (lpString="*.psd") returned 5 [0065.787] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini", pszSpec="*.cdr") returned 0 [0065.787] lstrlenA (lpString="*.cdr") returned 5 [0065.787] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini", pszSpec="*.dwg") returned 0 [0065.787] lstrlenA (lpString="*.dwg") returned 5 [0065.787] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini", pszSpec="*.max") returned 0 [0065.787] lstrlenA (lpString="*.max") returned 5 [0065.787] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini", pszSpec="*.bmp") returned 0 [0065.787] lstrlenA (lpString="*.bmp") returned 5 [0065.787] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini", pszSpec="*.gif") returned 0 [0065.787] lstrlenA (lpString="*.gif") returned 5 [0065.787] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini", pszSpec="*.png") returned 0 [0065.787] lstrlenA (lpString="*.png") returned 5 [0065.788] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini", pszSpec="*.doc") returned 0 [0065.788] lstrlenA (lpString="*.doc") returned 5 [0065.788] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini", pszSpec="*.docx") returned 0 [0065.788] lstrlenA (lpString="*.docx") returned 6 [0065.788] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini", pszSpec="*.xls") returned 0 [0065.788] lstrlenA (lpString="*.xls") returned 5 [0065.788] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini", pszSpec="*.xlsx") returned 0 [0065.788] lstrlenA (lpString="*.xlsx") returned 6 [0065.788] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini", pszSpec="*.ppt") returned 0 [0065.788] lstrlenA (lpString="*.ppt") returned 5 [0065.788] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini", pszSpec="*.pptx") returned 0 [0065.788] lstrlenA (lpString="*.pptx") returned 6 [0065.788] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini", pszSpec="*.txt") returned 0 [0065.788] lstrlenA (lpString="*.txt") returned 5 [0065.788] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini", pszSpec="*.pdf") returned 0 [0065.788] lstrlenA (lpString="*.pdf") returned 5 [0065.788] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini", pszSpec="*.djvu") returned 0 [0065.788] lstrlenA (lpString="*.djvu") returned 6 [0065.788] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini", pszSpec="*.htm") returned 0 [0065.788] lstrlenA (lpString="*.htm") returned 5 [0065.788] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini", pszSpec="*.html") returned 0 [0065.788] lstrlenA (lpString="*.html") returned 6 [0065.788] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini", pszSpec="*.mdb") returned 0 [0065.788] lstrlenA (lpString="*.mdb") returned 5 [0065.788] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini", pszSpec="*.cer") returned 0 [0065.788] lstrlenA (lpString="*.cer") returned 5 [0065.788] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini", pszSpec="*.p12") returned 0 [0065.788] lstrlenA (lpString="*.p12") returned 5 [0065.788] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini", pszSpec="*.pfx") returned 0 [0065.788] lstrlenA (lpString="*.pfx") returned 5 [0065.788] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini", pszSpec="*.kwm") returned 0 [0065.788] lstrlenA (lpString="*.kwm") returned 5 [0065.788] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini", pszSpec="*.pwm") returned 0 [0065.788] lstrlenA (lpString="*.pwm") returned 5 [0065.788] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini", pszSpec="*.1cd") returned 0 [0065.788] lstrlenA (lpString="*.1cd") returned 5 [0065.788] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini", pszSpec="*.md") returned 0 [0065.788] lstrlenA (lpString="*.md") returned 4 [0065.788] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini", pszSpec="*.mdf") returned 0 [0065.788] lstrlenA (lpString="*.mdf") returned 5 [0065.788] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini", pszSpec="*.dbf") returned 0 [0065.788] lstrlenA (lpString="*.dbf") returned 5 [0065.788] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini", pszSpec="*.odt") returned 0 [0065.788] lstrlenA (lpString="*.odt") returned 5 [0065.788] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini", pszSpec="*.vob") returned 0 [0065.789] lstrlenA (lpString="*.vob") returned 5 [0065.789] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini", pszSpec="*.ifo") returned 0 [0065.789] lstrlenA (lpString="*.ifo") returned 5 [0065.789] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini", pszSpec="*.lnk") returned 0 [0065.789] lstrlenA (lpString="*.lnk") returned 5 [0065.789] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini", pszSpec="*.torrent") returned 0 [0065.789] lstrlenA (lpString="*.torrent") returned 9 [0065.789] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini", pszSpec="*.mov") returned 0 [0065.789] lstrlenA (lpString="*.mov") returned 5 [0065.789] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini", pszSpec="*.m2v") returned 0 [0065.789] lstrlenA (lpString="*.m2v") returned 5 [0065.789] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini", pszSpec="*.3gp") returned 0 [0065.789] lstrlenA (lpString="*.3gp") returned 5 [0065.789] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini", pszSpec="*.mpeg") returned 0 [0065.789] lstrlenA (lpString="*.mpeg") returned 6 [0065.789] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini", pszSpec="*.mpg") returned 0 [0065.789] lstrlenA (lpString="*.mpg") returned 5 [0065.789] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini", pszSpec="*.flv") returned 0 [0065.789] lstrlenA (lpString="*.flv") returned 5 [0065.789] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini", pszSpec="*.avi") returned 0 [0065.789] lstrlenA (lpString="*.avi") returned 5 [0065.789] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini", pszSpec="*.mp4") returned 0 [0065.789] lstrlenA (lpString="*.mp4") returned 5 [0065.789] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini", pszSpec="*.wmv") returned 0 [0065.789] lstrlenA (lpString="*.wmv") returned 5 [0065.789] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini", pszSpec="*.divx") returned 0 [0065.789] lstrlenA (lpString="*.divx") returned 6 [0065.789] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini", pszSpec="*.mkv") returned 0 [0065.789] lstrlenA (lpString="*.mkv") returned 5 [0065.789] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini", pszSpec="*.mp3") returned 0 [0065.789] lstrlenA (lpString="*.mp3") returned 5 [0065.789] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini", pszSpec="*.wav") returned 0 [0065.789] lstrlenA (lpString="*.wav") returned 5 [0065.789] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini", pszSpec="*.flac") returned 0 [0065.789] lstrlenA (lpString="*.flac") returned 6 [0065.789] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini", pszSpec="*.ape") returned 0 [0065.789] lstrlenA (lpString="*.ape") returned 5 [0065.789] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini", pszSpec="*.wma") returned 0 [0065.789] lstrlenA (lpString="*.wma") returned 5 [0065.789] PathMatchSpecA (pszFile="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini", pszSpec="*.ac3") returned 0 [0065.789] lstrlenA (lpString="*.ac3") returned 5 [0065.789] FindNextFileA (in: hFindFile=0x5b5cd0, lpFindFileData=0xaf4e8 | out: lpFindFileData=0xaf4e8) returned 0 [0065.790] FindClose (in: hFindFile=0x5b5cd0 | out: hFindFile=0x5b5cd0) returned 1 [0065.790] FindNextFileA (in: hFindFile=0x5b4bf8, lpFindFileData=0xaf638 | out: lpFindFileData=0xaf638) returned 0 [0065.790] FindClose (in: hFindFile=0x5b4bf8 | out: hFindFile=0x5b4bf8) returned 1 [0065.790] FindNextFileA (in: hFindFile=0x5b4a08, lpFindFileData=0xaf788 | out: lpFindFileData=0xaf788) returned 1 [0065.790] lstrcmpA (lpString1=".", lpString2="Boot") returned -1 [0065.790] lstrcmpA (lpString1="..", lpString2="Boot") returned -1 [0065.790] PathFindFileNameA (pszPath="C:\\*.*") returned="*.*" [0065.790] lstrcatA (in: lpString1="C:\\", lpString2="Boot" | out: lpString1="C:\\Boot") returned="C:\\Boot" [0065.790] lstrlenA (lpString="C:\\Boot") returned 7 [0065.790] FindFirstFileA (in: lpFileName="C:\\Boot\\*.*", lpFindFileData=0xaf638 | out: lpFindFileData=0xaf638) returned 0x5b5bf0 [0065.790] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0065.790] FindNextFileA (in: hFindFile=0x5b5bf0, lpFindFileData=0xaf638 | out: lpFindFileData=0xaf638) returned 1 [0065.790] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0065.790] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0065.790] FindNextFileA (in: hFindFile=0x5b5bf0, lpFindFileData=0xaf638 | out: lpFindFileData=0xaf638) returned 1 [0065.790] PeekMessageA (in: lpMsg=0xaf614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf614) returned 0 [0065.790] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BCD") returned 1 [0065.790] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BCD") returned 1 [0065.790] lstrcmpiA (lpString1="", lpString2="BCD") returned -1 [0065.790] PathFindFileNameA (pszPath="C:\\Boot\\*.*") returned="*.*" [0065.790] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="BCD" | out: lpString1="C:\\Boot\\BCD") returned="C:\\Boot\\BCD" [0065.790] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.zip") returned 0 [0065.790] lstrlenA (lpString="*.zip") returned 5 [0065.790] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.rar") returned 0 [0065.790] lstrlenA (lpString="*.rar") returned 5 [0065.790] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.7z") returned 0 [0065.790] lstrlenA (lpString="*.7z") returned 4 [0065.791] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.tar") returned 0 [0065.791] lstrlenA (lpString="*.tar") returned 5 [0065.791] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.gzip") returned 0 [0065.791] lstrlenA (lpString="*.gzip") returned 6 [0065.791] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.jpg") returned 0 [0065.791] lstrlenA (lpString="*.jpg") returned 5 [0065.791] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.jpeg") returned 0 [0065.791] lstrlenA (lpString="*.jpeg") returned 6 [0065.791] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.psd") returned 0 [0065.791] lstrlenA (lpString="*.psd") returned 5 [0065.791] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.cdr") returned 0 [0065.791] lstrlenA (lpString="*.cdr") returned 5 [0065.791] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.dwg") returned 0 [0065.791] lstrlenA (lpString="*.dwg") returned 5 [0065.791] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.max") returned 0 [0065.791] lstrlenA (lpString="*.max") returned 5 [0065.791] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.bmp") returned 0 [0065.791] lstrlenA (lpString="*.bmp") returned 5 [0065.791] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.gif") returned 0 [0065.791] lstrlenA (lpString="*.gif") returned 5 [0065.791] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.png") returned 0 [0065.791] lstrlenA (lpString="*.png") returned 5 [0065.791] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.doc") returned 0 [0065.791] lstrlenA (lpString="*.doc") returned 5 [0065.791] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.docx") returned 0 [0065.791] lstrlenA (lpString="*.docx") returned 6 [0065.791] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.xls") returned 0 [0065.791] lstrlenA (lpString="*.xls") returned 5 [0065.791] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.xlsx") returned 0 [0065.791] lstrlenA (lpString="*.xlsx") returned 6 [0065.791] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.ppt") returned 0 [0065.791] lstrlenA (lpString="*.ppt") returned 5 [0065.791] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.pptx") returned 0 [0065.791] lstrlenA (lpString="*.pptx") returned 6 [0065.791] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.txt") returned 0 [0065.791] lstrlenA (lpString="*.txt") returned 5 [0065.791] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.pdf") returned 0 [0065.791] lstrlenA (lpString="*.pdf") returned 5 [0065.791] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.djvu") returned 0 [0065.792] lstrlenA (lpString="*.djvu") returned 6 [0065.792] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.htm") returned 0 [0065.792] lstrlenA (lpString="*.htm") returned 5 [0065.792] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.html") returned 0 [0065.792] lstrlenA (lpString="*.html") returned 6 [0065.792] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.mdb") returned 0 [0065.792] lstrlenA (lpString="*.mdb") returned 5 [0065.792] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.cer") returned 0 [0065.792] lstrlenA (lpString="*.cer") returned 5 [0065.792] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.p12") returned 0 [0065.792] lstrlenA (lpString="*.p12") returned 5 [0065.792] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.pfx") returned 0 [0065.792] lstrlenA (lpString="*.pfx") returned 5 [0065.792] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.kwm") returned 0 [0065.792] lstrlenA (lpString="*.kwm") returned 5 [0065.792] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.pwm") returned 0 [0065.792] lstrlenA (lpString="*.pwm") returned 5 [0065.792] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.1cd") returned 0 [0065.792] lstrlenA (lpString="*.1cd") returned 5 [0065.792] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.md") returned 0 [0065.792] lstrlenA (lpString="*.md") returned 4 [0065.792] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.mdf") returned 0 [0065.792] lstrlenA (lpString="*.mdf") returned 5 [0065.792] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.dbf") returned 0 [0065.792] lstrlenA (lpString="*.dbf") returned 5 [0065.792] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.odt") returned 0 [0065.792] lstrlenA (lpString="*.odt") returned 5 [0065.792] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.vob") returned 0 [0065.792] lstrlenA (lpString="*.vob") returned 5 [0065.792] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.ifo") returned 0 [0065.792] lstrlenA (lpString="*.ifo") returned 5 [0065.792] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.lnk") returned 0 [0065.792] lstrlenA (lpString="*.lnk") returned 5 [0065.792] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.torrent") returned 0 [0065.792] lstrlenA (lpString="*.torrent") returned 9 [0065.792] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.mov") returned 0 [0065.793] lstrlenA (lpString="*.mov") returned 5 [0065.793] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.m2v") returned 0 [0065.793] lstrlenA (lpString="*.m2v") returned 5 [0065.793] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.3gp") returned 0 [0065.793] lstrlenA (lpString="*.3gp") returned 5 [0065.793] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.mpeg") returned 0 [0065.793] lstrlenA (lpString="*.mpeg") returned 6 [0065.793] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.mpg") returned 0 [0065.793] lstrlenA (lpString="*.mpg") returned 5 [0065.793] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.flv") returned 0 [0065.793] lstrlenA (lpString="*.flv") returned 5 [0065.793] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.avi") returned 0 [0065.793] lstrlenA (lpString="*.avi") returned 5 [0065.793] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.mp4") returned 0 [0065.793] lstrlenA (lpString="*.mp4") returned 5 [0065.793] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.wmv") returned 0 [0065.793] lstrlenA (lpString="*.wmv") returned 5 [0065.793] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.divx") returned 0 [0065.793] lstrlenA (lpString="*.divx") returned 6 [0065.793] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.mkv") returned 0 [0065.793] lstrlenA (lpString="*.mkv") returned 5 [0065.793] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.mp3") returned 0 [0065.793] lstrlenA (lpString="*.mp3") returned 5 [0065.793] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.wav") returned 0 [0065.793] lstrlenA (lpString="*.wav") returned 5 [0065.793] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.flac") returned 0 [0065.793] lstrlenA (lpString="*.flac") returned 6 [0065.793] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.ape") returned 0 [0065.793] lstrlenA (lpString="*.ape") returned 5 [0065.793] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.wma") returned 0 [0065.793] lstrlenA (lpString="*.wma") returned 5 [0065.793] PathMatchSpecA (pszFile="C:\\Boot\\BCD", pszSpec="*.ac3") returned 0 [0065.793] lstrlenA (lpString="*.ac3") returned 5 [0065.793] FindNextFileA (in: hFindFile=0x5b5bf0, lpFindFileData=0xaf638 | out: lpFindFileData=0xaf638) returned 1 [0065.793] PeekMessageA (in: lpMsg=0xaf614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf614) returned 0 [0065.793] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BCD.LOG") returned 1 [0065.794] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BCD.LOG") returned 1 [0065.794] lstrcmpiA (lpString1="", lpString2="BCD.LOG") returned -1 [0065.794] PathFindFileNameA (pszPath="C:\\Boot\\BCD") returned="BCD" [0065.794] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="BCD.LOG" | out: lpString1="C:\\Boot\\BCD.LOG") returned="C:\\Boot\\BCD.LOG" [0065.794] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.zip") returned 0 [0065.794] lstrlenA (lpString="*.zip") returned 5 [0065.794] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.rar") returned 0 [0065.794] lstrlenA (lpString="*.rar") returned 5 [0065.794] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.7z") returned 0 [0065.794] lstrlenA (lpString="*.7z") returned 4 [0065.794] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.tar") returned 0 [0065.794] lstrlenA (lpString="*.tar") returned 5 [0065.794] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.gzip") returned 0 [0065.794] lstrlenA (lpString="*.gzip") returned 6 [0065.794] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.jpg") returned 0 [0065.794] lstrlenA (lpString="*.jpg") returned 5 [0065.794] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.jpeg") returned 0 [0065.794] lstrlenA (lpString="*.jpeg") returned 6 [0065.794] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.psd") returned 0 [0065.794] lstrlenA (lpString="*.psd") returned 5 [0065.794] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.cdr") returned 0 [0065.794] lstrlenA (lpString="*.cdr") returned 5 [0065.794] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.dwg") returned 0 [0065.794] lstrlenA (lpString="*.dwg") returned 5 [0065.794] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.max") returned 0 [0065.794] lstrlenA (lpString="*.max") returned 5 [0065.794] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.bmp") returned 0 [0065.794] lstrlenA (lpString="*.bmp") returned 5 [0065.794] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.gif") returned 0 [0065.794] lstrlenA (lpString="*.gif") returned 5 [0065.794] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.png") returned 0 [0065.794] lstrlenA (lpString="*.png") returned 5 [0065.794] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.doc") returned 0 [0065.794] lstrlenA (lpString="*.doc") returned 5 [0065.794] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.docx") returned 0 [0065.794] lstrlenA (lpString="*.docx") returned 6 [0065.795] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.xls") returned 0 [0065.795] lstrlenA (lpString="*.xls") returned 5 [0065.795] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.xlsx") returned 0 [0065.795] lstrlenA (lpString="*.xlsx") returned 6 [0065.795] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.ppt") returned 0 [0065.795] lstrlenA (lpString="*.ppt") returned 5 [0065.795] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.pptx") returned 0 [0065.795] lstrlenA (lpString="*.pptx") returned 6 [0065.795] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.txt") returned 0 [0065.795] lstrlenA (lpString="*.txt") returned 5 [0065.795] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.pdf") returned 0 [0065.795] lstrlenA (lpString="*.pdf") returned 5 [0065.795] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.djvu") returned 0 [0065.795] lstrlenA (lpString="*.djvu") returned 6 [0065.795] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.htm") returned 0 [0065.795] lstrlenA (lpString="*.htm") returned 5 [0065.795] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.html") returned 0 [0065.795] lstrlenA (lpString="*.html") returned 6 [0065.795] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.mdb") returned 0 [0065.795] lstrlenA (lpString="*.mdb") returned 5 [0065.795] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.cer") returned 0 [0065.795] lstrlenA (lpString="*.cer") returned 5 [0065.795] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.p12") returned 0 [0065.795] lstrlenA (lpString="*.p12") returned 5 [0065.795] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.pfx") returned 0 [0065.795] lstrlenA (lpString="*.pfx") returned 5 [0065.795] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.kwm") returned 0 [0065.795] lstrlenA (lpString="*.kwm") returned 5 [0065.795] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.pwm") returned 0 [0065.795] lstrlenA (lpString="*.pwm") returned 5 [0065.795] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.1cd") returned 0 [0065.795] lstrlenA (lpString="*.1cd") returned 5 [0065.795] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.md") returned 0 [0065.795] lstrlenA (lpString="*.md") returned 4 [0065.795] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.mdf") returned 0 [0065.795] lstrlenA (lpString="*.mdf") returned 5 [0065.795] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.dbf") returned 0 [0065.796] lstrlenA (lpString="*.dbf") returned 5 [0065.796] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.odt") returned 0 [0065.796] lstrlenA (lpString="*.odt") returned 5 [0065.796] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.vob") returned 0 [0065.796] lstrlenA (lpString="*.vob") returned 5 [0065.796] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.ifo") returned 0 [0065.796] lstrlenA (lpString="*.ifo") returned 5 [0065.796] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.lnk") returned 0 [0065.796] lstrlenA (lpString="*.lnk") returned 5 [0065.796] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.torrent") returned 0 [0065.796] lstrlenA (lpString="*.torrent") returned 9 [0065.796] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.mov") returned 0 [0065.796] lstrlenA (lpString="*.mov") returned 5 [0065.796] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.m2v") returned 0 [0065.796] lstrlenA (lpString="*.m2v") returned 5 [0065.796] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.3gp") returned 0 [0065.796] lstrlenA (lpString="*.3gp") returned 5 [0065.796] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.mpeg") returned 0 [0065.796] lstrlenA (lpString="*.mpeg") returned 6 [0065.796] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.mpg") returned 0 [0065.796] lstrlenA (lpString="*.mpg") returned 5 [0065.796] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.flv") returned 0 [0065.796] lstrlenA (lpString="*.flv") returned 5 [0065.796] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.avi") returned 0 [0065.796] lstrlenA (lpString="*.avi") returned 5 [0065.796] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.mp4") returned 0 [0065.796] lstrlenA (lpString="*.mp4") returned 5 [0065.796] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.wmv") returned 0 [0065.796] lstrlenA (lpString="*.wmv") returned 5 [0065.796] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.divx") returned 0 [0065.796] lstrlenA (lpString="*.divx") returned 6 [0065.796] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.mkv") returned 0 [0065.796] lstrlenA (lpString="*.mkv") returned 5 [0065.796] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.mp3") returned 0 [0065.796] lstrlenA (lpString="*.mp3") returned 5 [0065.796] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.wav") returned 0 [0065.796] lstrlenA (lpString="*.wav") returned 5 [0065.797] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.flac") returned 0 [0065.797] lstrlenA (lpString="*.flac") returned 6 [0065.797] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.ape") returned 0 [0065.797] lstrlenA (lpString="*.ape") returned 5 [0065.797] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.wma") returned 0 [0065.797] lstrlenA (lpString="*.wma") returned 5 [0065.797] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG", pszSpec="*.ac3") returned 0 [0065.797] lstrlenA (lpString="*.ac3") returned 5 [0065.797] FindNextFileA (in: hFindFile=0x5b5bf0, lpFindFileData=0xaf638 | out: lpFindFileData=0xaf638) returned 1 [0065.797] PeekMessageA (in: lpMsg=0xaf614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf614) returned 0 [0065.797] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BCD.LOG1") returned 1 [0065.797] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BCD.LOG1") returned 1 [0065.797] lstrcmpiA (lpString1="", lpString2="BCD.LOG1") returned -1 [0065.797] PathFindFileNameA (pszPath="C:\\Boot\\BCD.LOG") returned="BCD.LOG" [0065.797] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="BCD.LOG1" | out: lpString1="C:\\Boot\\BCD.LOG1") returned="C:\\Boot\\BCD.LOG1" [0065.797] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.zip") returned 0 [0065.797] lstrlenA (lpString="*.zip") returned 5 [0065.797] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.rar") returned 0 [0065.797] lstrlenA (lpString="*.rar") returned 5 [0065.797] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.7z") returned 0 [0065.797] lstrlenA (lpString="*.7z") returned 4 [0065.797] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.tar") returned 0 [0065.797] lstrlenA (lpString="*.tar") returned 5 [0065.797] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.gzip") returned 0 [0065.797] lstrlenA (lpString="*.gzip") returned 6 [0065.797] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.jpg") returned 0 [0065.797] lstrlenA (lpString="*.jpg") returned 5 [0065.797] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.jpeg") returned 0 [0065.797] lstrlenA (lpString="*.jpeg") returned 6 [0065.797] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.psd") returned 0 [0065.797] lstrlenA (lpString="*.psd") returned 5 [0065.797] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.cdr") returned 0 [0065.797] lstrlenA (lpString="*.cdr") returned 5 [0065.797] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.dwg") returned 0 [0065.797] lstrlenA (lpString="*.dwg") returned 5 [0065.797] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.max") returned 0 [0065.798] lstrlenA (lpString="*.max") returned 5 [0065.798] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.bmp") returned 0 [0065.798] lstrlenA (lpString="*.bmp") returned 5 [0065.798] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.gif") returned 0 [0065.798] lstrlenA (lpString="*.gif") returned 5 [0065.798] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.png") returned 0 [0065.798] lstrlenA (lpString="*.png") returned 5 [0065.798] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.doc") returned 0 [0065.798] lstrlenA (lpString="*.doc") returned 5 [0065.798] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.docx") returned 0 [0065.798] lstrlenA (lpString="*.docx") returned 6 [0065.798] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.xls") returned 0 [0065.798] lstrlenA (lpString="*.xls") returned 5 [0065.798] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.xlsx") returned 0 [0065.798] lstrlenA (lpString="*.xlsx") returned 6 [0065.798] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.ppt") returned 0 [0065.798] lstrlenA (lpString="*.ppt") returned 5 [0065.798] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.pptx") returned 0 [0065.798] lstrlenA (lpString="*.pptx") returned 6 [0065.798] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.txt") returned 0 [0065.798] lstrlenA (lpString="*.txt") returned 5 [0065.798] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.pdf") returned 0 [0065.798] lstrlenA (lpString="*.pdf") returned 5 [0065.798] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.djvu") returned 0 [0065.798] lstrlenA (lpString="*.djvu") returned 6 [0065.798] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.htm") returned 0 [0065.798] lstrlenA (lpString="*.htm") returned 5 [0065.798] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.html") returned 0 [0065.798] lstrlenA (lpString="*.html") returned 6 [0065.798] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.mdb") returned 0 [0065.798] lstrlenA (lpString="*.mdb") returned 5 [0065.798] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.cer") returned 0 [0065.798] lstrlenA (lpString="*.cer") returned 5 [0065.798] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.p12") returned 0 [0065.798] lstrlenA (lpString="*.p12") returned 5 [0065.798] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.pfx") returned 0 [0065.798] lstrlenA (lpString="*.pfx") returned 5 [0065.798] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.kwm") returned 0 [0065.798] lstrlenA (lpString="*.kwm") returned 5 [0065.798] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.pwm") returned 0 [0065.798] lstrlenA (lpString="*.pwm") returned 5 [0065.798] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.1cd") returned 0 [0065.798] lstrlenA (lpString="*.1cd") returned 5 [0065.798] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.md") returned 0 [0065.798] lstrlenA (lpString="*.md") returned 4 [0065.798] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.mdf") returned 0 [0065.798] lstrlenA (lpString="*.mdf") returned 5 [0065.798] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.dbf") returned 0 [0065.798] lstrlenA (lpString="*.dbf") returned 5 [0065.798] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.odt") returned 0 [0065.799] lstrlenA (lpString="*.odt") returned 5 [0065.799] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.vob") returned 0 [0065.799] lstrlenA (lpString="*.vob") returned 5 [0065.799] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.ifo") returned 0 [0065.799] lstrlenA (lpString="*.ifo") returned 5 [0065.799] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.lnk") returned 0 [0065.799] lstrlenA (lpString="*.lnk") returned 5 [0065.799] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.torrent") returned 0 [0065.799] lstrlenA (lpString="*.torrent") returned 9 [0065.799] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.mov") returned 0 [0065.799] lstrlenA (lpString="*.mov") returned 5 [0065.799] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.m2v") returned 0 [0065.799] lstrlenA (lpString="*.m2v") returned 5 [0065.799] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.3gp") returned 0 [0065.799] lstrlenA (lpString="*.3gp") returned 5 [0065.799] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.mpeg") returned 0 [0065.799] lstrlenA (lpString="*.mpeg") returned 6 [0065.799] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.mpg") returned 0 [0065.799] lstrlenA (lpString="*.mpg") returned 5 [0065.799] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.flv") returned 0 [0065.799] lstrlenA (lpString="*.flv") returned 5 [0065.799] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.avi") returned 0 [0065.799] lstrlenA (lpString="*.avi") returned 5 [0065.799] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.mp4") returned 0 [0065.799] lstrlenA (lpString="*.mp4") returned 5 [0065.799] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.wmv") returned 0 [0065.799] lstrlenA (lpString="*.wmv") returned 5 [0065.799] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.divx") returned 0 [0065.799] lstrlenA (lpString="*.divx") returned 6 [0065.799] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.mkv") returned 0 [0065.799] lstrlenA (lpString="*.mkv") returned 5 [0065.799] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.mp3") returned 0 [0065.799] lstrlenA (lpString="*.mp3") returned 5 [0065.799] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.wav") returned 0 [0065.799] lstrlenA (lpString="*.wav") returned 5 [0065.799] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.flac") returned 0 [0065.799] lstrlenA (lpString="*.flac") returned 6 [0065.799] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.ape") returned 0 [0065.799] lstrlenA (lpString="*.ape") returned 5 [0065.799] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.wma") returned 0 [0065.799] lstrlenA (lpString="*.wma") returned 5 [0065.799] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG1", pszSpec="*.ac3") returned 0 [0065.799] lstrlenA (lpString="*.ac3") returned 5 [0065.799] FindNextFileA (in: hFindFile=0x5b5bf0, lpFindFileData=0xaf638 | out: lpFindFileData=0xaf638) returned 1 [0065.799] PeekMessageA (in: lpMsg=0xaf614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf614) returned 0 [0065.799] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BCD.LOG2") returned 1 [0065.799] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BCD.LOG2") returned 1 [0065.799] lstrcmpiA (lpString1="", lpString2="BCD.LOG2") returned -1 [0065.800] PathFindFileNameA (pszPath="C:\\Boot\\BCD.LOG1") returned="BCD.LOG1" [0065.800] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="BCD.LOG2" | out: lpString1="C:\\Boot\\BCD.LOG2") returned="C:\\Boot\\BCD.LOG2" [0065.800] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.zip") returned 0 [0065.800] lstrlenA (lpString="*.zip") returned 5 [0065.800] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.rar") returned 0 [0065.800] lstrlenA (lpString="*.rar") returned 5 [0065.800] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.7z") returned 0 [0065.800] lstrlenA (lpString="*.7z") returned 4 [0065.800] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.tar") returned 0 [0065.800] lstrlenA (lpString="*.tar") returned 5 [0065.800] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.gzip") returned 0 [0065.800] lstrlenA (lpString="*.gzip") returned 6 [0065.800] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.jpg") returned 0 [0065.800] lstrlenA (lpString="*.jpg") returned 5 [0065.800] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.jpeg") returned 0 [0065.800] lstrlenA (lpString="*.jpeg") returned 6 [0065.800] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.psd") returned 0 [0065.800] lstrlenA (lpString="*.psd") returned 5 [0065.800] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.cdr") returned 0 [0065.800] lstrlenA (lpString="*.cdr") returned 5 [0065.800] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.dwg") returned 0 [0065.800] lstrlenA (lpString="*.dwg") returned 5 [0065.800] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.max") returned 0 [0065.800] lstrlenA (lpString="*.max") returned 5 [0065.800] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.bmp") returned 0 [0065.800] lstrlenA (lpString="*.bmp") returned 5 [0065.800] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.gif") returned 0 [0065.800] lstrlenA (lpString="*.gif") returned 5 [0065.800] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.png") returned 0 [0065.800] lstrlenA (lpString="*.png") returned 5 [0065.800] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.doc") returned 0 [0065.800] lstrlenA (lpString="*.doc") returned 5 [0065.800] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.docx") returned 0 [0065.800] lstrlenA (lpString="*.docx") returned 6 [0065.800] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.xls") returned 0 [0065.800] lstrlenA (lpString="*.xls") returned 5 [0065.800] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.xlsx") returned 0 [0065.800] lstrlenA (lpString="*.xlsx") returned 6 [0065.800] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.ppt") returned 0 [0065.800] lstrlenA (lpString="*.ppt") returned 5 [0065.800] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.pptx") returned 0 [0065.800] lstrlenA (lpString="*.pptx") returned 6 [0065.800] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.txt") returned 0 [0065.800] lstrlenA (lpString="*.txt") returned 5 [0065.800] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.pdf") returned 0 [0065.800] lstrlenA (lpString="*.pdf") returned 5 [0065.800] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.djvu") returned 0 [0065.800] lstrlenA (lpString="*.djvu") returned 6 [0065.800] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.htm") returned 0 [0065.801] lstrlenA (lpString="*.htm") returned 5 [0065.801] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.html") returned 0 [0065.801] lstrlenA (lpString="*.html") returned 6 [0065.801] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.mdb") returned 0 [0065.801] lstrlenA (lpString="*.mdb") returned 5 [0065.801] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.cer") returned 0 [0065.801] lstrlenA (lpString="*.cer") returned 5 [0065.801] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.p12") returned 0 [0065.801] lstrlenA (lpString="*.p12") returned 5 [0065.801] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.pfx") returned 0 [0065.801] lstrlenA (lpString="*.pfx") returned 5 [0065.801] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.kwm") returned 0 [0065.801] lstrlenA (lpString="*.kwm") returned 5 [0065.801] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.pwm") returned 0 [0065.801] lstrlenA (lpString="*.pwm") returned 5 [0065.801] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.1cd") returned 0 [0065.801] lstrlenA (lpString="*.1cd") returned 5 [0065.801] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.md") returned 0 [0065.801] lstrlenA (lpString="*.md") returned 4 [0065.801] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.mdf") returned 0 [0065.801] lstrlenA (lpString="*.mdf") returned 5 [0065.801] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.dbf") returned 0 [0065.801] lstrlenA (lpString="*.dbf") returned 5 [0065.801] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.odt") returned 0 [0065.801] lstrlenA (lpString="*.odt") returned 5 [0065.801] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.vob") returned 0 [0065.801] lstrlenA (lpString="*.vob") returned 5 [0065.801] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.ifo") returned 0 [0065.801] lstrlenA (lpString="*.ifo") returned 5 [0065.801] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.lnk") returned 0 [0065.801] lstrlenA (lpString="*.lnk") returned 5 [0065.801] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.torrent") returned 0 [0065.801] lstrlenA (lpString="*.torrent") returned 9 [0065.801] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.mov") returned 0 [0065.801] lstrlenA (lpString="*.mov") returned 5 [0065.801] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.m2v") returned 0 [0065.801] lstrlenA (lpString="*.m2v") returned 5 [0065.801] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.3gp") returned 0 [0065.801] lstrlenA (lpString="*.3gp") returned 5 [0065.801] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.mpeg") returned 0 [0065.801] lstrlenA (lpString="*.mpeg") returned 6 [0065.801] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.mpg") returned 0 [0065.801] lstrlenA (lpString="*.mpg") returned 5 [0065.801] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.flv") returned 0 [0065.801] lstrlenA (lpString="*.flv") returned 5 [0065.801] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.avi") returned 0 [0065.801] lstrlenA (lpString="*.avi") returned 5 [0065.801] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.mp4") returned 0 [0065.801] lstrlenA (lpString="*.mp4") returned 5 [0065.802] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.wmv") returned 0 [0065.802] lstrlenA (lpString="*.wmv") returned 5 [0065.802] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.divx") returned 0 [0065.802] lstrlenA (lpString="*.divx") returned 6 [0065.802] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.mkv") returned 0 [0065.802] lstrlenA (lpString="*.mkv") returned 5 [0065.802] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.mp3") returned 0 [0065.802] lstrlenA (lpString="*.mp3") returned 5 [0065.802] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.wav") returned 0 [0065.802] lstrlenA (lpString="*.wav") returned 5 [0065.802] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.flac") returned 0 [0065.802] lstrlenA (lpString="*.flac") returned 6 [0065.802] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.ape") returned 0 [0065.802] lstrlenA (lpString="*.ape") returned 5 [0065.802] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.wma") returned 0 [0065.802] lstrlenA (lpString="*.wma") returned 5 [0065.802] PathMatchSpecA (pszFile="C:\\Boot\\BCD.LOG2", pszSpec="*.ac3") returned 0 [0065.802] lstrlenA (lpString="*.ac3") returned 5 [0065.802] FindNextFileA (in: hFindFile=0x5b5bf0, lpFindFileData=0xaf638 | out: lpFindFileData=0xaf638) returned 1 [0065.802] PeekMessageA (in: lpMsg=0xaf614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf614) returned 0 [0065.802] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BOOTSTAT.DAT") returned 1 [0065.802] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BOOTSTAT.DAT") returned 1 [0065.802] lstrcmpiA (lpString1="", lpString2="BOOTSTAT.DAT") returned -1 [0065.802] PathFindFileNameA (pszPath="C:\\Boot\\BCD.LOG2") returned="BCD.LOG2" [0065.802] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="BOOTSTAT.DAT" | out: lpString1="C:\\Boot\\BOOTSTAT.DAT") returned="C:\\Boot\\BOOTSTAT.DAT" [0065.802] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.zip") returned 0 [0065.802] lstrlenA (lpString="*.zip") returned 5 [0065.802] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.rar") returned 0 [0065.802] lstrlenA (lpString="*.rar") returned 5 [0065.802] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.7z") returned 0 [0065.802] lstrlenA (lpString="*.7z") returned 4 [0065.802] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.tar") returned 0 [0065.802] lstrlenA (lpString="*.tar") returned 5 [0065.802] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.gzip") returned 0 [0065.802] lstrlenA (lpString="*.gzip") returned 6 [0065.802] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.jpg") returned 0 [0065.802] lstrlenA (lpString="*.jpg") returned 5 [0065.802] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.jpeg") returned 0 [0065.802] lstrlenA (lpString="*.jpeg") returned 6 [0065.802] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.psd") returned 0 [0065.802] lstrlenA (lpString="*.psd") returned 5 [0065.802] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.cdr") returned 0 [0065.802] lstrlenA (lpString="*.cdr") returned 5 [0065.802] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.dwg") returned 0 [0065.802] lstrlenA (lpString="*.dwg") returned 5 [0065.802] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.max") returned 0 [0065.803] lstrlenA (lpString="*.max") returned 5 [0065.803] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.bmp") returned 0 [0065.803] lstrlenA (lpString="*.bmp") returned 5 [0065.803] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.gif") returned 0 [0065.803] lstrlenA (lpString="*.gif") returned 5 [0065.803] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.png") returned 0 [0065.803] lstrlenA (lpString="*.png") returned 5 [0065.803] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.doc") returned 0 [0065.803] lstrlenA (lpString="*.doc") returned 5 [0065.803] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.docx") returned 0 [0065.803] lstrlenA (lpString="*.docx") returned 6 [0065.803] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.xls") returned 0 [0065.803] lstrlenA (lpString="*.xls") returned 5 [0065.803] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.xlsx") returned 0 [0065.803] lstrlenA (lpString="*.xlsx") returned 6 [0065.803] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.ppt") returned 0 [0065.803] lstrlenA (lpString="*.ppt") returned 5 [0065.803] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.pptx") returned 0 [0065.803] lstrlenA (lpString="*.pptx") returned 6 [0065.803] PathMatchSpecA (pszFile="C:\\Boot\\BOOTSTAT.DAT", pszSpec="*.txt") returned 0 [0065.803] lstrlenA (lpString="*.txt") returned 5 [0065.803] FindNextFileA (in: hFindFile=0x5b5bf0, lpFindFileData=0xaf638 | out: lpFindFileData=0xaf638) returned 1 [0065.803] lstrcmpA (lpString1=".", lpString2="cs-CZ") returned -1 [0065.803] lstrcmpA (lpString1="..", lpString2="cs-CZ") returned -1 [0065.804] PathFindFileNameA (pszPath="C:\\Boot\\BOOTSTAT.DAT") returned="BOOTSTAT.DAT" [0065.804] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="cs-CZ" | out: lpString1="C:\\Boot\\cs-CZ") returned="C:\\Boot\\cs-CZ" [0065.804] FindFirstFileA (in: lpFileName="C:\\Boot\\cs-CZ\\*.*", lpFindFileData=0xaf4e8 | out: lpFindFileData=0xaf4e8) returned 0x5b6c68 [0065.848] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0065.848] FindNextFileA (in: hFindFile=0x5b6c68, lpFindFileData=0xaf4e8 | out: lpFindFileData=0xaf4e8) returned 1 [0065.848] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0065.848] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0065.848] FindNextFileA (in: hFindFile=0x5b6c68, lpFindFileData=0xaf4e8 | out: lpFindFileData=0xaf4e8) returned 1 [0065.848] PeekMessageA (in: lpMsg=0xaf4c4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf4c4) returned 0 [0065.848] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="bootmgr.exe.mui") returned 1 [0065.848] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bootmgr.exe.mui") returned 1 [0065.848] lstrcmpiA (lpString1="", lpString2="bootmgr.exe.mui") returned -1 [0065.848] PathFindFileNameA (pszPath="C:\\Boot\\cs-CZ\\*.*") returned="*.*" [0065.848] lstrcatA (in: lpString1="C:\\Boot\\cs-CZ\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned="C:\\Boot\\cs-CZ\\bootmgr.exe.mui" [0065.848] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.zip") returned 0 [0065.848] lstrlenA (lpString="*.zip") returned 5 [0065.848] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.rar") returned 0 [0065.848] lstrlenA (lpString="*.rar") returned 5 [0065.848] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.7z") returned 0 [0065.848] lstrlenA (lpString="*.7z") returned 4 [0065.848] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.tar") returned 0 [0065.848] lstrlenA (lpString="*.tar") returned 5 [0065.849] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.gzip") returned 0 [0065.849] lstrlenA (lpString="*.gzip") returned 6 [0065.849] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.jpg") returned 0 [0065.849] lstrlenA (lpString="*.jpg") returned 5 [0065.849] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.jpeg") returned 0 [0065.849] lstrlenA (lpString="*.jpeg") returned 6 [0065.849] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.psd") returned 0 [0065.849] lstrlenA (lpString="*.psd") returned 5 [0065.849] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.cdr") returned 0 [0065.849] lstrlenA (lpString="*.cdr") returned 5 [0065.849] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.dwg") returned 0 [0065.849] lstrlenA (lpString="*.dwg") returned 5 [0065.849] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.max") returned 0 [0065.849] lstrlenA (lpString="*.max") returned 5 [0065.849] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.bmp") returned 0 [0065.849] lstrlenA (lpString="*.bmp") returned 5 [0065.849] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.gif") returned 0 [0065.849] lstrlenA (lpString="*.gif") returned 5 [0065.849] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.png") returned 0 [0065.849] lstrlenA (lpString="*.png") returned 5 [0065.849] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.doc") returned 0 [0065.849] lstrlenA (lpString="*.doc") returned 5 [0065.849] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.docx") returned 0 [0065.849] lstrlenA (lpString="*.docx") returned 6 [0065.849] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.xls") returned 0 [0065.849] lstrlenA (lpString="*.xls") returned 5 [0065.849] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.xlsx") returned 0 [0065.849] lstrlenA (lpString="*.xlsx") returned 6 [0065.849] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.ppt") returned 0 [0065.849] lstrlenA (lpString="*.ppt") returned 5 [0065.850] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.pptx") returned 0 [0065.850] lstrlenA (lpString="*.pptx") returned 6 [0065.850] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.txt") returned 0 [0065.850] lstrlenA (lpString="*.txt") returned 5 [0065.850] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.pdf") returned 0 [0065.850] lstrlenA (lpString="*.pdf") returned 5 [0065.850] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.djvu") returned 0 [0065.850] lstrlenA (lpString="*.djvu") returned 6 [0065.850] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.htm") returned 0 [0065.850] lstrlenA (lpString="*.htm") returned 5 [0065.850] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.html") returned 0 [0065.850] lstrlenA (lpString="*.html") returned 6 [0065.850] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.mdb") returned 0 [0065.850] lstrlenA (lpString="*.mdb") returned 5 [0065.850] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.cer") returned 0 [0065.850] lstrlenA (lpString="*.cer") returned 5 [0065.850] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.p12") returned 0 [0065.850] lstrlenA (lpString="*.p12") returned 5 [0065.850] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.pfx") returned 0 [0065.850] lstrlenA (lpString="*.pfx") returned 5 [0065.850] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.kwm") returned 0 [0065.850] lstrlenA (lpString="*.kwm") returned 5 [0065.850] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.pwm") returned 0 [0065.850] lstrlenA (lpString="*.pwm") returned 5 [0065.850] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.1cd") returned 0 [0065.850] lstrlenA (lpString="*.1cd") returned 5 [0065.850] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.md") returned 0 [0065.850] lstrlenA (lpString="*.md") returned 4 [0065.850] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.mdf") returned 0 [0065.850] lstrlenA (lpString="*.mdf") returned 5 [0065.850] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.dbf") returned 0 [0065.850] lstrlenA (lpString="*.dbf") returned 5 [0065.850] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.odt") returned 0 [0065.850] lstrlenA (lpString="*.odt") returned 5 [0065.851] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.vob") returned 0 [0065.851] lstrlenA (lpString="*.vob") returned 5 [0065.851] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.ifo") returned 0 [0065.851] lstrlenA (lpString="*.ifo") returned 5 [0065.851] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.lnk") returned 0 [0065.851] lstrlenA (lpString="*.lnk") returned 5 [0065.851] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.torrent") returned 0 [0065.851] lstrlenA (lpString="*.torrent") returned 9 [0065.851] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.mov") returned 0 [0065.851] lstrlenA (lpString="*.mov") returned 5 [0065.851] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.m2v") returned 0 [0065.851] lstrlenA (lpString="*.m2v") returned 5 [0065.851] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.3gp") returned 0 [0065.851] lstrlenA (lpString="*.3gp") returned 5 [0065.851] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.mpeg") returned 0 [0065.851] lstrlenA (lpString="*.mpeg") returned 6 [0065.851] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.mpg") returned 0 [0065.851] lstrlenA (lpString="*.mpg") returned 5 [0065.851] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.flv") returned 0 [0065.851] lstrlenA (lpString="*.flv") returned 5 [0065.851] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.avi") returned 0 [0065.851] lstrlenA (lpString="*.avi") returned 5 [0065.851] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.mp4") returned 0 [0065.851] lstrlenA (lpString="*.mp4") returned 5 [0065.851] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.wmv") returned 0 [0065.851] lstrlenA (lpString="*.wmv") returned 5 [0065.851] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.divx") returned 0 [0065.851] lstrlenA (lpString="*.divx") returned 6 [0065.851] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.mkv") returned 0 [0065.851] lstrlenA (lpString="*.mkv") returned 5 [0065.851] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.mp3") returned 0 [0065.851] lstrlenA (lpString="*.mp3") returned 5 [0065.851] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.wav") returned 0 [0065.851] lstrlenA (lpString="*.wav") returned 5 [0065.851] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.flac") returned 0 [0065.852] lstrlenA (lpString="*.flac") returned 6 [0065.852] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.ape") returned 0 [0065.852] lstrlenA (lpString="*.ape") returned 5 [0065.852] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.wma") returned 0 [0065.852] lstrlenA (lpString="*.wma") returned 5 [0065.852] PathMatchSpecA (pszFile="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", pszSpec="*.ac3") returned 0 [0065.852] lstrlenA (lpString="*.ac3") returned 5 [0065.852] FindNextFileA (in: hFindFile=0x5b6c68, lpFindFileData=0xaf4e8 | out: lpFindFileData=0xaf4e8) returned 0 [0065.852] FindClose (in: hFindFile=0x5b6c68 | out: hFindFile=0x5b6c68) returned 1 [0065.852] FindNextFileA (in: hFindFile=0x5b5bf0, lpFindFileData=0xaf638 | out: lpFindFileData=0xaf638) returned 1 [0065.852] lstrcmpA (lpString1=".", lpString2="da-DK") returned -1 [0065.852] lstrcmpA (lpString1="..", lpString2="da-DK") returned -1 [0065.852] PathFindFileNameA (pszPath="C:\\Boot\\*.*") returned="*.*" [0065.852] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="da-DK" | out: lpString1="C:\\Boot\\da-DK") returned="C:\\Boot\\da-DK" [0065.852] lstrlenA (lpString="C:\\Boot\\da-DK") returned 13 [0065.852] FindFirstFileA (in: lpFileName="C:\\Boot\\da-DK\\*.*", lpFindFileData=0xaf4e8 | out: lpFindFileData=0xaf4e8) returned 0x5b6c68 [0065.852] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0065.852] FindNextFileA (in: hFindFile=0x5b6c68, lpFindFileData=0xaf4e8 | out: lpFindFileData=0xaf4e8) returned 1 [0065.852] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0065.852] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0065.852] FindNextFileA (in: hFindFile=0x5b6c68, lpFindFileData=0xaf4e8 | out: lpFindFileData=0xaf4e8) returned 1 [0065.852] PeekMessageA (in: lpMsg=0xaf4c4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf4c4) returned 0 [0065.852] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="bootmgr.exe.mui") returned 1 [0065.852] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bootmgr.exe.mui") returned 1 [0065.852] lstrcmpiA (lpString1="", lpString2="bootmgr.exe.mui") returned -1 [0065.853] PathFindFileNameA (pszPath="C:\\Boot\\da-DK\\*.*") returned="*.*" [0065.853] lstrcatA (in: lpString1="C:\\Boot\\da-DK\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned="C:\\Boot\\da-DK\\bootmgr.exe.mui" [0065.853] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.zip") returned 0 [0065.853] lstrlenA (lpString="*.zip") returned 5 [0065.853] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.rar") returned 0 [0065.853] lstrlenA (lpString="*.rar") returned 5 [0065.853] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.7z") returned 0 [0065.853] lstrlenA (lpString="*.7z") returned 4 [0065.853] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.tar") returned 0 [0065.853] lstrlenA (lpString="*.tar") returned 5 [0065.853] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.gzip") returned 0 [0065.853] lstrlenA (lpString="*.gzip") returned 6 [0065.853] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.jpg") returned 0 [0065.853] lstrlenA (lpString="*.jpg") returned 5 [0065.853] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.jpeg") returned 0 [0065.853] lstrlenA (lpString="*.jpeg") returned 6 [0065.853] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.psd") returned 0 [0065.853] lstrlenA (lpString="*.psd") returned 5 [0065.853] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.cdr") returned 0 [0065.853] lstrlenA (lpString="*.cdr") returned 5 [0065.853] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.dwg") returned 0 [0065.853] lstrlenA (lpString="*.dwg") returned 5 [0065.853] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.max") returned 0 [0065.853] lstrlenA (lpString="*.max") returned 5 [0065.853] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.bmp") returned 0 [0065.853] lstrlenA (lpString="*.bmp") returned 5 [0065.853] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.gif") returned 0 [0065.853] lstrlenA (lpString="*.gif") returned 5 [0065.853] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.png") returned 0 [0065.853] lstrlenA (lpString="*.png") returned 5 [0065.853] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.doc") returned 0 [0065.853] lstrlenA (lpString="*.doc") returned 5 [0065.853] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.docx") returned 0 [0065.853] lstrlenA (lpString="*.docx") returned 6 [0065.853] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.xls") returned 0 [0065.853] lstrlenA (lpString="*.xls") returned 5 [0065.853] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.xlsx") returned 0 [0065.853] lstrlenA (lpString="*.xlsx") returned 6 [0065.853] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.ppt") returned 0 [0065.853] lstrlenA (lpString="*.ppt") returned 5 [0065.854] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.pptx") returned 0 [0065.854] lstrlenA (lpString="*.pptx") returned 6 [0065.854] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.txt") returned 0 [0065.854] lstrlenA (lpString="*.txt") returned 5 [0065.854] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.pdf") returned 0 [0065.854] lstrlenA (lpString="*.pdf") returned 5 [0065.854] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.djvu") returned 0 [0065.854] lstrlenA (lpString="*.djvu") returned 6 [0065.854] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.htm") returned 0 [0065.854] lstrlenA (lpString="*.htm") returned 5 [0065.854] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.html") returned 0 [0065.854] lstrlenA (lpString="*.html") returned 6 [0065.854] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.mdb") returned 0 [0065.854] lstrlenA (lpString="*.mdb") returned 5 [0065.854] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.cer") returned 0 [0065.854] lstrlenA (lpString="*.cer") returned 5 [0065.854] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.p12") returned 0 [0065.854] lstrlenA (lpString="*.p12") returned 5 [0065.854] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.pfx") returned 0 [0065.854] lstrlenA (lpString="*.pfx") returned 5 [0065.854] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.kwm") returned 0 [0065.854] lstrlenA (lpString="*.kwm") returned 5 [0065.854] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.pwm") returned 0 [0065.854] lstrlenA (lpString="*.pwm") returned 5 [0065.854] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.1cd") returned 0 [0065.854] lstrlenA (lpString="*.1cd") returned 5 [0065.854] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.md") returned 0 [0065.854] lstrlenA (lpString="*.md") returned 4 [0065.854] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.mdf") returned 0 [0065.854] lstrlenA (lpString="*.mdf") returned 5 [0065.854] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.dbf") returned 0 [0065.854] lstrlenA (lpString="*.dbf") returned 5 [0065.854] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.odt") returned 0 [0065.854] lstrlenA (lpString="*.odt") returned 5 [0065.854] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.vob") returned 0 [0065.854] lstrlenA (lpString="*.vob") returned 5 [0065.854] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.ifo") returned 0 [0065.854] lstrlenA (lpString="*.ifo") returned 5 [0065.854] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.lnk") returned 0 [0065.855] lstrlenA (lpString="*.lnk") returned 5 [0065.855] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.torrent") returned 0 [0065.855] lstrlenA (lpString="*.torrent") returned 9 [0065.855] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.mov") returned 0 [0065.855] lstrlenA (lpString="*.mov") returned 5 [0065.855] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.m2v") returned 0 [0065.855] lstrlenA (lpString="*.m2v") returned 5 [0065.855] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.3gp") returned 0 [0065.855] lstrlenA (lpString="*.3gp") returned 5 [0065.855] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.mpeg") returned 0 [0065.855] lstrlenA (lpString="*.mpeg") returned 6 [0065.855] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.mpg") returned 0 [0065.855] lstrlenA (lpString="*.mpg") returned 5 [0065.855] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.flv") returned 0 [0065.855] lstrlenA (lpString="*.flv") returned 5 [0065.855] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.avi") returned 0 [0065.855] lstrlenA (lpString="*.avi") returned 5 [0065.855] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.mp4") returned 0 [0065.855] lstrlenA (lpString="*.mp4") returned 5 [0065.855] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.wmv") returned 0 [0065.855] lstrlenA (lpString="*.wmv") returned 5 [0065.855] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.divx") returned 0 [0065.855] lstrlenA (lpString="*.divx") returned 6 [0065.855] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.mkv") returned 0 [0065.855] lstrlenA (lpString="*.mkv") returned 5 [0065.855] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.mp3") returned 0 [0065.855] lstrlenA (lpString="*.mp3") returned 5 [0065.855] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.wav") returned 0 [0065.855] lstrlenA (lpString="*.wav") returned 5 [0065.855] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.flac") returned 0 [0065.855] lstrlenA (lpString="*.flac") returned 6 [0065.855] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.ape") returned 0 [0065.855] lstrlenA (lpString="*.ape") returned 5 [0065.855] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.wma") returned 0 [0065.855] lstrlenA (lpString="*.wma") returned 5 [0065.855] PathMatchSpecA (pszFile="C:\\Boot\\da-DK\\bootmgr.exe.mui", pszSpec="*.ac3") returned 0 [0065.855] lstrlenA (lpString="*.ac3") returned 5 [0065.855] FindNextFileA (in: hFindFile=0x5b6c68, lpFindFileData=0xaf4e8 | out: lpFindFileData=0xaf4e8) returned 0 [0065.855] FindClose (in: hFindFile=0x5b6c68 | out: hFindFile=0x5b6c68) returned 1 [0065.856] FindNextFileA (in: hFindFile=0x5b5bf0, lpFindFileData=0xaf638 | out: lpFindFileData=0xaf638) returned 1 [0065.856] lstrcmpA (lpString1=".", lpString2="de-DE") returned -1 [0065.856] lstrcmpA (lpString1="..", lpString2="de-DE") returned -1 [0065.856] PathFindFileNameA (pszPath="C:\\Boot\\*.*") returned="*.*" [0065.856] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="de-DE" | out: lpString1="C:\\Boot\\de-DE") returned="C:\\Boot\\de-DE" [0065.856] lstrlenA (lpString="C:\\Boot\\de-DE") returned 13 [0065.856] FindFirstFileA (in: lpFileName="C:\\Boot\\de-DE\\*.*", lpFindFileData=0xaf4e8 | out: lpFindFileData=0xaf4e8) returned 0x5b6c68 [0065.896] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0065.896] FindNextFileA (in: hFindFile=0x5b6c68, lpFindFileData=0xaf4e8 | out: lpFindFileData=0xaf4e8) returned 1 [0065.896] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0065.896] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0065.896] FindNextFileA (in: hFindFile=0x5b6c68, lpFindFileData=0xaf4e8 | out: lpFindFileData=0xaf4e8) returned 1 [0065.896] PeekMessageA (in: lpMsg=0xaf4c4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf4c4) returned 0 [0065.896] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="bootmgr.exe.mui") returned 1 [0065.896] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bootmgr.exe.mui") returned 1 [0065.896] lstrcmpiA (lpString1="", lpString2="bootmgr.exe.mui") returned -1 [0065.896] PathFindFileNameA (pszPath="C:\\Boot\\de-DE\\*.*") returned="*.*" [0065.896] lstrcatA (in: lpString1="C:\\Boot\\de-DE\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned="C:\\Boot\\de-DE\\bootmgr.exe.mui" [0065.896] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.zip") returned 0 [0065.896] lstrlenA (lpString="*.zip") returned 5 [0065.896] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.rar") returned 0 [0065.896] lstrlenA (lpString="*.rar") returned 5 [0065.896] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.7z") returned 0 [0065.896] lstrlenA (lpString="*.7z") returned 4 [0065.896] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.tar") returned 0 [0065.896] lstrlenA (lpString="*.tar") returned 5 [0065.896] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.gzip") returned 0 [0065.896] lstrlenA (lpString="*.gzip") returned 6 [0065.896] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.jpg") returned 0 [0065.896] lstrlenA (lpString="*.jpg") returned 5 [0065.896] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.jpeg") returned 0 [0065.896] lstrlenA (lpString="*.jpeg") returned 6 [0065.896] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.psd") returned 0 [0065.896] lstrlenA (lpString="*.psd") returned 5 [0065.896] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.cdr") returned 0 [0065.896] lstrlenA (lpString="*.cdr") returned 5 [0065.896] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.dwg") returned 0 [0065.897] lstrlenA (lpString="*.dwg") returned 5 [0065.897] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.max") returned 0 [0065.897] lstrlenA (lpString="*.max") returned 5 [0065.897] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.bmp") returned 0 [0065.897] lstrlenA (lpString="*.bmp") returned 5 [0065.897] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.gif") returned 0 [0065.897] lstrlenA (lpString="*.gif") returned 5 [0065.897] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.png") returned 0 [0065.897] lstrlenA (lpString="*.png") returned 5 [0065.897] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.doc") returned 0 [0065.897] lstrlenA (lpString="*.doc") returned 5 [0065.897] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.docx") returned 0 [0065.897] lstrlenA (lpString="*.docx") returned 6 [0065.897] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.xls") returned 0 [0065.897] lstrlenA (lpString="*.xls") returned 5 [0065.897] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.xlsx") returned 0 [0065.897] lstrlenA (lpString="*.xlsx") returned 6 [0065.897] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.ppt") returned 0 [0065.897] lstrlenA (lpString="*.ppt") returned 5 [0065.897] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.pptx") returned 0 [0065.897] lstrlenA (lpString="*.pptx") returned 6 [0065.897] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.txt") returned 0 [0065.897] lstrlenA (lpString="*.txt") returned 5 [0065.897] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.pdf") returned 0 [0065.897] lstrlenA (lpString="*.pdf") returned 5 [0065.897] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.djvu") returned 0 [0065.897] lstrlenA (lpString="*.djvu") returned 6 [0065.897] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.htm") returned 0 [0065.897] lstrlenA (lpString="*.htm") returned 5 [0065.897] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.html") returned 0 [0065.897] lstrlenA (lpString="*.html") returned 6 [0065.897] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.mdb") returned 0 [0065.897] lstrlenA (lpString="*.mdb") returned 5 [0065.897] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.cer") returned 0 [0065.897] lstrlenA (lpString="*.cer") returned 5 [0065.897] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.p12") returned 0 [0065.897] lstrlenA (lpString="*.p12") returned 5 [0065.897] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.pfx") returned 0 [0065.897] lstrlenA (lpString="*.pfx") returned 5 [0065.897] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.kwm") returned 0 [0065.898] lstrlenA (lpString="*.kwm") returned 5 [0065.898] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.pwm") returned 0 [0065.898] lstrlenA (lpString="*.pwm") returned 5 [0065.898] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.1cd") returned 0 [0065.898] lstrlenA (lpString="*.1cd") returned 5 [0065.898] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.md") returned 0 [0065.898] lstrlenA (lpString="*.md") returned 4 [0065.898] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.mdf") returned 0 [0065.898] lstrlenA (lpString="*.mdf") returned 5 [0065.898] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.dbf") returned 0 [0065.898] lstrlenA (lpString="*.dbf") returned 5 [0065.898] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.odt") returned 0 [0065.898] lstrlenA (lpString="*.odt") returned 5 [0065.898] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.vob") returned 0 [0065.898] lstrlenA (lpString="*.vob") returned 5 [0065.898] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.ifo") returned 0 [0065.898] lstrlenA (lpString="*.ifo") returned 5 [0065.898] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.lnk") returned 0 [0065.898] lstrlenA (lpString="*.lnk") returned 5 [0065.898] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.torrent") returned 0 [0065.898] lstrlenA (lpString="*.torrent") returned 9 [0065.898] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.mov") returned 0 [0065.898] lstrlenA (lpString="*.mov") returned 5 [0065.898] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.m2v") returned 0 [0065.898] lstrlenA (lpString="*.m2v") returned 5 [0065.898] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.3gp") returned 0 [0065.898] lstrlenA (lpString="*.3gp") returned 5 [0065.898] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.mpeg") returned 0 [0065.898] lstrlenA (lpString="*.mpeg") returned 6 [0065.898] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.mpg") returned 0 [0065.898] lstrlenA (lpString="*.mpg") returned 5 [0065.898] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.flv") returned 0 [0065.898] lstrlenA (lpString="*.flv") returned 5 [0065.898] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.avi") returned 0 [0065.898] lstrlenA (lpString="*.avi") returned 5 [0065.898] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.mp4") returned 0 [0065.898] lstrlenA (lpString="*.mp4") returned 5 [0065.898] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.wmv") returned 0 [0065.899] lstrlenA (lpString="*.wmv") returned 5 [0065.899] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.divx") returned 0 [0065.899] lstrlenA (lpString="*.divx") returned 6 [0065.899] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.mkv") returned 0 [0065.899] lstrlenA (lpString="*.mkv") returned 5 [0065.899] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.mp3") returned 0 [0065.899] lstrlenA (lpString="*.mp3") returned 5 [0065.899] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.wav") returned 0 [0065.899] lstrlenA (lpString="*.wav") returned 5 [0065.899] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.flac") returned 0 [0065.899] lstrlenA (lpString="*.flac") returned 6 [0065.899] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.ape") returned 0 [0065.899] lstrlenA (lpString="*.ape") returned 5 [0065.899] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.wma") returned 0 [0065.899] lstrlenA (lpString="*.wma") returned 5 [0065.899] PathMatchSpecA (pszFile="C:\\Boot\\de-DE\\bootmgr.exe.mui", pszSpec="*.ac3") returned 0 [0065.899] lstrlenA (lpString="*.ac3") returned 5 [0065.899] FindNextFileA (in: hFindFile=0x5b6c68, lpFindFileData=0xaf4e8 | out: lpFindFileData=0xaf4e8) returned 0 [0065.899] FindClose (in: hFindFile=0x5b6c68 | out: hFindFile=0x5b6c68) returned 1 [0065.899] FindNextFileA (in: hFindFile=0x5b5bf0, lpFindFileData=0xaf638 | out: lpFindFileData=0xaf638) returned 1 [0065.899] lstrcmpA (lpString1=".", lpString2="el-GR") returned -1 [0065.899] lstrcmpA (lpString1="..", lpString2="el-GR") returned -1 [0065.899] PathFindFileNameA (pszPath="C:\\Boot\\*.*") returned="*.*" [0065.899] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="el-GR" | out: lpString1="C:\\Boot\\el-GR") returned="C:\\Boot\\el-GR" [0065.899] lstrlenA (lpString="C:\\Boot\\el-GR") returned 13 [0065.899] FindFirstFileA (in: lpFileName="C:\\Boot\\el-GR\\*.*", lpFindFileData=0xaf4e8 | out: lpFindFileData=0xaf4e8) returned 0x5b6c68 [0065.900] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0065.900] FindNextFileA (in: hFindFile=0x5b6c68, lpFindFileData=0xaf4e8 | out: lpFindFileData=0xaf4e8) returned 1 [0065.900] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0065.900] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0065.900] FindNextFileA (in: hFindFile=0x5b6c68, lpFindFileData=0xaf4e8 | out: lpFindFileData=0xaf4e8) returned 1 [0065.900] PeekMessageA (in: lpMsg=0xaf4c4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf4c4) returned 0 [0065.900] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="bootmgr.exe.mui") returned 1 [0065.900] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bootmgr.exe.mui") returned 1 [0065.900] lstrcmpiA (lpString1="", lpString2="bootmgr.exe.mui") returned -1 [0065.900] PathFindFileNameA (pszPath="C:\\Boot\\el-GR\\*.*") returned="*.*" [0065.900] lstrcatA (in: lpString1="C:\\Boot\\el-GR\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned="C:\\Boot\\el-GR\\bootmgr.exe.mui" [0065.900] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.zip") returned 0 [0065.900] lstrlenA (lpString="*.zip") returned 5 [0065.900] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.rar") returned 0 [0065.900] lstrlenA (lpString="*.rar") returned 5 [0065.900] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.7z") returned 0 [0065.900] lstrlenA (lpString="*.7z") returned 4 [0065.900] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.tar") returned 0 [0065.900] lstrlenA (lpString="*.tar") returned 5 [0065.900] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.gzip") returned 0 [0065.900] lstrlenA (lpString="*.gzip") returned 6 [0065.900] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.jpg") returned 0 [0065.900] lstrlenA (lpString="*.jpg") returned 5 [0065.900] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.jpeg") returned 0 [0065.900] lstrlenA (lpString="*.jpeg") returned 6 [0065.900] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.psd") returned 0 [0065.900] lstrlenA (lpString="*.psd") returned 5 [0065.900] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.cdr") returned 0 [0065.900] lstrlenA (lpString="*.cdr") returned 5 [0065.900] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.dwg") returned 0 [0065.901] lstrlenA (lpString="*.dwg") returned 5 [0065.901] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.max") returned 0 [0065.901] lstrlenA (lpString="*.max") returned 5 [0065.901] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.bmp") returned 0 [0065.901] lstrlenA (lpString="*.bmp") returned 5 [0065.901] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.gif") returned 0 [0065.901] lstrlenA (lpString="*.gif") returned 5 [0065.901] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.png") returned 0 [0065.901] lstrlenA (lpString="*.png") returned 5 [0065.901] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.doc") returned 0 [0065.901] lstrlenA (lpString="*.doc") returned 5 [0065.901] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.docx") returned 0 [0065.901] lstrlenA (lpString="*.docx") returned 6 [0065.901] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.xls") returned 0 [0065.901] lstrlenA (lpString="*.xls") returned 5 [0065.901] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.xlsx") returned 0 [0065.901] lstrlenA (lpString="*.xlsx") returned 6 [0065.901] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.ppt") returned 0 [0065.901] lstrlenA (lpString="*.ppt") returned 5 [0065.901] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.pptx") returned 0 [0065.901] lstrlenA (lpString="*.pptx") returned 6 [0065.901] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.txt") returned 0 [0065.901] lstrlenA (lpString="*.txt") returned 5 [0065.901] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.pdf") returned 0 [0065.901] lstrlenA (lpString="*.pdf") returned 5 [0065.901] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.djvu") returned 0 [0065.901] lstrlenA (lpString="*.djvu") returned 6 [0065.901] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.htm") returned 0 [0065.901] lstrlenA (lpString="*.htm") returned 5 [0065.901] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.html") returned 0 [0065.901] lstrlenA (lpString="*.html") returned 6 [0065.901] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.mdb") returned 0 [0065.901] lstrlenA (lpString="*.mdb") returned 5 [0065.901] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.cer") returned 0 [0065.901] lstrlenA (lpString="*.cer") returned 5 [0065.901] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.p12") returned 0 [0065.901] lstrlenA (lpString="*.p12") returned 5 [0065.901] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.pfx") returned 0 [0065.901] lstrlenA (lpString="*.pfx") returned 5 [0065.901] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.kwm") returned 0 [0065.901] lstrlenA (lpString="*.kwm") returned 5 [0065.901] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.pwm") returned 0 [0065.902] lstrlenA (lpString="*.pwm") returned 5 [0065.902] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.1cd") returned 0 [0065.902] lstrlenA (lpString="*.1cd") returned 5 [0065.902] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.md") returned 0 [0065.902] lstrlenA (lpString="*.md") returned 4 [0065.902] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.mdf") returned 0 [0065.902] lstrlenA (lpString="*.mdf") returned 5 [0065.902] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.dbf") returned 0 [0065.902] lstrlenA (lpString="*.dbf") returned 5 [0065.902] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.odt") returned 0 [0065.902] lstrlenA (lpString="*.odt") returned 5 [0065.902] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.vob") returned 0 [0065.902] lstrlenA (lpString="*.vob") returned 5 [0065.902] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.ifo") returned 0 [0065.902] lstrlenA (lpString="*.ifo") returned 5 [0065.902] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.lnk") returned 0 [0065.902] lstrlenA (lpString="*.lnk") returned 5 [0065.902] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.torrent") returned 0 [0065.902] lstrlenA (lpString="*.torrent") returned 9 [0065.902] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.mov") returned 0 [0065.902] lstrlenA (lpString="*.mov") returned 5 [0065.902] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.m2v") returned 0 [0065.902] lstrlenA (lpString="*.m2v") returned 5 [0065.902] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.3gp") returned 0 [0065.902] lstrlenA (lpString="*.3gp") returned 5 [0065.902] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.mpeg") returned 0 [0065.902] lstrlenA (lpString="*.mpeg") returned 6 [0065.902] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.mpg") returned 0 [0065.902] lstrlenA (lpString="*.mpg") returned 5 [0065.902] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.flv") returned 0 [0065.902] lstrlenA (lpString="*.flv") returned 5 [0065.902] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.avi") returned 0 [0065.902] lstrlenA (lpString="*.avi") returned 5 [0065.902] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.mp4") returned 0 [0065.902] lstrlenA (lpString="*.mp4") returned 5 [0065.902] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.wmv") returned 0 [0065.902] lstrlenA (lpString="*.wmv") returned 5 [0065.902] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.divx") returned 0 [0065.902] lstrlenA (lpString="*.divx") returned 6 [0065.902] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.mkv") returned 0 [0065.902] lstrlenA (lpString="*.mkv") returned 5 [0065.903] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.mp3") returned 0 [0065.903] lstrlenA (lpString="*.mp3") returned 5 [0065.903] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.wav") returned 0 [0065.903] lstrlenA (lpString="*.wav") returned 5 [0065.903] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.flac") returned 0 [0065.903] lstrlenA (lpString="*.flac") returned 6 [0065.903] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.ape") returned 0 [0065.903] lstrlenA (lpString="*.ape") returned 5 [0065.903] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.wma") returned 0 [0065.903] lstrlenA (lpString="*.wma") returned 5 [0065.903] PathMatchSpecA (pszFile="C:\\Boot\\el-GR\\bootmgr.exe.mui", pszSpec="*.ac3") returned 0 [0065.903] lstrlenA (lpString="*.ac3") returned 5 [0065.903] FindNextFileA (in: hFindFile=0x5b6c68, lpFindFileData=0xaf4e8 | out: lpFindFileData=0xaf4e8) returned 0 [0065.903] FindClose (in: hFindFile=0x5b6c68 | out: hFindFile=0x5b6c68) returned 1 [0065.903] FindNextFileA (in: hFindFile=0x5b5bf0, lpFindFileData=0xaf638 | out: lpFindFileData=0xaf638) returned 1 [0065.903] lstrcmpA (lpString1=".", lpString2="en-US") returned -1 [0065.903] lstrcmpA (lpString1="..", lpString2="en-US") returned -1 [0065.903] PathFindFileNameA (pszPath="C:\\Boot\\*.*") returned="*.*" [0065.903] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="en-US" | out: lpString1="C:\\Boot\\en-US") returned="C:\\Boot\\en-US" [0065.903] lstrlenA (lpString="C:\\Boot\\en-US") returned 13 [0065.903] FindFirstFileA (in: lpFileName="C:\\Boot\\en-US\\*.*", lpFindFileData=0xaf4e8 | out: lpFindFileData=0xaf4e8) returned 0x5b6c68 [0065.943] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0065.943] FindNextFileA (in: hFindFile=0x5b6c68, lpFindFileData=0xaf4e8 | out: lpFindFileData=0xaf4e8) returned 1 [0065.943] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0065.943] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0065.943] FindNextFileA (in: hFindFile=0x5b6c68, lpFindFileData=0xaf4e8 | out: lpFindFileData=0xaf4e8) returned 1 [0065.943] PeekMessageA (in: lpMsg=0xaf4c4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf4c4) returned 0 [0065.943] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="bootmgr.exe.mui") returned 1 [0065.943] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bootmgr.exe.mui") returned 1 [0065.943] lstrcmpiA (lpString1="", lpString2="bootmgr.exe.mui") returned -1 [0065.943] PathFindFileNameA (pszPath="C:\\Boot\\en-US\\*.*") returned="*.*" [0065.943] lstrcatA (in: lpString1="C:\\Boot\\en-US\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\en-US\\bootmgr.exe.mui") returned="C:\\Boot\\en-US\\bootmgr.exe.mui" [0065.943] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.zip") returned 0 [0065.943] lstrlenA (lpString="*.zip") returned 5 [0065.943] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.rar") returned 0 [0065.943] lstrlenA (lpString="*.rar") returned 5 [0065.943] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.7z") returned 0 [0065.943] lstrlenA (lpString="*.7z") returned 4 [0065.943] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.tar") returned 0 [0065.943] lstrlenA (lpString="*.tar") returned 5 [0065.944] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.gzip") returned 0 [0065.944] lstrlenA (lpString="*.gzip") returned 6 [0065.944] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.jpg") returned 0 [0065.944] lstrlenA (lpString="*.jpg") returned 5 [0065.944] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.jpeg") returned 0 [0065.944] lstrlenA (lpString="*.jpeg") returned 6 [0065.944] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.psd") returned 0 [0065.944] lstrlenA (lpString="*.psd") returned 5 [0065.944] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.cdr") returned 0 [0065.944] lstrlenA (lpString="*.cdr") returned 5 [0065.944] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.dwg") returned 0 [0065.944] lstrlenA (lpString="*.dwg") returned 5 [0065.944] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.max") returned 0 [0065.944] lstrlenA (lpString="*.max") returned 5 [0065.944] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.bmp") returned 0 [0065.944] lstrlenA (lpString="*.bmp") returned 5 [0065.944] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.gif") returned 0 [0065.944] lstrlenA (lpString="*.gif") returned 5 [0065.944] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.png") returned 0 [0065.944] lstrlenA (lpString="*.png") returned 5 [0065.944] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.doc") returned 0 [0065.944] lstrlenA (lpString="*.doc") returned 5 [0065.944] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.docx") returned 0 [0065.944] lstrlenA (lpString="*.docx") returned 6 [0065.944] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.xls") returned 0 [0065.944] lstrlenA (lpString="*.xls") returned 5 [0065.944] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.xlsx") returned 0 [0065.944] lstrlenA (lpString="*.xlsx") returned 6 [0065.944] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.ppt") returned 0 [0065.944] lstrlenA (lpString="*.ppt") returned 5 [0065.944] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.pptx") returned 0 [0065.944] lstrlenA (lpString="*.pptx") returned 6 [0065.944] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.txt") returned 0 [0065.944] lstrlenA (lpString="*.txt") returned 5 [0065.944] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.pdf") returned 0 [0065.944] lstrlenA (lpString="*.pdf") returned 5 [0065.944] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.djvu") returned 0 [0065.945] lstrlenA (lpString="*.djvu") returned 6 [0065.945] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.htm") returned 0 [0065.945] lstrlenA (lpString="*.htm") returned 5 [0065.945] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.html") returned 0 [0065.945] lstrlenA (lpString="*.html") returned 6 [0065.945] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.mdb") returned 0 [0065.945] lstrlenA (lpString="*.mdb") returned 5 [0065.945] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.cer") returned 0 [0065.945] lstrlenA (lpString="*.cer") returned 5 [0065.945] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.p12") returned 0 [0065.945] lstrlenA (lpString="*.p12") returned 5 [0065.945] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.pfx") returned 0 [0065.945] lstrlenA (lpString="*.pfx") returned 5 [0065.945] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.kwm") returned 0 [0065.945] lstrlenA (lpString="*.kwm") returned 5 [0065.945] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.pwm") returned 0 [0065.945] lstrlenA (lpString="*.pwm") returned 5 [0065.945] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.1cd") returned 0 [0065.945] lstrlenA (lpString="*.1cd") returned 5 [0065.945] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.md") returned 0 [0065.945] lstrlenA (lpString="*.md") returned 4 [0065.945] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.mdf") returned 0 [0065.945] lstrlenA (lpString="*.mdf") returned 5 [0065.945] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.dbf") returned 0 [0065.945] lstrlenA (lpString="*.dbf") returned 5 [0065.945] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.odt") returned 0 [0065.945] lstrlenA (lpString="*.odt") returned 5 [0065.945] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.vob") returned 0 [0065.945] lstrlenA (lpString="*.vob") returned 5 [0065.945] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.ifo") returned 0 [0065.945] lstrlenA (lpString="*.ifo") returned 5 [0065.945] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.lnk") returned 0 [0065.945] lstrlenA (lpString="*.lnk") returned 5 [0065.945] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.torrent") returned 0 [0065.945] lstrlenA (lpString="*.torrent") returned 9 [0065.945] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.mov") returned 0 [0065.946] lstrlenA (lpString="*.mov") returned 5 [0065.946] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.m2v") returned 0 [0065.946] lstrlenA (lpString="*.m2v") returned 5 [0065.946] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.3gp") returned 0 [0065.946] lstrlenA (lpString="*.3gp") returned 5 [0065.946] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.mpeg") returned 0 [0065.946] lstrlenA (lpString="*.mpeg") returned 6 [0065.946] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.mpg") returned 0 [0065.946] lstrlenA (lpString="*.mpg") returned 5 [0065.946] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.flv") returned 0 [0065.946] lstrlenA (lpString="*.flv") returned 5 [0065.946] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.avi") returned 0 [0065.946] lstrlenA (lpString="*.avi") returned 5 [0065.946] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.mp4") returned 0 [0065.946] lstrlenA (lpString="*.mp4") returned 5 [0065.946] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.wmv") returned 0 [0065.946] lstrlenA (lpString="*.wmv") returned 5 [0065.946] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.divx") returned 0 [0065.946] lstrlenA (lpString="*.divx") returned 6 [0065.946] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.mkv") returned 0 [0065.946] lstrlenA (lpString="*.mkv") returned 5 [0065.946] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.mp3") returned 0 [0065.946] lstrlenA (lpString="*.mp3") returned 5 [0065.946] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.wav") returned 0 [0065.946] lstrlenA (lpString="*.wav") returned 5 [0065.946] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.flac") returned 0 [0065.946] lstrlenA (lpString="*.flac") returned 6 [0065.946] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.ape") returned 0 [0065.946] lstrlenA (lpString="*.ape") returned 5 [0065.946] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.wma") returned 0 [0065.946] lstrlenA (lpString="*.wma") returned 5 [0065.946] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\bootmgr.exe.mui", pszSpec="*.ac3") returned 0 [0065.946] lstrlenA (lpString="*.ac3") returned 5 [0065.946] FindNextFileA (in: hFindFile=0x5b6c68, lpFindFileData=0xaf4e8 | out: lpFindFileData=0xaf4e8) returned 1 [0065.946] PeekMessageA (in: lpMsg=0xaf4c4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf4c4) returned 0 [0065.947] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="memtest.exe.mui") returned -1 [0065.947] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="memtest.exe.mui") returned -1 [0065.947] lstrcmpiA (lpString1="", lpString2="memtest.exe.mui") returned -1 [0065.947] PathFindFileNameA (pszPath="C:\\Boot\\en-US\\bootmgr.exe.mui") returned="bootmgr.exe.mui" [0065.947] lstrcatA (in: lpString1="C:\\Boot\\en-US\\", lpString2="memtest.exe.mui" | out: lpString1="C:\\Boot\\en-US\\memtest.exe.mui") returned="C:\\Boot\\en-US\\memtest.exe.mui" [0065.947] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.zip") returned 0 [0065.947] lstrlenA (lpString="*.zip") returned 5 [0065.947] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.rar") returned 0 [0065.947] lstrlenA (lpString="*.rar") returned 5 [0065.947] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.7z") returned 0 [0065.947] lstrlenA (lpString="*.7z") returned 4 [0065.947] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.tar") returned 0 [0065.947] lstrlenA (lpString="*.tar") returned 5 [0065.947] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.gzip") returned 0 [0065.947] lstrlenA (lpString="*.gzip") returned 6 [0065.947] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.jpg") returned 0 [0065.947] lstrlenA (lpString="*.jpg") returned 5 [0065.947] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.jpeg") returned 0 [0065.947] lstrlenA (lpString="*.jpeg") returned 6 [0065.947] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.psd") returned 0 [0065.947] lstrlenA (lpString="*.psd") returned 5 [0065.947] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.cdr") returned 0 [0065.947] lstrlenA (lpString="*.cdr") returned 5 [0065.947] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.dwg") returned 0 [0065.947] lstrlenA (lpString="*.dwg") returned 5 [0065.947] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.max") returned 0 [0065.947] lstrlenA (lpString="*.max") returned 5 [0065.947] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.bmp") returned 0 [0065.947] lstrlenA (lpString="*.bmp") returned 5 [0065.947] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.gif") returned 0 [0065.947] lstrlenA (lpString="*.gif") returned 5 [0065.947] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.png") returned 0 [0065.947] lstrlenA (lpString="*.png") returned 5 [0065.948] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.doc") returned 0 [0065.948] lstrlenA (lpString="*.doc") returned 5 [0065.948] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.docx") returned 0 [0065.948] lstrlenA (lpString="*.docx") returned 6 [0065.948] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.xls") returned 0 [0065.948] lstrlenA (lpString="*.xls") returned 5 [0065.948] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.xlsx") returned 0 [0065.948] lstrlenA (lpString="*.xlsx") returned 6 [0065.948] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.ppt") returned 0 [0065.948] lstrlenA (lpString="*.ppt") returned 5 [0065.948] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.pptx") returned 0 [0065.948] lstrlenA (lpString="*.pptx") returned 6 [0065.948] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.txt") returned 0 [0065.948] lstrlenA (lpString="*.txt") returned 5 [0065.948] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.pdf") returned 0 [0065.948] lstrlenA (lpString="*.pdf") returned 5 [0065.948] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.djvu") returned 0 [0065.948] lstrlenA (lpString="*.djvu") returned 6 [0065.948] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.htm") returned 0 [0065.948] lstrlenA (lpString="*.htm") returned 5 [0065.948] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.html") returned 0 [0065.948] lstrlenA (lpString="*.html") returned 6 [0065.948] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.mdb") returned 0 [0065.948] lstrlenA (lpString="*.mdb") returned 5 [0065.948] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.cer") returned 0 [0065.948] lstrlenA (lpString="*.cer") returned 5 [0065.948] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.p12") returned 0 [0065.948] lstrlenA (lpString="*.p12") returned 5 [0065.948] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.pfx") returned 0 [0065.948] lstrlenA (lpString="*.pfx") returned 5 [0065.948] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.kwm") returned 0 [0065.948] lstrlenA (lpString="*.kwm") returned 5 [0065.948] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.pwm") returned 0 [0065.948] lstrlenA (lpString="*.pwm") returned 5 [0065.948] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.1cd") returned 0 [0065.949] lstrlenA (lpString="*.1cd") returned 5 [0065.949] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.md") returned 0 [0065.949] lstrlenA (lpString="*.md") returned 4 [0065.949] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.mdf") returned 0 [0065.949] lstrlenA (lpString="*.mdf") returned 5 [0065.949] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.dbf") returned 0 [0065.949] lstrlenA (lpString="*.dbf") returned 5 [0065.949] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.odt") returned 0 [0065.949] lstrlenA (lpString="*.odt") returned 5 [0065.949] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.vob") returned 0 [0065.949] lstrlenA (lpString="*.vob") returned 5 [0065.949] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.ifo") returned 0 [0065.949] lstrlenA (lpString="*.ifo") returned 5 [0065.949] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.lnk") returned 0 [0065.949] lstrlenA (lpString="*.lnk") returned 5 [0065.949] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.torrent") returned 0 [0065.949] lstrlenA (lpString="*.torrent") returned 9 [0065.949] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.mov") returned 0 [0065.949] lstrlenA (lpString="*.mov") returned 5 [0065.949] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.m2v") returned 0 [0065.949] lstrlenA (lpString="*.m2v") returned 5 [0065.949] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.3gp") returned 0 [0065.949] lstrlenA (lpString="*.3gp") returned 5 [0065.949] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.mpeg") returned 0 [0065.949] lstrlenA (lpString="*.mpeg") returned 6 [0065.949] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.mpg") returned 0 [0065.949] lstrlenA (lpString="*.mpg") returned 5 [0065.949] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.flv") returned 0 [0065.949] lstrlenA (lpString="*.flv") returned 5 [0065.949] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.avi") returned 0 [0065.949] lstrlenA (lpString="*.avi") returned 5 [0065.949] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.mp4") returned 0 [0065.949] lstrlenA (lpString="*.mp4") returned 5 [0065.949] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.wmv") returned 0 [0065.949] lstrlenA (lpString="*.wmv") returned 5 [0065.950] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.divx") returned 0 [0065.950] lstrlenA (lpString="*.divx") returned 6 [0065.950] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.mkv") returned 0 [0065.950] lstrlenA (lpString="*.mkv") returned 5 [0065.950] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.mp3") returned 0 [0065.950] lstrlenA (lpString="*.mp3") returned 5 [0065.950] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.wav") returned 0 [0065.950] lstrlenA (lpString="*.wav") returned 5 [0065.950] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.flac") returned 0 [0065.950] lstrlenA (lpString="*.flac") returned 6 [0065.950] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.ape") returned 0 [0065.950] lstrlenA (lpString="*.ape") returned 5 [0065.950] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.wma") returned 0 [0065.950] lstrlenA (lpString="*.wma") returned 5 [0065.950] PathMatchSpecA (pszFile="C:\\Boot\\en-US\\memtest.exe.mui", pszSpec="*.ac3") returned 0 [0065.950] lstrlenA (lpString="*.ac3") returned 5 [0065.950] FindNextFileA (in: hFindFile=0x5b6c68, lpFindFileData=0xaf4e8 | out: lpFindFileData=0xaf4e8) returned 0 [0065.950] FindClose (in: hFindFile=0x5b6c68 | out: hFindFile=0x5b6c68) returned 1 [0065.950] FindNextFileA (in: hFindFile=0x5b5bf0, lpFindFileData=0xaf638 | out: lpFindFileData=0xaf638) returned 1 [0065.950] lstrcmpA (lpString1=".", lpString2="es-ES") returned -1 [0065.950] lstrcmpA (lpString1="..", lpString2="es-ES") returned -1 [0065.950] PathFindFileNameA (pszPath="C:\\Boot\\*.*") returned="*.*" [0065.950] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="es-ES" | out: lpString1="C:\\Boot\\es-ES") returned="C:\\Boot\\es-ES" [0065.950] lstrlenA (lpString="C:\\Boot\\es-ES") returned 13 [0065.950] FindFirstFileA (in: lpFileName="C:\\Boot\\es-ES\\*.*", lpFindFileData=0xaf4e8 | out: lpFindFileData=0xaf4e8) returned 0x5b6c68 [0066.020] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0066.020] FindNextFileA (in: hFindFile=0x5b6c68, lpFindFileData=0xaf4e8 | out: lpFindFileData=0xaf4e8) returned 1 [0066.021] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0066.021] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0066.021] FindNextFileA (in: hFindFile=0x5b6c68, lpFindFileData=0xaf4e8 | out: lpFindFileData=0xaf4e8) returned 1 [0066.021] PeekMessageA (in: lpMsg=0xaf4c4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf4c4) returned 0 [0066.021] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="bootmgr.exe.mui") returned 1 [0066.021] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bootmgr.exe.mui") returned 1 [0066.021] lstrcmpiA (lpString1="", lpString2="bootmgr.exe.mui") returned -1 [0066.021] PathFindFileNameA (pszPath="C:\\Boot\\es-ES\\*.*") returned="*.*" [0066.021] lstrcatA (in: lpString1="C:\\Boot\\es-ES\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\es-ES\\bootmgr.exe.mui") returned="C:\\Boot\\es-ES\\bootmgr.exe.mui" [0066.021] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.zip") returned 0 [0066.021] lstrlenA (lpString="*.zip") returned 5 [0066.021] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.rar") returned 0 [0066.021] lstrlenA (lpString="*.rar") returned 5 [0066.021] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.7z") returned 0 [0066.021] lstrlenA (lpString="*.7z") returned 4 [0066.021] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.tar") returned 0 [0066.021] lstrlenA (lpString="*.tar") returned 5 [0066.021] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.gzip") returned 0 [0066.021] lstrlenA (lpString="*.gzip") returned 6 [0066.021] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.jpg") returned 0 [0066.021] lstrlenA (lpString="*.jpg") returned 5 [0066.021] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.jpeg") returned 0 [0066.021] lstrlenA (lpString="*.jpeg") returned 6 [0066.021] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.psd") returned 0 [0066.021] lstrlenA (lpString="*.psd") returned 5 [0066.021] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.cdr") returned 0 [0066.021] lstrlenA (lpString="*.cdr") returned 5 [0066.021] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.dwg") returned 0 [0066.021] lstrlenA (lpString="*.dwg") returned 5 [0066.021] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.max") returned 0 [0066.021] lstrlenA (lpString="*.max") returned 5 [0066.021] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.bmp") returned 0 [0066.021] lstrlenA (lpString="*.bmp") returned 5 [0066.021] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.gif") returned 0 [0066.021] lstrlenA (lpString="*.gif") returned 5 [0066.021] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.png") returned 0 [0066.021] lstrlenA (lpString="*.png") returned 5 [0066.021] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.doc") returned 0 [0066.021] lstrlenA (lpString="*.doc") returned 5 [0066.021] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.docx") returned 0 [0066.022] lstrlenA (lpString="*.docx") returned 6 [0066.022] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.xls") returned 0 [0066.022] lstrlenA (lpString="*.xls") returned 5 [0066.022] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.xlsx") returned 0 [0066.022] lstrlenA (lpString="*.xlsx") returned 6 [0066.022] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.ppt") returned 0 [0066.022] lstrlenA (lpString="*.ppt") returned 5 [0066.022] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.pptx") returned 0 [0066.022] lstrlenA (lpString="*.pptx") returned 6 [0066.022] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.txt") returned 0 [0066.022] lstrlenA (lpString="*.txt") returned 5 [0066.022] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.pdf") returned 0 [0066.022] lstrlenA (lpString="*.pdf") returned 5 [0066.022] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.djvu") returned 0 [0066.022] lstrlenA (lpString="*.djvu") returned 6 [0066.022] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.htm") returned 0 [0066.022] lstrlenA (lpString="*.htm") returned 5 [0066.022] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.html") returned 0 [0066.022] lstrlenA (lpString="*.html") returned 6 [0066.022] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.mdb") returned 0 [0066.022] lstrlenA (lpString="*.mdb") returned 5 [0066.022] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.cer") returned 0 [0066.022] lstrlenA (lpString="*.cer") returned 5 [0066.022] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.p12") returned 0 [0066.022] lstrlenA (lpString="*.p12") returned 5 [0066.022] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.pfx") returned 0 [0066.022] lstrlenA (lpString="*.pfx") returned 5 [0066.022] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.kwm") returned 0 [0066.022] lstrlenA (lpString="*.kwm") returned 5 [0066.022] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.pwm") returned 0 [0066.022] lstrlenA (lpString="*.pwm") returned 5 [0066.022] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.1cd") returned 0 [0066.022] lstrlenA (lpString="*.1cd") returned 5 [0066.022] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.md") returned 0 [0066.022] lstrlenA (lpString="*.md") returned 4 [0066.022] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.mdf") returned 0 [0066.022] lstrlenA (lpString="*.mdf") returned 5 [0066.023] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.dbf") returned 0 [0066.023] lstrlenA (lpString="*.dbf") returned 5 [0066.023] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.odt") returned 0 [0066.023] lstrlenA (lpString="*.odt") returned 5 [0066.023] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.vob") returned 0 [0066.023] lstrlenA (lpString="*.vob") returned 5 [0066.023] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.ifo") returned 0 [0066.023] lstrlenA (lpString="*.ifo") returned 5 [0066.023] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.lnk") returned 0 [0066.023] lstrlenA (lpString="*.lnk") returned 5 [0066.023] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.torrent") returned 0 [0066.023] lstrlenA (lpString="*.torrent") returned 9 [0066.023] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.mov") returned 0 [0066.023] lstrlenA (lpString="*.mov") returned 5 [0066.023] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.m2v") returned 0 [0066.023] lstrlenA (lpString="*.m2v") returned 5 [0066.023] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.3gp") returned 0 [0066.023] lstrlenA (lpString="*.3gp") returned 5 [0066.023] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.mpeg") returned 0 [0066.023] lstrlenA (lpString="*.mpeg") returned 6 [0066.023] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.mpg") returned 0 [0066.023] lstrlenA (lpString="*.mpg") returned 5 [0066.023] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.flv") returned 0 [0066.023] lstrlenA (lpString="*.flv") returned 5 [0066.023] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.avi") returned 0 [0066.023] lstrlenA (lpString="*.avi") returned 5 [0066.023] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.mp4") returned 0 [0066.023] lstrlenA (lpString="*.mp4") returned 5 [0066.023] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.wmv") returned 0 [0066.023] lstrlenA (lpString="*.wmv") returned 5 [0066.023] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.divx") returned 0 [0066.023] lstrlenA (lpString="*.divx") returned 6 [0066.023] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.mkv") returned 0 [0066.023] lstrlenA (lpString="*.mkv") returned 5 [0066.023] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.mp3") returned 0 [0066.023] lstrlenA (lpString="*.mp3") returned 5 [0066.023] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.wav") returned 0 [0066.023] lstrlenA (lpString="*.wav") returned 5 [0066.023] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.flac") returned 0 [0066.023] lstrlenA (lpString="*.flac") returned 6 [0066.024] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.ape") returned 0 [0066.024] lstrlenA (lpString="*.ape") returned 5 [0066.024] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.wma") returned 0 [0066.024] lstrlenA (lpString="*.wma") returned 5 [0066.024] PathMatchSpecA (pszFile="C:\\Boot\\es-ES\\bootmgr.exe.mui", pszSpec="*.ac3") returned 0 [0066.024] lstrlenA (lpString="*.ac3") returned 5 [0066.024] FindNextFileA (in: hFindFile=0x5b6c68, lpFindFileData=0xaf4e8 | out: lpFindFileData=0xaf4e8) returned 0 [0066.024] FindClose (in: hFindFile=0x5b6c68 | out: hFindFile=0x5b6c68) returned 1 [0066.024] FindNextFileA (in: hFindFile=0x5b5bf0, lpFindFileData=0xaf638 | out: lpFindFileData=0xaf638) returned 1 [0066.024] lstrcmpA (lpString1=".", lpString2="fi-FI") returned -1 [0066.024] lstrcmpA (lpString1="..", lpString2="fi-FI") returned -1 [0066.024] PathFindFileNameA (pszPath="C:\\Boot\\*.*") returned="*.*" [0066.024] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="fi-FI" | out: lpString1="C:\\Boot\\fi-FI") returned="C:\\Boot\\fi-FI" [0066.024] lstrlenA (lpString="C:\\Boot\\fi-FI") returned 13 [0066.024] FindFirstFileA (in: lpFileName="C:\\Boot\\fi-FI\\*.*", lpFindFileData=0xaf4e8 | out: lpFindFileData=0xaf4e8) returned 0x5b6c68 [0066.024] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0066.024] FindNextFileA (in: hFindFile=0x5b6c68, lpFindFileData=0xaf4e8 | out: lpFindFileData=0xaf4e8) returned 1 [0066.024] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0066.024] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0066.024] FindNextFileA (in: hFindFile=0x5b6c68, lpFindFileData=0xaf4e8 | out: lpFindFileData=0xaf4e8) returned 1 [0066.024] PeekMessageA (in: lpMsg=0xaf4c4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf4c4) returned 0 [0066.024] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="bootmgr.exe.mui") returned 1 [0066.024] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bootmgr.exe.mui") returned 1 [0066.024] lstrcmpiA (lpString1="", lpString2="bootmgr.exe.mui") returned -1 [0066.024] PathFindFileNameA (pszPath="C:\\Boot\\fi-FI\\*.*") returned="*.*" [0066.024] lstrcatA (in: lpString1="C:\\Boot\\fi-FI\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\fi-FI\\bootmgr.exe.mui") returned="C:\\Boot\\fi-FI\\bootmgr.exe.mui" [0066.025] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.zip") returned 0 [0066.025] lstrlenA (lpString="*.zip") returned 5 [0066.025] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.rar") returned 0 [0066.025] lstrlenA (lpString="*.rar") returned 5 [0066.025] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.7z") returned 0 [0066.025] lstrlenA (lpString="*.7z") returned 4 [0066.025] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.tar") returned 0 [0066.025] lstrlenA (lpString="*.tar") returned 5 [0066.025] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.gzip") returned 0 [0066.025] lstrlenA (lpString="*.gzip") returned 6 [0066.025] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.jpg") returned 0 [0066.025] lstrlenA (lpString="*.jpg") returned 5 [0066.025] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.jpeg") returned 0 [0066.025] lstrlenA (lpString="*.jpeg") returned 6 [0066.025] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.psd") returned 0 [0066.025] lstrlenA (lpString="*.psd") returned 5 [0066.025] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.cdr") returned 0 [0066.025] lstrlenA (lpString="*.cdr") returned 5 [0066.025] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.dwg") returned 0 [0066.025] lstrlenA (lpString="*.dwg") returned 5 [0066.025] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.max") returned 0 [0066.025] lstrlenA (lpString="*.max") returned 5 [0066.025] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.bmp") returned 0 [0066.025] lstrlenA (lpString="*.bmp") returned 5 [0066.025] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.gif") returned 0 [0066.025] lstrlenA (lpString="*.gif") returned 5 [0066.025] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.png") returned 0 [0066.025] lstrlenA (lpString="*.png") returned 5 [0066.025] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.doc") returned 0 [0066.025] lstrlenA (lpString="*.doc") returned 5 [0066.025] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.docx") returned 0 [0066.025] lstrlenA (lpString="*.docx") returned 6 [0066.025] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.xls") returned 0 [0066.025] lstrlenA (lpString="*.xls") returned 5 [0066.025] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.xlsx") returned 0 [0066.025] lstrlenA (lpString="*.xlsx") returned 6 [0066.025] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.ppt") returned 0 [0066.025] lstrlenA (lpString="*.ppt") returned 5 [0066.025] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.pptx") returned 0 [0066.025] lstrlenA (lpString="*.pptx") returned 6 [0066.025] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.txt") returned 0 [0066.025] lstrlenA (lpString="*.txt") returned 5 [0066.025] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.pdf") returned 0 [0066.025] lstrlenA (lpString="*.pdf") returned 5 [0066.025] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.djvu") returned 0 [0066.026] lstrlenA (lpString="*.djvu") returned 6 [0066.026] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.htm") returned 0 [0066.026] lstrlenA (lpString="*.htm") returned 5 [0066.026] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.html") returned 0 [0066.026] lstrlenA (lpString="*.html") returned 6 [0066.026] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.mdb") returned 0 [0066.026] lstrlenA (lpString="*.mdb") returned 5 [0066.026] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.cer") returned 0 [0066.026] lstrlenA (lpString="*.cer") returned 5 [0066.026] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.p12") returned 0 [0066.026] lstrlenA (lpString="*.p12") returned 5 [0066.026] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.pfx") returned 0 [0066.026] lstrlenA (lpString="*.pfx") returned 5 [0066.026] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.kwm") returned 0 [0066.026] lstrlenA (lpString="*.kwm") returned 5 [0066.026] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.pwm") returned 0 [0066.026] lstrlenA (lpString="*.pwm") returned 5 [0066.026] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.1cd") returned 0 [0066.026] lstrlenA (lpString="*.1cd") returned 5 [0066.026] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.md") returned 0 [0066.026] lstrlenA (lpString="*.md") returned 4 [0066.026] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.mdf") returned 0 [0066.026] lstrlenA (lpString="*.mdf") returned 5 [0066.026] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.dbf") returned 0 [0066.026] lstrlenA (lpString="*.dbf") returned 5 [0066.026] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.odt") returned 0 [0066.026] lstrlenA (lpString="*.odt") returned 5 [0066.026] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.vob") returned 0 [0066.026] lstrlenA (lpString="*.vob") returned 5 [0066.026] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.ifo") returned 0 [0066.026] lstrlenA (lpString="*.ifo") returned 5 [0066.026] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.lnk") returned 0 [0066.026] lstrlenA (lpString="*.lnk") returned 5 [0066.026] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.torrent") returned 0 [0066.026] lstrlenA (lpString="*.torrent") returned 9 [0066.026] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.mov") returned 0 [0066.026] lstrlenA (lpString="*.mov") returned 5 [0066.026] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.m2v") returned 0 [0066.026] lstrlenA (lpString="*.m2v") returned 5 [0066.026] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.3gp") returned 0 [0066.026] lstrlenA (lpString="*.3gp") returned 5 [0066.026] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.mpeg") returned 0 [0066.026] lstrlenA (lpString="*.mpeg") returned 6 [0066.027] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.mpg") returned 0 [0066.027] lstrlenA (lpString="*.mpg") returned 5 [0066.027] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.flv") returned 0 [0066.027] lstrlenA (lpString="*.flv") returned 5 [0066.027] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.avi") returned 0 [0066.027] lstrlenA (lpString="*.avi") returned 5 [0066.027] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.mp4") returned 0 [0066.027] lstrlenA (lpString="*.mp4") returned 5 [0066.027] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.wmv") returned 0 [0066.027] lstrlenA (lpString="*.wmv") returned 5 [0066.027] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.divx") returned 0 [0066.027] lstrlenA (lpString="*.divx") returned 6 [0066.027] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.mkv") returned 0 [0066.027] lstrlenA (lpString="*.mkv") returned 5 [0066.027] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.mp3") returned 0 [0066.027] lstrlenA (lpString="*.mp3") returned 5 [0066.027] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.wav") returned 0 [0066.027] lstrlenA (lpString="*.wav") returned 5 [0066.027] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.flac") returned 0 [0066.027] lstrlenA (lpString="*.flac") returned 6 [0066.027] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.ape") returned 0 [0066.027] lstrlenA (lpString="*.ape") returned 5 [0066.027] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.wma") returned 0 [0066.027] lstrlenA (lpString="*.wma") returned 5 [0066.027] PathMatchSpecA (pszFile="C:\\Boot\\fi-FI\\bootmgr.exe.mui", pszSpec="*.ac3") returned 0 [0066.027] lstrlenA (lpString="*.ac3") returned 5 [0066.027] FindNextFileA (in: hFindFile=0x5b6c68, lpFindFileData=0xaf4e8 | out: lpFindFileData=0xaf4e8) returned 0 [0066.027] FindClose (in: hFindFile=0x5b6c68 | out: hFindFile=0x5b6c68) returned 1 [0066.027] FindNextFileA (in: hFindFile=0x5b5bf0, lpFindFileData=0xaf638 | out: lpFindFileData=0xaf638) returned 1 [0066.027] lstrcmpA (lpString1=".", lpString2="Fonts") returned -1 [0066.027] lstrcmpA (lpString1="..", lpString2="Fonts") returned -1 [0066.027] PathFindFileNameA (pszPath="C:\\Boot\\*.*") returned="*.*" [0066.027] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="Fonts" | out: lpString1="C:\\Boot\\Fonts") returned="C:\\Boot\\Fonts" [0066.027] lstrlenA (lpString="C:\\Boot\\Fonts") returned 13 [0066.027] FindFirstFileA (in: lpFileName="C:\\Boot\\Fonts\\*.*", lpFindFileData=0xaf4e8 | out: lpFindFileData=0xaf4e8) returned 0x5b6c68 [0066.066] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0066.066] FindNextFileA (in: hFindFile=0x5b6c68, lpFindFileData=0xaf4e8 | out: lpFindFileData=0xaf4e8) returned 1 [0066.066] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0066.066] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0066.066] FindNextFileA (in: hFindFile=0x5b6c68, lpFindFileData=0xaf4e8 | out: lpFindFileData=0xaf4e8) returned 1 [0066.066] PeekMessageA (in: lpMsg=0xaf4c4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf4c4) returned 0 [0066.066] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="chs_boot.ttf") returned 1 [0066.066] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="chs_boot.ttf") returned 1 [0066.066] lstrcmpiA (lpString1="", lpString2="chs_boot.ttf") returned -1 [0066.066] PathFindFileNameA (pszPath="C:\\Boot\\Fonts\\*.*") returned="*.*" [0066.066] lstrcatA (in: lpString1="C:\\Boot\\Fonts\\", lpString2="chs_boot.ttf" | out: lpString1="C:\\Boot\\Fonts\\chs_boot.ttf") returned="C:\\Boot\\Fonts\\chs_boot.ttf" [0066.066] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.zip") returned 0 [0066.066] lstrlenA (lpString="*.zip") returned 5 [0066.066] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.rar") returned 0 [0066.066] lstrlenA (lpString="*.rar") returned 5 [0066.066] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.7z") returned 0 [0066.066] lstrlenA (lpString="*.7z") returned 4 [0066.066] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.tar") returned 0 [0066.066] lstrlenA (lpString="*.tar") returned 5 [0066.066] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.gzip") returned 0 [0066.066] lstrlenA (lpString="*.gzip") returned 6 [0066.066] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.jpg") returned 0 [0066.066] lstrlenA (lpString="*.jpg") returned 5 [0066.066] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.jpeg") returned 0 [0066.066] lstrlenA (lpString="*.jpeg") returned 6 [0066.066] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.psd") returned 0 [0066.066] lstrlenA (lpString="*.psd") returned 5 [0066.066] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.cdr") returned 0 [0066.066] lstrlenA (lpString="*.cdr") returned 5 [0066.066] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.dwg") returned 0 [0066.066] lstrlenA (lpString="*.dwg") returned 5 [0066.066] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.max") returned 0 [0066.066] lstrlenA (lpString="*.max") returned 5 [0066.067] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.bmp") returned 0 [0066.067] lstrlenA (lpString="*.bmp") returned 5 [0066.067] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.gif") returned 0 [0066.067] lstrlenA (lpString="*.gif") returned 5 [0066.067] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.png") returned 0 [0066.067] lstrlenA (lpString="*.png") returned 5 [0066.067] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.doc") returned 0 [0066.067] lstrlenA (lpString="*.doc") returned 5 [0066.067] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.docx") returned 0 [0066.067] lstrlenA (lpString="*.docx") returned 6 [0066.067] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.xls") returned 0 [0066.067] lstrlenA (lpString="*.xls") returned 5 [0066.067] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.xlsx") returned 0 [0066.067] lstrlenA (lpString="*.xlsx") returned 6 [0066.067] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.ppt") returned 0 [0066.067] lstrlenA (lpString="*.ppt") returned 5 [0066.067] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.pptx") returned 0 [0066.067] lstrlenA (lpString="*.pptx") returned 6 [0066.067] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.txt") returned 0 [0066.067] lstrlenA (lpString="*.txt") returned 5 [0066.067] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.pdf") returned 0 [0066.067] lstrlenA (lpString="*.pdf") returned 5 [0066.067] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.djvu") returned 0 [0066.067] lstrlenA (lpString="*.djvu") returned 6 [0066.067] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.htm") returned 0 [0066.067] lstrlenA (lpString="*.htm") returned 5 [0066.067] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.html") returned 0 [0066.067] lstrlenA (lpString="*.html") returned 6 [0066.067] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.mdb") returned 0 [0066.067] lstrlenA (lpString="*.mdb") returned 5 [0066.067] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.cer") returned 0 [0066.067] lstrlenA (lpString="*.cer") returned 5 [0066.067] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.p12") returned 0 [0066.067] lstrlenA (lpString="*.p12") returned 5 [0066.067] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.pfx") returned 0 [0066.067] lstrlenA (lpString="*.pfx") returned 5 [0066.067] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.kwm") returned 0 [0066.067] lstrlenA (lpString="*.kwm") returned 5 [0066.068] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.pwm") returned 0 [0066.068] lstrlenA (lpString="*.pwm") returned 5 [0066.068] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.1cd") returned 0 [0066.068] lstrlenA (lpString="*.1cd") returned 5 [0066.068] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.md") returned 0 [0066.068] lstrlenA (lpString="*.md") returned 4 [0066.068] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.mdf") returned 0 [0066.068] lstrlenA (lpString="*.mdf") returned 5 [0066.068] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.dbf") returned 0 [0066.068] lstrlenA (lpString="*.dbf") returned 5 [0066.068] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.odt") returned 0 [0066.068] lstrlenA (lpString="*.odt") returned 5 [0066.068] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.vob") returned 0 [0066.068] lstrlenA (lpString="*.vob") returned 5 [0066.068] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.ifo") returned 0 [0066.068] lstrlenA (lpString="*.ifo") returned 5 [0066.068] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.lnk") returned 0 [0066.068] lstrlenA (lpString="*.lnk") returned 5 [0066.068] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.torrent") returned 0 [0066.068] lstrlenA (lpString="*.torrent") returned 9 [0066.068] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.mov") returned 0 [0066.068] lstrlenA (lpString="*.mov") returned 5 [0066.068] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.m2v") returned 0 [0066.068] lstrlenA (lpString="*.m2v") returned 5 [0066.068] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.3gp") returned 0 [0066.068] lstrlenA (lpString="*.3gp") returned 5 [0066.068] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.mpeg") returned 0 [0066.068] lstrlenA (lpString="*.mpeg") returned 6 [0066.068] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.mpg") returned 0 [0066.068] lstrlenA (lpString="*.mpg") returned 5 [0066.068] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.flv") returned 0 [0066.068] lstrlenA (lpString="*.flv") returned 5 [0066.068] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.avi") returned 0 [0066.068] lstrlenA (lpString="*.avi") returned 5 [0066.068] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.mp4") returned 0 [0066.068] lstrlenA (lpString="*.mp4") returned 5 [0066.068] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.wmv") returned 0 [0066.068] lstrlenA (lpString="*.wmv") returned 5 [0066.068] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.divx") returned 0 [0066.068] lstrlenA (lpString="*.divx") returned 6 [0066.068] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.mkv") returned 0 [0066.068] lstrlenA (lpString="*.mkv") returned 5 [0066.068] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.mp3") returned 0 [0066.068] lstrlenA (lpString="*.mp3") returned 5 [0066.068] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.wav") returned 0 [0066.069] lstrlenA (lpString="*.wav") returned 5 [0066.069] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.flac") returned 0 [0066.069] lstrlenA (lpString="*.flac") returned 6 [0066.069] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.ape") returned 0 [0066.069] lstrlenA (lpString="*.ape") returned 5 [0066.069] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.wma") returned 0 [0066.069] lstrlenA (lpString="*.wma") returned 5 [0066.069] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\chs_boot.ttf", pszSpec="*.ac3") returned 0 [0066.069] lstrlenA (lpString="*.ac3") returned 5 [0066.069] FindNextFileA (in: hFindFile=0x5b6c68, lpFindFileData=0xaf4e8 | out: lpFindFileData=0xaf4e8) returned 1 [0066.069] PeekMessageA (in: lpMsg=0xaf4c4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf4c4) returned 0 [0066.069] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="cht_boot.ttf") returned 1 [0066.069] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="cht_boot.ttf") returned 1 [0066.069] lstrcmpiA (lpString1="", lpString2="cht_boot.ttf") returned -1 [0066.069] PathFindFileNameA (pszPath="C:\\Boot\\Fonts\\chs_boot.ttf") returned="chs_boot.ttf" [0066.069] lstrcatA (in: lpString1="C:\\Boot\\Fonts\\", lpString2="cht_boot.ttf" | out: lpString1="C:\\Boot\\Fonts\\cht_boot.ttf") returned="C:\\Boot\\Fonts\\cht_boot.ttf" [0066.069] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.zip") returned 0 [0066.069] lstrlenA (lpString="*.zip") returned 5 [0066.069] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.rar") returned 0 [0066.069] lstrlenA (lpString="*.rar") returned 5 [0066.069] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.7z") returned 0 [0066.069] lstrlenA (lpString="*.7z") returned 4 [0066.069] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.tar") returned 0 [0066.069] lstrlenA (lpString="*.tar") returned 5 [0066.069] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.gzip") returned 0 [0066.069] lstrlenA (lpString="*.gzip") returned 6 [0066.069] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.jpg") returned 0 [0066.069] lstrlenA (lpString="*.jpg") returned 5 [0066.069] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.jpeg") returned 0 [0066.069] lstrlenA (lpString="*.jpeg") returned 6 [0066.069] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.psd") returned 0 [0066.069] lstrlenA (lpString="*.psd") returned 5 [0066.069] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.cdr") returned 0 [0066.069] lstrlenA (lpString="*.cdr") returned 5 [0066.069] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.dwg") returned 0 [0066.069] lstrlenA (lpString="*.dwg") returned 5 [0066.069] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.max") returned 0 [0066.069] lstrlenA (lpString="*.max") returned 5 [0066.069] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.bmp") returned 0 [0066.069] lstrlenA (lpString="*.bmp") returned 5 [0066.069] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.gif") returned 0 [0066.069] lstrlenA (lpString="*.gif") returned 5 [0066.070] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.png") returned 0 [0066.070] lstrlenA (lpString="*.png") returned 5 [0066.070] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.doc") returned 0 [0066.070] lstrlenA (lpString="*.doc") returned 5 [0066.070] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.docx") returned 0 [0066.070] lstrlenA (lpString="*.docx") returned 6 [0066.070] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.xls") returned 0 [0066.070] lstrlenA (lpString="*.xls") returned 5 [0066.070] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.xlsx") returned 0 [0066.070] lstrlenA (lpString="*.xlsx") returned 6 [0066.070] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.ppt") returned 0 [0066.070] lstrlenA (lpString="*.ppt") returned 5 [0066.070] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.pptx") returned 0 [0066.070] lstrlenA (lpString="*.pptx") returned 6 [0066.070] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.txt") returned 0 [0066.070] lstrlenA (lpString="*.txt") returned 5 [0066.070] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.pdf") returned 0 [0066.070] lstrlenA (lpString="*.pdf") returned 5 [0066.070] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.djvu") returned 0 [0066.070] lstrlenA (lpString="*.djvu") returned 6 [0066.070] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.htm") returned 0 [0066.070] lstrlenA (lpString="*.htm") returned 5 [0066.070] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.html") returned 0 [0066.070] lstrlenA (lpString="*.html") returned 6 [0066.070] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.mdb") returned 0 [0066.070] lstrlenA (lpString="*.mdb") returned 5 [0066.070] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.cer") returned 0 [0066.070] lstrlenA (lpString="*.cer") returned 5 [0066.070] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.p12") returned 0 [0066.070] lstrlenA (lpString="*.p12") returned 5 [0066.070] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.pfx") returned 0 [0066.070] lstrlenA (lpString="*.pfx") returned 5 [0066.070] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.kwm") returned 0 [0066.070] lstrlenA (lpString="*.kwm") returned 5 [0066.070] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.pwm") returned 0 [0066.070] lstrlenA (lpString="*.pwm") returned 5 [0066.070] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.1cd") returned 0 [0066.071] lstrlenA (lpString="*.1cd") returned 5 [0066.071] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.md") returned 0 [0066.071] lstrlenA (lpString="*.md") returned 4 [0066.071] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.mdf") returned 0 [0066.071] lstrlenA (lpString="*.mdf") returned 5 [0066.071] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.dbf") returned 0 [0066.071] lstrlenA (lpString="*.dbf") returned 5 [0066.071] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.odt") returned 0 [0066.071] lstrlenA (lpString="*.odt") returned 5 [0066.071] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.vob") returned 0 [0066.071] lstrlenA (lpString="*.vob") returned 5 [0066.071] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.ifo") returned 0 [0066.071] lstrlenA (lpString="*.ifo") returned 5 [0066.071] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.lnk") returned 0 [0066.071] lstrlenA (lpString="*.lnk") returned 5 [0066.071] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.torrent") returned 0 [0066.071] lstrlenA (lpString="*.torrent") returned 9 [0066.071] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.mov") returned 0 [0066.071] lstrlenA (lpString="*.mov") returned 5 [0066.071] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.m2v") returned 0 [0066.071] lstrlenA (lpString="*.m2v") returned 5 [0066.071] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.3gp") returned 0 [0066.071] lstrlenA (lpString="*.3gp") returned 5 [0066.071] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.mpeg") returned 0 [0066.071] lstrlenA (lpString="*.mpeg") returned 6 [0066.071] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.mpg") returned 0 [0066.071] lstrlenA (lpString="*.mpg") returned 5 [0066.071] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.flv") returned 0 [0066.071] lstrlenA (lpString="*.flv") returned 5 [0066.071] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.avi") returned 0 [0066.071] lstrlenA (lpString="*.avi") returned 5 [0066.071] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.mp4") returned 0 [0066.071] lstrlenA (lpString="*.mp4") returned 5 [0066.071] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.wmv") returned 0 [0066.071] lstrlenA (lpString="*.wmv") returned 5 [0066.071] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.divx") returned 0 [0066.071] lstrlenA (lpString="*.divx") returned 6 [0066.071] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.mkv") returned 0 [0066.071] lstrlenA (lpString="*.mkv") returned 5 [0066.071] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.mp3") returned 0 [0066.071] lstrlenA (lpString="*.mp3") returned 5 [0066.071] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.wav") returned 0 [0066.071] lstrlenA (lpString="*.wav") returned 5 [0066.071] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.flac") returned 0 [0066.072] lstrlenA (lpString="*.flac") returned 6 [0066.072] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.ape") returned 0 [0066.072] lstrlenA (lpString="*.ape") returned 5 [0066.072] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.wma") returned 0 [0066.072] lstrlenA (lpString="*.wma") returned 5 [0066.072] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\cht_boot.ttf", pszSpec="*.ac3") returned 0 [0066.072] lstrlenA (lpString="*.ac3") returned 5 [0066.072] FindNextFileA (in: hFindFile=0x5b6c68, lpFindFileData=0xaf4e8 | out: lpFindFileData=0xaf4e8) returned 1 [0066.072] PeekMessageA (in: lpMsg=0xaf4c4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf4c4) returned 0 [0066.072] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="jpn_boot.ttf") returned -1 [0066.072] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="jpn_boot.ttf") returned -1 [0066.072] lstrcmpiA (lpString1="", lpString2="jpn_boot.ttf") returned -1 [0066.072] PathFindFileNameA (pszPath="C:\\Boot\\Fonts\\cht_boot.ttf") returned="cht_boot.ttf" [0066.072] lstrcatA (in: lpString1="C:\\Boot\\Fonts\\", lpString2="jpn_boot.ttf" | out: lpString1="C:\\Boot\\Fonts\\jpn_boot.ttf") returned="C:\\Boot\\Fonts\\jpn_boot.ttf" [0066.072] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.zip") returned 0 [0066.072] lstrlenA (lpString="*.zip") returned 5 [0066.072] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.rar") returned 0 [0066.072] lstrlenA (lpString="*.rar") returned 5 [0066.072] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.7z") returned 0 [0066.072] lstrlenA (lpString="*.7z") returned 4 [0066.072] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.tar") returned 0 [0066.072] lstrlenA (lpString="*.tar") returned 5 [0066.072] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.gzip") returned 0 [0066.072] lstrlenA (lpString="*.gzip") returned 6 [0066.072] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.jpg") returned 0 [0066.072] lstrlenA (lpString="*.jpg") returned 5 [0066.072] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.jpeg") returned 0 [0066.072] lstrlenA (lpString="*.jpeg") returned 6 [0066.072] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.psd") returned 0 [0066.072] lstrlenA (lpString="*.psd") returned 5 [0066.072] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.cdr") returned 0 [0066.072] lstrlenA (lpString="*.cdr") returned 5 [0066.072] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.dwg") returned 0 [0066.072] lstrlenA (lpString="*.dwg") returned 5 [0066.072] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.max") returned 0 [0066.072] lstrlenA (lpString="*.max") returned 5 [0066.072] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.bmp") returned 0 [0066.072] lstrlenA (lpString="*.bmp") returned 5 [0066.072] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.gif") returned 0 [0066.072] lstrlenA (lpString="*.gif") returned 5 [0066.073] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.png") returned 0 [0066.073] lstrlenA (lpString="*.png") returned 5 [0066.073] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.doc") returned 0 [0066.073] lstrlenA (lpString="*.doc") returned 5 [0066.073] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.docx") returned 0 [0066.073] lstrlenA (lpString="*.docx") returned 6 [0066.073] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.xls") returned 0 [0066.073] lstrlenA (lpString="*.xls") returned 5 [0066.073] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.xlsx") returned 0 [0066.073] lstrlenA (lpString="*.xlsx") returned 6 [0066.073] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.ppt") returned 0 [0066.073] lstrlenA (lpString="*.ppt") returned 5 [0066.073] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.pptx") returned 0 [0066.073] lstrlenA (lpString="*.pptx") returned 6 [0066.073] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.txt") returned 0 [0066.073] lstrlenA (lpString="*.txt") returned 5 [0066.073] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.pdf") returned 0 [0066.073] lstrlenA (lpString="*.pdf") returned 5 [0066.073] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.djvu") returned 0 [0066.073] lstrlenA (lpString="*.djvu") returned 6 [0066.073] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.htm") returned 0 [0066.073] lstrlenA (lpString="*.htm") returned 5 [0066.073] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.html") returned 0 [0066.073] lstrlenA (lpString="*.html") returned 6 [0066.073] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.mdb") returned 0 [0066.073] lstrlenA (lpString="*.mdb") returned 5 [0066.073] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.cer") returned 0 [0066.073] lstrlenA (lpString="*.cer") returned 5 [0066.073] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.p12") returned 0 [0066.073] lstrlenA (lpString="*.p12") returned 5 [0066.073] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.pfx") returned 0 [0066.073] lstrlenA (lpString="*.pfx") returned 5 [0066.073] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.kwm") returned 0 [0066.073] lstrlenA (lpString="*.kwm") returned 5 [0066.073] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.pwm") returned 0 [0066.073] lstrlenA (lpString="*.pwm") returned 5 [0066.073] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.1cd") returned 0 [0066.073] lstrlenA (lpString="*.1cd") returned 5 [0066.073] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.md") returned 0 [0066.073] lstrlenA (lpString="*.md") returned 4 [0066.073] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.mdf") returned 0 [0066.073] lstrlenA (lpString="*.mdf") returned 5 [0066.073] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.dbf") returned 0 [0066.073] lstrlenA (lpString="*.dbf") returned 5 [0066.074] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.odt") returned 0 [0066.074] lstrlenA (lpString="*.odt") returned 5 [0066.074] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.vob") returned 0 [0066.074] lstrlenA (lpString="*.vob") returned 5 [0066.074] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.ifo") returned 0 [0066.074] lstrlenA (lpString="*.ifo") returned 5 [0066.074] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.lnk") returned 0 [0066.074] lstrlenA (lpString="*.lnk") returned 5 [0066.074] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.torrent") returned 0 [0066.074] lstrlenA (lpString="*.torrent") returned 9 [0066.074] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.mov") returned 0 [0066.074] lstrlenA (lpString="*.mov") returned 5 [0066.074] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.m2v") returned 0 [0066.074] lstrlenA (lpString="*.m2v") returned 5 [0066.074] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.3gp") returned 0 [0066.074] lstrlenA (lpString="*.3gp") returned 5 [0066.074] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.mpeg") returned 0 [0066.074] lstrlenA (lpString="*.mpeg") returned 6 [0066.074] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.mpg") returned 0 [0066.074] lstrlenA (lpString="*.mpg") returned 5 [0066.074] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.flv") returned 0 [0066.074] lstrlenA (lpString="*.flv") returned 5 [0066.074] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.avi") returned 0 [0066.074] lstrlenA (lpString="*.avi") returned 5 [0066.074] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.mp4") returned 0 [0066.074] lstrlenA (lpString="*.mp4") returned 5 [0066.074] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.wmv") returned 0 [0066.074] lstrlenA (lpString="*.wmv") returned 5 [0066.074] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.divx") returned 0 [0066.074] lstrlenA (lpString="*.divx") returned 6 [0066.074] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.mkv") returned 0 [0066.074] lstrlenA (lpString="*.mkv") returned 5 [0066.074] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.mp3") returned 0 [0066.074] lstrlenA (lpString="*.mp3") returned 5 [0066.074] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.wav") returned 0 [0066.074] lstrlenA (lpString="*.wav") returned 5 [0066.074] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.flac") returned 0 [0066.074] lstrlenA (lpString="*.flac") returned 6 [0066.074] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.ape") returned 0 [0066.074] lstrlenA (lpString="*.ape") returned 5 [0066.074] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.wma") returned 0 [0066.074] lstrlenA (lpString="*.wma") returned 5 [0066.074] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\jpn_boot.ttf", pszSpec="*.ac3") returned 0 [0066.074] lstrlenA (lpString="*.ac3") returned 5 [0066.075] FindNextFileA (in: hFindFile=0x5b6c68, lpFindFileData=0xaf4e8 | out: lpFindFileData=0xaf4e8) returned 1 [0066.075] PeekMessageA (in: lpMsg=0xaf4c4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf4c4) returned 0 [0066.075] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="kor_boot.ttf") returned -1 [0066.075] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="kor_boot.ttf") returned -1 [0066.075] lstrcmpiA (lpString1="", lpString2="kor_boot.ttf") returned -1 [0066.075] PathFindFileNameA (pszPath="C:\\Boot\\Fonts\\jpn_boot.ttf") returned="jpn_boot.ttf" [0066.075] lstrcatA (in: lpString1="C:\\Boot\\Fonts\\", lpString2="kor_boot.ttf" | out: lpString1="C:\\Boot\\Fonts\\kor_boot.ttf") returned="C:\\Boot\\Fonts\\kor_boot.ttf" [0066.075] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.zip") returned 0 [0066.075] lstrlenA (lpString="*.zip") returned 5 [0066.075] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.rar") returned 0 [0066.075] lstrlenA (lpString="*.rar") returned 5 [0066.075] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.7z") returned 0 [0066.075] lstrlenA (lpString="*.7z") returned 4 [0066.075] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.tar") returned 0 [0066.075] lstrlenA (lpString="*.tar") returned 5 [0066.075] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.gzip") returned 0 [0066.075] lstrlenA (lpString="*.gzip") returned 6 [0066.075] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.jpg") returned 0 [0066.075] lstrlenA (lpString="*.jpg") returned 5 [0066.075] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.jpeg") returned 0 [0066.075] lstrlenA (lpString="*.jpeg") returned 6 [0066.075] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.psd") returned 0 [0066.075] lstrlenA (lpString="*.psd") returned 5 [0066.075] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.cdr") returned 0 [0066.075] lstrlenA (lpString="*.cdr") returned 5 [0066.075] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.dwg") returned 0 [0066.075] lstrlenA (lpString="*.dwg") returned 5 [0066.075] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.max") returned 0 [0066.075] lstrlenA (lpString="*.max") returned 5 [0066.075] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.bmp") returned 0 [0066.075] lstrlenA (lpString="*.bmp") returned 5 [0066.075] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.gif") returned 0 [0066.075] lstrlenA (lpString="*.gif") returned 5 [0066.075] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.png") returned 0 [0066.075] lstrlenA (lpString="*.png") returned 5 [0066.075] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.doc") returned 0 [0066.075] lstrlenA (lpString="*.doc") returned 5 [0066.075] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.docx") returned 0 [0066.075] lstrlenA (lpString="*.docx") returned 6 [0066.075] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.xls") returned 0 [0066.075] lstrlenA (lpString="*.xls") returned 5 [0066.075] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.xlsx") returned 0 [0066.075] lstrlenA (lpString="*.xlsx") returned 6 [0066.076] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.ppt") returned 0 [0066.076] lstrlenA (lpString="*.ppt") returned 5 [0066.076] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.pptx") returned 0 [0066.076] lstrlenA (lpString="*.pptx") returned 6 [0066.076] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.txt") returned 0 [0066.076] lstrlenA (lpString="*.txt") returned 5 [0066.076] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.pdf") returned 0 [0066.076] lstrlenA (lpString="*.pdf") returned 5 [0066.076] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.djvu") returned 0 [0066.076] lstrlenA (lpString="*.djvu") returned 6 [0066.076] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.htm") returned 0 [0066.076] lstrlenA (lpString="*.htm") returned 5 [0066.076] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.html") returned 0 [0066.076] lstrlenA (lpString="*.html") returned 6 [0066.076] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.mdb") returned 0 [0066.076] lstrlenA (lpString="*.mdb") returned 5 [0066.076] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.cer") returned 0 [0066.076] lstrlenA (lpString="*.cer") returned 5 [0066.076] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.p12") returned 0 [0066.076] lstrlenA (lpString="*.p12") returned 5 [0066.076] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.pfx") returned 0 [0066.076] lstrlenA (lpString="*.pfx") returned 5 [0066.076] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.kwm") returned 0 [0066.076] lstrlenA (lpString="*.kwm") returned 5 [0066.076] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.pwm") returned 0 [0066.076] lstrlenA (lpString="*.pwm") returned 5 [0066.076] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.1cd") returned 0 [0066.076] lstrlenA (lpString="*.1cd") returned 5 [0066.076] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.md") returned 0 [0066.076] lstrlenA (lpString="*.md") returned 4 [0066.076] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.mdf") returned 0 [0066.076] lstrlenA (lpString="*.mdf") returned 5 [0066.076] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.dbf") returned 0 [0066.076] lstrlenA (lpString="*.dbf") returned 5 [0066.076] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.odt") returned 0 [0066.076] lstrlenA (lpString="*.odt") returned 5 [0066.076] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.vob") returned 0 [0066.076] lstrlenA (lpString="*.vob") returned 5 [0066.076] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.ifo") returned 0 [0066.076] lstrlenA (lpString="*.ifo") returned 5 [0066.076] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.lnk") returned 0 [0066.076] lstrlenA (lpString="*.lnk") returned 5 [0066.077] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.torrent") returned 0 [0066.077] lstrlenA (lpString="*.torrent") returned 9 [0066.077] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.mov") returned 0 [0066.077] lstrlenA (lpString="*.mov") returned 5 [0066.077] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.m2v") returned 0 [0066.077] lstrlenA (lpString="*.m2v") returned 5 [0066.077] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.3gp") returned 0 [0066.077] lstrlenA (lpString="*.3gp") returned 5 [0066.077] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.mpeg") returned 0 [0066.077] lstrlenA (lpString="*.mpeg") returned 6 [0066.077] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.mpg") returned 0 [0066.077] lstrlenA (lpString="*.mpg") returned 5 [0066.077] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.flv") returned 0 [0066.077] lstrlenA (lpString="*.flv") returned 5 [0066.077] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.avi") returned 0 [0066.077] lstrlenA (lpString="*.avi") returned 5 [0066.077] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.mp4") returned 0 [0066.077] lstrlenA (lpString="*.mp4") returned 5 [0066.077] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.wmv") returned 0 [0066.077] lstrlenA (lpString="*.wmv") returned 5 [0066.077] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.divx") returned 0 [0066.077] lstrlenA (lpString="*.divx") returned 6 [0066.077] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.mkv") returned 0 [0066.077] lstrlenA (lpString="*.mkv") returned 5 [0066.077] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.mp3") returned 0 [0066.077] lstrlenA (lpString="*.mp3") returned 5 [0066.077] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.wav") returned 0 [0066.077] lstrlenA (lpString="*.wav") returned 5 [0066.077] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.flac") returned 0 [0066.077] lstrlenA (lpString="*.flac") returned 6 [0066.077] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.ape") returned 0 [0066.077] lstrlenA (lpString="*.ape") returned 5 [0066.077] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.wma") returned 0 [0066.077] lstrlenA (lpString="*.wma") returned 5 [0066.077] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\kor_boot.ttf", pszSpec="*.ac3") returned 0 [0066.077] lstrlenA (lpString="*.ac3") returned 5 [0066.077] FindNextFileA (in: hFindFile=0x5b6c68, lpFindFileData=0xaf4e8 | out: lpFindFileData=0xaf4e8) returned 1 [0066.077] PeekMessageA (in: lpMsg=0xaf4c4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf4c4) returned 0 [0066.077] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="wgl4_boot.ttf") returned -1 [0066.077] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="wgl4_boot.ttf") returned -1 [0066.077] lstrcmpiA (lpString1="", lpString2="wgl4_boot.ttf") returned -1 [0066.077] PathFindFileNameA (pszPath="C:\\Boot\\Fonts\\kor_boot.ttf") returned="kor_boot.ttf" [0066.078] lstrcatA (in: lpString1="C:\\Boot\\Fonts\\", lpString2="wgl4_boot.ttf" | out: lpString1="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned="C:\\Boot\\Fonts\\wgl4_boot.ttf" [0066.078] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.zip") returned 0 [0066.078] lstrlenA (lpString="*.zip") returned 5 [0066.078] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.rar") returned 0 [0066.078] lstrlenA (lpString="*.rar") returned 5 [0066.078] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.7z") returned 0 [0066.078] lstrlenA (lpString="*.7z") returned 4 [0066.078] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.tar") returned 0 [0066.078] lstrlenA (lpString="*.tar") returned 5 [0066.078] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.gzip") returned 0 [0066.078] lstrlenA (lpString="*.gzip") returned 6 [0066.078] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.jpg") returned 0 [0066.078] lstrlenA (lpString="*.jpg") returned 5 [0066.078] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.jpeg") returned 0 [0066.078] lstrlenA (lpString="*.jpeg") returned 6 [0066.078] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.psd") returned 0 [0066.078] lstrlenA (lpString="*.psd") returned 5 [0066.078] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.cdr") returned 0 [0066.078] lstrlenA (lpString="*.cdr") returned 5 [0066.078] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.dwg") returned 0 [0066.078] lstrlenA (lpString="*.dwg") returned 5 [0066.078] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.max") returned 0 [0066.078] lstrlenA (lpString="*.max") returned 5 [0066.078] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.bmp") returned 0 [0066.078] lstrlenA (lpString="*.bmp") returned 5 [0066.078] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.gif") returned 0 [0066.078] lstrlenA (lpString="*.gif") returned 5 [0066.078] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.png") returned 0 [0066.078] lstrlenA (lpString="*.png") returned 5 [0066.078] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.doc") returned 0 [0066.078] lstrlenA (lpString="*.doc") returned 5 [0066.078] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.docx") returned 0 [0066.078] lstrlenA (lpString="*.docx") returned 6 [0066.078] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.xls") returned 0 [0066.078] lstrlenA (lpString="*.xls") returned 5 [0066.078] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.xlsx") returned 0 [0066.079] lstrlenA (lpString="*.xlsx") returned 6 [0066.079] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.ppt") returned 0 [0066.079] lstrlenA (lpString="*.ppt") returned 5 [0066.079] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.pptx") returned 0 [0066.079] lstrlenA (lpString="*.pptx") returned 6 [0066.079] PathMatchSpecA (pszFile="C:\\Boot\\Fonts\\wgl4_boot.ttf", pszSpec="*.txt") returned 0 [0066.079] lstrlenA (lpString="*.txt") returned 5 [0066.079] FindNextFileA (in: hFindFile=0x5b6c68, lpFindFileData=0xaf4e8 | out: lpFindFileData=0xaf4e8) returned 0 [0066.079] FindClose (in: hFindFile=0x5b6c68 | out: hFindFile=0x5b6c68) returned 1 [0066.079] FindNextFileA (in: hFindFile=0x5b5bf0, lpFindFileData=0xaf638 | out: lpFindFileData=0xaf638) returned 1 [0066.079] lstrcmpA (lpString1=".", lpString2="fr-FR") returned -1 [0066.079] lstrcmpA (lpString1="..", lpString2="fr-FR") returned -1 [0066.079] PathFindFileNameA (pszPath="C:\\Boot\\*.*") returned="*.*" [0066.079] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="fr-FR" | out: lpString1="C:\\Boot\\fr-FR") returned="C:\\Boot\\fr-FR" [0066.079] FindFirstFileA (in: lpFileName="C:\\Boot\\fr-FR\\*.*", lpFindFileData=0xaf4e8 | out: lpFindFileData=0xaf4e8) returned 0x5b6c68 [0066.080] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0066.080] FindNextFileA (in: hFindFile=0x5b6c68, lpFindFileData=0xaf4e8 | out: lpFindFileData=0xaf4e8) returned 1 [0066.080] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0066.080] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0066.080] FindNextFileA (in: hFindFile=0x5b6c68, lpFindFileData=0xaf4e8 | out: lpFindFileData=0xaf4e8) returned 1 [0066.080] PeekMessageA (in: lpMsg=0xaf4c4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf4c4) returned 0 [0066.080] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="bootmgr.exe.mui") returned 1 [0066.080] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bootmgr.exe.mui") returned 1 [0066.080] lstrcmpiA (lpString1="", lpString2="bootmgr.exe.mui") returned -1 [0066.080] PathFindFileNameA (pszPath="C:\\Boot\\fr-FR\\*.*") returned="*.*" [0066.080] lstrcatA (in: lpString1="C:\\Boot\\fr-FR\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned="C:\\Boot\\fr-FR\\bootmgr.exe.mui" [0066.080] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.zip") returned 0 [0066.080] lstrlenA (lpString="*.zip") returned 5 [0066.080] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.rar") returned 0 [0066.080] lstrlenA (lpString="*.rar") returned 5 [0066.080] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.7z") returned 0 [0066.080] lstrlenA (lpString="*.7z") returned 4 [0066.080] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.tar") returned 0 [0066.080] lstrlenA (lpString="*.tar") returned 5 [0066.080] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.gzip") returned 0 [0066.080] lstrlenA (lpString="*.gzip") returned 6 [0066.081] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.jpg") returned 0 [0066.081] lstrlenA (lpString="*.jpg") returned 5 [0066.081] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.jpeg") returned 0 [0066.081] lstrlenA (lpString="*.jpeg") returned 6 [0066.081] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.psd") returned 0 [0066.081] lstrlenA (lpString="*.psd") returned 5 [0066.081] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.cdr") returned 0 [0066.081] lstrlenA (lpString="*.cdr") returned 5 [0066.081] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.dwg") returned 0 [0066.081] lstrlenA (lpString="*.dwg") returned 5 [0066.081] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.max") returned 0 [0066.081] lstrlenA (lpString="*.max") returned 5 [0066.081] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.bmp") returned 0 [0066.081] lstrlenA (lpString="*.bmp") returned 5 [0066.081] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.gif") returned 0 [0066.081] lstrlenA (lpString="*.gif") returned 5 [0066.081] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.png") returned 0 [0066.081] lstrlenA (lpString="*.png") returned 5 [0066.081] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.doc") returned 0 [0066.081] lstrlenA (lpString="*.doc") returned 5 [0066.081] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.docx") returned 0 [0066.081] lstrlenA (lpString="*.docx") returned 6 [0066.081] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.xls") returned 0 [0066.081] lstrlenA (lpString="*.xls") returned 5 [0066.081] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.xlsx") returned 0 [0066.081] lstrlenA (lpString="*.xlsx") returned 6 [0066.081] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.ppt") returned 0 [0066.081] lstrlenA (lpString="*.ppt") returned 5 [0066.081] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.pptx") returned 0 [0066.081] lstrlenA (lpString="*.pptx") returned 6 [0066.081] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.txt") returned 0 [0066.081] lstrlenA (lpString="*.txt") returned 5 [0066.081] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.pdf") returned 0 [0066.081] lstrlenA (lpString="*.pdf") returned 5 [0066.081] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.djvu") returned 0 [0066.081] lstrlenA (lpString="*.djvu") returned 6 [0066.081] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.htm") returned 0 [0066.081] lstrlenA (lpString="*.htm") returned 5 [0066.081] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.html") returned 0 [0066.081] lstrlenA (lpString="*.html") returned 6 [0066.081] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.mdb") returned 0 [0066.082] lstrlenA (lpString="*.mdb") returned 5 [0066.082] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.cer") returned 0 [0066.082] lstrlenA (lpString="*.cer") returned 5 [0066.082] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.p12") returned 0 [0066.082] lstrlenA (lpString="*.p12") returned 5 [0066.082] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.pfx") returned 0 [0066.082] lstrlenA (lpString="*.pfx") returned 5 [0066.082] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.kwm") returned 0 [0066.082] lstrlenA (lpString="*.kwm") returned 5 [0066.082] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.pwm") returned 0 [0066.082] lstrlenA (lpString="*.pwm") returned 5 [0066.082] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.1cd") returned 0 [0066.082] lstrlenA (lpString="*.1cd") returned 5 [0066.082] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.md") returned 0 [0066.082] lstrlenA (lpString="*.md") returned 4 [0066.082] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.mdf") returned 0 [0066.082] lstrlenA (lpString="*.mdf") returned 5 [0066.082] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.dbf") returned 0 [0066.082] lstrlenA (lpString="*.dbf") returned 5 [0066.082] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.odt") returned 0 [0066.082] lstrlenA (lpString="*.odt") returned 5 [0066.082] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.vob") returned 0 [0066.082] lstrlenA (lpString="*.vob") returned 5 [0066.082] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.ifo") returned 0 [0066.082] lstrlenA (lpString="*.ifo") returned 5 [0066.082] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.lnk") returned 0 [0066.082] lstrlenA (lpString="*.lnk") returned 5 [0066.082] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.torrent") returned 0 [0066.082] lstrlenA (lpString="*.torrent") returned 9 [0066.082] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.mov") returned 0 [0066.082] lstrlenA (lpString="*.mov") returned 5 [0066.082] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.m2v") returned 0 [0066.082] lstrlenA (lpString="*.m2v") returned 5 [0066.082] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.3gp") returned 0 [0066.082] lstrlenA (lpString="*.3gp") returned 5 [0066.082] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.mpeg") returned 0 [0066.083] lstrlenA (lpString="*.mpeg") returned 6 [0066.083] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.mpg") returned 0 [0066.083] lstrlenA (lpString="*.mpg") returned 5 [0066.083] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.flv") returned 0 [0066.083] lstrlenA (lpString="*.flv") returned 5 [0066.083] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.avi") returned 0 [0066.083] lstrlenA (lpString="*.avi") returned 5 [0066.083] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.mp4") returned 0 [0066.083] lstrlenA (lpString="*.mp4") returned 5 [0066.083] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.wmv") returned 0 [0066.083] lstrlenA (lpString="*.wmv") returned 5 [0066.083] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.divx") returned 0 [0066.083] lstrlenA (lpString="*.divx") returned 6 [0066.083] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.mkv") returned 0 [0066.083] lstrlenA (lpString="*.mkv") returned 5 [0066.083] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.mp3") returned 0 [0066.083] lstrlenA (lpString="*.mp3") returned 5 [0066.083] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.wav") returned 0 [0066.083] lstrlenA (lpString="*.wav") returned 5 [0066.083] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.flac") returned 0 [0066.083] lstrlenA (lpString="*.flac") returned 6 [0066.083] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.ape") returned 0 [0066.083] lstrlenA (lpString="*.ape") returned 5 [0066.083] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.wma") returned 0 [0066.083] lstrlenA (lpString="*.wma") returned 5 [0066.083] PathMatchSpecA (pszFile="C:\\Boot\\fr-FR\\bootmgr.exe.mui", pszSpec="*.ac3") returned 0 [0066.083] lstrlenA (lpString="*.ac3") returned 5 [0066.083] FindNextFileA (in: hFindFile=0x5b6c68, lpFindFileData=0xaf4e8 | out: lpFindFileData=0xaf4e8) returned 0 [0066.083] FindClose (in: hFindFile=0x5b6c68 | out: hFindFile=0x5b6c68) returned 1 [0066.083] FindNextFileA (in: hFindFile=0x5b5bf0, lpFindFileData=0xaf638 | out: lpFindFileData=0xaf638) returned 1 [0066.083] lstrcmpA (lpString1=".", lpString2="hu-HU") returned -1 [0066.083] lstrcmpA (lpString1="..", lpString2="hu-HU") returned -1 [0066.083] PathFindFileNameA (pszPath="C:\\Boot\\*.*") returned="*.*" [0066.084] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="hu-HU" | out: lpString1="C:\\Boot\\hu-HU") returned="C:\\Boot\\hu-HU" [0066.084] lstrlenA (lpString="C:\\Boot\\hu-HU") returned 13 [0066.084] FindFirstFileA (in: lpFileName="C:\\Boot\\hu-HU\\*.*", lpFindFileData=0xaf4e8 | out: lpFindFileData=0xaf4e8) returned 0x5b6c68 [0066.084] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0066.084] FindNextFileA (in: hFindFile=0x5b6c68, lpFindFileData=0xaf4e8 | out: lpFindFileData=0xaf4e8) returned 1 [0066.084] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0066.084] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0066.084] FindNextFileA (in: hFindFile=0x5b6c68, lpFindFileData=0xaf4e8 | out: lpFindFileData=0xaf4e8) returned 1 [0066.084] PeekMessageA (in: lpMsg=0xaf4c4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf4c4) returned 0 [0066.084] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="bootmgr.exe.mui") returned 1 [0066.084] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bootmgr.exe.mui") returned 1 [0066.084] lstrcmpiA (lpString1="", lpString2="bootmgr.exe.mui") returned -1 [0066.084] PathFindFileNameA (pszPath="C:\\Boot\\hu-HU\\*.*") returned="*.*" [0066.084] lstrcatA (in: lpString1="C:\\Boot\\hu-HU\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned="C:\\Boot\\hu-HU\\bootmgr.exe.mui" [0066.084] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.zip") returned 0 [0066.084] lstrlenA (lpString="*.zip") returned 5 [0066.084] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.rar") returned 0 [0066.084] lstrlenA (lpString="*.rar") returned 5 [0066.084] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.7z") returned 0 [0066.084] lstrlenA (lpString="*.7z") returned 4 [0066.084] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.tar") returned 0 [0066.084] lstrlenA (lpString="*.tar") returned 5 [0066.084] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.gzip") returned 0 [0066.084] lstrlenA (lpString="*.gzip") returned 6 [0066.084] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.jpg") returned 0 [0066.084] lstrlenA (lpString="*.jpg") returned 5 [0066.085] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.jpeg") returned 0 [0066.085] lstrlenA (lpString="*.jpeg") returned 6 [0066.085] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.psd") returned 0 [0066.085] lstrlenA (lpString="*.psd") returned 5 [0066.085] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.cdr") returned 0 [0066.085] lstrlenA (lpString="*.cdr") returned 5 [0066.085] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.dwg") returned 0 [0066.085] lstrlenA (lpString="*.dwg") returned 5 [0066.085] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.max") returned 0 [0066.085] lstrlenA (lpString="*.max") returned 5 [0066.085] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.bmp") returned 0 [0066.085] lstrlenA (lpString="*.bmp") returned 5 [0066.085] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.gif") returned 0 [0066.085] lstrlenA (lpString="*.gif") returned 5 [0066.085] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.png") returned 0 [0066.085] lstrlenA (lpString="*.png") returned 5 [0066.085] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.doc") returned 0 [0066.085] lstrlenA (lpString="*.doc") returned 5 [0066.085] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.docx") returned 0 [0066.085] lstrlenA (lpString="*.docx") returned 6 [0066.085] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.xls") returned 0 [0066.085] lstrlenA (lpString="*.xls") returned 5 [0066.085] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.xlsx") returned 0 [0066.085] lstrlenA (lpString="*.xlsx") returned 6 [0066.085] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.ppt") returned 0 [0066.085] lstrlenA (lpString="*.ppt") returned 5 [0066.085] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.pptx") returned 0 [0066.085] lstrlenA (lpString="*.pptx") returned 6 [0066.085] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.txt") returned 0 [0066.085] lstrlenA (lpString="*.txt") returned 5 [0066.085] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.pdf") returned 0 [0066.085] lstrlenA (lpString="*.pdf") returned 5 [0066.085] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.djvu") returned 0 [0066.085] lstrlenA (lpString="*.djvu") returned 6 [0066.085] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.htm") returned 0 [0066.085] lstrlenA (lpString="*.htm") returned 5 [0066.085] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.html") returned 0 [0066.085] lstrlenA (lpString="*.html") returned 6 [0066.085] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.mdb") returned 0 [0066.085] lstrlenA (lpString="*.mdb") returned 5 [0066.085] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.cer") returned 0 [0066.085] lstrlenA (lpString="*.cer") returned 5 [0066.086] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.p12") returned 0 [0066.086] lstrlenA (lpString="*.p12") returned 5 [0066.086] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.pfx") returned 0 [0066.086] lstrlenA (lpString="*.pfx") returned 5 [0066.086] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.kwm") returned 0 [0066.086] lstrlenA (lpString="*.kwm") returned 5 [0066.086] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.pwm") returned 0 [0066.086] lstrlenA (lpString="*.pwm") returned 5 [0066.086] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.1cd") returned 0 [0066.086] lstrlenA (lpString="*.1cd") returned 5 [0066.086] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.md") returned 0 [0066.086] lstrlenA (lpString="*.md") returned 4 [0066.086] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.mdf") returned 0 [0066.086] lstrlenA (lpString="*.mdf") returned 5 [0066.086] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.dbf") returned 0 [0066.086] lstrlenA (lpString="*.dbf") returned 5 [0066.086] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.odt") returned 0 [0066.086] lstrlenA (lpString="*.odt") returned 5 [0066.086] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.vob") returned 0 [0066.086] lstrlenA (lpString="*.vob") returned 5 [0066.086] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.ifo") returned 0 [0066.086] lstrlenA (lpString="*.ifo") returned 5 [0066.086] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.lnk") returned 0 [0066.086] lstrlenA (lpString="*.lnk") returned 5 [0066.086] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.torrent") returned 0 [0066.086] lstrlenA (lpString="*.torrent") returned 9 [0066.086] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.mov") returned 0 [0066.086] lstrlenA (lpString="*.mov") returned 5 [0066.086] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.m2v") returned 0 [0066.086] lstrlenA (lpString="*.m2v") returned 5 [0066.086] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.3gp") returned 0 [0066.086] lstrlenA (lpString="*.3gp") returned 5 [0066.086] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.mpeg") returned 0 [0066.086] lstrlenA (lpString="*.mpeg") returned 6 [0066.086] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.mpg") returned 0 [0066.086] lstrlenA (lpString="*.mpg") returned 5 [0066.086] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.flv") returned 0 [0066.086] lstrlenA (lpString="*.flv") returned 5 [0066.086] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.avi") returned 0 [0066.086] lstrlenA (lpString="*.avi") returned 5 [0066.086] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.mp4") returned 0 [0066.087] lstrlenA (lpString="*.mp4") returned 5 [0066.087] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.wmv") returned 0 [0066.087] lstrlenA (lpString="*.wmv") returned 5 [0066.087] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.divx") returned 0 [0066.087] lstrlenA (lpString="*.divx") returned 6 [0066.087] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.mkv") returned 0 [0066.087] lstrlenA (lpString="*.mkv") returned 5 [0066.087] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.mp3") returned 0 [0066.087] lstrlenA (lpString="*.mp3") returned 5 [0066.087] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.wav") returned 0 [0066.087] lstrlenA (lpString="*.wav") returned 5 [0066.087] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.flac") returned 0 [0066.087] lstrlenA (lpString="*.flac") returned 6 [0066.087] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.ape") returned 0 [0066.087] lstrlenA (lpString="*.ape") returned 5 [0066.087] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.wma") returned 0 [0066.087] lstrlenA (lpString="*.wma") returned 5 [0066.087] PathMatchSpecA (pszFile="C:\\Boot\\hu-HU\\bootmgr.exe.mui", pszSpec="*.ac3") returned 0 [0066.087] lstrlenA (lpString="*.ac3") returned 5 [0066.087] FindNextFileA (in: hFindFile=0x5b6c68, lpFindFileData=0xaf4e8 | out: lpFindFileData=0xaf4e8) returned 0 [0066.087] FindClose (in: hFindFile=0x5b6c68 | out: hFindFile=0x5b6c68) returned 1 [0066.087] FindNextFileA (in: hFindFile=0x5b5bf0, lpFindFileData=0xaf638 | out: lpFindFileData=0xaf638) returned 1 [0066.087] lstrcmpA (lpString1=".", lpString2="it-IT") returned -1 [0066.087] lstrcmpA (lpString1="..", lpString2="it-IT") returned -1 [0066.087] PathFindFileNameA (pszPath="C:\\Boot\\*.*") returned="*.*" [0066.087] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="it-IT" | out: lpString1="C:\\Boot\\it-IT") returned="C:\\Boot\\it-IT" [0066.087] lstrlenA (lpString="C:\\Boot\\it-IT") returned 13 [0066.087] FindFirstFileA (in: lpFileName="C:\\Boot\\it-IT\\*.*", lpFindFileData=0xaf4e8 | out: lpFindFileData=0xaf4e8) returned 0x5b6c68 [0066.088] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0066.088] FindNextFileA (in: hFindFile=0x5b6c68, lpFindFileData=0xaf4e8 | out: lpFindFileData=0xaf4e8) returned 1 [0066.088] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0066.088] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0066.088] FindNextFileA (in: hFindFile=0x5b6c68, lpFindFileData=0xaf4e8 | out: lpFindFileData=0xaf4e8) returned 1 [0066.088] PeekMessageA (in: lpMsg=0xaf4c4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf4c4) returned 0 [0066.088] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="bootmgr.exe.mui") returned 1 [0066.088] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bootmgr.exe.mui") returned 1 [0066.088] lstrcmpiA (lpString1="", lpString2="bootmgr.exe.mui") returned -1 [0066.088] PathFindFileNameA (pszPath="C:\\Boot\\it-IT\\*.*") returned="*.*" [0066.088] lstrcatA (in: lpString1="C:\\Boot\\it-IT\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned="C:\\Boot\\it-IT\\bootmgr.exe.mui" [0066.088] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.zip") returned 0 [0066.088] lstrlenA (lpString="*.zip") returned 5 [0066.088] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.rar") returned 0 [0066.088] lstrlenA (lpString="*.rar") returned 5 [0066.088] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.7z") returned 0 [0066.088] lstrlenA (lpString="*.7z") returned 4 [0066.088] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.tar") returned 0 [0066.088] lstrlenA (lpString="*.tar") returned 5 [0066.088] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.gzip") returned 0 [0066.088] lstrlenA (lpString="*.gzip") returned 6 [0066.088] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.jpg") returned 0 [0066.088] lstrlenA (lpString="*.jpg") returned 5 [0066.089] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.jpeg") returned 0 [0066.089] lstrlenA (lpString="*.jpeg") returned 6 [0066.089] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.psd") returned 0 [0066.089] lstrlenA (lpString="*.psd") returned 5 [0066.089] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.cdr") returned 0 [0066.089] lstrlenA (lpString="*.cdr") returned 5 [0066.089] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.dwg") returned 0 [0066.089] lstrlenA (lpString="*.dwg") returned 5 [0066.089] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.max") returned 0 [0066.089] lstrlenA (lpString="*.max") returned 5 [0066.089] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.bmp") returned 0 [0066.089] lstrlenA (lpString="*.bmp") returned 5 [0066.089] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.gif") returned 0 [0066.089] lstrlenA (lpString="*.gif") returned 5 [0066.089] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.png") returned 0 [0066.089] lstrlenA (lpString="*.png") returned 5 [0066.089] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.doc") returned 0 [0066.089] lstrlenA (lpString="*.doc") returned 5 [0066.089] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.docx") returned 0 [0066.089] lstrlenA (lpString="*.docx") returned 6 [0066.089] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.xls") returned 0 [0066.089] lstrlenA (lpString="*.xls") returned 5 [0066.089] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.xlsx") returned 0 [0066.089] lstrlenA (lpString="*.xlsx") returned 6 [0066.089] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.ppt") returned 0 [0066.089] lstrlenA (lpString="*.ppt") returned 5 [0066.089] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.pptx") returned 0 [0066.089] lstrlenA (lpString="*.pptx") returned 6 [0066.089] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.txt") returned 0 [0066.089] lstrlenA (lpString="*.txt") returned 5 [0066.089] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.pdf") returned 0 [0066.089] lstrlenA (lpString="*.pdf") returned 5 [0066.089] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.djvu") returned 0 [0066.089] lstrlenA (lpString="*.djvu") returned 6 [0066.089] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.htm") returned 0 [0066.089] lstrlenA (lpString="*.htm") returned 5 [0066.089] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.html") returned 0 [0066.089] lstrlenA (lpString="*.html") returned 6 [0066.089] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.mdb") returned 0 [0066.089] lstrlenA (lpString="*.mdb") returned 5 [0066.089] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.cer") returned 0 [0066.089] lstrlenA (lpString="*.cer") returned 5 [0066.089] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.p12") returned 0 [0066.089] lstrlenA (lpString="*.p12") returned 5 [0066.089] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.pfx") returned 0 [0066.089] lstrlenA (lpString="*.pfx") returned 5 [0066.089] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.kwm") returned 0 [0066.090] lstrlenA (lpString="*.kwm") returned 5 [0066.090] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.pwm") returned 0 [0066.090] lstrlenA (lpString="*.pwm") returned 5 [0066.090] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.1cd") returned 0 [0066.090] lstrlenA (lpString="*.1cd") returned 5 [0066.090] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.md") returned 0 [0066.090] lstrlenA (lpString="*.md") returned 4 [0066.090] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.mdf") returned 0 [0066.090] lstrlenA (lpString="*.mdf") returned 5 [0066.090] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.dbf") returned 0 [0066.090] lstrlenA (lpString="*.dbf") returned 5 [0066.090] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.odt") returned 0 [0066.090] lstrlenA (lpString="*.odt") returned 5 [0066.090] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.vob") returned 0 [0066.090] lstrlenA (lpString="*.vob") returned 5 [0066.090] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.ifo") returned 0 [0066.090] lstrlenA (lpString="*.ifo") returned 5 [0066.090] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.lnk") returned 0 [0066.090] lstrlenA (lpString="*.lnk") returned 5 [0066.090] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.torrent") returned 0 [0066.090] lstrlenA (lpString="*.torrent") returned 9 [0066.090] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.mov") returned 0 [0066.090] lstrlenA (lpString="*.mov") returned 5 [0066.090] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.m2v") returned 0 [0066.090] lstrlenA (lpString="*.m2v") returned 5 [0066.090] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.3gp") returned 0 [0066.090] lstrlenA (lpString="*.3gp") returned 5 [0066.090] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.mpeg") returned 0 [0066.090] lstrlenA (lpString="*.mpeg") returned 6 [0066.090] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.mpg") returned 0 [0066.090] lstrlenA (lpString="*.mpg") returned 5 [0066.090] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.flv") returned 0 [0066.090] lstrlenA (lpString="*.flv") returned 5 [0066.090] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.avi") returned 0 [0066.090] lstrlenA (lpString="*.avi") returned 5 [0066.090] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.mp4") returned 0 [0066.090] lstrlenA (lpString="*.mp4") returned 5 [0066.090] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.wmv") returned 0 [0066.090] lstrlenA (lpString="*.wmv") returned 5 [0066.090] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.divx") returned 0 [0066.090] lstrlenA (lpString="*.divx") returned 6 [0066.090] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.mkv") returned 0 [0066.090] lstrlenA (lpString="*.mkv") returned 5 [0066.090] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.mp3") returned 0 [0066.090] lstrlenA (lpString="*.mp3") returned 5 [0066.090] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.wav") returned 0 [0066.090] lstrlenA (lpString="*.wav") returned 5 [0066.090] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.flac") returned 0 [0066.091] lstrlenA (lpString="*.flac") returned 6 [0066.091] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.ape") returned 0 [0066.091] lstrlenA (lpString="*.ape") returned 5 [0066.091] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.wma") returned 0 [0066.091] lstrlenA (lpString="*.wma") returned 5 [0066.091] PathMatchSpecA (pszFile="C:\\Boot\\it-IT\\bootmgr.exe.mui", pszSpec="*.ac3") returned 0 [0066.091] lstrlenA (lpString="*.ac3") returned 5 [0066.091] FindNextFileA (in: hFindFile=0x5b6c68, lpFindFileData=0xaf4e8 | out: lpFindFileData=0xaf4e8) returned 0 [0066.091] FindClose (in: hFindFile=0x5b6c68 | out: hFindFile=0x5b6c68) returned 1 [0066.091] FindNextFileA (in: hFindFile=0x5b5bf0, lpFindFileData=0xaf638 | out: lpFindFileData=0xaf638) returned 1 [0066.091] lstrcmpA (lpString1=".", lpString2="ja-JP") returned -1 [0066.091] lstrcmpA (lpString1="..", lpString2="ja-JP") returned -1 [0066.091] PathFindFileNameA (pszPath="C:\\Boot\\*.*") returned="*.*" [0066.091] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="ja-JP" | out: lpString1="C:\\Boot\\ja-JP") returned="C:\\Boot\\ja-JP" [0066.091] lstrlenA (lpString="C:\\Boot\\ja-JP") returned 13 [0066.091] FindFirstFileA (in: lpFileName="C:\\Boot\\ja-JP\\*.*", lpFindFileData=0xaf4e8 | out: lpFindFileData=0xaf4e8) returned 0x5b6c68 [0066.091] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0066.091] FindNextFileA (in: hFindFile=0x5b6c68, lpFindFileData=0xaf4e8 | out: lpFindFileData=0xaf4e8) returned 1 [0066.091] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0066.091] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0066.091] FindNextFileA (in: hFindFile=0x5b6c68, lpFindFileData=0xaf4e8 | out: lpFindFileData=0xaf4e8) returned 1 [0066.091] PeekMessageA (in: lpMsg=0xaf4c4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf4c4) returned 0 [0066.091] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="bootmgr.exe.mui") returned 1 [0066.091] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bootmgr.exe.mui") returned 1 [0066.091] lstrcmpiA (lpString1="", lpString2="bootmgr.exe.mui") returned -1 [0066.091] PathFindFileNameA (pszPath="C:\\Boot\\ja-JP\\*.*") returned="*.*" [0066.091] lstrcatA (in: lpString1="C:\\Boot\\ja-JP\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned="C:\\Boot\\ja-JP\\bootmgr.exe.mui" [0066.091] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.zip") returned 0 [0066.091] lstrlenA (lpString="*.zip") returned 5 [0066.091] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.rar") returned 0 [0066.092] lstrlenA (lpString="*.rar") returned 5 [0066.092] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.7z") returned 0 [0066.092] lstrlenA (lpString="*.7z") returned 4 [0066.092] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.tar") returned 0 [0066.092] lstrlenA (lpString="*.tar") returned 5 [0066.092] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.gzip") returned 0 [0066.092] lstrlenA (lpString="*.gzip") returned 6 [0066.092] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.jpg") returned 0 [0066.092] lstrlenA (lpString="*.jpg") returned 5 [0066.092] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.jpeg") returned 0 [0066.092] lstrlenA (lpString="*.jpeg") returned 6 [0066.092] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.psd") returned 0 [0066.092] lstrlenA (lpString="*.psd") returned 5 [0066.092] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.cdr") returned 0 [0066.092] lstrlenA (lpString="*.cdr") returned 5 [0066.092] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.dwg") returned 0 [0066.092] lstrlenA (lpString="*.dwg") returned 5 [0066.092] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.max") returned 0 [0066.092] lstrlenA (lpString="*.max") returned 5 [0066.092] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.bmp") returned 0 [0066.092] lstrlenA (lpString="*.bmp") returned 5 [0066.092] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.gif") returned 0 [0066.092] lstrlenA (lpString="*.gif") returned 5 [0066.092] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.png") returned 0 [0066.092] lstrlenA (lpString="*.png") returned 5 [0066.092] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.doc") returned 0 [0066.092] lstrlenA (lpString="*.doc") returned 5 [0066.092] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.docx") returned 0 [0066.092] lstrlenA (lpString="*.docx") returned 6 [0066.092] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.xls") returned 0 [0066.092] lstrlenA (lpString="*.xls") returned 5 [0066.092] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.xlsx") returned 0 [0066.092] lstrlenA (lpString="*.xlsx") returned 6 [0066.092] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.ppt") returned 0 [0066.092] lstrlenA (lpString="*.ppt") returned 5 [0066.092] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.pptx") returned 0 [0066.092] lstrlenA (lpString="*.pptx") returned 6 [0066.092] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.txt") returned 0 [0066.092] lstrlenA (lpString="*.txt") returned 5 [0066.092] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.pdf") returned 0 [0066.092] lstrlenA (lpString="*.pdf") returned 5 [0066.092] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.djvu") returned 0 [0066.092] lstrlenA (lpString="*.djvu") returned 6 [0066.092] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.htm") returned 0 [0066.092] lstrlenA (lpString="*.htm") returned 5 [0066.092] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.html") returned 0 [0066.092] lstrlenA (lpString="*.html") returned 6 [0066.092] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.mdb") returned 0 [0066.092] lstrlenA (lpString="*.mdb") returned 5 [0066.092] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.cer") returned 0 [0066.093] lstrlenA (lpString="*.cer") returned 5 [0066.093] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.p12") returned 0 [0066.093] lstrlenA (lpString="*.p12") returned 5 [0066.093] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.pfx") returned 0 [0066.093] lstrlenA (lpString="*.pfx") returned 5 [0066.093] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.kwm") returned 0 [0066.093] lstrlenA (lpString="*.kwm") returned 5 [0066.093] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.pwm") returned 0 [0066.093] lstrlenA (lpString="*.pwm") returned 5 [0066.093] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.1cd") returned 0 [0066.093] lstrlenA (lpString="*.1cd") returned 5 [0066.093] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.md") returned 0 [0066.093] lstrlenA (lpString="*.md") returned 4 [0066.093] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.mdf") returned 0 [0066.093] lstrlenA (lpString="*.mdf") returned 5 [0066.093] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.dbf") returned 0 [0066.093] lstrlenA (lpString="*.dbf") returned 5 [0066.093] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.odt") returned 0 [0066.093] lstrlenA (lpString="*.odt") returned 5 [0066.093] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.vob") returned 0 [0066.093] lstrlenA (lpString="*.vob") returned 5 [0066.093] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.ifo") returned 0 [0066.093] lstrlenA (lpString="*.ifo") returned 5 [0066.093] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.lnk") returned 0 [0066.093] lstrlenA (lpString="*.lnk") returned 5 [0066.093] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.torrent") returned 0 [0066.093] lstrlenA (lpString="*.torrent") returned 9 [0066.093] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.mov") returned 0 [0066.093] lstrlenA (lpString="*.mov") returned 5 [0066.093] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.m2v") returned 0 [0066.093] lstrlenA (lpString="*.m2v") returned 5 [0066.093] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.3gp") returned 0 [0066.093] lstrlenA (lpString="*.3gp") returned 5 [0066.093] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.mpeg") returned 0 [0066.093] lstrlenA (lpString="*.mpeg") returned 6 [0066.093] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.mpg") returned 0 [0066.093] lstrlenA (lpString="*.mpg") returned 5 [0066.093] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.flv") returned 0 [0066.093] lstrlenA (lpString="*.flv") returned 5 [0066.093] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.avi") returned 0 [0066.093] lstrlenA (lpString="*.avi") returned 5 [0066.093] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.mp4") returned 0 [0066.093] lstrlenA (lpString="*.mp4") returned 5 [0066.093] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.wmv") returned 0 [0066.093] lstrlenA (lpString="*.wmv") returned 5 [0066.093] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.divx") returned 0 [0066.093] lstrlenA (lpString="*.divx") returned 6 [0066.094] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.mkv") returned 0 [0066.094] lstrlenA (lpString="*.mkv") returned 5 [0066.094] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.mp3") returned 0 [0066.094] lstrlenA (lpString="*.mp3") returned 5 [0066.094] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.wav") returned 0 [0066.094] lstrlenA (lpString="*.wav") returned 5 [0066.094] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.flac") returned 0 [0066.094] lstrlenA (lpString="*.flac") returned 6 [0066.094] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.ape") returned 0 [0066.094] lstrlenA (lpString="*.ape") returned 5 [0066.094] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.wma") returned 0 [0066.094] lstrlenA (lpString="*.wma") returned 5 [0066.094] PathMatchSpecA (pszFile="C:\\Boot\\ja-JP\\bootmgr.exe.mui", pszSpec="*.ac3") returned 0 [0066.094] lstrlenA (lpString="*.ac3") returned 5 [0066.094] FindNextFileA (in: hFindFile=0x5b6c68, lpFindFileData=0xaf4e8 | out: lpFindFileData=0xaf4e8) returned 0 [0066.094] FindClose (in: hFindFile=0x5b6c68 | out: hFindFile=0x5b6c68) returned 1 [0066.094] FindNextFileA (in: hFindFile=0x5b5bf0, lpFindFileData=0xaf638 | out: lpFindFileData=0xaf638) returned 1 [0066.094] lstrcmpA (lpString1=".", lpString2="ko-KR") returned -1 [0066.094] lstrcmpA (lpString1="..", lpString2="ko-KR") returned -1 [0066.094] PathFindFileNameA (pszPath="C:\\Boot\\*.*") returned="*.*" [0066.094] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="ko-KR" | out: lpString1="C:\\Boot\\ko-KR") returned="C:\\Boot\\ko-KR" [0066.094] lstrlenA (lpString="C:\\Boot\\ko-KR") returned 13 [0066.094] FindFirstFileA (in: lpFileName="C:\\Boot\\ko-KR\\*.*", lpFindFileData=0xaf4e8 | out: lpFindFileData=0xaf4e8) returned 0x5b6c68 [0066.095] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0066.095] FindNextFileA (in: hFindFile=0x5b6c68, lpFindFileData=0xaf4e8 | out: lpFindFileData=0xaf4e8) returned 1 [0066.095] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0066.095] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0066.095] FindNextFileA (in: hFindFile=0x5b6c68, lpFindFileData=0xaf4e8 | out: lpFindFileData=0xaf4e8) returned 1 [0066.095] PeekMessageA (in: lpMsg=0xaf4c4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf4c4) returned 0 [0066.095] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="bootmgr.exe.mui") returned 1 [0066.095] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bootmgr.exe.mui") returned 1 [0066.095] lstrcmpiA (lpString1="", lpString2="bootmgr.exe.mui") returned -1 [0066.095] PathFindFileNameA (pszPath="C:\\Boot\\ko-KR\\*.*") returned="*.*" [0066.095] lstrcatA (in: lpString1="C:\\Boot\\ko-KR\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned="C:\\Boot\\ko-KR\\bootmgr.exe.mui" [0066.095] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.zip") returned 0 [0066.095] lstrlenA (lpString="*.zip") returned 5 [0066.095] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.rar") returned 0 [0066.095] lstrlenA (lpString="*.rar") returned 5 [0066.095] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.7z") returned 0 [0066.095] lstrlenA (lpString="*.7z") returned 4 [0066.095] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.tar") returned 0 [0066.095] lstrlenA (lpString="*.tar") returned 5 [0066.095] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.gzip") returned 0 [0066.095] lstrlenA (lpString="*.gzip") returned 6 [0066.095] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.jpg") returned 0 [0066.095] lstrlenA (lpString="*.jpg") returned 5 [0066.095] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.jpeg") returned 0 [0066.095] lstrlenA (lpString="*.jpeg") returned 6 [0066.095] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.psd") returned 0 [0066.095] lstrlenA (lpString="*.psd") returned 5 [0066.095] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.cdr") returned 0 [0066.096] lstrlenA (lpString="*.cdr") returned 5 [0066.096] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.dwg") returned 0 [0066.096] lstrlenA (lpString="*.dwg") returned 5 [0066.096] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.max") returned 0 [0066.096] lstrlenA (lpString="*.max") returned 5 [0066.096] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.bmp") returned 0 [0066.096] lstrlenA (lpString="*.bmp") returned 5 [0066.096] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.gif") returned 0 [0066.096] lstrlenA (lpString="*.gif") returned 5 [0066.096] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.png") returned 0 [0066.096] lstrlenA (lpString="*.png") returned 5 [0066.096] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.doc") returned 0 [0066.096] lstrlenA (lpString="*.doc") returned 5 [0066.096] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.docx") returned 0 [0066.096] lstrlenA (lpString="*.docx") returned 6 [0066.096] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.xls") returned 0 [0066.096] lstrlenA (lpString="*.xls") returned 5 [0066.096] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.xlsx") returned 0 [0066.096] lstrlenA (lpString="*.xlsx") returned 6 [0066.096] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.ppt") returned 0 [0066.096] lstrlenA (lpString="*.ppt") returned 5 [0066.096] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.pptx") returned 0 [0066.096] lstrlenA (lpString="*.pptx") returned 6 [0066.096] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.txt") returned 0 [0066.096] lstrlenA (lpString="*.txt") returned 5 [0066.096] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.pdf") returned 0 [0066.096] lstrlenA (lpString="*.pdf") returned 5 [0066.096] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.djvu") returned 0 [0066.096] lstrlenA (lpString="*.djvu") returned 6 [0066.096] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.htm") returned 0 [0066.096] lstrlenA (lpString="*.htm") returned 5 [0066.096] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.html") returned 0 [0066.096] lstrlenA (lpString="*.html") returned 6 [0066.096] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.mdb") returned 0 [0066.096] lstrlenA (lpString="*.mdb") returned 5 [0066.096] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.cer") returned 0 [0066.096] lstrlenA (lpString="*.cer") returned 5 [0066.096] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.p12") returned 0 [0066.096] lstrlenA (lpString="*.p12") returned 5 [0066.096] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.pfx") returned 0 [0066.096] lstrlenA (lpString="*.pfx") returned 5 [0066.096] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.kwm") returned 0 [0066.096] lstrlenA (lpString="*.kwm") returned 5 [0066.096] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.pwm") returned 0 [0066.096] lstrlenA (lpString="*.pwm") returned 5 [0066.096] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.1cd") returned 0 [0066.096] lstrlenA (lpString="*.1cd") returned 5 [0066.097] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.md") returned 0 [0066.097] lstrlenA (lpString="*.md") returned 4 [0066.097] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.mdf") returned 0 [0066.097] lstrlenA (lpString="*.mdf") returned 5 [0066.097] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.dbf") returned 0 [0066.097] lstrlenA (lpString="*.dbf") returned 5 [0066.097] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.odt") returned 0 [0066.097] lstrlenA (lpString="*.odt") returned 5 [0066.097] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.vob") returned 0 [0066.097] lstrlenA (lpString="*.vob") returned 5 [0066.097] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.ifo") returned 0 [0066.097] lstrlenA (lpString="*.ifo") returned 5 [0066.097] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.lnk") returned 0 [0066.097] lstrlenA (lpString="*.lnk") returned 5 [0066.097] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.torrent") returned 0 [0066.097] lstrlenA (lpString="*.torrent") returned 9 [0066.097] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.mov") returned 0 [0066.097] lstrlenA (lpString="*.mov") returned 5 [0066.097] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.m2v") returned 0 [0066.097] lstrlenA (lpString="*.m2v") returned 5 [0066.097] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.3gp") returned 0 [0066.097] lstrlenA (lpString="*.3gp") returned 5 [0066.097] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.mpeg") returned 0 [0066.097] lstrlenA (lpString="*.mpeg") returned 6 [0066.097] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.mpg") returned 0 [0066.097] lstrlenA (lpString="*.mpg") returned 5 [0066.097] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.flv") returned 0 [0066.097] lstrlenA (lpString="*.flv") returned 5 [0066.097] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.avi") returned 0 [0066.097] lstrlenA (lpString="*.avi") returned 5 [0066.097] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.mp4") returned 0 [0066.097] lstrlenA (lpString="*.mp4") returned 5 [0066.097] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.wmv") returned 0 [0066.097] lstrlenA (lpString="*.wmv") returned 5 [0066.097] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.divx") returned 0 [0066.097] lstrlenA (lpString="*.divx") returned 6 [0066.097] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.mkv") returned 0 [0066.097] lstrlenA (lpString="*.mkv") returned 5 [0066.097] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.mp3") returned 0 [0066.097] lstrlenA (lpString="*.mp3") returned 5 [0066.097] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.wav") returned 0 [0066.097] lstrlenA (lpString="*.wav") returned 5 [0066.097] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.flac") returned 0 [0066.097] lstrlenA (lpString="*.flac") returned 6 [0066.098] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.ape") returned 0 [0066.098] lstrlenA (lpString="*.ape") returned 5 [0066.098] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.wma") returned 0 [0066.098] lstrlenA (lpString="*.wma") returned 5 [0066.098] PathMatchSpecA (pszFile="C:\\Boot\\ko-KR\\bootmgr.exe.mui", pszSpec="*.ac3") returned 0 [0066.098] lstrlenA (lpString="*.ac3") returned 5 [0066.098] FindNextFileA (in: hFindFile=0x5b6c68, lpFindFileData=0xaf4e8 | out: lpFindFileData=0xaf4e8) returned 0 [0066.098] FindClose (in: hFindFile=0x5b6c68 | out: hFindFile=0x5b6c68) returned 1 [0066.098] FindNextFileA (in: hFindFile=0x5b5bf0, lpFindFileData=0xaf638 | out: lpFindFileData=0xaf638) returned 1 [0066.098] PeekMessageA (in: lpMsg=0xaf614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf614) returned 0 [0066.098] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="memtest.exe") returned -1 [0066.098] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="memtest.exe") returned -1 [0066.098] lstrcmpiA (lpString1="", lpString2="memtest.exe") returned -1 [0066.098] PathFindFileNameA (pszPath="C:\\Boot\\*.*") returned="*.*" [0066.098] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="memtest.exe" | out: lpString1="C:\\Boot\\memtest.exe") returned="C:\\Boot\\memtest.exe" [0066.098] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.zip") returned 0 [0066.098] lstrlenA (lpString="*.zip") returned 5 [0066.098] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.rar") returned 0 [0066.098] lstrlenA (lpString="*.rar") returned 5 [0066.098] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.7z") returned 0 [0066.098] lstrlenA (lpString="*.7z") returned 4 [0066.098] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.tar") returned 0 [0066.098] lstrlenA (lpString="*.tar") returned 5 [0066.098] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.gzip") returned 0 [0066.098] lstrlenA (lpString="*.gzip") returned 6 [0066.098] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.jpg") returned 0 [0066.098] lstrlenA (lpString="*.jpg") returned 5 [0066.098] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.jpeg") returned 0 [0066.098] lstrlenA (lpString="*.jpeg") returned 6 [0066.098] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.psd") returned 0 [0066.098] lstrlenA (lpString="*.psd") returned 5 [0066.098] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.cdr") returned 0 [0066.098] lstrlenA (lpString="*.cdr") returned 5 [0066.098] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.dwg") returned 0 [0066.098] lstrlenA (lpString="*.dwg") returned 5 [0066.099] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.max") returned 0 [0066.099] lstrlenA (lpString="*.max") returned 5 [0066.099] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.bmp") returned 0 [0066.099] lstrlenA (lpString="*.bmp") returned 5 [0066.099] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.gif") returned 0 [0066.099] lstrlenA (lpString="*.gif") returned 5 [0066.099] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.png") returned 0 [0066.099] lstrlenA (lpString="*.png") returned 5 [0066.099] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.doc") returned 0 [0066.099] lstrlenA (lpString="*.doc") returned 5 [0066.099] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.docx") returned 0 [0066.099] lstrlenA (lpString="*.docx") returned 6 [0066.099] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.xls") returned 0 [0066.099] lstrlenA (lpString="*.xls") returned 5 [0066.099] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.xlsx") returned 0 [0066.099] lstrlenA (lpString="*.xlsx") returned 6 [0066.099] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.ppt") returned 0 [0066.099] lstrlenA (lpString="*.ppt") returned 5 [0066.099] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.pptx") returned 0 [0066.099] lstrlenA (lpString="*.pptx") returned 6 [0066.099] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.txt") returned 0 [0066.099] lstrlenA (lpString="*.txt") returned 5 [0066.099] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.pdf") returned 0 [0066.099] lstrlenA (lpString="*.pdf") returned 5 [0066.099] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.djvu") returned 0 [0066.099] lstrlenA (lpString="*.djvu") returned 6 [0066.099] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.htm") returned 0 [0066.099] lstrlenA (lpString="*.htm") returned 5 [0066.099] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.html") returned 0 [0066.099] lstrlenA (lpString="*.html") returned 6 [0066.099] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.mdb") returned 0 [0066.099] lstrlenA (lpString="*.mdb") returned 5 [0066.099] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.cer") returned 0 [0066.099] lstrlenA (lpString="*.cer") returned 5 [0066.099] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.p12") returned 0 [0066.099] lstrlenA (lpString="*.p12") returned 5 [0066.099] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.pfx") returned 0 [0066.099] lstrlenA (lpString="*.pfx") returned 5 [0066.099] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.kwm") returned 0 [0066.099] lstrlenA (lpString="*.kwm") returned 5 [0066.099] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.pwm") returned 0 [0066.099] lstrlenA (lpString="*.pwm") returned 5 [0066.099] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.1cd") returned 0 [0066.099] lstrlenA (lpString="*.1cd") returned 5 [0066.099] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.md") returned 0 [0066.099] lstrlenA (lpString="*.md") returned 4 [0066.099] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.mdf") returned 0 [0066.099] lstrlenA (lpString="*.mdf") returned 5 [0066.100] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.dbf") returned 0 [0066.100] lstrlenA (lpString="*.dbf") returned 5 [0066.100] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.odt") returned 0 [0066.100] lstrlenA (lpString="*.odt") returned 5 [0066.100] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.vob") returned 0 [0066.100] lstrlenA (lpString="*.vob") returned 5 [0066.100] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.ifo") returned 0 [0066.100] lstrlenA (lpString="*.ifo") returned 5 [0066.100] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.lnk") returned 0 [0066.100] lstrlenA (lpString="*.lnk") returned 5 [0066.100] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.torrent") returned 0 [0066.100] lstrlenA (lpString="*.torrent") returned 9 [0066.100] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.mov") returned 0 [0066.100] lstrlenA (lpString="*.mov") returned 5 [0066.100] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.m2v") returned 0 [0066.100] lstrlenA (lpString="*.m2v") returned 5 [0066.100] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.3gp") returned 0 [0066.100] lstrlenA (lpString="*.3gp") returned 5 [0066.100] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.mpeg") returned 0 [0066.100] lstrlenA (lpString="*.mpeg") returned 6 [0066.100] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.mpg") returned 0 [0066.100] lstrlenA (lpString="*.mpg") returned 5 [0066.100] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.flv") returned 0 [0066.100] lstrlenA (lpString="*.flv") returned 5 [0066.100] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.avi") returned 0 [0066.100] lstrlenA (lpString="*.avi") returned 5 [0066.100] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.mp4") returned 0 [0066.100] lstrlenA (lpString="*.mp4") returned 5 [0066.100] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.wmv") returned 0 [0066.100] lstrlenA (lpString="*.wmv") returned 5 [0066.100] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.divx") returned 0 [0066.100] lstrlenA (lpString="*.divx") returned 6 [0066.100] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.mkv") returned 0 [0066.100] lstrlenA (lpString="*.mkv") returned 5 [0066.100] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.mp3") returned 0 [0066.100] lstrlenA (lpString="*.mp3") returned 5 [0066.100] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.wav") returned 0 [0066.100] lstrlenA (lpString="*.wav") returned 5 [0066.100] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.flac") returned 0 [0066.100] lstrlenA (lpString="*.flac") returned 6 [0066.100] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.ape") returned 0 [0066.100] lstrlenA (lpString="*.ape") returned 5 [0066.101] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.wma") returned 0 [0066.101] lstrlenA (lpString="*.wma") returned 5 [0066.101] PathMatchSpecA (pszFile="C:\\Boot\\memtest.exe", pszSpec="*.ac3") returned 0 [0066.101] lstrlenA (lpString="*.ac3") returned 5 [0066.101] FindNextFileA (in: hFindFile=0x5b5bf0, lpFindFileData=0xaf638 | out: lpFindFileData=0xaf638) returned 1 [0066.101] lstrcmpA (lpString1=".", lpString2="nb-NO") returned -1 [0066.101] lstrcmpA (lpString1="..", lpString2="nb-NO") returned -1 [0066.101] PathFindFileNameA (pszPath="C:\\Boot\\memtest.exe") returned="memtest.exe" [0066.101] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="nb-NO" | out: lpString1="C:\\Boot\\nb-NO") returned="C:\\Boot\\nb-NO" [0066.101] lstrlenA (lpString="C:\\Boot\\nb-NO") returned 13 [0066.101] FindFirstFileA (in: lpFileName="C:\\Boot\\nb-NO\\*.*", lpFindFileData=0xaf4e8 | out: lpFindFileData=0xaf4e8) returned 0x5b6c68 [0066.101] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0066.101] FindNextFileA (in: hFindFile=0x5b6c68, lpFindFileData=0xaf4e8 | out: lpFindFileData=0xaf4e8) returned 1 [0066.101] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0066.101] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0066.101] FindNextFileA (in: hFindFile=0x5b6c68, lpFindFileData=0xaf4e8 | out: lpFindFileData=0xaf4e8) returned 1 [0066.101] PeekMessageA (in: lpMsg=0xaf4c4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf4c4) returned 0 [0066.101] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="bootmgr.exe.mui") returned 1 [0066.101] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bootmgr.exe.mui") returned 1 [0066.101] lstrcmpiA (lpString1="", lpString2="bootmgr.exe.mui") returned -1 [0066.101] PathFindFileNameA (pszPath="C:\\Boot\\nb-NO\\*.*") returned="*.*" [0066.101] lstrcatA (in: lpString1="C:\\Boot\\nb-NO\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\nb-NO\\bootmgr.exe.mui") returned="C:\\Boot\\nb-NO\\bootmgr.exe.mui" [0066.101] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.zip") returned 0 [0066.101] lstrlenA (lpString="*.zip") returned 5 [0066.102] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.rar") returned 0 [0066.102] lstrlenA (lpString="*.rar") returned 5 [0066.102] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.7z") returned 0 [0066.102] lstrlenA (lpString="*.7z") returned 4 [0066.102] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.tar") returned 0 [0066.102] lstrlenA (lpString="*.tar") returned 5 [0066.102] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.gzip") returned 0 [0066.102] lstrlenA (lpString="*.gzip") returned 6 [0066.102] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.jpg") returned 0 [0066.102] lstrlenA (lpString="*.jpg") returned 5 [0066.102] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.jpeg") returned 0 [0066.102] lstrlenA (lpString="*.jpeg") returned 6 [0066.102] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.psd") returned 0 [0066.102] lstrlenA (lpString="*.psd") returned 5 [0066.102] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.cdr") returned 0 [0066.102] lstrlenA (lpString="*.cdr") returned 5 [0066.102] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.dwg") returned 0 [0066.102] lstrlenA (lpString="*.dwg") returned 5 [0066.102] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.max") returned 0 [0066.102] lstrlenA (lpString="*.max") returned 5 [0066.102] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.bmp") returned 0 [0066.102] lstrlenA (lpString="*.bmp") returned 5 [0066.102] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.gif") returned 0 [0066.102] lstrlenA (lpString="*.gif") returned 5 [0066.102] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.png") returned 0 [0066.102] lstrlenA (lpString="*.png") returned 5 [0066.102] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.doc") returned 0 [0066.102] lstrlenA (lpString="*.doc") returned 5 [0066.102] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.docx") returned 0 [0066.102] lstrlenA (lpString="*.docx") returned 6 [0066.102] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.xls") returned 0 [0066.102] lstrlenA (lpString="*.xls") returned 5 [0066.102] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.xlsx") returned 0 [0066.102] lstrlenA (lpString="*.xlsx") returned 6 [0066.102] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.ppt") returned 0 [0066.103] lstrlenA (lpString="*.ppt") returned 5 [0066.103] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.pptx") returned 0 [0066.103] lstrlenA (lpString="*.pptx") returned 6 [0066.103] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.txt") returned 0 [0066.103] lstrlenA (lpString="*.txt") returned 5 [0066.103] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.pdf") returned 0 [0066.103] lstrlenA (lpString="*.pdf") returned 5 [0066.103] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.djvu") returned 0 [0066.103] lstrlenA (lpString="*.djvu") returned 6 [0066.103] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.htm") returned 0 [0066.103] lstrlenA (lpString="*.htm") returned 5 [0066.103] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.html") returned 0 [0066.103] lstrlenA (lpString="*.html") returned 6 [0066.103] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.mdb") returned 0 [0066.103] lstrlenA (lpString="*.mdb") returned 5 [0066.103] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.cer") returned 0 [0066.103] lstrlenA (lpString="*.cer") returned 5 [0066.103] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.p12") returned 0 [0066.103] lstrlenA (lpString="*.p12") returned 5 [0066.103] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.pfx") returned 0 [0066.103] lstrlenA (lpString="*.pfx") returned 5 [0066.103] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.kwm") returned 0 [0066.103] lstrlenA (lpString="*.kwm") returned 5 [0066.103] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.pwm") returned 0 [0066.103] lstrlenA (lpString="*.pwm") returned 5 [0066.103] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.1cd") returned 0 [0066.103] lstrlenA (lpString="*.1cd") returned 5 [0066.103] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.md") returned 0 [0066.103] lstrlenA (lpString="*.md") returned 4 [0066.103] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.mdf") returned 0 [0066.103] lstrlenA (lpString="*.mdf") returned 5 [0066.103] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.dbf") returned 0 [0066.103] lstrlenA (lpString="*.dbf") returned 5 [0066.103] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.odt") returned 0 [0066.103] lstrlenA (lpString="*.odt") returned 5 [0066.103] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.vob") returned 0 [0066.103] lstrlenA (lpString="*.vob") returned 5 [0066.104] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.ifo") returned 0 [0066.104] lstrlenA (lpString="*.ifo") returned 5 [0066.104] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.lnk") returned 0 [0066.104] lstrlenA (lpString="*.lnk") returned 5 [0066.104] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.torrent") returned 0 [0066.104] lstrlenA (lpString="*.torrent") returned 9 [0066.104] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.mov") returned 0 [0066.104] lstrlenA (lpString="*.mov") returned 5 [0066.104] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.m2v") returned 0 [0066.104] lstrlenA (lpString="*.m2v") returned 5 [0066.104] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.3gp") returned 0 [0066.104] lstrlenA (lpString="*.3gp") returned 5 [0066.104] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.mpeg") returned 0 [0066.104] lstrlenA (lpString="*.mpeg") returned 6 [0066.104] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.mpg") returned 0 [0066.104] lstrlenA (lpString="*.mpg") returned 5 [0066.104] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.flv") returned 0 [0066.104] lstrlenA (lpString="*.flv") returned 5 [0066.104] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.avi") returned 0 [0066.104] lstrlenA (lpString="*.avi") returned 5 [0066.104] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.mp4") returned 0 [0066.104] lstrlenA (lpString="*.mp4") returned 5 [0066.104] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.wmv") returned 0 [0066.104] lstrlenA (lpString="*.wmv") returned 5 [0066.104] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.divx") returned 0 [0066.104] lstrlenA (lpString="*.divx") returned 6 [0066.104] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.mkv") returned 0 [0066.104] lstrlenA (lpString="*.mkv") returned 5 [0066.104] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.mp3") returned 0 [0066.104] lstrlenA (lpString="*.mp3") returned 5 [0066.104] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.wav") returned 0 [0066.104] lstrlenA (lpString="*.wav") returned 5 [0066.104] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.flac") returned 0 [0066.104] lstrlenA (lpString="*.flac") returned 6 [0066.104] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.ape") returned 0 [0066.104] lstrlenA (lpString="*.ape") returned 5 [0066.104] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.wma") returned 0 [0066.104] lstrlenA (lpString="*.wma") returned 5 [0066.104] PathMatchSpecA (pszFile="C:\\Boot\\nb-NO\\bootmgr.exe.mui", pszSpec="*.ac3") returned 0 [0066.104] lstrlenA (lpString="*.ac3") returned 5 [0066.104] FindNextFileA (in: hFindFile=0x5b6c68, lpFindFileData=0xaf4e8 | out: lpFindFileData=0xaf4e8) returned 0 [0066.104] FindClose (in: hFindFile=0x5b6c68 | out: hFindFile=0x5b6c68) returned 1 [0066.105] FindNextFileA (in: hFindFile=0x5b5bf0, lpFindFileData=0xaf638 | out: lpFindFileData=0xaf638) returned 1 [0066.105] lstrcmpA (lpString1=".", lpString2="nl-NL") returned -1 [0066.105] lstrcmpA (lpString1="..", lpString2="nl-NL") returned -1 [0066.105] PathFindFileNameA (pszPath="C:\\Boot\\*.*") returned="*.*" [0066.105] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="nl-NL" | out: lpString1="C:\\Boot\\nl-NL") returned="C:\\Boot\\nl-NL" [0066.105] lstrlenA (lpString="C:\\Boot\\nl-NL") returned 13 [0066.105] FindFirstFileA (in: lpFileName="C:\\Boot\\nl-NL\\*.*", lpFindFileData=0xaf4e8 | out: lpFindFileData=0xaf4e8) returned 0x5b6c68 [0066.113] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0066.113] FindNextFileA (in: hFindFile=0x5b6c68, lpFindFileData=0xaf4e8 | out: lpFindFileData=0xaf4e8) returned 1 [0066.113] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0066.113] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0066.113] FindNextFileA (in: hFindFile=0x5b6c68, lpFindFileData=0xaf4e8 | out: lpFindFileData=0xaf4e8) returned 1 [0066.113] PeekMessageA (in: lpMsg=0xaf4c4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf4c4) returned 0 [0066.113] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="bootmgr.exe.mui") returned 1 [0066.113] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bootmgr.exe.mui") returned 1 [0066.113] lstrcmpiA (lpString1="", lpString2="bootmgr.exe.mui") returned -1 [0066.113] PathFindFileNameA (pszPath="C:\\Boot\\nl-NL\\*.*") returned="*.*" [0066.113] lstrcatA (in: lpString1="C:\\Boot\\nl-NL\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\nl-NL\\bootmgr.exe.mui") returned="C:\\Boot\\nl-NL\\bootmgr.exe.mui" [0066.114] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.zip") returned 0 [0066.114] lstrlenA (lpString="*.zip") returned 5 [0066.114] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.rar") returned 0 [0066.114] lstrlenA (lpString="*.rar") returned 5 [0066.114] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.7z") returned 0 [0066.114] lstrlenA (lpString="*.7z") returned 4 [0066.114] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.tar") returned 0 [0066.114] lstrlenA (lpString="*.tar") returned 5 [0066.114] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.gzip") returned 0 [0066.114] lstrlenA (lpString="*.gzip") returned 6 [0066.114] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.jpg") returned 0 [0066.114] lstrlenA (lpString="*.jpg") returned 5 [0066.114] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.jpeg") returned 0 [0066.114] lstrlenA (lpString="*.jpeg") returned 6 [0066.114] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.psd") returned 0 [0066.114] lstrlenA (lpString="*.psd") returned 5 [0066.114] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.cdr") returned 0 [0066.114] lstrlenA (lpString="*.cdr") returned 5 [0066.114] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.dwg") returned 0 [0066.114] lstrlenA (lpString="*.dwg") returned 5 [0066.114] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.max") returned 0 [0066.114] lstrlenA (lpString="*.max") returned 5 [0066.114] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.bmp") returned 0 [0066.114] lstrlenA (lpString="*.bmp") returned 5 [0066.114] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.gif") returned 0 [0066.114] lstrlenA (lpString="*.gif") returned 5 [0066.114] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.png") returned 0 [0066.115] lstrlenA (lpString="*.png") returned 5 [0066.115] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.doc") returned 0 [0066.115] lstrlenA (lpString="*.doc") returned 5 [0066.115] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.docx") returned 0 [0066.115] lstrlenA (lpString="*.docx") returned 6 [0066.115] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.xls") returned 0 [0066.115] lstrlenA (lpString="*.xls") returned 5 [0066.115] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.xlsx") returned 0 [0066.115] lstrlenA (lpString="*.xlsx") returned 6 [0066.115] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.ppt") returned 0 [0066.115] lstrlenA (lpString="*.ppt") returned 5 [0066.115] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.pptx") returned 0 [0066.115] lstrlenA (lpString="*.pptx") returned 6 [0066.115] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.txt") returned 0 [0066.115] lstrlenA (lpString="*.txt") returned 5 [0066.115] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.pdf") returned 0 [0066.115] lstrlenA (lpString="*.pdf") returned 5 [0066.115] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.djvu") returned 0 [0066.115] lstrlenA (lpString="*.djvu") returned 6 [0066.115] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.htm") returned 0 [0066.115] lstrlenA (lpString="*.htm") returned 5 [0066.115] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.html") returned 0 [0066.115] lstrlenA (lpString="*.html") returned 6 [0066.115] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.mdb") returned 0 [0066.115] lstrlenA (lpString="*.mdb") returned 5 [0066.115] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.cer") returned 0 [0066.115] lstrlenA (lpString="*.cer") returned 5 [0066.115] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.p12") returned 0 [0066.115] lstrlenA (lpString="*.p12") returned 5 [0066.115] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.pfx") returned 0 [0066.115] lstrlenA (lpString="*.pfx") returned 5 [0066.115] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.kwm") returned 0 [0066.115] lstrlenA (lpString="*.kwm") returned 5 [0066.115] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.pwm") returned 0 [0066.115] lstrlenA (lpString="*.pwm") returned 5 [0066.115] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.1cd") returned 0 [0066.115] lstrlenA (lpString="*.1cd") returned 5 [0066.115] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.md") returned 0 [0066.115] lstrlenA (lpString="*.md") returned 4 [0066.115] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.mdf") returned 0 [0066.115] lstrlenA (lpString="*.mdf") returned 5 [0066.115] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.dbf") returned 0 [0066.115] lstrlenA (lpString="*.dbf") returned 5 [0066.115] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.odt") returned 0 [0066.115] lstrlenA (lpString="*.odt") returned 5 [0066.115] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.vob") returned 0 [0066.115] lstrlenA (lpString="*.vob") returned 5 [0066.115] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.ifo") returned 0 [0066.115] lstrlenA (lpString="*.ifo") returned 5 [0066.115] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.lnk") returned 0 [0066.116] lstrlenA (lpString="*.lnk") returned 5 [0066.116] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.torrent") returned 0 [0066.116] lstrlenA (lpString="*.torrent") returned 9 [0066.116] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.mov") returned 0 [0066.116] lstrlenA (lpString="*.mov") returned 5 [0066.116] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.m2v") returned 0 [0066.116] lstrlenA (lpString="*.m2v") returned 5 [0066.116] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.3gp") returned 0 [0066.116] lstrlenA (lpString="*.3gp") returned 5 [0066.116] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.mpeg") returned 0 [0066.116] lstrlenA (lpString="*.mpeg") returned 6 [0066.116] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.mpg") returned 0 [0066.116] lstrlenA (lpString="*.mpg") returned 5 [0066.116] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.flv") returned 0 [0066.116] lstrlenA (lpString="*.flv") returned 5 [0066.116] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.avi") returned 0 [0066.116] lstrlenA (lpString="*.avi") returned 5 [0066.116] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.mp4") returned 0 [0066.116] lstrlenA (lpString="*.mp4") returned 5 [0066.116] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.wmv") returned 0 [0066.116] lstrlenA (lpString="*.wmv") returned 5 [0066.116] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.divx") returned 0 [0066.116] lstrlenA (lpString="*.divx") returned 6 [0066.116] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.mkv") returned 0 [0066.116] lstrlenA (lpString="*.mkv") returned 5 [0066.116] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.mp3") returned 0 [0066.116] lstrlenA (lpString="*.mp3") returned 5 [0066.116] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.wav") returned 0 [0066.116] lstrlenA (lpString="*.wav") returned 5 [0066.116] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.flac") returned 0 [0066.116] lstrlenA (lpString="*.flac") returned 6 [0066.116] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.ape") returned 0 [0066.116] lstrlenA (lpString="*.ape") returned 5 [0066.116] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.wma") returned 0 [0066.116] lstrlenA (lpString="*.wma") returned 5 [0066.116] PathMatchSpecA (pszFile="C:\\Boot\\nl-NL\\bootmgr.exe.mui", pszSpec="*.ac3") returned 0 [0066.117] lstrlenA (lpString="*.ac3") returned 5 [0066.117] FindNextFileA (in: hFindFile=0x5b6c68, lpFindFileData=0xaf4e8 | out: lpFindFileData=0xaf4e8) returned 0 [0066.117] FindClose (in: hFindFile=0x5b6c68 | out: hFindFile=0x5b6c68) returned 1 [0066.117] FindNextFileA (in: hFindFile=0x5b5bf0, lpFindFileData=0xaf638 | out: lpFindFileData=0xaf638) returned 1 [0066.117] lstrcmpA (lpString1=".", lpString2="pl-PL") returned -1 [0066.117] lstrcmpA (lpString1="..", lpString2="pl-PL") returned -1 [0066.117] PathFindFileNameA (pszPath="C:\\Boot\\*.*") returned="*.*" [0066.117] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="pl-PL" | out: lpString1="C:\\Boot\\pl-PL") returned="C:\\Boot\\pl-PL" [0066.117] lstrlenA (lpString="C:\\Boot\\pl-PL") returned 13 [0066.117] FindFirstFileA (in: lpFileName="C:\\Boot\\pl-PL\\*.*", lpFindFileData=0xaf4e8 | out: lpFindFileData=0xaf4e8) returned 0x5b6c68 [0066.117] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0066.117] FindNextFileA (in: hFindFile=0x5b6c68, lpFindFileData=0xaf4e8 | out: lpFindFileData=0xaf4e8) returned 1 [0066.117] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0066.117] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0066.117] FindNextFileA (in: hFindFile=0x5b6c68, lpFindFileData=0xaf4e8 | out: lpFindFileData=0xaf4e8) returned 1 [0066.117] PeekMessageA (in: lpMsg=0xaf4c4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf4c4) returned 0 [0066.117] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="bootmgr.exe.mui") returned 1 [0066.117] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bootmgr.exe.mui") returned 1 [0066.117] lstrcmpiA (lpString1="", lpString2="bootmgr.exe.mui") returned -1 [0066.117] PathFindFileNameA (pszPath="C:\\Boot\\pl-PL\\*.*") returned="*.*" [0066.117] lstrcatA (in: lpString1="C:\\Boot\\pl-PL\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\pl-PL\\bootmgr.exe.mui") returned="C:\\Boot\\pl-PL\\bootmgr.exe.mui" [0066.118] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.zip") returned 0 [0066.118] lstrlenA (lpString="*.zip") returned 5 [0066.118] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.rar") returned 0 [0066.118] lstrlenA (lpString="*.rar") returned 5 [0066.118] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.7z") returned 0 [0066.118] lstrlenA (lpString="*.7z") returned 4 [0066.118] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.tar") returned 0 [0066.118] lstrlenA (lpString="*.tar") returned 5 [0066.118] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.gzip") returned 0 [0066.118] lstrlenA (lpString="*.gzip") returned 6 [0066.118] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.jpg") returned 0 [0066.118] lstrlenA (lpString="*.jpg") returned 5 [0066.118] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.jpeg") returned 0 [0066.118] lstrlenA (lpString="*.jpeg") returned 6 [0066.118] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.psd") returned 0 [0066.118] lstrlenA (lpString="*.psd") returned 5 [0066.118] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.cdr") returned 0 [0066.118] lstrlenA (lpString="*.cdr") returned 5 [0066.118] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.dwg") returned 0 [0066.118] lstrlenA (lpString="*.dwg") returned 5 [0066.118] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.max") returned 0 [0066.118] lstrlenA (lpString="*.max") returned 5 [0066.118] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.bmp") returned 0 [0066.118] lstrlenA (lpString="*.bmp") returned 5 [0066.118] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.gif") returned 0 [0066.118] lstrlenA (lpString="*.gif") returned 5 [0066.118] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.png") returned 0 [0066.118] lstrlenA (lpString="*.png") returned 5 [0066.118] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.doc") returned 0 [0066.118] lstrlenA (lpString="*.doc") returned 5 [0066.118] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.docx") returned 0 [0066.118] lstrlenA (lpString="*.docx") returned 6 [0066.118] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.xls") returned 0 [0066.118] lstrlenA (lpString="*.xls") returned 5 [0066.118] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.xlsx") returned 0 [0066.118] lstrlenA (lpString="*.xlsx") returned 6 [0066.118] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.ppt") returned 0 [0066.118] lstrlenA (lpString="*.ppt") returned 5 [0066.118] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.pptx") returned 0 [0066.118] lstrlenA (lpString="*.pptx") returned 6 [0066.118] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.txt") returned 0 [0066.118] lstrlenA (lpString="*.txt") returned 5 [0066.118] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.pdf") returned 0 [0066.118] lstrlenA (lpString="*.pdf") returned 5 [0066.118] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.djvu") returned 0 [0066.119] lstrlenA (lpString="*.djvu") returned 6 [0066.119] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.htm") returned 0 [0066.119] lstrlenA (lpString="*.htm") returned 5 [0066.119] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.html") returned 0 [0066.119] lstrlenA (lpString="*.html") returned 6 [0066.119] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.mdb") returned 0 [0066.119] lstrlenA (lpString="*.mdb") returned 5 [0066.119] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.cer") returned 0 [0066.119] lstrlenA (lpString="*.cer") returned 5 [0066.119] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.p12") returned 0 [0066.119] lstrlenA (lpString="*.p12") returned 5 [0066.119] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.pfx") returned 0 [0066.119] lstrlenA (lpString="*.pfx") returned 5 [0066.119] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.kwm") returned 0 [0066.119] lstrlenA (lpString="*.kwm") returned 5 [0066.119] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.pwm") returned 0 [0066.119] lstrlenA (lpString="*.pwm") returned 5 [0066.119] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.1cd") returned 0 [0066.119] lstrlenA (lpString="*.1cd") returned 5 [0066.119] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.md") returned 0 [0066.119] lstrlenA (lpString="*.md") returned 4 [0066.119] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.mdf") returned 0 [0066.119] lstrlenA (lpString="*.mdf") returned 5 [0066.119] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.dbf") returned 0 [0066.119] lstrlenA (lpString="*.dbf") returned 5 [0066.119] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.odt") returned 0 [0066.119] lstrlenA (lpString="*.odt") returned 5 [0066.119] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.vob") returned 0 [0066.119] lstrlenA (lpString="*.vob") returned 5 [0066.119] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.ifo") returned 0 [0066.119] lstrlenA (lpString="*.ifo") returned 5 [0066.119] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.lnk") returned 0 [0066.119] lstrlenA (lpString="*.lnk") returned 5 [0066.119] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.torrent") returned 0 [0066.119] lstrlenA (lpString="*.torrent") returned 9 [0066.119] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.mov") returned 0 [0066.119] lstrlenA (lpString="*.mov") returned 5 [0066.119] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.m2v") returned 0 [0066.119] lstrlenA (lpString="*.m2v") returned 5 [0066.119] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.3gp") returned 0 [0066.119] lstrlenA (lpString="*.3gp") returned 5 [0066.119] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.mpeg") returned 0 [0066.119] lstrlenA (lpString="*.mpeg") returned 6 [0066.119] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.mpg") returned 0 [0066.119] lstrlenA (lpString="*.mpg") returned 5 [0066.119] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.flv") returned 0 [0066.120] lstrlenA (lpString="*.flv") returned 5 [0066.120] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.avi") returned 0 [0066.120] lstrlenA (lpString="*.avi") returned 5 [0066.120] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.mp4") returned 0 [0066.120] lstrlenA (lpString="*.mp4") returned 5 [0066.120] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.wmv") returned 0 [0066.120] lstrlenA (lpString="*.wmv") returned 5 [0066.120] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.divx") returned 0 [0066.120] lstrlenA (lpString="*.divx") returned 6 [0066.120] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.mkv") returned 0 [0066.120] lstrlenA (lpString="*.mkv") returned 5 [0066.120] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.mp3") returned 0 [0066.120] lstrlenA (lpString="*.mp3") returned 5 [0066.120] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.wav") returned 0 [0066.120] lstrlenA (lpString="*.wav") returned 5 [0066.120] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.flac") returned 0 [0066.120] lstrlenA (lpString="*.flac") returned 6 [0066.120] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.ape") returned 0 [0066.120] lstrlenA (lpString="*.ape") returned 5 [0066.120] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.wma") returned 0 [0066.120] lstrlenA (lpString="*.wma") returned 5 [0066.120] PathMatchSpecA (pszFile="C:\\Boot\\pl-PL\\bootmgr.exe.mui", pszSpec="*.ac3") returned 0 [0066.120] lstrlenA (lpString="*.ac3") returned 5 [0066.120] FindNextFileA (in: hFindFile=0x5b6c68, lpFindFileData=0xaf4e8 | out: lpFindFileData=0xaf4e8) returned 0 [0066.120] FindClose (in: hFindFile=0x5b6c68 | out: hFindFile=0x5b6c68) returned 1 [0066.120] FindNextFileA (in: hFindFile=0x5b5bf0, lpFindFileData=0xaf638 | out: lpFindFileData=0xaf638) returned 1 [0066.120] lstrcmpA (lpString1=".", lpString2="pt-BR") returned -1 [0066.120] lstrcmpA (lpString1="..", lpString2="pt-BR") returned -1 [0066.120] PathFindFileNameA (pszPath="C:\\Boot\\*.*") returned="*.*" [0066.120] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="pt-BR" | out: lpString1="C:\\Boot\\pt-BR") returned="C:\\Boot\\pt-BR" [0066.120] lstrlenA (lpString="C:\\Boot\\pt-BR") returned 13 [0066.120] FindFirstFileA (in: lpFileName="C:\\Boot\\pt-BR\\*.*", lpFindFileData=0xaf4e8 | out: lpFindFileData=0xaf4e8) returned 0x5b6c68 [0066.124] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0066.124] FindNextFileA (in: hFindFile=0x5b6c68, lpFindFileData=0xaf4e8 | out: lpFindFileData=0xaf4e8) returned 1 [0066.124] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0066.124] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0066.124] FindNextFileA (in: hFindFile=0x5b6c68, lpFindFileData=0xaf4e8 | out: lpFindFileData=0xaf4e8) returned 1 [0066.124] PeekMessageA (in: lpMsg=0xaf4c4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf4c4) returned 0 [0066.124] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="bootmgr.exe.mui") returned 1 [0066.124] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bootmgr.exe.mui") returned 1 [0066.124] lstrcmpiA (lpString1="", lpString2="bootmgr.exe.mui") returned -1 [0066.124] PathFindFileNameA (pszPath="C:\\Boot\\pt-BR\\*.*") returned="*.*" [0066.124] lstrcatA (in: lpString1="C:\\Boot\\pt-BR\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\pt-BR\\bootmgr.exe.mui") returned="C:\\Boot\\pt-BR\\bootmgr.exe.mui" [0066.124] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.zip") returned 0 [0066.124] lstrlenA (lpString="*.zip") returned 5 [0066.124] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.rar") returned 0 [0066.124] lstrlenA (lpString="*.rar") returned 5 [0066.125] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.7z") returned 0 [0066.125] lstrlenA (lpString="*.7z") returned 4 [0066.125] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.tar") returned 0 [0066.125] lstrlenA (lpString="*.tar") returned 5 [0066.125] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.gzip") returned 0 [0066.125] lstrlenA (lpString="*.gzip") returned 6 [0066.125] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.jpg") returned 0 [0066.125] lstrlenA (lpString="*.jpg") returned 5 [0066.125] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.jpeg") returned 0 [0066.125] lstrlenA (lpString="*.jpeg") returned 6 [0066.125] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.psd") returned 0 [0066.125] lstrlenA (lpString="*.psd") returned 5 [0066.125] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.cdr") returned 0 [0066.125] lstrlenA (lpString="*.cdr") returned 5 [0066.125] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.dwg") returned 0 [0066.125] lstrlenA (lpString="*.dwg") returned 5 [0066.125] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.max") returned 0 [0066.125] lstrlenA (lpString="*.max") returned 5 [0066.125] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.bmp") returned 0 [0066.125] lstrlenA (lpString="*.bmp") returned 5 [0066.125] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.gif") returned 0 [0066.125] lstrlenA (lpString="*.gif") returned 5 [0066.125] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.png") returned 0 [0066.125] lstrlenA (lpString="*.png") returned 5 [0066.125] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.doc") returned 0 [0066.125] lstrlenA (lpString="*.doc") returned 5 [0066.125] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.docx") returned 0 [0066.125] lstrlenA (lpString="*.docx") returned 6 [0066.125] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.xls") returned 0 [0066.125] lstrlenA (lpString="*.xls") returned 5 [0066.125] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.xlsx") returned 0 [0066.125] lstrlenA (lpString="*.xlsx") returned 6 [0066.125] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.ppt") returned 0 [0066.125] lstrlenA (lpString="*.ppt") returned 5 [0066.125] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.pptx") returned 0 [0066.125] lstrlenA (lpString="*.pptx") returned 6 [0066.126] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.txt") returned 0 [0066.126] lstrlenA (lpString="*.txt") returned 5 [0066.126] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.pdf") returned 0 [0066.126] lstrlenA (lpString="*.pdf") returned 5 [0066.126] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.djvu") returned 0 [0066.126] lstrlenA (lpString="*.djvu") returned 6 [0066.126] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.htm") returned 0 [0066.126] lstrlenA (lpString="*.htm") returned 5 [0066.126] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.html") returned 0 [0066.126] lstrlenA (lpString="*.html") returned 6 [0066.126] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.mdb") returned 0 [0066.126] lstrlenA (lpString="*.mdb") returned 5 [0066.126] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.cer") returned 0 [0066.126] lstrlenA (lpString="*.cer") returned 5 [0066.126] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.p12") returned 0 [0066.126] lstrlenA (lpString="*.p12") returned 5 [0066.126] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.pfx") returned 0 [0066.126] lstrlenA (lpString="*.pfx") returned 5 [0066.126] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.kwm") returned 0 [0066.126] lstrlenA (lpString="*.kwm") returned 5 [0066.126] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.pwm") returned 0 [0066.126] lstrlenA (lpString="*.pwm") returned 5 [0066.126] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.1cd") returned 0 [0066.126] lstrlenA (lpString="*.1cd") returned 5 [0066.126] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.md") returned 0 [0066.126] lstrlenA (lpString="*.md") returned 4 [0066.126] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.mdf") returned 0 [0066.126] lstrlenA (lpString="*.mdf") returned 5 [0066.126] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.dbf") returned 0 [0066.126] lstrlenA (lpString="*.dbf") returned 5 [0066.126] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.odt") returned 0 [0066.126] lstrlenA (lpString="*.odt") returned 5 [0066.126] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.vob") returned 0 [0066.126] lstrlenA (lpString="*.vob") returned 5 [0066.126] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.ifo") returned 0 [0066.126] lstrlenA (lpString="*.ifo") returned 5 [0066.126] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.lnk") returned 0 [0066.126] lstrlenA (lpString="*.lnk") returned 5 [0066.126] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.torrent") returned 0 [0066.126] lstrlenA (lpString="*.torrent") returned 9 [0066.126] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.mov") returned 0 [0066.126] lstrlenA (lpString="*.mov") returned 5 [0066.127] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.m2v") returned 0 [0066.127] lstrlenA (lpString="*.m2v") returned 5 [0066.127] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.3gp") returned 0 [0066.127] lstrlenA (lpString="*.3gp") returned 5 [0066.127] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.mpeg") returned 0 [0066.127] lstrlenA (lpString="*.mpeg") returned 6 [0066.127] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.mpg") returned 0 [0066.127] lstrlenA (lpString="*.mpg") returned 5 [0066.127] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.flv") returned 0 [0066.127] lstrlenA (lpString="*.flv") returned 5 [0066.127] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.avi") returned 0 [0066.127] lstrlenA (lpString="*.avi") returned 5 [0066.127] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.mp4") returned 0 [0066.127] lstrlenA (lpString="*.mp4") returned 5 [0066.127] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.wmv") returned 0 [0066.127] lstrlenA (lpString="*.wmv") returned 5 [0066.127] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.divx") returned 0 [0066.127] lstrlenA (lpString="*.divx") returned 6 [0066.127] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.mkv") returned 0 [0066.127] lstrlenA (lpString="*.mkv") returned 5 [0066.127] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.mp3") returned 0 [0066.127] lstrlenA (lpString="*.mp3") returned 5 [0066.127] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.wav") returned 0 [0066.127] lstrlenA (lpString="*.wav") returned 5 [0066.127] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.flac") returned 0 [0066.127] lstrlenA (lpString="*.flac") returned 6 [0066.127] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.ape") returned 0 [0066.127] lstrlenA (lpString="*.ape") returned 5 [0066.127] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.wma") returned 0 [0066.127] lstrlenA (lpString="*.wma") returned 5 [0066.127] PathMatchSpecA (pszFile="C:\\Boot\\pt-BR\\bootmgr.exe.mui", pszSpec="*.ac3") returned 0 [0066.127] lstrlenA (lpString="*.ac3") returned 5 [0066.127] FindNextFileA (in: hFindFile=0x5b6c68, lpFindFileData=0xaf4e8 | out: lpFindFileData=0xaf4e8) returned 0 [0066.127] FindClose (in: hFindFile=0x5b6c68 | out: hFindFile=0x5b6c68) returned 1 [0066.128] FindNextFileA (in: hFindFile=0x5b5bf0, lpFindFileData=0xaf638 | out: lpFindFileData=0xaf638) returned 1 [0066.128] lstrcmpA (lpString1=".", lpString2="pt-PT") returned -1 [0066.128] lstrcmpA (lpString1="..", lpString2="pt-PT") returned -1 [0066.128] PathFindFileNameA (pszPath="C:\\Boot\\*.*") returned="*.*" [0066.128] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="pt-PT" | out: lpString1="C:\\Boot\\pt-PT") returned="C:\\Boot\\pt-PT" [0066.128] lstrlenA (lpString="C:\\Boot\\pt-PT") returned 13 [0066.128] FindFirstFileA (in: lpFileName="C:\\Boot\\pt-PT\\*.*", lpFindFileData=0xaf4e8 | out: lpFindFileData=0xaf4e8) returned 0x5b6c68 [0066.128] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0066.128] FindNextFileA (in: hFindFile=0x5b6c68, lpFindFileData=0xaf4e8 | out: lpFindFileData=0xaf4e8) returned 1 [0066.128] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0066.128] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0066.128] FindNextFileA (in: hFindFile=0x5b6c68, lpFindFileData=0xaf4e8 | out: lpFindFileData=0xaf4e8) returned 1 [0066.128] PeekMessageA (in: lpMsg=0xaf4c4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf4c4) returned 0 [0066.128] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="bootmgr.exe.mui") returned 1 [0066.128] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bootmgr.exe.mui") returned 1 [0066.128] lstrcmpiA (lpString1="", lpString2="bootmgr.exe.mui") returned -1 [0066.128] PathFindFileNameA (pszPath="C:\\Boot\\pt-PT\\*.*") returned="*.*" [0066.128] lstrcatA (in: lpString1="C:\\Boot\\pt-PT\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\pt-PT\\bootmgr.exe.mui") returned="C:\\Boot\\pt-PT\\bootmgr.exe.mui" [0066.128] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.zip") returned 0 [0066.128] lstrlenA (lpString="*.zip") returned 5 [0066.128] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.rar") returned 0 [0066.128] lstrlenA (lpString="*.rar") returned 5 [0066.128] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.7z") returned 0 [0066.128] lstrlenA (lpString="*.7z") returned 4 [0066.128] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.tar") returned 0 [0066.128] lstrlenA (lpString="*.tar") returned 5 [0066.128] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.gzip") returned 0 [0066.128] lstrlenA (lpString="*.gzip") returned 6 [0066.129] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.jpg") returned 0 [0066.129] lstrlenA (lpString="*.jpg") returned 5 [0066.129] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.jpeg") returned 0 [0066.129] lstrlenA (lpString="*.jpeg") returned 6 [0066.129] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.psd") returned 0 [0066.129] lstrlenA (lpString="*.psd") returned 5 [0066.129] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.cdr") returned 0 [0066.129] lstrlenA (lpString="*.cdr") returned 5 [0066.129] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.dwg") returned 0 [0066.129] lstrlenA (lpString="*.dwg") returned 5 [0066.129] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.max") returned 0 [0066.129] lstrlenA (lpString="*.max") returned 5 [0066.129] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.bmp") returned 0 [0066.129] lstrlenA (lpString="*.bmp") returned 5 [0066.129] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.gif") returned 0 [0066.129] lstrlenA (lpString="*.gif") returned 5 [0066.129] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.png") returned 0 [0066.129] lstrlenA (lpString="*.png") returned 5 [0066.129] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.doc") returned 0 [0066.129] lstrlenA (lpString="*.doc") returned 5 [0066.129] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.docx") returned 0 [0066.129] lstrlenA (lpString="*.docx") returned 6 [0066.129] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.xls") returned 0 [0066.129] lstrlenA (lpString="*.xls") returned 5 [0066.129] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.xlsx") returned 0 [0066.129] lstrlenA (lpString="*.xlsx") returned 6 [0066.129] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.ppt") returned 0 [0066.129] lstrlenA (lpString="*.ppt") returned 5 [0066.129] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.pptx") returned 0 [0066.129] lstrlenA (lpString="*.pptx") returned 6 [0066.129] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.txt") returned 0 [0066.129] lstrlenA (lpString="*.txt") returned 5 [0066.129] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.pdf") returned 0 [0066.129] lstrlenA (lpString="*.pdf") returned 5 [0066.129] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.djvu") returned 0 [0066.129] lstrlenA (lpString="*.djvu") returned 6 [0066.129] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.htm") returned 0 [0066.129] lstrlenA (lpString="*.htm") returned 5 [0066.129] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.html") returned 0 [0066.129] lstrlenA (lpString="*.html") returned 6 [0066.129] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.mdb") returned 0 [0066.130] lstrlenA (lpString="*.mdb") returned 5 [0066.130] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.cer") returned 0 [0066.130] lstrlenA (lpString="*.cer") returned 5 [0066.130] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.p12") returned 0 [0066.130] lstrlenA (lpString="*.p12") returned 5 [0066.130] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.pfx") returned 0 [0066.130] lstrlenA (lpString="*.pfx") returned 5 [0066.130] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.kwm") returned 0 [0066.130] lstrlenA (lpString="*.kwm") returned 5 [0066.130] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.pwm") returned 0 [0066.130] lstrlenA (lpString="*.pwm") returned 5 [0066.130] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.1cd") returned 0 [0066.130] lstrlenA (lpString="*.1cd") returned 5 [0066.130] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.md") returned 0 [0066.130] lstrlenA (lpString="*.md") returned 4 [0066.130] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.mdf") returned 0 [0066.130] lstrlenA (lpString="*.mdf") returned 5 [0066.130] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.dbf") returned 0 [0066.130] lstrlenA (lpString="*.dbf") returned 5 [0066.130] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.odt") returned 0 [0066.130] lstrlenA (lpString="*.odt") returned 5 [0066.130] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.vob") returned 0 [0066.130] lstrlenA (lpString="*.vob") returned 5 [0066.130] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.ifo") returned 0 [0066.130] lstrlenA (lpString="*.ifo") returned 5 [0066.130] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.lnk") returned 0 [0066.130] lstrlenA (lpString="*.lnk") returned 5 [0066.130] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.torrent") returned 0 [0066.130] lstrlenA (lpString="*.torrent") returned 9 [0066.130] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.mov") returned 0 [0066.130] lstrlenA (lpString="*.mov") returned 5 [0066.130] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.m2v") returned 0 [0066.130] lstrlenA (lpString="*.m2v") returned 5 [0066.130] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.3gp") returned 0 [0066.130] lstrlenA (lpString="*.3gp") returned 5 [0066.130] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.mpeg") returned 0 [0066.130] lstrlenA (lpString="*.mpeg") returned 6 [0066.130] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.mpg") returned 0 [0066.130] lstrlenA (lpString="*.mpg") returned 5 [0066.130] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.flv") returned 0 [0066.130] lstrlenA (lpString="*.flv") returned 5 [0066.130] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.avi") returned 0 [0066.130] lstrlenA (lpString="*.avi") returned 5 [0066.130] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.mp4") returned 0 [0066.130] lstrlenA (lpString="*.mp4") returned 5 [0066.130] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.wmv") returned 0 [0066.131] lstrlenA (lpString="*.wmv") returned 5 [0066.131] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.divx") returned 0 [0066.131] lstrlenA (lpString="*.divx") returned 6 [0066.131] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.mkv") returned 0 [0066.131] lstrlenA (lpString="*.mkv") returned 5 [0066.131] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.mp3") returned 0 [0066.131] lstrlenA (lpString="*.mp3") returned 5 [0066.131] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.wav") returned 0 [0066.131] lstrlenA (lpString="*.wav") returned 5 [0066.131] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.flac") returned 0 [0066.131] lstrlenA (lpString="*.flac") returned 6 [0066.131] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.ape") returned 0 [0066.131] lstrlenA (lpString="*.ape") returned 5 [0066.131] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.wma") returned 0 [0066.131] lstrlenA (lpString="*.wma") returned 5 [0066.131] PathMatchSpecA (pszFile="C:\\Boot\\pt-PT\\bootmgr.exe.mui", pszSpec="*.ac3") returned 0 [0066.131] lstrlenA (lpString="*.ac3") returned 5 [0066.131] FindNextFileA (in: hFindFile=0x5b6c68, lpFindFileData=0xaf4e8 | out: lpFindFileData=0xaf4e8) returned 0 [0066.131] FindClose (in: hFindFile=0x5b6c68 | out: hFindFile=0x5b6c68) returned 1 [0066.131] FindNextFileA (in: hFindFile=0x5b5bf0, lpFindFileData=0xaf638 | out: lpFindFileData=0xaf638) returned 1 [0066.131] lstrcmpA (lpString1=".", lpString2="ru-RU") returned -1 [0066.131] lstrcmpA (lpString1="..", lpString2="ru-RU") returned -1 [0066.131] PathFindFileNameA (pszPath="C:\\Boot\\*.*") returned="*.*" [0066.131] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="ru-RU" | out: lpString1="C:\\Boot\\ru-RU") returned="C:\\Boot\\ru-RU" [0066.131] lstrlenA (lpString="C:\\Boot\\ru-RU") returned 13 [0066.131] FindFirstFileA (in: lpFileName="C:\\Boot\\ru-RU\\*.*", lpFindFileData=0xaf4e8 | out: lpFindFileData=0xaf4e8) returned 0x5b6c68 [0066.132] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0066.132] FindNextFileA (in: hFindFile=0x5b6c68, lpFindFileData=0xaf4e8 | out: lpFindFileData=0xaf4e8) returned 1 [0066.132] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0066.132] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0066.132] FindNextFileA (in: hFindFile=0x5b6c68, lpFindFileData=0xaf4e8 | out: lpFindFileData=0xaf4e8) returned 1 [0066.132] PeekMessageA (in: lpMsg=0xaf4c4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf4c4) returned 0 [0066.132] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="bootmgr.exe.mui") returned 1 [0066.132] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bootmgr.exe.mui") returned 1 [0066.132] lstrcmpiA (lpString1="", lpString2="bootmgr.exe.mui") returned -1 [0066.132] PathFindFileNameA (pszPath="C:\\Boot\\ru-RU\\*.*") returned="*.*" [0066.132] lstrcatA (in: lpString1="C:\\Boot\\ru-RU\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\ru-RU\\bootmgr.exe.mui") returned="C:\\Boot\\ru-RU\\bootmgr.exe.mui" [0066.132] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.zip") returned 0 [0066.132] lstrlenA (lpString="*.zip") returned 5 [0066.132] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.rar") returned 0 [0066.132] lstrlenA (lpString="*.rar") returned 5 [0066.132] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.7z") returned 0 [0066.132] lstrlenA (lpString="*.7z") returned 4 [0066.132] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.tar") returned 0 [0066.132] lstrlenA (lpString="*.tar") returned 5 [0066.132] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.gzip") returned 0 [0066.133] lstrlenA (lpString="*.gzip") returned 6 [0066.133] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.jpg") returned 0 [0066.133] lstrlenA (lpString="*.jpg") returned 5 [0066.133] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.jpeg") returned 0 [0066.133] lstrlenA (lpString="*.jpeg") returned 6 [0066.133] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.psd") returned 0 [0066.133] lstrlenA (lpString="*.psd") returned 5 [0066.133] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.cdr") returned 0 [0066.133] lstrlenA (lpString="*.cdr") returned 5 [0066.133] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.dwg") returned 0 [0066.133] lstrlenA (lpString="*.dwg") returned 5 [0066.133] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.max") returned 0 [0066.133] lstrlenA (lpString="*.max") returned 5 [0066.133] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.bmp") returned 0 [0066.133] lstrlenA (lpString="*.bmp") returned 5 [0066.133] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.gif") returned 0 [0066.133] lstrlenA (lpString="*.gif") returned 5 [0066.133] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.png") returned 0 [0066.133] lstrlenA (lpString="*.png") returned 5 [0066.133] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.doc") returned 0 [0066.133] lstrlenA (lpString="*.doc") returned 5 [0066.133] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.docx") returned 0 [0066.133] lstrlenA (lpString="*.docx") returned 6 [0066.133] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.xls") returned 0 [0066.133] lstrlenA (lpString="*.xls") returned 5 [0066.133] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.xlsx") returned 0 [0066.133] lstrlenA (lpString="*.xlsx") returned 6 [0066.133] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.ppt") returned 0 [0066.133] lstrlenA (lpString="*.ppt") returned 5 [0066.133] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.pptx") returned 0 [0066.133] lstrlenA (lpString="*.pptx") returned 6 [0066.133] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.txt") returned 0 [0066.133] lstrlenA (lpString="*.txt") returned 5 [0066.133] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.pdf") returned 0 [0066.133] lstrlenA (lpString="*.pdf") returned 5 [0066.133] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.djvu") returned 0 [0066.133] lstrlenA (lpString="*.djvu") returned 6 [0066.133] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.htm") returned 0 [0066.133] lstrlenA (lpString="*.htm") returned 5 [0066.134] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.html") returned 0 [0066.134] lstrlenA (lpString="*.html") returned 6 [0066.134] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.mdb") returned 0 [0066.134] lstrlenA (lpString="*.mdb") returned 5 [0066.134] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.cer") returned 0 [0066.134] lstrlenA (lpString="*.cer") returned 5 [0066.134] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.p12") returned 0 [0066.134] lstrlenA (lpString="*.p12") returned 5 [0066.134] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.pfx") returned 0 [0066.134] lstrlenA (lpString="*.pfx") returned 5 [0066.134] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.kwm") returned 0 [0066.134] lstrlenA (lpString="*.kwm") returned 5 [0066.134] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.pwm") returned 0 [0066.134] lstrlenA (lpString="*.pwm") returned 5 [0066.134] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.1cd") returned 0 [0066.134] lstrlenA (lpString="*.1cd") returned 5 [0066.134] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.md") returned 0 [0066.134] lstrlenA (lpString="*.md") returned 4 [0066.134] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.mdf") returned 0 [0066.134] lstrlenA (lpString="*.mdf") returned 5 [0066.134] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.dbf") returned 0 [0066.134] lstrlenA (lpString="*.dbf") returned 5 [0066.134] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.odt") returned 0 [0066.134] lstrlenA (lpString="*.odt") returned 5 [0066.134] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.vob") returned 0 [0066.134] lstrlenA (lpString="*.vob") returned 5 [0066.134] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.ifo") returned 0 [0066.134] lstrlenA (lpString="*.ifo") returned 5 [0066.134] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.lnk") returned 0 [0066.134] lstrlenA (lpString="*.lnk") returned 5 [0066.134] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.torrent") returned 0 [0066.134] lstrlenA (lpString="*.torrent") returned 9 [0066.134] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.mov") returned 0 [0066.134] lstrlenA (lpString="*.mov") returned 5 [0066.134] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.m2v") returned 0 [0066.134] lstrlenA (lpString="*.m2v") returned 5 [0066.134] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.3gp") returned 0 [0066.134] lstrlenA (lpString="*.3gp") returned 5 [0066.134] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.mpeg") returned 0 [0066.134] lstrlenA (lpString="*.mpeg") returned 6 [0066.134] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.mpg") returned 0 [0066.134] lstrlenA (lpString="*.mpg") returned 5 [0066.134] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.flv") returned 0 [0066.134] lstrlenA (lpString="*.flv") returned 5 [0066.134] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.avi") returned 0 [0066.134] lstrlenA (lpString="*.avi") returned 5 [0066.134] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.mp4") returned 0 [0066.135] lstrlenA (lpString="*.mp4") returned 5 [0066.135] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.wmv") returned 0 [0066.135] lstrlenA (lpString="*.wmv") returned 5 [0066.135] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.divx") returned 0 [0066.135] lstrlenA (lpString="*.divx") returned 6 [0066.135] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.mkv") returned 0 [0066.135] lstrlenA (lpString="*.mkv") returned 5 [0066.135] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.mp3") returned 0 [0066.135] lstrlenA (lpString="*.mp3") returned 5 [0066.135] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.wav") returned 0 [0066.135] lstrlenA (lpString="*.wav") returned 5 [0066.135] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.flac") returned 0 [0066.135] lstrlenA (lpString="*.flac") returned 6 [0066.135] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.ape") returned 0 [0066.135] lstrlenA (lpString="*.ape") returned 5 [0066.135] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.wma") returned 0 [0066.135] lstrlenA (lpString="*.wma") returned 5 [0066.135] PathMatchSpecA (pszFile="C:\\Boot\\ru-RU\\bootmgr.exe.mui", pszSpec="*.ac3") returned 0 [0066.135] lstrlenA (lpString="*.ac3") returned 5 [0066.135] FindNextFileA (in: hFindFile=0x5b6c68, lpFindFileData=0xaf4e8 | out: lpFindFileData=0xaf4e8) returned 0 [0066.135] FindClose (in: hFindFile=0x5b6c68 | out: hFindFile=0x5b6c68) returned 1 [0066.135] FindNextFileA (in: hFindFile=0x5b5bf0, lpFindFileData=0xaf638 | out: lpFindFileData=0xaf638) returned 1 [0066.135] lstrcmpA (lpString1=".", lpString2="sv-SE") returned -1 [0066.135] lstrcmpA (lpString1="..", lpString2="sv-SE") returned -1 [0066.135] PathFindFileNameA (pszPath="C:\\Boot\\*.*") returned="*.*" [0066.135] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="sv-SE" | out: lpString1="C:\\Boot\\sv-SE") returned="C:\\Boot\\sv-SE" [0066.135] lstrlenA (lpString="C:\\Boot\\sv-SE") returned 13 [0066.135] FindFirstFileA (in: lpFileName="C:\\Boot\\sv-SE\\*.*", lpFindFileData=0xaf4e8 | out: lpFindFileData=0xaf4e8) returned 0x5b6c68 [0066.135] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0066.135] FindNextFileA (in: hFindFile=0x5b6c68, lpFindFileData=0xaf4e8 | out: lpFindFileData=0xaf4e8) returned 1 [0066.136] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0066.136] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0066.136] FindNextFileA (in: hFindFile=0x5b6c68, lpFindFileData=0xaf4e8 | out: lpFindFileData=0xaf4e8) returned 1 [0066.136] PeekMessageA (in: lpMsg=0xaf4c4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf4c4) returned 0 [0066.136] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="bootmgr.exe.mui") returned 1 [0066.136] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bootmgr.exe.mui") returned 1 [0066.136] lstrcmpiA (lpString1="", lpString2="bootmgr.exe.mui") returned -1 [0066.136] PathFindFileNameA (pszPath="C:\\Boot\\sv-SE\\*.*") returned="*.*" [0066.136] lstrcatA (in: lpString1="C:\\Boot\\sv-SE\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\sv-SE\\bootmgr.exe.mui") returned="C:\\Boot\\sv-SE\\bootmgr.exe.mui" [0066.136] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.zip") returned 0 [0066.136] lstrlenA (lpString="*.zip") returned 5 [0066.136] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.rar") returned 0 [0066.136] lstrlenA (lpString="*.rar") returned 5 [0066.136] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.7z") returned 0 [0066.136] lstrlenA (lpString="*.7z") returned 4 [0066.136] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.tar") returned 0 [0066.136] lstrlenA (lpString="*.tar") returned 5 [0066.136] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.gzip") returned 0 [0066.136] lstrlenA (lpString="*.gzip") returned 6 [0066.136] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.jpg") returned 0 [0066.136] lstrlenA (lpString="*.jpg") returned 5 [0066.136] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.jpeg") returned 0 [0066.136] lstrlenA (lpString="*.jpeg") returned 6 [0066.136] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.psd") returned 0 [0066.136] lstrlenA (lpString="*.psd") returned 5 [0066.136] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.cdr") returned 0 [0066.136] lstrlenA (lpString="*.cdr") returned 5 [0066.136] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.dwg") returned 0 [0066.136] lstrlenA (lpString="*.dwg") returned 5 [0066.136] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.max") returned 0 [0066.136] lstrlenA (lpString="*.max") returned 5 [0066.136] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.bmp") returned 0 [0066.136] lstrlenA (lpString="*.bmp") returned 5 [0066.136] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.gif") returned 0 [0066.136] lstrlenA (lpString="*.gif") returned 5 [0066.136] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.png") returned 0 [0066.136] lstrlenA (lpString="*.png") returned 5 [0066.136] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.doc") returned 0 [0066.136] lstrlenA (lpString="*.doc") returned 5 [0066.136] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.docx") returned 0 [0066.136] lstrlenA (lpString="*.docx") returned 6 [0066.136] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.xls") returned 0 [0066.136] lstrlenA (lpString="*.xls") returned 5 [0066.136] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.xlsx") returned 0 [0066.136] lstrlenA (lpString="*.xlsx") returned 6 [0066.136] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.ppt") returned 0 [0066.136] lstrlenA (lpString="*.ppt") returned 5 [0066.137] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.pptx") returned 0 [0066.137] lstrlenA (lpString="*.pptx") returned 6 [0066.137] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.txt") returned 0 [0066.137] lstrlenA (lpString="*.txt") returned 5 [0066.137] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.pdf") returned 0 [0066.137] lstrlenA (lpString="*.pdf") returned 5 [0066.137] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.djvu") returned 0 [0066.137] lstrlenA (lpString="*.djvu") returned 6 [0066.137] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.htm") returned 0 [0066.137] lstrlenA (lpString="*.htm") returned 5 [0066.137] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.html") returned 0 [0066.137] lstrlenA (lpString="*.html") returned 6 [0066.137] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.mdb") returned 0 [0066.137] lstrlenA (lpString="*.mdb") returned 5 [0066.137] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.cer") returned 0 [0066.137] lstrlenA (lpString="*.cer") returned 5 [0066.137] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.p12") returned 0 [0066.137] lstrlenA (lpString="*.p12") returned 5 [0066.137] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.pfx") returned 0 [0066.137] lstrlenA (lpString="*.pfx") returned 5 [0066.137] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.kwm") returned 0 [0066.137] lstrlenA (lpString="*.kwm") returned 5 [0066.137] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.pwm") returned 0 [0066.137] lstrlenA (lpString="*.pwm") returned 5 [0066.137] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.1cd") returned 0 [0066.137] lstrlenA (lpString="*.1cd") returned 5 [0066.137] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.md") returned 0 [0066.137] lstrlenA (lpString="*.md") returned 4 [0066.137] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.mdf") returned 0 [0066.137] lstrlenA (lpString="*.mdf") returned 5 [0066.137] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.dbf") returned 0 [0066.137] lstrlenA (lpString="*.dbf") returned 5 [0066.137] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.odt") returned 0 [0066.137] lstrlenA (lpString="*.odt") returned 5 [0066.137] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.vob") returned 0 [0066.137] lstrlenA (lpString="*.vob") returned 5 [0066.137] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.ifo") returned 0 [0066.137] lstrlenA (lpString="*.ifo") returned 5 [0066.137] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.lnk") returned 0 [0066.137] lstrlenA (lpString="*.lnk") returned 5 [0066.137] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.torrent") returned 0 [0066.137] lstrlenA (lpString="*.torrent") returned 9 [0066.137] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.mov") returned 0 [0066.137] lstrlenA (lpString="*.mov") returned 5 [0066.137] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.m2v") returned 0 [0066.137] lstrlenA (lpString="*.m2v") returned 5 [0066.137] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.3gp") returned 0 [0066.137] lstrlenA (lpString="*.3gp") returned 5 [0066.137] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.mpeg") returned 0 [0066.137] lstrlenA (lpString="*.mpeg") returned 6 [0066.138] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.mpg") returned 0 [0066.138] lstrlenA (lpString="*.mpg") returned 5 [0066.138] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.flv") returned 0 [0066.138] lstrlenA (lpString="*.flv") returned 5 [0066.138] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.avi") returned 0 [0066.138] lstrlenA (lpString="*.avi") returned 5 [0066.138] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.mp4") returned 0 [0066.138] lstrlenA (lpString="*.mp4") returned 5 [0066.138] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.wmv") returned 0 [0066.138] lstrlenA (lpString="*.wmv") returned 5 [0066.138] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.divx") returned 0 [0066.138] lstrlenA (lpString="*.divx") returned 6 [0066.138] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.mkv") returned 0 [0066.138] lstrlenA (lpString="*.mkv") returned 5 [0066.138] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.mp3") returned 0 [0066.138] lstrlenA (lpString="*.mp3") returned 5 [0066.138] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.wav") returned 0 [0066.138] lstrlenA (lpString="*.wav") returned 5 [0066.138] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.flac") returned 0 [0066.138] lstrlenA (lpString="*.flac") returned 6 [0066.138] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.ape") returned 0 [0066.138] lstrlenA (lpString="*.ape") returned 5 [0066.138] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.wma") returned 0 [0066.138] lstrlenA (lpString="*.wma") returned 5 [0066.138] PathMatchSpecA (pszFile="C:\\Boot\\sv-SE\\bootmgr.exe.mui", pszSpec="*.ac3") returned 0 [0066.138] lstrlenA (lpString="*.ac3") returned 5 [0066.138] FindNextFileA (in: hFindFile=0x5b6c68, lpFindFileData=0xaf4e8 | out: lpFindFileData=0xaf4e8) returned 0 [0066.138] FindClose (in: hFindFile=0x5b6c68 | out: hFindFile=0x5b6c68) returned 1 [0066.138] FindNextFileA (in: hFindFile=0x5b5bf0, lpFindFileData=0xaf638 | out: lpFindFileData=0xaf638) returned 1 [0066.138] lstrcmpA (lpString1=".", lpString2="tr-TR") returned -1 [0066.138] lstrcmpA (lpString1="..", lpString2="tr-TR") returned -1 [0066.138] PathFindFileNameA (pszPath="C:\\Boot\\*.*") returned="*.*" [0066.138] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="tr-TR" | out: lpString1="C:\\Boot\\tr-TR") returned="C:\\Boot\\tr-TR" [0066.138] lstrlenA (lpString="C:\\Boot\\tr-TR") returned 13 [0066.138] FindFirstFileA (in: lpFileName="C:\\Boot\\tr-TR\\*.*", lpFindFileData=0xaf4e8 | out: lpFindFileData=0xaf4e8) returned 0x5b6c68 [0066.139] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0066.139] FindNextFileA (in: hFindFile=0x5b6c68, lpFindFileData=0xaf4e8 | out: lpFindFileData=0xaf4e8) returned 1 [0066.139] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0066.139] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0066.139] FindNextFileA (in: hFindFile=0x5b6c68, lpFindFileData=0xaf4e8 | out: lpFindFileData=0xaf4e8) returned 1 [0066.139] PeekMessageA (in: lpMsg=0xaf4c4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf4c4) returned 0 [0066.139] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="bootmgr.exe.mui") returned 1 [0066.139] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bootmgr.exe.mui") returned 1 [0066.139] lstrcmpiA (lpString1="", lpString2="bootmgr.exe.mui") returned -1 [0066.139] PathFindFileNameA (pszPath="C:\\Boot\\tr-TR\\*.*") returned="*.*" [0066.139] lstrcatA (in: lpString1="C:\\Boot\\tr-TR\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\tr-TR\\bootmgr.exe.mui") returned="C:\\Boot\\tr-TR\\bootmgr.exe.mui" [0066.139] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.zip") returned 0 [0066.139] lstrlenA (lpString="*.zip") returned 5 [0066.139] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.rar") returned 0 [0066.139] lstrlenA (lpString="*.rar") returned 5 [0066.139] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.7z") returned 0 [0066.139] lstrlenA (lpString="*.7z") returned 4 [0066.139] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.tar") returned 0 [0066.139] lstrlenA (lpString="*.tar") returned 5 [0066.139] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.gzip") returned 0 [0066.139] lstrlenA (lpString="*.gzip") returned 6 [0066.139] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.jpg") returned 0 [0066.140] lstrlenA (lpString="*.jpg") returned 5 [0066.140] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.jpeg") returned 0 [0066.140] lstrlenA (lpString="*.jpeg") returned 6 [0066.140] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.psd") returned 0 [0066.140] lstrlenA (lpString="*.psd") returned 5 [0066.140] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.cdr") returned 0 [0066.140] lstrlenA (lpString="*.cdr") returned 5 [0066.140] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.dwg") returned 0 [0066.140] lstrlenA (lpString="*.dwg") returned 5 [0066.140] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.max") returned 0 [0066.140] lstrlenA (lpString="*.max") returned 5 [0066.140] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.bmp") returned 0 [0066.140] lstrlenA (lpString="*.bmp") returned 5 [0066.140] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.gif") returned 0 [0066.140] lstrlenA (lpString="*.gif") returned 5 [0066.140] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.png") returned 0 [0066.140] lstrlenA (lpString="*.png") returned 5 [0066.140] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.doc") returned 0 [0066.140] lstrlenA (lpString="*.doc") returned 5 [0066.140] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.docx") returned 0 [0066.140] lstrlenA (lpString="*.docx") returned 6 [0066.140] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.xls") returned 0 [0066.140] lstrlenA (lpString="*.xls") returned 5 [0066.140] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.xlsx") returned 0 [0066.140] lstrlenA (lpString="*.xlsx") returned 6 [0066.140] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.ppt") returned 0 [0066.140] lstrlenA (lpString="*.ppt") returned 5 [0066.140] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.pptx") returned 0 [0066.140] lstrlenA (lpString="*.pptx") returned 6 [0066.140] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.txt") returned 0 [0066.140] lstrlenA (lpString="*.txt") returned 5 [0066.140] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.pdf") returned 0 [0066.140] lstrlenA (lpString="*.pdf") returned 5 [0066.140] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.djvu") returned 0 [0066.140] lstrlenA (lpString="*.djvu") returned 6 [0066.140] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.htm") returned 0 [0066.140] lstrlenA (lpString="*.htm") returned 5 [0066.140] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.html") returned 0 [0066.140] lstrlenA (lpString="*.html") returned 6 [0066.140] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.mdb") returned 0 [0066.140] lstrlenA (lpString="*.mdb") returned 5 [0066.140] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.cer") returned 0 [0066.140] lstrlenA (lpString="*.cer") returned 5 [0066.140] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.p12") returned 0 [0066.140] lstrlenA (lpString="*.p12") returned 5 [0066.140] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.pfx") returned 0 [0066.140] lstrlenA (lpString="*.pfx") returned 5 [0066.140] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.kwm") returned 0 [0066.140] lstrlenA (lpString="*.kwm") returned 5 [0066.141] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.pwm") returned 0 [0066.141] lstrlenA (lpString="*.pwm") returned 5 [0066.141] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.1cd") returned 0 [0066.141] lstrlenA (lpString="*.1cd") returned 5 [0066.141] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.md") returned 0 [0066.141] lstrlenA (lpString="*.md") returned 4 [0066.141] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.mdf") returned 0 [0066.141] lstrlenA (lpString="*.mdf") returned 5 [0066.141] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.dbf") returned 0 [0066.141] lstrlenA (lpString="*.dbf") returned 5 [0066.141] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.odt") returned 0 [0066.141] lstrlenA (lpString="*.odt") returned 5 [0066.141] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.vob") returned 0 [0066.141] lstrlenA (lpString="*.vob") returned 5 [0066.141] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.ifo") returned 0 [0066.141] lstrlenA (lpString="*.ifo") returned 5 [0066.141] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.lnk") returned 0 [0066.141] lstrlenA (lpString="*.lnk") returned 5 [0066.141] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.torrent") returned 0 [0066.141] lstrlenA (lpString="*.torrent") returned 9 [0066.141] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.mov") returned 0 [0066.141] lstrlenA (lpString="*.mov") returned 5 [0066.141] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.m2v") returned 0 [0066.141] lstrlenA (lpString="*.m2v") returned 5 [0066.141] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.3gp") returned 0 [0066.141] lstrlenA (lpString="*.3gp") returned 5 [0066.141] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.mpeg") returned 0 [0066.141] lstrlenA (lpString="*.mpeg") returned 6 [0066.141] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.mpg") returned 0 [0066.141] lstrlenA (lpString="*.mpg") returned 5 [0066.141] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.flv") returned 0 [0066.141] lstrlenA (lpString="*.flv") returned 5 [0066.141] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.avi") returned 0 [0066.141] lstrlenA (lpString="*.avi") returned 5 [0066.141] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.mp4") returned 0 [0066.141] lstrlenA (lpString="*.mp4") returned 5 [0066.141] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.wmv") returned 0 [0066.141] lstrlenA (lpString="*.wmv") returned 5 [0066.141] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.divx") returned 0 [0066.141] lstrlenA (lpString="*.divx") returned 6 [0066.141] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.mkv") returned 0 [0066.141] lstrlenA (lpString="*.mkv") returned 5 [0066.141] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.mp3") returned 0 [0066.141] lstrlenA (lpString="*.mp3") returned 5 [0066.141] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.wav") returned 0 [0066.142] lstrlenA (lpString="*.wav") returned 5 [0066.142] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.flac") returned 0 [0066.142] lstrlenA (lpString="*.flac") returned 6 [0066.142] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.ape") returned 0 [0066.142] lstrlenA (lpString="*.ape") returned 5 [0066.142] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.wma") returned 0 [0066.142] lstrlenA (lpString="*.wma") returned 5 [0066.142] PathMatchSpecA (pszFile="C:\\Boot\\tr-TR\\bootmgr.exe.mui", pszSpec="*.ac3") returned 0 [0066.142] lstrlenA (lpString="*.ac3") returned 5 [0066.142] FindNextFileA (in: hFindFile=0x5b6c68, lpFindFileData=0xaf4e8 | out: lpFindFileData=0xaf4e8) returned 0 [0066.142] FindClose (in: hFindFile=0x5b6c68 | out: hFindFile=0x5b6c68) returned 1 [0066.142] FindNextFileA (in: hFindFile=0x5b5bf0, lpFindFileData=0xaf638 | out: lpFindFileData=0xaf638) returned 1 [0066.142] lstrcmpA (lpString1=".", lpString2="zh-CN") returned -1 [0066.142] lstrcmpA (lpString1="..", lpString2="zh-CN") returned -1 [0066.142] PathFindFileNameA (pszPath="C:\\Boot\\*.*") returned="*.*" [0066.142] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="zh-CN" | out: lpString1="C:\\Boot\\zh-CN") returned="C:\\Boot\\zh-CN" [0066.142] lstrlenA (lpString="C:\\Boot\\zh-CN") returned 13 [0066.142] FindFirstFileA (in: lpFileName="C:\\Boot\\zh-CN\\*.*", lpFindFileData=0xaf4e8 | out: lpFindFileData=0xaf4e8) returned 0x5b6c68 [0066.142] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0066.142] FindNextFileA (in: hFindFile=0x5b6c68, lpFindFileData=0xaf4e8 | out: lpFindFileData=0xaf4e8) returned 1 [0066.142] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0066.142] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0066.142] FindNextFileA (in: hFindFile=0x5b6c68, lpFindFileData=0xaf4e8 | out: lpFindFileData=0xaf4e8) returned 1 [0066.142] PeekMessageA (in: lpMsg=0xaf4c4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf4c4) returned 0 [0066.143] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="bootmgr.exe.mui") returned 1 [0066.143] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bootmgr.exe.mui") returned 1 [0066.143] lstrcmpiA (lpString1="", lpString2="bootmgr.exe.mui") returned -1 [0066.143] PathFindFileNameA (pszPath="C:\\Boot\\zh-CN\\*.*") returned="*.*" [0066.143] lstrcatA (in: lpString1="C:\\Boot\\zh-CN\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\zh-CN\\bootmgr.exe.mui") returned="C:\\Boot\\zh-CN\\bootmgr.exe.mui" [0066.143] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.zip") returned 0 [0066.143] lstrlenA (lpString="*.zip") returned 5 [0066.143] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.rar") returned 0 [0066.143] lstrlenA (lpString="*.rar") returned 5 [0066.143] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.7z") returned 0 [0066.143] lstrlenA (lpString="*.7z") returned 4 [0066.143] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.tar") returned 0 [0066.143] lstrlenA (lpString="*.tar") returned 5 [0066.143] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.gzip") returned 0 [0066.143] lstrlenA (lpString="*.gzip") returned 6 [0066.143] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.jpg") returned 0 [0066.143] lstrlenA (lpString="*.jpg") returned 5 [0066.143] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.jpeg") returned 0 [0066.143] lstrlenA (lpString="*.jpeg") returned 6 [0066.143] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.psd") returned 0 [0066.143] lstrlenA (lpString="*.psd") returned 5 [0066.143] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.cdr") returned 0 [0066.143] lstrlenA (lpString="*.cdr") returned 5 [0066.143] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.dwg") returned 0 [0066.143] lstrlenA (lpString="*.dwg") returned 5 [0066.143] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.max") returned 0 [0066.143] lstrlenA (lpString="*.max") returned 5 [0066.143] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.bmp") returned 0 [0066.143] lstrlenA (lpString="*.bmp") returned 5 [0066.143] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.gif") returned 0 [0066.143] lstrlenA (lpString="*.gif") returned 5 [0066.143] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.png") returned 0 [0066.143] lstrlenA (lpString="*.png") returned 5 [0066.143] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.doc") returned 0 [0066.143] lstrlenA (lpString="*.doc") returned 5 [0066.143] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.docx") returned 0 [0066.143] lstrlenA (lpString="*.docx") returned 6 [0066.143] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.xls") returned 0 [0066.143] lstrlenA (lpString="*.xls") returned 5 [0066.143] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.xlsx") returned 0 [0066.143] lstrlenA (lpString="*.xlsx") returned 6 [0066.143] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.ppt") returned 0 [0066.143] lstrlenA (lpString="*.ppt") returned 5 [0066.143] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.pptx") returned 0 [0066.143] lstrlenA (lpString="*.pptx") returned 6 [0066.143] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.txt") returned 0 [0066.143] lstrlenA (lpString="*.txt") returned 5 [0066.143] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.pdf") returned 0 [0066.144] lstrlenA (lpString="*.pdf") returned 5 [0066.144] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.djvu") returned 0 [0066.144] lstrlenA (lpString="*.djvu") returned 6 [0066.144] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.htm") returned 0 [0066.144] lstrlenA (lpString="*.htm") returned 5 [0066.144] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.html") returned 0 [0066.144] lstrlenA (lpString="*.html") returned 6 [0066.144] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.mdb") returned 0 [0066.144] lstrlenA (lpString="*.mdb") returned 5 [0066.144] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.cer") returned 0 [0066.144] lstrlenA (lpString="*.cer") returned 5 [0066.144] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.p12") returned 0 [0066.144] lstrlenA (lpString="*.p12") returned 5 [0066.144] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.pfx") returned 0 [0066.144] lstrlenA (lpString="*.pfx") returned 5 [0066.144] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.kwm") returned 0 [0066.144] lstrlenA (lpString="*.kwm") returned 5 [0066.144] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.pwm") returned 0 [0066.144] lstrlenA (lpString="*.pwm") returned 5 [0066.144] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.1cd") returned 0 [0066.144] lstrlenA (lpString="*.1cd") returned 5 [0066.144] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.md") returned 0 [0066.144] lstrlenA (lpString="*.md") returned 4 [0066.144] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.mdf") returned 0 [0066.144] lstrlenA (lpString="*.mdf") returned 5 [0066.144] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.dbf") returned 0 [0066.144] lstrlenA (lpString="*.dbf") returned 5 [0066.144] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.odt") returned 0 [0066.144] lstrlenA (lpString="*.odt") returned 5 [0066.144] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.vob") returned 0 [0066.144] lstrlenA (lpString="*.vob") returned 5 [0066.144] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.ifo") returned 0 [0066.144] lstrlenA (lpString="*.ifo") returned 5 [0066.144] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.lnk") returned 0 [0066.144] lstrlenA (lpString="*.lnk") returned 5 [0066.144] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.torrent") returned 0 [0066.144] lstrlenA (lpString="*.torrent") returned 9 [0066.144] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.mov") returned 0 [0066.144] lstrlenA (lpString="*.mov") returned 5 [0066.144] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.m2v") returned 0 [0066.144] lstrlenA (lpString="*.m2v") returned 5 [0066.144] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.3gp") returned 0 [0066.144] lstrlenA (lpString="*.3gp") returned 5 [0066.144] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.mpeg") returned 0 [0066.144] lstrlenA (lpString="*.mpeg") returned 6 [0066.144] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.mpg") returned 0 [0066.144] lstrlenA (lpString="*.mpg") returned 5 [0066.144] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.flv") returned 0 [0066.144] lstrlenA (lpString="*.flv") returned 5 [0066.144] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.avi") returned 0 [0066.145] lstrlenA (lpString="*.avi") returned 5 [0066.145] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.mp4") returned 0 [0066.145] lstrlenA (lpString="*.mp4") returned 5 [0066.145] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.wmv") returned 0 [0066.145] lstrlenA (lpString="*.wmv") returned 5 [0066.145] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.divx") returned 0 [0066.145] lstrlenA (lpString="*.divx") returned 6 [0066.145] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.mkv") returned 0 [0066.145] lstrlenA (lpString="*.mkv") returned 5 [0066.145] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.mp3") returned 0 [0066.145] lstrlenA (lpString="*.mp3") returned 5 [0066.145] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.wav") returned 0 [0066.145] lstrlenA (lpString="*.wav") returned 5 [0066.145] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.flac") returned 0 [0066.145] lstrlenA (lpString="*.flac") returned 6 [0066.145] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.ape") returned 0 [0066.145] lstrlenA (lpString="*.ape") returned 5 [0066.145] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.wma") returned 0 [0066.145] lstrlenA (lpString="*.wma") returned 5 [0066.145] PathMatchSpecA (pszFile="C:\\Boot\\zh-CN\\bootmgr.exe.mui", pszSpec="*.ac3") returned 0 [0066.145] lstrlenA (lpString="*.ac3") returned 5 [0066.145] FindNextFileA (in: hFindFile=0x5b6c68, lpFindFileData=0xaf4e8 | out: lpFindFileData=0xaf4e8) returned 0 [0066.145] FindClose (in: hFindFile=0x5b6c68 | out: hFindFile=0x5b6c68) returned 1 [0066.145] FindNextFileA (in: hFindFile=0x5b5bf0, lpFindFileData=0xaf638 | out: lpFindFileData=0xaf638) returned 1 [0066.145] lstrcmpA (lpString1=".", lpString2="zh-HK") returned -1 [0066.145] lstrcmpA (lpString1="..", lpString2="zh-HK") returned -1 [0066.145] PathFindFileNameA (pszPath="C:\\Boot\\*.*") returned="*.*" [0066.145] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="zh-HK" | out: lpString1="C:\\Boot\\zh-HK") returned="C:\\Boot\\zh-HK" [0066.145] lstrlenA (lpString="C:\\Boot\\zh-HK") returned 13 [0066.145] FindFirstFileA (in: lpFileName="C:\\Boot\\zh-HK\\*.*", lpFindFileData=0xaf4e8 | out: lpFindFileData=0xaf4e8) returned 0x5b6c68 [0066.146] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0066.146] FindNextFileA (in: hFindFile=0x5b6c68, lpFindFileData=0xaf4e8 | out: lpFindFileData=0xaf4e8) returned 1 [0066.146] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0066.146] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0066.146] FindNextFileA (in: hFindFile=0x5b6c68, lpFindFileData=0xaf4e8 | out: lpFindFileData=0xaf4e8) returned 1 [0066.146] PeekMessageA (in: lpMsg=0xaf4c4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf4c4) returned 0 [0066.146] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="bootmgr.exe.mui") returned 1 [0066.146] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bootmgr.exe.mui") returned 1 [0066.146] lstrcmpiA (lpString1="", lpString2="bootmgr.exe.mui") returned -1 [0066.146] PathFindFileNameA (pszPath="C:\\Boot\\zh-HK\\*.*") returned="*.*" [0066.146] lstrcatA (in: lpString1="C:\\Boot\\zh-HK\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\zh-HK\\bootmgr.exe.mui") returned="C:\\Boot\\zh-HK\\bootmgr.exe.mui" [0066.146] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.zip") returned 0 [0066.146] lstrlenA (lpString="*.zip") returned 5 [0066.146] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.rar") returned 0 [0066.146] lstrlenA (lpString="*.rar") returned 5 [0066.146] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.7z") returned 0 [0066.146] lstrlenA (lpString="*.7z") returned 4 [0066.146] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.tar") returned 0 [0066.147] lstrlenA (lpString="*.tar") returned 5 [0066.147] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.gzip") returned 0 [0066.147] lstrlenA (lpString="*.gzip") returned 6 [0066.147] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.jpg") returned 0 [0066.147] lstrlenA (lpString="*.jpg") returned 5 [0066.147] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.jpeg") returned 0 [0066.147] lstrlenA (lpString="*.jpeg") returned 6 [0066.147] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.psd") returned 0 [0066.147] lstrlenA (lpString="*.psd") returned 5 [0066.147] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.cdr") returned 0 [0066.147] lstrlenA (lpString="*.cdr") returned 5 [0066.147] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.dwg") returned 0 [0066.147] lstrlenA (lpString="*.dwg") returned 5 [0066.147] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.max") returned 0 [0066.147] lstrlenA (lpString="*.max") returned 5 [0066.147] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.bmp") returned 0 [0066.147] lstrlenA (lpString="*.bmp") returned 5 [0066.147] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.gif") returned 0 [0066.147] lstrlenA (lpString="*.gif") returned 5 [0066.147] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.png") returned 0 [0066.147] lstrlenA (lpString="*.png") returned 5 [0066.147] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.doc") returned 0 [0066.147] lstrlenA (lpString="*.doc") returned 5 [0066.147] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.docx") returned 0 [0066.147] lstrlenA (lpString="*.docx") returned 6 [0066.147] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.xls") returned 0 [0066.147] lstrlenA (lpString="*.xls") returned 5 [0066.147] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.xlsx") returned 0 [0066.147] lstrlenA (lpString="*.xlsx") returned 6 [0066.147] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.ppt") returned 0 [0066.147] lstrlenA (lpString="*.ppt") returned 5 [0066.147] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.pptx") returned 0 [0066.147] lstrlenA (lpString="*.pptx") returned 6 [0066.147] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.txt") returned 0 [0066.147] lstrlenA (lpString="*.txt") returned 5 [0066.147] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.pdf") returned 0 [0066.147] lstrlenA (lpString="*.pdf") returned 5 [0066.147] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.djvu") returned 0 [0066.147] lstrlenA (lpString="*.djvu") returned 6 [0066.147] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.htm") returned 0 [0066.147] lstrlenA (lpString="*.htm") returned 5 [0066.148] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.html") returned 0 [0066.148] lstrlenA (lpString="*.html") returned 6 [0066.148] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.mdb") returned 0 [0066.148] lstrlenA (lpString="*.mdb") returned 5 [0066.148] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.cer") returned 0 [0066.148] lstrlenA (lpString="*.cer") returned 5 [0066.148] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.p12") returned 0 [0066.148] lstrlenA (lpString="*.p12") returned 5 [0066.148] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.pfx") returned 0 [0066.148] lstrlenA (lpString="*.pfx") returned 5 [0066.148] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.kwm") returned 0 [0066.148] lstrlenA (lpString="*.kwm") returned 5 [0066.148] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.pwm") returned 0 [0066.148] lstrlenA (lpString="*.pwm") returned 5 [0066.148] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.1cd") returned 0 [0066.148] lstrlenA (lpString="*.1cd") returned 5 [0066.148] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.md") returned 0 [0066.148] lstrlenA (lpString="*.md") returned 4 [0066.148] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.mdf") returned 0 [0066.148] lstrlenA (lpString="*.mdf") returned 5 [0066.148] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.dbf") returned 0 [0066.148] lstrlenA (lpString="*.dbf") returned 5 [0066.148] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.odt") returned 0 [0066.148] lstrlenA (lpString="*.odt") returned 5 [0066.148] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.vob") returned 0 [0066.148] lstrlenA (lpString="*.vob") returned 5 [0066.148] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.ifo") returned 0 [0066.148] lstrlenA (lpString="*.ifo") returned 5 [0066.148] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.lnk") returned 0 [0066.148] lstrlenA (lpString="*.lnk") returned 5 [0066.148] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.torrent") returned 0 [0066.148] lstrlenA (lpString="*.torrent") returned 9 [0066.148] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.mov") returned 0 [0066.148] lstrlenA (lpString="*.mov") returned 5 [0066.148] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.m2v") returned 0 [0066.148] lstrlenA (lpString="*.m2v") returned 5 [0066.148] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.3gp") returned 0 [0066.149] lstrlenA (lpString="*.3gp") returned 5 [0066.149] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.mpeg") returned 0 [0066.149] lstrlenA (lpString="*.mpeg") returned 6 [0066.149] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.mpg") returned 0 [0066.149] lstrlenA (lpString="*.mpg") returned 5 [0066.149] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.flv") returned 0 [0066.149] lstrlenA (lpString="*.flv") returned 5 [0066.149] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.avi") returned 0 [0066.149] lstrlenA (lpString="*.avi") returned 5 [0066.149] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.mp4") returned 0 [0066.149] lstrlenA (lpString="*.mp4") returned 5 [0066.149] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.wmv") returned 0 [0066.149] lstrlenA (lpString="*.wmv") returned 5 [0066.149] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.divx") returned 0 [0066.149] lstrlenA (lpString="*.divx") returned 6 [0066.149] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.mkv") returned 0 [0066.149] lstrlenA (lpString="*.mkv") returned 5 [0066.149] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.mp3") returned 0 [0066.149] lstrlenA (lpString="*.mp3") returned 5 [0066.149] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.wav") returned 0 [0066.149] lstrlenA (lpString="*.wav") returned 5 [0066.149] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.flac") returned 0 [0066.149] lstrlenA (lpString="*.flac") returned 6 [0066.149] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.ape") returned 0 [0066.149] lstrlenA (lpString="*.ape") returned 5 [0066.149] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.wma") returned 0 [0066.149] lstrlenA (lpString="*.wma") returned 5 [0066.149] PathMatchSpecA (pszFile="C:\\Boot\\zh-HK\\bootmgr.exe.mui", pszSpec="*.ac3") returned 0 [0066.149] lstrlenA (lpString="*.ac3") returned 5 [0066.149] FindNextFileA (in: hFindFile=0x5b6c68, lpFindFileData=0xaf4e8 | out: lpFindFileData=0xaf4e8) returned 0 [0066.149] FindClose (in: hFindFile=0x5b6c68 | out: hFindFile=0x5b6c68) returned 1 [0066.149] FindNextFileA (in: hFindFile=0x5b5bf0, lpFindFileData=0xaf638 | out: lpFindFileData=0xaf638) returned 1 [0066.149] lstrcmpA (lpString1=".", lpString2="zh-TW") returned -1 [0066.149] lstrcmpA (lpString1="..", lpString2="zh-TW") returned -1 [0066.149] PathFindFileNameA (pszPath="C:\\Boot\\*.*") returned="*.*" [0066.149] lstrcatA (in: lpString1="C:\\Boot\\", lpString2="zh-TW" | out: lpString1="C:\\Boot\\zh-TW") returned="C:\\Boot\\zh-TW" [0066.149] lstrlenA (lpString="C:\\Boot\\zh-TW") returned 13 [0066.149] FindFirstFileA (in: lpFileName="C:\\Boot\\zh-TW\\*.*", lpFindFileData=0xaf4e8 | out: lpFindFileData=0xaf4e8) returned 0x5b6c68 [0066.150] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0066.150] FindNextFileA (in: hFindFile=0x5b6c68, lpFindFileData=0xaf4e8 | out: lpFindFileData=0xaf4e8) returned 1 [0066.150] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0066.150] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0066.150] FindNextFileA (in: hFindFile=0x5b6c68, lpFindFileData=0xaf4e8 | out: lpFindFileData=0xaf4e8) returned 1 [0066.150] PeekMessageA (in: lpMsg=0xaf4c4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf4c4) returned 0 [0066.150] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="bootmgr.exe.mui") returned 1 [0066.150] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bootmgr.exe.mui") returned 1 [0066.150] lstrcmpiA (lpString1="", lpString2="bootmgr.exe.mui") returned -1 [0066.150] PathFindFileNameA (pszPath="C:\\Boot\\zh-TW\\*.*") returned="*.*" [0066.150] lstrcatA (in: lpString1="C:\\Boot\\zh-TW\\", lpString2="bootmgr.exe.mui" | out: lpString1="C:\\Boot\\zh-TW\\bootmgr.exe.mui") returned="C:\\Boot\\zh-TW\\bootmgr.exe.mui" [0066.150] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.zip") returned 0 [0066.150] lstrlenA (lpString="*.zip") returned 5 [0066.150] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.rar") returned 0 [0066.150] lstrlenA (lpString="*.rar") returned 5 [0066.150] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.7z") returned 0 [0066.150] lstrlenA (lpString="*.7z") returned 4 [0066.150] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.tar") returned 0 [0066.150] lstrlenA (lpString="*.tar") returned 5 [0066.150] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.gzip") returned 0 [0066.150] lstrlenA (lpString="*.gzip") returned 6 [0066.150] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.jpg") returned 0 [0066.150] lstrlenA (lpString="*.jpg") returned 5 [0066.150] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.jpeg") returned 0 [0066.150] lstrlenA (lpString="*.jpeg") returned 6 [0066.150] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.psd") returned 0 [0066.150] lstrlenA (lpString="*.psd") returned 5 [0066.150] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.cdr") returned 0 [0066.150] lstrlenA (lpString="*.cdr") returned 5 [0066.150] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.dwg") returned 0 [0066.150] lstrlenA (lpString="*.dwg") returned 5 [0066.150] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.max") returned 0 [0066.150] lstrlenA (lpString="*.max") returned 5 [0066.150] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.bmp") returned 0 [0066.151] lstrlenA (lpString="*.bmp") returned 5 [0066.151] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.gif") returned 0 [0066.151] lstrlenA (lpString="*.gif") returned 5 [0066.151] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.png") returned 0 [0066.151] lstrlenA (lpString="*.png") returned 5 [0066.151] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.doc") returned 0 [0066.151] lstrlenA (lpString="*.doc") returned 5 [0066.151] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.docx") returned 0 [0066.151] lstrlenA (lpString="*.docx") returned 6 [0066.151] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.xls") returned 0 [0066.151] lstrlenA (lpString="*.xls") returned 5 [0066.151] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.xlsx") returned 0 [0066.151] lstrlenA (lpString="*.xlsx") returned 6 [0066.151] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.ppt") returned 0 [0066.151] lstrlenA (lpString="*.ppt") returned 5 [0066.151] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.pptx") returned 0 [0066.151] lstrlenA (lpString="*.pptx") returned 6 [0066.151] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.txt") returned 0 [0066.151] lstrlenA (lpString="*.txt") returned 5 [0066.151] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.pdf") returned 0 [0066.151] lstrlenA (lpString="*.pdf") returned 5 [0066.151] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.djvu") returned 0 [0066.151] lstrlenA (lpString="*.djvu") returned 6 [0066.151] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.htm") returned 0 [0066.151] lstrlenA (lpString="*.htm") returned 5 [0066.151] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.html") returned 0 [0066.151] lstrlenA (lpString="*.html") returned 6 [0066.151] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.mdb") returned 0 [0066.151] lstrlenA (lpString="*.mdb") returned 5 [0066.151] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.cer") returned 0 [0066.151] lstrlenA (lpString="*.cer") returned 5 [0066.151] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.p12") returned 0 [0066.151] lstrlenA (lpString="*.p12") returned 5 [0066.151] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.pfx") returned 0 [0066.151] lstrlenA (lpString="*.pfx") returned 5 [0066.151] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.kwm") returned 0 [0066.151] lstrlenA (lpString="*.kwm") returned 5 [0066.151] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.pwm") returned 0 [0066.151] lstrlenA (lpString="*.pwm") returned 5 [0066.151] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.1cd") returned 0 [0066.151] lstrlenA (lpString="*.1cd") returned 5 [0066.151] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.md") returned 0 [0066.151] lstrlenA (lpString="*.md") returned 4 [0066.151] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.mdf") returned 0 [0066.151] lstrlenA (lpString="*.mdf") returned 5 [0066.152] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.dbf") returned 0 [0066.152] lstrlenA (lpString="*.dbf") returned 5 [0066.152] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.odt") returned 0 [0066.152] lstrlenA (lpString="*.odt") returned 5 [0066.152] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.vob") returned 0 [0066.152] lstrlenA (lpString="*.vob") returned 5 [0066.152] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.ifo") returned 0 [0066.152] lstrlenA (lpString="*.ifo") returned 5 [0066.152] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.lnk") returned 0 [0066.152] lstrlenA (lpString="*.lnk") returned 5 [0066.152] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.torrent") returned 0 [0066.152] lstrlenA (lpString="*.torrent") returned 9 [0066.152] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.mov") returned 0 [0066.152] lstrlenA (lpString="*.mov") returned 5 [0066.152] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.m2v") returned 0 [0066.152] lstrlenA (lpString="*.m2v") returned 5 [0066.152] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.3gp") returned 0 [0066.152] lstrlenA (lpString="*.3gp") returned 5 [0066.152] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.mpeg") returned 0 [0066.152] lstrlenA (lpString="*.mpeg") returned 6 [0066.152] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.mpg") returned 0 [0066.152] lstrlenA (lpString="*.mpg") returned 5 [0066.152] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.flv") returned 0 [0066.152] lstrlenA (lpString="*.flv") returned 5 [0066.152] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.avi") returned 0 [0066.152] lstrlenA (lpString="*.avi") returned 5 [0066.152] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.mp4") returned 0 [0066.152] lstrlenA (lpString="*.mp4") returned 5 [0066.152] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.wmv") returned 0 [0066.152] lstrlenA (lpString="*.wmv") returned 5 [0066.152] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.divx") returned 0 [0066.152] lstrlenA (lpString="*.divx") returned 6 [0066.152] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.mkv") returned 0 [0066.152] lstrlenA (lpString="*.mkv") returned 5 [0066.152] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.mp3") returned 0 [0066.152] lstrlenA (lpString="*.mp3") returned 5 [0066.152] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.wav") returned 0 [0066.152] lstrlenA (lpString="*.wav") returned 5 [0066.152] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.flac") returned 0 [0066.152] lstrlenA (lpString="*.flac") returned 6 [0066.152] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.ape") returned 0 [0066.152] lstrlenA (lpString="*.ape") returned 5 [0066.152] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.wma") returned 0 [0066.152] lstrlenA (lpString="*.wma") returned 5 [0066.152] PathMatchSpecA (pszFile="C:\\Boot\\zh-TW\\bootmgr.exe.mui", pszSpec="*.ac3") returned 0 [0066.152] lstrlenA (lpString="*.ac3") returned 5 [0066.153] FindNextFileA (in: hFindFile=0x5b6c68, lpFindFileData=0xaf4e8 | out: lpFindFileData=0xaf4e8) returned 0 [0066.153] FindClose (in: hFindFile=0x5b6c68 | out: hFindFile=0x5b6c68) returned 1 [0066.153] FindNextFileA (in: hFindFile=0x5b5bf0, lpFindFileData=0xaf638 | out: lpFindFileData=0xaf638) returned 0 [0066.153] FindClose (in: hFindFile=0x5b5bf0 | out: hFindFile=0x5b5bf0) returned 1 [0066.153] FindNextFileA (in: hFindFile=0x5b4a08, lpFindFileData=0xaf788 | out: lpFindFileData=0xaf788) returned 1 [0066.153] PeekMessageA (in: lpMsg=0xaf764, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf764) returned 0 [0066.153] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="bootmgr") returned 1 [0066.153] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bootmgr") returned 1 [0066.153] lstrcmpiA (lpString1="", lpString2="bootmgr") returned -1 [0066.153] PathFindFileNameA (pszPath="C:\\*.*") returned="*.*" [0066.153] lstrcatA (in: lpString1="C:\\", lpString2="bootmgr" | out: lpString1="C:\\bootmgr") returned="C:\\bootmgr" [0066.153] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.zip") returned 0 [0066.153] lstrlenA (lpString="*.zip") returned 5 [0066.153] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.rar") returned 0 [0066.153] lstrlenA (lpString="*.rar") returned 5 [0066.153] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.7z") returned 0 [0066.153] lstrlenA (lpString="*.7z") returned 4 [0066.153] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.tar") returned 0 [0066.153] lstrlenA (lpString="*.tar") returned 5 [0066.153] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.gzip") returned 0 [0066.153] lstrlenA (lpString="*.gzip") returned 6 [0066.153] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.jpg") returned 0 [0066.153] lstrlenA (lpString="*.jpg") returned 5 [0066.153] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.jpeg") returned 0 [0066.153] lstrlenA (lpString="*.jpeg") returned 6 [0066.153] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.psd") returned 0 [0066.153] lstrlenA (lpString="*.psd") returned 5 [0066.153] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.cdr") returned 0 [0066.153] lstrlenA (lpString="*.cdr") returned 5 [0066.153] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.dwg") returned 0 [0066.153] lstrlenA (lpString="*.dwg") returned 5 [0066.153] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.max") returned 0 [0066.153] lstrlenA (lpString="*.max") returned 5 [0066.153] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.bmp") returned 0 [0066.153] lstrlenA (lpString="*.bmp") returned 5 [0066.153] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.gif") returned 0 [0066.153] lstrlenA (lpString="*.gif") returned 5 [0066.153] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.png") returned 0 [0066.153] lstrlenA (lpString="*.png") returned 5 [0066.153] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.doc") returned 0 [0066.153] lstrlenA (lpString="*.doc") returned 5 [0066.154] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.docx") returned 0 [0066.154] lstrlenA (lpString="*.docx") returned 6 [0066.154] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.xls") returned 0 [0066.154] lstrlenA (lpString="*.xls") returned 5 [0066.154] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.xlsx") returned 0 [0066.154] lstrlenA (lpString="*.xlsx") returned 6 [0066.154] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.ppt") returned 0 [0066.154] lstrlenA (lpString="*.ppt") returned 5 [0066.154] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.pptx") returned 0 [0066.154] lstrlenA (lpString="*.pptx") returned 6 [0066.154] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.txt") returned 0 [0066.154] lstrlenA (lpString="*.txt") returned 5 [0066.154] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.pdf") returned 0 [0066.154] lstrlenA (lpString="*.pdf") returned 5 [0066.154] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.djvu") returned 0 [0066.154] lstrlenA (lpString="*.djvu") returned 6 [0066.154] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.htm") returned 0 [0066.154] lstrlenA (lpString="*.htm") returned 5 [0066.154] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.html") returned 0 [0066.154] lstrlenA (lpString="*.html") returned 6 [0066.154] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.mdb") returned 0 [0066.154] lstrlenA (lpString="*.mdb") returned 5 [0066.154] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.cer") returned 0 [0066.154] lstrlenA (lpString="*.cer") returned 5 [0066.154] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.p12") returned 0 [0066.154] lstrlenA (lpString="*.p12") returned 5 [0066.154] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.pfx") returned 0 [0066.154] lstrlenA (lpString="*.pfx") returned 5 [0066.154] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.kwm") returned 0 [0066.154] lstrlenA (lpString="*.kwm") returned 5 [0066.154] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.pwm") returned 0 [0066.154] lstrlenA (lpString="*.pwm") returned 5 [0066.154] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.1cd") returned 0 [0066.154] lstrlenA (lpString="*.1cd") returned 5 [0066.154] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.md") returned 0 [0066.154] lstrlenA (lpString="*.md") returned 4 [0066.154] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.mdf") returned 0 [0066.154] lstrlenA (lpString="*.mdf") returned 5 [0066.154] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.dbf") returned 0 [0066.154] lstrlenA (lpString="*.dbf") returned 5 [0066.154] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.odt") returned 0 [0066.154] lstrlenA (lpString="*.odt") returned 5 [0066.154] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.vob") returned 0 [0066.154] lstrlenA (lpString="*.vob") returned 5 [0066.154] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.ifo") returned 0 [0066.154] lstrlenA (lpString="*.ifo") returned 5 [0066.154] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.lnk") returned 0 [0066.154] lstrlenA (lpString="*.lnk") returned 5 [0066.154] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.torrent") returned 0 [0066.154] lstrlenA (lpString="*.torrent") returned 9 [0066.155] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.mov") returned 0 [0066.155] lstrlenA (lpString="*.mov") returned 5 [0066.155] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.m2v") returned 0 [0066.155] lstrlenA (lpString="*.m2v") returned 5 [0066.155] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.3gp") returned 0 [0066.155] lstrlenA (lpString="*.3gp") returned 5 [0066.155] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.mpeg") returned 0 [0066.155] lstrlenA (lpString="*.mpeg") returned 6 [0066.155] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.mpg") returned 0 [0066.155] lstrlenA (lpString="*.mpg") returned 5 [0066.155] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.flv") returned 0 [0066.155] lstrlenA (lpString="*.flv") returned 5 [0066.155] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.avi") returned 0 [0066.155] lstrlenA (lpString="*.avi") returned 5 [0066.155] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.mp4") returned 0 [0066.155] lstrlenA (lpString="*.mp4") returned 5 [0066.155] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.wmv") returned 0 [0066.155] lstrlenA (lpString="*.wmv") returned 5 [0066.155] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.divx") returned 0 [0066.155] lstrlenA (lpString="*.divx") returned 6 [0066.155] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.mkv") returned 0 [0066.155] lstrlenA (lpString="*.mkv") returned 5 [0066.155] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.mp3") returned 0 [0066.155] lstrlenA (lpString="*.mp3") returned 5 [0066.155] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.wav") returned 0 [0066.155] lstrlenA (lpString="*.wav") returned 5 [0066.155] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.flac") returned 0 [0066.155] lstrlenA (lpString="*.flac") returned 6 [0066.155] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.ape") returned 0 [0066.155] lstrlenA (lpString="*.ape") returned 5 [0066.155] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.wma") returned 0 [0066.155] lstrlenA (lpString="*.wma") returned 5 [0066.155] PathMatchSpecA (pszFile="C:\\bootmgr", pszSpec="*.ac3") returned 0 [0066.155] lstrlenA (lpString="*.ac3") returned 5 [0066.155] FindNextFileA (in: hFindFile=0x5b4a08, lpFindFileData=0xaf788 | out: lpFindFileData=0xaf788) returned 1 [0066.155] PeekMessageA (in: lpMsg=0xaf764, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf764) returned 0 [0066.155] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BOOTSECT.BAK") returned 1 [0066.155] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BOOTSECT.BAK") returned 1 [0066.155] lstrcmpiA (lpString1="", lpString2="BOOTSECT.BAK") returned -1 [0066.155] PathFindFileNameA (pszPath="C:\\bootmgr") returned="bootmgr" [0066.155] lstrcatA (in: lpString1="C:\\", lpString2="BOOTSECT.BAK" | out: lpString1="C:\\BOOTSECT.BAK") returned="C:\\BOOTSECT.BAK" [0066.155] PathMatchSpecA (pszFile="C:\\BOOTSECT.BAK", pszSpec="*.zip") returned 0 [0066.155] lstrlenA (lpString="*.zip") returned 5 [0066.155] PathMatchSpecA (pszFile="C:\\BOOTSECT.BAK", pszSpec="*.rar") returned 0 [0066.155] lstrlenA (lpString="*.rar") returned 5 [0066.156] PathMatchSpecA (pszFile="C:\\BOOTSECT.BAK", pszSpec="*.7z") returned 0 [0066.156] lstrlenA (lpString="*.7z") returned 4 [0066.156] PathMatchSpecA (pszFile="C:\\BOOTSECT.BAK", pszSpec="*.tar") returned 0 [0066.156] lstrlenA (lpString="*.tar") returned 5 [0066.156] PathMatchSpecA (pszFile="C:\\BOOTSECT.BAK", pszSpec="*.gzip") returned 0 [0066.156] lstrlenA (lpString="*.gzip") returned 6 [0066.156] PathMatchSpecA (pszFile="C:\\BOOTSECT.BAK", pszSpec="*.jpg") returned 0 [0066.156] lstrlenA (lpString="*.jpg") returned 5 [0066.156] PathMatchSpecA (pszFile="C:\\BOOTSECT.BAK", pszSpec="*.jpeg") returned 0 [0066.156] lstrlenA (lpString="*.jpeg") returned 6 [0066.156] PathMatchSpecA (pszFile="C:\\BOOTSECT.BAK", pszSpec="*.psd") returned 0 [0066.156] lstrlenA (lpString="*.psd") returned 5 [0066.156] PathMatchSpecA (pszFile="C:\\BOOTSECT.BAK", pszSpec="*.cdr") returned 0 [0066.156] lstrlenA (lpString="*.cdr") returned 5 [0066.156] PathMatchSpecA (pszFile="C:\\BOOTSECT.BAK", pszSpec="*.dwg") returned 0 [0066.156] lstrlenA (lpString="*.dwg") returned 5 [0066.156] PathMatchSpecA (pszFile="C:\\BOOTSECT.BAK", pszSpec="*.max") returned 0 [0066.156] lstrlenA (lpString="*.max") returned 5 [0066.156] PathMatchSpecA (pszFile="C:\\BOOTSECT.BAK", pszSpec="*.bmp") returned 0 [0066.156] lstrlenA (lpString="*.bmp") returned 5 [0066.156] PathMatchSpecA (pszFile="C:\\BOOTSECT.BAK", pszSpec="*.gif") returned 0 [0066.156] lstrlenA (lpString="*.gif") returned 5 [0066.156] PathMatchSpecA (pszFile="C:\\BOOTSECT.BAK", pszSpec="*.png") returned 0 [0066.156] lstrlenA (lpString="*.png") returned 5 [0066.156] PathMatchSpecA (pszFile="C:\\BOOTSECT.BAK", pszSpec="*.doc") returned 0 [0066.156] lstrlenA (lpString="*.doc") returned 5 [0066.156] PathMatchSpecA (pszFile="C:\\BOOTSECT.BAK", pszSpec="*.docx") returned 0 [0066.156] lstrlenA (lpString="*.docx") returned 6 [0066.156] PathMatchSpecA (pszFile="C:\\BOOTSECT.BAK", pszSpec="*.xls") returned 0 [0066.156] lstrlenA (lpString="*.xls") returned 5 [0066.156] PathMatchSpecA (pszFile="C:\\BOOTSECT.BAK", pszSpec="*.xlsx") returned 0 [0066.156] lstrlenA (lpString="*.xlsx") returned 6 [0066.156] PathMatchSpecA (pszFile="C:\\BOOTSECT.BAK", pszSpec="*.ppt") returned 0 [0066.156] lstrlenA (lpString="*.ppt") returned 5 [0066.156] PathMatchSpecA (pszFile="C:\\BOOTSECT.BAK", pszSpec="*.pptx") returned 0 [0066.156] lstrlenA (lpString="*.pptx") returned 6 [0066.156] PathMatchSpecA (pszFile="C:\\BOOTSECT.BAK", pszSpec="*.txt") returned 0 [0066.156] lstrlenA (lpString="*.txt") returned 5 [0066.156] PathMatchSpecA (pszFile="C:\\BOOTSECT.BAK", pszSpec="*.pdf") returned 0 [0066.156] lstrlenA (lpString="*.pdf") returned 5 [0066.156] PathMatchSpecA (pszFile="C:\\BOOTSECT.BAK", pszSpec="*.djvu") returned 0 [0066.156] lstrlenA (lpString="*.djvu") returned 6 [0066.156] PathMatchSpecA (pszFile="C:\\BOOTSECT.BAK", pszSpec="*.htm") returned 0 [0066.156] lstrlenA (lpString="*.htm") returned 5 [0066.156] PathMatchSpecA (pszFile="C:\\BOOTSECT.BAK", pszSpec="*.html") returned 0 [0066.157] lstrlenA (lpString="*.html") returned 6 [0066.157] PathMatchSpecA (pszFile="C:\\BOOTSECT.BAK", pszSpec="*.mdb") returned 0 [0066.157] lstrlenA (lpString="*.mdb") returned 5 [0066.157] PathMatchSpecA (pszFile="C:\\BOOTSECT.BAK", pszSpec="*.cer") returned 0 [0066.157] lstrlenA (lpString="*.cer") returned 5 [0066.157] PathMatchSpecA (pszFile="C:\\BOOTSECT.BAK", pszSpec="*.p12") returned 0 [0066.157] lstrlenA (lpString="*.p12") returned 5 [0066.157] PathMatchSpecA (pszFile="C:\\BOOTSECT.BAK", pszSpec="*.pfx") returned 0 [0066.157] lstrlenA (lpString="*.pfx") returned 5 [0066.157] PathMatchSpecA (pszFile="C:\\BOOTSECT.BAK", pszSpec="*.kwm") returned 0 [0066.157] lstrlenA (lpString="*.kwm") returned 5 [0066.157] PathMatchSpecA (pszFile="C:\\BOOTSECT.BAK", pszSpec="*.pwm") returned 0 [0066.157] lstrlenA (lpString="*.pwm") returned 5 [0066.157] PathMatchSpecA (pszFile="C:\\BOOTSECT.BAK", pszSpec="*.1cd") returned 0 [0066.157] lstrlenA (lpString="*.1cd") returned 5 [0066.157] PathMatchSpecA (pszFile="C:\\BOOTSECT.BAK", pszSpec="*.md") returned 0 [0066.157] lstrlenA (lpString="*.md") returned 4 [0066.157] PathMatchSpecA (pszFile="C:\\BOOTSECT.BAK", pszSpec="*.mdf") returned 0 [0066.157] lstrlenA (lpString="*.mdf") returned 5 [0066.157] PathMatchSpecA (pszFile="C:\\BOOTSECT.BAK", pszSpec="*.dbf") returned 0 [0066.157] lstrlenA (lpString="*.dbf") returned 5 [0066.157] PathMatchSpecA (pszFile="C:\\BOOTSECT.BAK", pszSpec="*.odt") returned 0 [0066.157] lstrlenA (lpString="*.odt") returned 5 [0066.157] PathMatchSpecA (pszFile="C:\\BOOTSECT.BAK", pszSpec="*.vob") returned 0 [0066.157] lstrlenA (lpString="*.vob") returned 5 [0066.157] PathMatchSpecA (pszFile="C:\\BOOTSECT.BAK", pszSpec="*.ifo") returned 0 [0066.157] lstrlenA (lpString="*.ifo") returned 5 [0066.157] PathMatchSpecA (pszFile="C:\\BOOTSECT.BAK", pszSpec="*.lnk") returned 0 [0066.157] lstrlenA (lpString="*.lnk") returned 5 [0066.157] PathMatchSpecA (pszFile="C:\\BOOTSECT.BAK", pszSpec="*.torrent") returned 0 [0066.157] lstrlenA (lpString="*.torrent") returned 9 [0066.157] PathMatchSpecA (pszFile="C:\\BOOTSECT.BAK", pszSpec="*.mov") returned 0 [0066.157] lstrlenA (lpString="*.mov") returned 5 [0066.157] PathMatchSpecA (pszFile="C:\\BOOTSECT.BAK", pszSpec="*.m2v") returned 0 [0066.157] lstrlenA (lpString="*.m2v") returned 5 [0066.157] PathMatchSpecA (pszFile="C:\\BOOTSECT.BAK", pszSpec="*.3gp") returned 0 [0066.157] lstrlenA (lpString="*.3gp") returned 5 [0066.157] PathMatchSpecA (pszFile="C:\\BOOTSECT.BAK", pszSpec="*.mpeg") returned 0 [0066.157] lstrlenA (lpString="*.mpeg") returned 6 [0066.157] PathMatchSpecA (pszFile="C:\\BOOTSECT.BAK", pszSpec="*.mpg") returned 0 [0066.157] lstrlenA (lpString="*.mpg") returned 5 [0066.157] PathMatchSpecA (pszFile="C:\\BOOTSECT.BAK", pszSpec="*.flv") returned 0 [0066.157] lstrlenA (lpString="*.flv") returned 5 [0066.157] PathMatchSpecA (pszFile="C:\\BOOTSECT.BAK", pszSpec="*.avi") returned 0 [0066.157] lstrlenA (lpString="*.avi") returned 5 [0066.158] PathMatchSpecA (pszFile="C:\\BOOTSECT.BAK", pszSpec="*.mp4") returned 0 [0066.158] lstrlenA (lpString="*.mp4") returned 5 [0066.158] PathMatchSpecA (pszFile="C:\\BOOTSECT.BAK", pszSpec="*.wmv") returned 0 [0066.158] lstrlenA (lpString="*.wmv") returned 5 [0066.158] PathMatchSpecA (pszFile="C:\\BOOTSECT.BAK", pszSpec="*.divx") returned 0 [0066.158] lstrlenA (lpString="*.divx") returned 6 [0066.158] PathMatchSpecA (pszFile="C:\\BOOTSECT.BAK", pszSpec="*.mkv") returned 0 [0066.158] lstrlenA (lpString="*.mkv") returned 5 [0066.158] PathMatchSpecA (pszFile="C:\\BOOTSECT.BAK", pszSpec="*.mp3") returned 0 [0066.158] lstrlenA (lpString="*.mp3") returned 5 [0066.158] PathMatchSpecA (pszFile="C:\\BOOTSECT.BAK", pszSpec="*.wav") returned 0 [0066.158] lstrlenA (lpString="*.wav") returned 5 [0066.158] PathMatchSpecA (pszFile="C:\\BOOTSECT.BAK", pszSpec="*.flac") returned 0 [0066.158] lstrlenA (lpString="*.flac") returned 6 [0066.158] PathMatchSpecA (pszFile="C:\\BOOTSECT.BAK", pszSpec="*.ape") returned 0 [0066.158] lstrlenA (lpString="*.ape") returned 5 [0066.158] PathMatchSpecA (pszFile="C:\\BOOTSECT.BAK", pszSpec="*.wma") returned 0 [0066.158] lstrlenA (lpString="*.wma") returned 5 [0066.158] PathMatchSpecA (pszFile="C:\\BOOTSECT.BAK", pszSpec="*.ac3") returned 0 [0066.158] lstrlenA (lpString="*.ac3") returned 5 [0066.158] FindNextFileA (in: hFindFile=0x5b4a08, lpFindFileData=0xaf788 | out: lpFindFileData=0xaf788) returned 1 [0066.158] lstrcmpA (lpString1=".", lpString2="Config.Msi") returned -1 [0066.158] lstrcmpA (lpString1="..", lpString2="Config.Msi") returned -1 [0066.158] PathFindFileNameA (pszPath="C:\\BOOTSECT.BAK") returned="BOOTSECT.BAK" [0066.158] lstrcatA (in: lpString1="C:\\", lpString2="Config.Msi" | out: lpString1="C:\\Config.Msi") returned="C:\\Config.Msi" [0066.158] lstrlenA (lpString="C:\\Config.Msi") returned 13 [0066.158] FindFirstFileA (in: lpFileName="C:\\Config.Msi\\*.*", lpFindFileData=0xaf638 | out: lpFindFileData=0xaf638) returned 0x5b5c00 [0066.159] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0066.159] FindNextFileA (in: hFindFile=0x5b5c00, lpFindFileData=0xaf638 | out: lpFindFileData=0xaf638) returned 1 [0066.159] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0066.159] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0066.159] FindNextFileA (in: hFindFile=0x5b5c00, lpFindFileData=0xaf638 | out: lpFindFileData=0xaf638) returned 0 [0066.159] FindClose (in: hFindFile=0x5b5c00 | out: hFindFile=0x5b5c00) returned 1 [0066.159] FindNextFileA (in: hFindFile=0x5b4a08, lpFindFileData=0xaf788 | out: lpFindFileData=0xaf788) returned 1 [0066.159] lstrcmpA (lpString1=".", lpString2="Documents and Settings") returned -1 [0066.159] lstrcmpA (lpString1="..", lpString2="Documents and Settings") returned -1 [0066.159] PathFindFileNameA (pszPath="C:\\*.*") returned="*.*" [0066.159] lstrcatA (in: lpString1="C:\\", lpString2="Documents and Settings" | out: lpString1="C:\\Documents and Settings") returned="C:\\Documents and Settings" [0066.159] lstrlenA (lpString="C:\\Documents and Settings") returned 25 [0066.159] FindFirstFileA (in: lpFileName="C:\\Documents and Settings\\*.*", lpFindFileData=0xaf638 | out: lpFindFileData=0xaf638) returned 0xffffffff [0066.159] FindNextFileA (in: hFindFile=0x5b4a08, lpFindFileData=0xaf788 | out: lpFindFileData=0xaf788) returned 1 [0066.159] PeekMessageA (in: lpMsg=0xaf764, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf764) returned 0 [0066.159] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="hiberfil.sys") returned -1 [0066.159] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="hiberfil.sys") returned 1 [0066.159] lstrcmpiA (lpString1="", lpString2="hiberfil.sys") returned -1 [0066.159] PathFindFileNameA (pszPath="C:\\*.*") returned="*.*" [0066.159] lstrcatA (in: lpString1="C:\\", lpString2="hiberfil.sys" | out: lpString1="C:\\hiberfil.sys") returned="C:\\hiberfil.sys" [0066.159] PathMatchSpecA (pszFile="C:\\hiberfil.sys", pszSpec="*.zip") returned 0 [0066.159] lstrlenA (lpString="*.zip") returned 5 [0066.159] PathMatchSpecA (pszFile="C:\\hiberfil.sys", pszSpec="*.rar") returned 0 [0066.159] lstrlenA (lpString="*.rar") returned 5 [0066.160] PathMatchSpecA (pszFile="C:\\hiberfil.sys", pszSpec="*.7z") returned 0 [0066.160] lstrlenA (lpString="*.7z") returned 4 [0066.160] PathMatchSpecA (pszFile="C:\\hiberfil.sys", pszSpec="*.tar") returned 0 [0066.160] lstrlenA (lpString="*.tar") returned 5 [0066.160] PathMatchSpecA (pszFile="C:\\hiberfil.sys", pszSpec="*.gzip") returned 0 [0066.160] lstrlenA (lpString="*.gzip") returned 6 [0066.160] PathMatchSpecA (pszFile="C:\\hiberfil.sys", pszSpec="*.jpg") returned 0 [0066.160] lstrlenA (lpString="*.jpg") returned 5 [0066.160] PathMatchSpecA (pszFile="C:\\hiberfil.sys", pszSpec="*.jpeg") returned 0 [0066.160] lstrlenA (lpString="*.jpeg") returned 6 [0066.160] PathMatchSpecA (pszFile="C:\\hiberfil.sys", pszSpec="*.psd") returned 0 [0066.160] lstrlenA (lpString="*.psd") returned 5 [0066.160] PathMatchSpecA (pszFile="C:\\hiberfil.sys", pszSpec="*.cdr") returned 0 [0066.160] lstrlenA (lpString="*.cdr") returned 5 [0066.160] PathMatchSpecA (pszFile="C:\\hiberfil.sys", pszSpec="*.dwg") returned 0 [0066.160] lstrlenA (lpString="*.dwg") returned 5 [0066.160] PathMatchSpecA (pszFile="C:\\hiberfil.sys", pszSpec="*.max") returned 0 [0066.160] lstrlenA (lpString="*.max") returned 5 [0066.160] PathMatchSpecA (pszFile="C:\\hiberfil.sys", pszSpec="*.bmp") returned 0 [0066.160] lstrlenA (lpString="*.bmp") returned 5 [0066.160] PathMatchSpecA (pszFile="C:\\hiberfil.sys", pszSpec="*.gif") returned 0 [0066.160] lstrlenA (lpString="*.gif") returned 5 [0066.160] PathMatchSpecA (pszFile="C:\\hiberfil.sys", pszSpec="*.png") returned 0 [0066.160] lstrlenA (lpString="*.png") returned 5 [0066.160] PathMatchSpecA (pszFile="C:\\hiberfil.sys", pszSpec="*.doc") returned 0 [0066.160] lstrlenA (lpString="*.doc") returned 5 [0066.160] PathMatchSpecA (pszFile="C:\\hiberfil.sys", pszSpec="*.docx") returned 0 [0066.160] lstrlenA (lpString="*.docx") returned 6 [0066.160] PathMatchSpecA (pszFile="C:\\hiberfil.sys", pszSpec="*.xls") returned 0 [0066.160] lstrlenA (lpString="*.xls") returned 5 [0066.160] PathMatchSpecA (pszFile="C:\\hiberfil.sys", pszSpec="*.xlsx") returned 0 [0066.160] lstrlenA (lpString="*.xlsx") returned 6 [0066.160] PathMatchSpecA (pszFile="C:\\hiberfil.sys", pszSpec="*.ppt") returned 0 [0066.160] lstrlenA (lpString="*.ppt") returned 5 [0066.160] PathMatchSpecA (pszFile="C:\\hiberfil.sys", pszSpec="*.pptx") returned 0 [0066.160] lstrlenA (lpString="*.pptx") returned 6 [0066.160] PathMatchSpecA (pszFile="C:\\hiberfil.sys", pszSpec="*.txt") returned 0 [0066.160] lstrlenA (lpString="*.txt") returned 5 [0066.160] PathMatchSpecA (pszFile="C:\\hiberfil.sys", pszSpec="*.pdf") returned 0 [0066.160] lstrlenA (lpString="*.pdf") returned 5 [0066.160] PathMatchSpecA (pszFile="C:\\hiberfil.sys", pszSpec="*.djvu") returned 0 [0066.160] lstrlenA (lpString="*.djvu") returned 6 [0066.160] PathMatchSpecA (pszFile="C:\\hiberfil.sys", pszSpec="*.htm") returned 0 [0066.160] lstrlenA (lpString="*.htm") returned 5 [0066.160] PathMatchSpecA (pszFile="C:\\hiberfil.sys", pszSpec="*.html") returned 0 [0066.161] lstrlenA (lpString="*.html") returned 6 [0066.161] PathMatchSpecA (pszFile="C:\\hiberfil.sys", pszSpec="*.mdb") returned 0 [0066.161] lstrlenA (lpString="*.mdb") returned 5 [0066.161] PathMatchSpecA (pszFile="C:\\hiberfil.sys", pszSpec="*.cer") returned 0 [0066.161] lstrlenA (lpString="*.cer") returned 5 [0066.161] PathMatchSpecA (pszFile="C:\\hiberfil.sys", pszSpec="*.p12") returned 0 [0066.161] lstrlenA (lpString="*.p12") returned 5 [0066.161] PathMatchSpecA (pszFile="C:\\hiberfil.sys", pszSpec="*.pfx") returned 0 [0066.161] lstrlenA (lpString="*.pfx") returned 5 [0066.161] PathMatchSpecA (pszFile="C:\\hiberfil.sys", pszSpec="*.kwm") returned 0 [0066.161] lstrlenA (lpString="*.kwm") returned 5 [0066.161] PathMatchSpecA (pszFile="C:\\hiberfil.sys", pszSpec="*.pwm") returned 0 [0066.161] lstrlenA (lpString="*.pwm") returned 5 [0066.161] PathMatchSpecA (pszFile="C:\\hiberfil.sys", pszSpec="*.1cd") returned 0 [0066.161] lstrlenA (lpString="*.1cd") returned 5 [0066.161] PathMatchSpecA (pszFile="C:\\hiberfil.sys", pszSpec="*.md") returned 0 [0066.161] lstrlenA (lpString="*.md") returned 4 [0066.161] PathMatchSpecA (pszFile="C:\\hiberfil.sys", pszSpec="*.mdf") returned 0 [0066.161] lstrlenA (lpString="*.mdf") returned 5 [0066.161] PathMatchSpecA (pszFile="C:\\hiberfil.sys", pszSpec="*.dbf") returned 0 [0066.161] lstrlenA (lpString="*.dbf") returned 5 [0066.161] PathMatchSpecA (pszFile="C:\\hiberfil.sys", pszSpec="*.odt") returned 0 [0066.161] lstrlenA (lpString="*.odt") returned 5 [0066.161] PathMatchSpecA (pszFile="C:\\hiberfil.sys", pszSpec="*.vob") returned 0 [0066.161] lstrlenA (lpString="*.vob") returned 5 [0066.161] PathMatchSpecA (pszFile="C:\\hiberfil.sys", pszSpec="*.ifo") returned 0 [0066.161] lstrlenA (lpString="*.ifo") returned 5 [0066.161] PathMatchSpecA (pszFile="C:\\hiberfil.sys", pszSpec="*.lnk") returned 0 [0066.161] lstrlenA (lpString="*.lnk") returned 5 [0066.161] PathMatchSpecA (pszFile="C:\\hiberfil.sys", pszSpec="*.torrent") returned 0 [0066.161] lstrlenA (lpString="*.torrent") returned 9 [0066.161] PathMatchSpecA (pszFile="C:\\hiberfil.sys", pszSpec="*.mov") returned 0 [0066.161] lstrlenA (lpString="*.mov") returned 5 [0066.161] PathMatchSpecA (pszFile="C:\\hiberfil.sys", pszSpec="*.m2v") returned 0 [0066.161] lstrlenA (lpString="*.m2v") returned 5 [0066.161] PathMatchSpecA (pszFile="C:\\hiberfil.sys", pszSpec="*.3gp") returned 0 [0066.161] lstrlenA (lpString="*.3gp") returned 5 [0066.161] PathMatchSpecA (pszFile="C:\\hiberfil.sys", pszSpec="*.mpeg") returned 0 [0066.161] lstrlenA (lpString="*.mpeg") returned 6 [0066.162] PathMatchSpecA (pszFile="C:\\hiberfil.sys", pszSpec="*.mpg") returned 0 [0066.162] lstrlenA (lpString="*.mpg") returned 5 [0066.162] PathMatchSpecA (pszFile="C:\\hiberfil.sys", pszSpec="*.flv") returned 0 [0066.162] lstrlenA (lpString="*.flv") returned 5 [0066.162] PathMatchSpecA (pszFile="C:\\hiberfil.sys", pszSpec="*.avi") returned 0 [0066.162] lstrlenA (lpString="*.avi") returned 5 [0066.162] PathMatchSpecA (pszFile="C:\\hiberfil.sys", pszSpec="*.mp4") returned 0 [0066.162] lstrlenA (lpString="*.mp4") returned 5 [0066.162] PathMatchSpecA (pszFile="C:\\hiberfil.sys", pszSpec="*.wmv") returned 0 [0066.162] lstrlenA (lpString="*.wmv") returned 5 [0066.162] PathMatchSpecA (pszFile="C:\\hiberfil.sys", pszSpec="*.divx") returned 0 [0066.162] lstrlenA (lpString="*.divx") returned 6 [0066.162] PathMatchSpecA (pszFile="C:\\hiberfil.sys", pszSpec="*.mkv") returned 0 [0066.162] lstrlenA (lpString="*.mkv") returned 5 [0066.162] PathMatchSpecA (pszFile="C:\\hiberfil.sys", pszSpec="*.mp3") returned 0 [0066.162] lstrlenA (lpString="*.mp3") returned 5 [0066.162] PathMatchSpecA (pszFile="C:\\hiberfil.sys", pszSpec="*.wav") returned 0 [0066.162] lstrlenA (lpString="*.wav") returned 5 [0066.162] PathMatchSpecA (pszFile="C:\\hiberfil.sys", pszSpec="*.flac") returned 0 [0066.162] lstrlenA (lpString="*.flac") returned 6 [0066.162] PathMatchSpecA (pszFile="C:\\hiberfil.sys", pszSpec="*.ape") returned 0 [0066.162] lstrlenA (lpString="*.ape") returned 5 [0066.162] PathMatchSpecA (pszFile="C:\\hiberfil.sys", pszSpec="*.wma") returned 0 [0066.162] lstrlenA (lpString="*.wma") returned 5 [0066.162] PathMatchSpecA (pszFile="C:\\hiberfil.sys", pszSpec="*.ac3") returned 0 [0066.162] lstrlenA (lpString="*.ac3") returned 5 [0066.162] FindNextFileA (in: hFindFile=0x5b4a08, lpFindFileData=0xaf788 | out: lpFindFileData=0xaf788) returned 1 [0066.162] lstrcmpA (lpString1=".", lpString2="MSOCache") returned -1 [0066.162] lstrcmpA (lpString1="..", lpString2="MSOCache") returned -1 [0066.162] PathFindFileNameA (pszPath="C:\\hiberfil.sys") returned="hiberfil.sys" [0066.162] lstrcatA (in: lpString1="C:\\", lpString2="MSOCache" | out: lpString1="C:\\MSOCache") returned="C:\\MSOCache" [0066.162] lstrlenA (lpString="C:\\MSOCache") returned 11 [0066.162] FindFirstFileA (in: lpFileName="C:\\MSOCache\\*.*", lpFindFileData=0xaf638 | out: lpFindFileData=0xaf638) returned 0x5b5bd0 [0066.163] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0066.163] FindNextFileA (in: hFindFile=0x5b5bd0, lpFindFileData=0xaf638 | out: lpFindFileData=0xaf638) returned 1 [0066.163] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0066.163] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0066.163] FindNextFileA (in: hFindFile=0x5b5bd0, lpFindFileData=0xaf638 | out: lpFindFileData=0xaf638) returned 1 [0066.163] lstrcmpA (lpString1=".", lpString2="All Users") returned -1 [0066.163] lstrcmpA (lpString1="..", lpString2="All Users") returned -1 [0066.163] PathFindFileNameA (pszPath="C:\\MSOCache\\*.*") returned="*.*" [0066.163] lstrcatA (in: lpString1="C:\\MSOCache\\", lpString2="All Users" | out: lpString1="C:\\MSOCache\\All Users") returned="C:\\MSOCache\\All Users" [0066.163] lstrlenA (lpString="C:\\MSOCache\\All Users") returned 21 [0066.163] FindFirstFileA (in: lpFileName="C:\\MSOCache\\All Users\\*.*", lpFindFileData=0xaf4e8 | out: lpFindFileData=0xaf4e8) returned 0x5b6c58 [0066.173] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0066.173] FindNextFileA (in: hFindFile=0x5b6c58, lpFindFileData=0xaf4e8 | out: lpFindFileData=0xaf4e8) returned 1 [0066.174] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0066.174] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0066.174] FindNextFileA (in: hFindFile=0x5b6c58, lpFindFileData=0xaf4e8 | out: lpFindFileData=0xaf4e8) returned 1 [0066.174] lstrcmpA (lpString1=".", lpString2="{90140000-0016-0409-1000-0000000FF1CE}-C") returned -1 [0066.174] lstrcmpA (lpString1="..", lpString2="{90140000-0016-0409-1000-0000000FF1CE}-C") returned -1 [0066.174] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\*.*") returned="*.*" [0066.174] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\", lpString2="{90140000-0016-0409-1000-0000000FF1CE}-C" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C") returned="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C" [0066.174] lstrlenA (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C") returned 62 [0066.175] FindFirstFileA (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\*.*", lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 0x5b6c18 [0066.175] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0066.175] FindNextFileA (in: hFindFile=0x5b6c18, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0066.175] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0066.175] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0066.175] FindNextFileA (in: hFindFile=0x5b6c18, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0066.176] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0066.176] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="ExcelLR.cab") returned -1 [0066.176] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ExcelLR.cab") returned 1 [0066.176] lstrcmpiA (lpString1="", lpString2="ExcelLR.cab") returned -1 [0066.176] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\*.*") returned="*.*" [0066.176] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\", lpString2="ExcelLR.cab" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab" [0066.176] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab", pszSpec="*.zip") returned 0 [0066.176] lstrlenA (lpString="*.zip") returned 5 [0066.176] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab", pszSpec="*.rar") returned 0 [0066.176] lstrlenA (lpString="*.rar") returned 5 [0066.176] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab", pszSpec="*.7z") returned 0 [0066.176] lstrlenA (lpString="*.7z") returned 4 [0066.176] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab", pszSpec="*.tar") returned 0 [0066.176] lstrlenA (lpString="*.tar") returned 5 [0066.176] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab", pszSpec="*.gzip") returned 0 [0066.176] lstrlenA (lpString="*.gzip") returned 6 [0066.176] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab", pszSpec="*.jpg") returned 0 [0066.177] lstrlenA (lpString="*.jpg") returned 5 [0066.177] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab", pszSpec="*.jpeg") returned 0 [0066.177] lstrlenA (lpString="*.jpeg") returned 6 [0066.177] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab", pszSpec="*.psd") returned 0 [0066.177] lstrlenA (lpString="*.psd") returned 5 [0066.177] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab", pszSpec="*.cdr") returned 0 [0066.177] lstrlenA (lpString="*.cdr") returned 5 [0066.177] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab", pszSpec="*.dwg") returned 0 [0066.177] lstrlenA (lpString="*.dwg") returned 5 [0066.177] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab", pszSpec="*.max") returned 0 [0066.177] lstrlenA (lpString="*.max") returned 5 [0066.177] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab", pszSpec="*.bmp") returned 0 [0066.177] lstrlenA (lpString="*.bmp") returned 5 [0066.177] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab", pszSpec="*.gif") returned 0 [0066.177] lstrlenA (lpString="*.gif") returned 5 [0066.177] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab", pszSpec="*.png") returned 0 [0066.177] lstrlenA (lpString="*.png") returned 5 [0066.177] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab", pszSpec="*.doc") returned 0 [0066.177] lstrlenA (lpString="*.doc") returned 5 [0066.177] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab", pszSpec="*.docx") returned 0 [0066.177] lstrlenA (lpString="*.docx") returned 6 [0066.177] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab", pszSpec="*.xls") returned 0 [0066.177] lstrlenA (lpString="*.xls") returned 5 [0066.177] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab", pszSpec="*.xlsx") returned 0 [0066.177] lstrlenA (lpString="*.xlsx") returned 6 [0066.177] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab", pszSpec="*.ppt") returned 0 [0066.177] lstrlenA (lpString="*.ppt") returned 5 [0066.177] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab", pszSpec="*.pptx") returned 0 [0066.177] lstrlenA (lpString="*.pptx") returned 6 [0066.177] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab", pszSpec="*.txt") returned 0 [0066.177] lstrlenA (lpString="*.txt") returned 5 [0066.177] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab", pszSpec="*.pdf") returned 0 [0066.177] lstrlenA (lpString="*.pdf") returned 5 [0066.177] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab", pszSpec="*.djvu") returned 0 [0066.177] lstrlenA (lpString="*.djvu") returned 6 [0066.178] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab", pszSpec="*.htm") returned 0 [0066.178] lstrlenA (lpString="*.htm") returned 5 [0066.178] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab", pszSpec="*.html") returned 0 [0066.178] lstrlenA (lpString="*.html") returned 6 [0066.178] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab", pszSpec="*.mdb") returned 0 [0066.178] lstrlenA (lpString="*.mdb") returned 5 [0066.178] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab", pszSpec="*.cer") returned 0 [0066.178] lstrlenA (lpString="*.cer") returned 5 [0066.178] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab", pszSpec="*.p12") returned 0 [0066.178] lstrlenA (lpString="*.p12") returned 5 [0066.178] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab", pszSpec="*.pfx") returned 0 [0066.178] lstrlenA (lpString="*.pfx") returned 5 [0066.178] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab", pszSpec="*.kwm") returned 0 [0066.178] lstrlenA (lpString="*.kwm") returned 5 [0066.178] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab", pszSpec="*.pwm") returned 0 [0066.178] lstrlenA (lpString="*.pwm") returned 5 [0066.178] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab", pszSpec="*.1cd") returned 0 [0066.178] lstrlenA (lpString="*.1cd") returned 5 [0066.178] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab", pszSpec="*.md") returned 0 [0066.178] lstrlenA (lpString="*.md") returned 4 [0066.178] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab", pszSpec="*.mdf") returned 0 [0066.178] lstrlenA (lpString="*.mdf") returned 5 [0066.178] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab", pszSpec="*.dbf") returned 0 [0066.178] lstrlenA (lpString="*.dbf") returned 5 [0066.178] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab", pszSpec="*.odt") returned 0 [0066.178] lstrlenA (lpString="*.odt") returned 5 [0066.178] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab", pszSpec="*.vob") returned 0 [0066.178] lstrlenA (lpString="*.vob") returned 5 [0066.178] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab", pszSpec="*.ifo") returned 0 [0066.178] lstrlenA (lpString="*.ifo") returned 5 [0066.178] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab", pszSpec="*.lnk") returned 0 [0066.178] lstrlenA (lpString="*.lnk") returned 5 [0066.178] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab", pszSpec="*.torrent") returned 0 [0066.178] lstrlenA (lpString="*.torrent") returned 9 [0066.178] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab", pszSpec="*.mov") returned 0 [0066.179] lstrlenA (lpString="*.mov") returned 5 [0066.179] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab", pszSpec="*.m2v") returned 0 [0066.179] lstrlenA (lpString="*.m2v") returned 5 [0066.179] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab", pszSpec="*.3gp") returned 0 [0066.179] lstrlenA (lpString="*.3gp") returned 5 [0066.179] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab", pszSpec="*.mpeg") returned 0 [0066.179] lstrlenA (lpString="*.mpeg") returned 6 [0066.179] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab", pszSpec="*.mpg") returned 0 [0066.179] lstrlenA (lpString="*.mpg") returned 5 [0066.179] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab", pszSpec="*.flv") returned 0 [0066.179] lstrlenA (lpString="*.flv") returned 5 [0066.179] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab", pszSpec="*.avi") returned 0 [0066.179] lstrlenA (lpString="*.avi") returned 5 [0066.179] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab", pszSpec="*.mp4") returned 0 [0066.179] lstrlenA (lpString="*.mp4") returned 5 [0066.179] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab", pszSpec="*.wmv") returned 0 [0066.179] lstrlenA (lpString="*.wmv") returned 5 [0066.179] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab", pszSpec="*.divx") returned 0 [0066.179] lstrlenA (lpString="*.divx") returned 6 [0066.179] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab", pszSpec="*.mkv") returned 0 [0066.179] lstrlenA (lpString="*.mkv") returned 5 [0066.179] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab", pszSpec="*.mp3") returned 0 [0066.179] lstrlenA (lpString="*.mp3") returned 5 [0066.179] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab", pszSpec="*.wav") returned 0 [0066.179] lstrlenA (lpString="*.wav") returned 5 [0066.179] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab", pszSpec="*.flac") returned 0 [0066.179] lstrlenA (lpString="*.flac") returned 6 [0066.179] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab", pszSpec="*.ape") returned 0 [0066.179] lstrlenA (lpString="*.ape") returned 5 [0066.179] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab", pszSpec="*.wma") returned 0 [0066.179] lstrlenA (lpString="*.wma") returned 5 [0066.179] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab", pszSpec="*.ac3") returned 0 [0066.179] lstrlenA (lpString="*.ac3") returned 5 [0066.179] FindNextFileA (in: hFindFile=0x5b6c18, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0066.179] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0066.180] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="ExcelMUI.msi") returned -1 [0066.180] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ExcelMUI.msi") returned 1 [0066.180] lstrcmpiA (lpString1="", lpString2="ExcelMUI.msi") returned -1 [0066.180] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned="ExcelLR.cab" [0066.180] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\", lpString2="ExcelMUI.msi" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi" [0066.180] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi", pszSpec="*.zip") returned 0 [0066.180] lstrlenA (lpString="*.zip") returned 5 [0066.180] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi", pszSpec="*.rar") returned 0 [0066.180] lstrlenA (lpString="*.rar") returned 5 [0066.180] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi", pszSpec="*.7z") returned 0 [0066.180] lstrlenA (lpString="*.7z") returned 4 [0066.180] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi", pszSpec="*.tar") returned 0 [0066.180] lstrlenA (lpString="*.tar") returned 5 [0066.180] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi", pszSpec="*.gzip") returned 0 [0066.180] lstrlenA (lpString="*.gzip") returned 6 [0066.180] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi", pszSpec="*.jpg") returned 0 [0066.180] lstrlenA (lpString="*.jpg") returned 5 [0066.180] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi", pszSpec="*.jpeg") returned 0 [0066.180] lstrlenA (lpString="*.jpeg") returned 6 [0066.180] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi", pszSpec="*.psd") returned 0 [0066.180] lstrlenA (lpString="*.psd") returned 5 [0066.180] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi", pszSpec="*.cdr") returned 0 [0066.180] lstrlenA (lpString="*.cdr") returned 5 [0066.180] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi", pszSpec="*.dwg") returned 0 [0066.180] lstrlenA (lpString="*.dwg") returned 5 [0066.180] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi", pszSpec="*.max") returned 0 [0066.180] lstrlenA (lpString="*.max") returned 5 [0066.180] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi", pszSpec="*.bmp") returned 0 [0066.180] lstrlenA (lpString="*.bmp") returned 5 [0066.180] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi", pszSpec="*.gif") returned 0 [0066.180] lstrlenA (lpString="*.gif") returned 5 [0066.180] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi", pszSpec="*.png") returned 0 [0066.180] lstrlenA (lpString="*.png") returned 5 [0066.180] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi", pszSpec="*.doc") returned 0 [0066.181] lstrlenA (lpString="*.doc") returned 5 [0066.181] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi", pszSpec="*.docx") returned 0 [0066.181] lstrlenA (lpString="*.docx") returned 6 [0066.181] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi", pszSpec="*.xls") returned 0 [0066.181] lstrlenA (lpString="*.xls") returned 5 [0066.181] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi", pszSpec="*.xlsx") returned 0 [0066.181] lstrlenA (lpString="*.xlsx") returned 6 [0066.181] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi", pszSpec="*.ppt") returned 0 [0066.181] lstrlenA (lpString="*.ppt") returned 5 [0066.181] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi", pszSpec="*.pptx") returned 0 [0066.181] lstrlenA (lpString="*.pptx") returned 6 [0066.181] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi", pszSpec="*.txt") returned 0 [0066.181] lstrlenA (lpString="*.txt") returned 5 [0066.181] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi", pszSpec="*.pdf") returned 0 [0066.181] lstrlenA (lpString="*.pdf") returned 5 [0066.181] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi", pszSpec="*.djvu") returned 0 [0066.181] lstrlenA (lpString="*.djvu") returned 6 [0066.181] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi", pszSpec="*.htm") returned 0 [0066.181] lstrlenA (lpString="*.htm") returned 5 [0066.181] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi", pszSpec="*.html") returned 0 [0066.181] lstrlenA (lpString="*.html") returned 6 [0066.181] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi", pszSpec="*.mdb") returned 0 [0066.181] lstrlenA (lpString="*.mdb") returned 5 [0066.181] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi", pszSpec="*.cer") returned 0 [0066.181] lstrlenA (lpString="*.cer") returned 5 [0066.181] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi", pszSpec="*.p12") returned 0 [0066.181] lstrlenA (lpString="*.p12") returned 5 [0066.181] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi", pszSpec="*.pfx") returned 0 [0066.181] lstrlenA (lpString="*.pfx") returned 5 [0066.181] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi", pszSpec="*.kwm") returned 0 [0066.181] lstrlenA (lpString="*.kwm") returned 5 [0066.181] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi", pszSpec="*.pwm") returned 0 [0066.182] lstrlenA (lpString="*.pwm") returned 5 [0066.182] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi", pszSpec="*.1cd") returned 0 [0066.182] lstrlenA (lpString="*.1cd") returned 5 [0066.182] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi", pszSpec="*.md") returned 0 [0066.182] lstrlenA (lpString="*.md") returned 4 [0066.182] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi", pszSpec="*.mdf") returned 0 [0066.182] lstrlenA (lpString="*.mdf") returned 5 [0066.182] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi", pszSpec="*.dbf") returned 0 [0066.182] lstrlenA (lpString="*.dbf") returned 5 [0066.182] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi", pszSpec="*.odt") returned 0 [0066.182] lstrlenA (lpString="*.odt") returned 5 [0066.182] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi", pszSpec="*.vob") returned 0 [0066.182] lstrlenA (lpString="*.vob") returned 5 [0066.182] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi", pszSpec="*.ifo") returned 0 [0066.182] lstrlenA (lpString="*.ifo") returned 5 [0066.182] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi", pszSpec="*.lnk") returned 0 [0066.182] lstrlenA (lpString="*.lnk") returned 5 [0066.182] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi", pszSpec="*.torrent") returned 0 [0066.182] lstrlenA (lpString="*.torrent") returned 9 [0066.182] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi", pszSpec="*.mov") returned 0 [0066.182] lstrlenA (lpString="*.mov") returned 5 [0066.182] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi", pszSpec="*.m2v") returned 0 [0066.182] lstrlenA (lpString="*.m2v") returned 5 [0066.182] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi", pszSpec="*.3gp") returned 0 [0066.182] lstrlenA (lpString="*.3gp") returned 5 [0066.182] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi", pszSpec="*.mpeg") returned 0 [0066.182] lstrlenA (lpString="*.mpeg") returned 6 [0066.182] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi", pszSpec="*.mpg") returned 0 [0066.182] lstrlenA (lpString="*.mpg") returned 5 [0066.182] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi", pszSpec="*.flv") returned 0 [0066.182] lstrlenA (lpString="*.flv") returned 5 [0066.182] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi", pszSpec="*.avi") returned 0 [0066.182] lstrlenA (lpString="*.avi") returned 5 [0066.182] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi", pszSpec="*.mp4") returned 0 [0066.183] lstrlenA (lpString="*.mp4") returned 5 [0066.183] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi", pszSpec="*.wmv") returned 0 [0066.183] lstrlenA (lpString="*.wmv") returned 5 [0066.183] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi", pszSpec="*.divx") returned 0 [0066.183] lstrlenA (lpString="*.divx") returned 6 [0066.183] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi", pszSpec="*.mkv") returned 0 [0066.183] lstrlenA (lpString="*.mkv") returned 5 [0066.183] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi", pszSpec="*.mp3") returned 0 [0066.183] lstrlenA (lpString="*.mp3") returned 5 [0066.183] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi", pszSpec="*.wav") returned 0 [0066.183] lstrlenA (lpString="*.wav") returned 5 [0066.183] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi", pszSpec="*.flac") returned 0 [0066.183] lstrlenA (lpString="*.flac") returned 6 [0066.183] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi", pszSpec="*.ape") returned 0 [0066.183] lstrlenA (lpString="*.ape") returned 5 [0066.183] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi", pszSpec="*.wma") returned 0 [0066.183] lstrlenA (lpString="*.wma") returned 5 [0066.183] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi", pszSpec="*.ac3") returned 0 [0066.183] lstrlenA (lpString="*.ac3") returned 5 [0066.183] FindNextFileA (in: hFindFile=0x5b6c18, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0066.183] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0066.183] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="ExcelMUI.xml") returned -1 [0066.183] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ExcelMUI.xml") returned 1 [0066.183] lstrcmpiA (lpString1="", lpString2="ExcelMUI.xml") returned -1 [0066.183] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned="ExcelMUI.msi" [0066.183] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\", lpString2="ExcelMUI.xml" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml" [0066.183] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml", pszSpec="*.zip") returned 0 [0066.183] lstrlenA (lpString="*.zip") returned 5 [0066.183] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml", pszSpec="*.rar") returned 0 [0066.183] lstrlenA (lpString="*.rar") returned 5 [0066.183] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml", pszSpec="*.7z") returned 0 [0066.183] lstrlenA (lpString="*.7z") returned 4 [0066.183] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml", pszSpec="*.tar") returned 0 [0066.183] lstrlenA (lpString="*.tar") returned 5 [0066.183] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml", pszSpec="*.gzip") returned 0 [0066.183] lstrlenA (lpString="*.gzip") returned 6 [0066.183] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml", pszSpec="*.jpg") returned 0 [0066.184] lstrlenA (lpString="*.jpg") returned 5 [0066.184] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml", pszSpec="*.jpeg") returned 0 [0066.184] lstrlenA (lpString="*.jpeg") returned 6 [0066.184] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml", pszSpec="*.psd") returned 0 [0066.184] lstrlenA (lpString="*.psd") returned 5 [0066.184] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml", pszSpec="*.cdr") returned 0 [0066.184] lstrlenA (lpString="*.cdr") returned 5 [0066.184] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml", pszSpec="*.dwg") returned 0 [0066.184] lstrlenA (lpString="*.dwg") returned 5 [0066.184] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml", pszSpec="*.max") returned 0 [0066.184] lstrlenA (lpString="*.max") returned 5 [0066.184] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml", pszSpec="*.bmp") returned 0 [0066.184] lstrlenA (lpString="*.bmp") returned 5 [0066.184] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml", pszSpec="*.gif") returned 0 [0066.184] lstrlenA (lpString="*.gif") returned 5 [0066.184] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml", pszSpec="*.png") returned 0 [0066.184] lstrlenA (lpString="*.png") returned 5 [0066.184] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml", pszSpec="*.doc") returned 0 [0066.184] lstrlenA (lpString="*.doc") returned 5 [0066.184] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml", pszSpec="*.docx") returned 0 [0066.184] lstrlenA (lpString="*.docx") returned 6 [0066.184] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml", pszSpec="*.xls") returned 0 [0066.184] lstrlenA (lpString="*.xls") returned 5 [0066.184] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml", pszSpec="*.xlsx") returned 0 [0066.184] lstrlenA (lpString="*.xlsx") returned 6 [0066.184] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml", pszSpec="*.ppt") returned 0 [0066.184] lstrlenA (lpString="*.ppt") returned 5 [0066.184] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml", pszSpec="*.pptx") returned 0 [0066.184] lstrlenA (lpString="*.pptx") returned 6 [0066.184] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml", pszSpec="*.txt") returned 0 [0066.184] lstrlenA (lpString="*.txt") returned 5 [0066.184] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml", pszSpec="*.pdf") returned 0 [0066.184] lstrlenA (lpString="*.pdf") returned 5 [0066.184] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml", pszSpec="*.djvu") returned 0 [0066.184] lstrlenA (lpString="*.djvu") returned 6 [0066.184] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml", pszSpec="*.htm") returned 0 [0066.184] lstrlenA (lpString="*.htm") returned 5 [0066.184] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml", pszSpec="*.html") returned 0 [0066.185] lstrlenA (lpString="*.html") returned 6 [0066.185] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml", pszSpec="*.mdb") returned 0 [0066.185] lstrlenA (lpString="*.mdb") returned 5 [0066.185] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml", pszSpec="*.cer") returned 0 [0066.185] lstrlenA (lpString="*.cer") returned 5 [0066.185] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml", pszSpec="*.p12") returned 0 [0066.185] lstrlenA (lpString="*.p12") returned 5 [0066.185] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml", pszSpec="*.pfx") returned 0 [0066.185] lstrlenA (lpString="*.pfx") returned 5 [0066.185] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml", pszSpec="*.kwm") returned 0 [0066.185] lstrlenA (lpString="*.kwm") returned 5 [0066.185] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml", pszSpec="*.pwm") returned 0 [0066.185] lstrlenA (lpString="*.pwm") returned 5 [0066.185] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml", pszSpec="*.1cd") returned 0 [0066.185] lstrlenA (lpString="*.1cd") returned 5 [0066.185] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml", pszSpec="*.md") returned 0 [0066.185] lstrlenA (lpString="*.md") returned 4 [0066.185] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml", pszSpec="*.mdf") returned 0 [0066.185] lstrlenA (lpString="*.mdf") returned 5 [0066.185] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml", pszSpec="*.dbf") returned 0 [0066.185] lstrlenA (lpString="*.dbf") returned 5 [0066.185] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml", pszSpec="*.odt") returned 0 [0066.185] lstrlenA (lpString="*.odt") returned 5 [0066.185] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml", pszSpec="*.vob") returned 0 [0066.185] lstrlenA (lpString="*.vob") returned 5 [0066.185] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml", pszSpec="*.ifo") returned 0 [0066.185] lstrlenA (lpString="*.ifo") returned 5 [0066.185] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml", pszSpec="*.lnk") returned 0 [0066.185] lstrlenA (lpString="*.lnk") returned 5 [0066.185] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml", pszSpec="*.torrent") returned 0 [0066.185] lstrlenA (lpString="*.torrent") returned 9 [0066.185] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml", pszSpec="*.mov") returned 0 [0066.185] lstrlenA (lpString="*.mov") returned 5 [0066.185] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml", pszSpec="*.m2v") returned 0 [0066.185] lstrlenA (lpString="*.m2v") returned 5 [0066.185] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml", pszSpec="*.3gp") returned 0 [0066.186] lstrlenA (lpString="*.3gp") returned 5 [0066.186] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml", pszSpec="*.mpeg") returned 0 [0066.186] lstrlenA (lpString="*.mpeg") returned 6 [0066.186] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml", pszSpec="*.mpg") returned 0 [0066.186] lstrlenA (lpString="*.mpg") returned 5 [0066.186] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml", pszSpec="*.flv") returned 0 [0066.186] lstrlenA (lpString="*.flv") returned 5 [0066.186] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml", pszSpec="*.avi") returned 0 [0066.186] lstrlenA (lpString="*.avi") returned 5 [0066.186] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml", pszSpec="*.mp4") returned 0 [0066.186] lstrlenA (lpString="*.mp4") returned 5 [0066.186] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml", pszSpec="*.wmv") returned 0 [0066.186] lstrlenA (lpString="*.wmv") returned 5 [0066.186] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml", pszSpec="*.divx") returned 0 [0066.186] lstrlenA (lpString="*.divx") returned 6 [0066.186] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml", pszSpec="*.mkv") returned 0 [0066.186] lstrlenA (lpString="*.mkv") returned 5 [0066.186] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml", pszSpec="*.mp3") returned 0 [0066.186] lstrlenA (lpString="*.mp3") returned 5 [0066.186] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml", pszSpec="*.wav") returned 0 [0066.186] lstrlenA (lpString="*.wav") returned 5 [0066.186] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml", pszSpec="*.flac") returned 0 [0066.186] lstrlenA (lpString="*.flac") returned 6 [0066.186] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml", pszSpec="*.ape") returned 0 [0066.186] lstrlenA (lpString="*.ape") returned 5 [0066.186] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml", pszSpec="*.wma") returned 0 [0066.186] lstrlenA (lpString="*.wma") returned 5 [0066.186] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml", pszSpec="*.ac3") returned 0 [0066.186] lstrlenA (lpString="*.ac3") returned 5 [0066.186] FindNextFileA (in: hFindFile=0x5b6c18, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0066.186] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0066.186] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Setup.xml") returned -1 [0066.186] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Setup.xml") returned -1 [0066.186] lstrcmpiA (lpString1="", lpString2="Setup.xml") returned -1 [0066.186] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned="ExcelMUI.xml" [0066.187] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\", lpString2="Setup.xml" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml" [0066.187] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.zip") returned 0 [0066.187] lstrlenA (lpString="*.zip") returned 5 [0066.187] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.rar") returned 0 [0066.187] lstrlenA (lpString="*.rar") returned 5 [0066.187] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.7z") returned 0 [0066.187] lstrlenA (lpString="*.7z") returned 4 [0066.187] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.tar") returned 0 [0066.187] lstrlenA (lpString="*.tar") returned 5 [0066.187] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.gzip") returned 0 [0066.187] lstrlenA (lpString="*.gzip") returned 6 [0066.187] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.jpg") returned 0 [0066.187] lstrlenA (lpString="*.jpg") returned 5 [0066.187] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.jpeg") returned 0 [0066.187] lstrlenA (lpString="*.jpeg") returned 6 [0066.187] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.psd") returned 0 [0066.187] lstrlenA (lpString="*.psd") returned 5 [0066.187] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.cdr") returned 0 [0066.187] lstrlenA (lpString="*.cdr") returned 5 [0066.187] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.dwg") returned 0 [0066.187] lstrlenA (lpString="*.dwg") returned 5 [0066.187] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.max") returned 0 [0066.187] lstrlenA (lpString="*.max") returned 5 [0066.187] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.bmp") returned 0 [0066.187] lstrlenA (lpString="*.bmp") returned 5 [0066.187] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.gif") returned 0 [0066.187] lstrlenA (lpString="*.gif") returned 5 [0066.187] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.png") returned 0 [0066.187] lstrlenA (lpString="*.png") returned 5 [0066.187] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.doc") returned 0 [0066.187] lstrlenA (lpString="*.doc") returned 5 [0066.187] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.docx") returned 0 [0066.187] lstrlenA (lpString="*.docx") returned 6 [0066.187] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.xls") returned 0 [0066.187] lstrlenA (lpString="*.xls") returned 5 [0066.188] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.xlsx") returned 0 [0066.188] lstrlenA (lpString="*.xlsx") returned 6 [0066.188] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.ppt") returned 0 [0066.188] lstrlenA (lpString="*.ppt") returned 5 [0066.188] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.pptx") returned 0 [0066.188] lstrlenA (lpString="*.pptx") returned 6 [0066.188] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.txt") returned 0 [0066.188] lstrlenA (lpString="*.txt") returned 5 [0066.188] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.pdf") returned 0 [0066.188] lstrlenA (lpString="*.pdf") returned 5 [0066.188] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.djvu") returned 0 [0066.188] lstrlenA (lpString="*.djvu") returned 6 [0066.188] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.htm") returned 0 [0066.188] lstrlenA (lpString="*.htm") returned 5 [0066.188] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.html") returned 0 [0066.188] lstrlenA (lpString="*.html") returned 6 [0066.188] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.mdb") returned 0 [0066.188] lstrlenA (lpString="*.mdb") returned 5 [0066.188] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.cer") returned 0 [0066.188] lstrlenA (lpString="*.cer") returned 5 [0066.188] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.p12") returned 0 [0066.188] lstrlenA (lpString="*.p12") returned 5 [0066.188] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.pfx") returned 0 [0066.188] lstrlenA (lpString="*.pfx") returned 5 [0066.188] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.kwm") returned 0 [0066.188] lstrlenA (lpString="*.kwm") returned 5 [0066.188] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.pwm") returned 0 [0066.188] lstrlenA (lpString="*.pwm") returned 5 [0066.188] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.1cd") returned 0 [0066.188] lstrlenA (lpString="*.1cd") returned 5 [0066.188] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.md") returned 0 [0066.188] lstrlenA (lpString="*.md") returned 4 [0066.188] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.mdf") returned 0 [0066.188] lstrlenA (lpString="*.mdf") returned 5 [0066.188] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.dbf") returned 0 [0066.188] lstrlenA (lpString="*.dbf") returned 5 [0066.188] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.odt") returned 0 [0066.188] lstrlenA (lpString="*.odt") returned 5 [0066.189] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.vob") returned 0 [0066.189] lstrlenA (lpString="*.vob") returned 5 [0066.189] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.ifo") returned 0 [0066.189] lstrlenA (lpString="*.ifo") returned 5 [0066.189] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.lnk") returned 0 [0066.189] lstrlenA (lpString="*.lnk") returned 5 [0066.189] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.torrent") returned 0 [0066.189] lstrlenA (lpString="*.torrent") returned 9 [0066.189] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.mov") returned 0 [0066.189] lstrlenA (lpString="*.mov") returned 5 [0066.189] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.m2v") returned 0 [0066.189] lstrlenA (lpString="*.m2v") returned 5 [0066.189] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.3gp") returned 0 [0066.189] lstrlenA (lpString="*.3gp") returned 5 [0066.189] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.mpeg") returned 0 [0066.189] lstrlenA (lpString="*.mpeg") returned 6 [0066.189] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.mpg") returned 0 [0066.189] lstrlenA (lpString="*.mpg") returned 5 [0066.189] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.flv") returned 0 [0066.189] lstrlenA (lpString="*.flv") returned 5 [0066.189] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.avi") returned 0 [0066.189] lstrlenA (lpString="*.avi") returned 5 [0066.189] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.mp4") returned 0 [0066.189] lstrlenA (lpString="*.mp4") returned 5 [0066.189] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.wmv") returned 0 [0066.189] lstrlenA (lpString="*.wmv") returned 5 [0066.189] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.divx") returned 0 [0066.189] lstrlenA (lpString="*.divx") returned 6 [0066.189] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.mkv") returned 0 [0066.189] lstrlenA (lpString="*.mkv") returned 5 [0066.189] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.mp3") returned 0 [0066.189] lstrlenA (lpString="*.mp3") returned 5 [0066.189] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.wav") returned 0 [0066.189] lstrlenA (lpString="*.wav") returned 5 [0066.189] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.flac") returned 0 [0066.189] lstrlenA (lpString="*.flac") returned 6 [0066.189] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.ape") returned 0 [0066.189] lstrlenA (lpString="*.ape") returned 5 [0066.189] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.wma") returned 0 [0066.190] lstrlenA (lpString="*.wma") returned 5 [0066.190] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.ac3") returned 0 [0066.190] lstrlenA (lpString="*.ac3") returned 5 [0066.190] FindNextFileA (in: hFindFile=0x5b6c18, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 0 [0066.190] FindClose (in: hFindFile=0x5b6c18 | out: hFindFile=0x5b6c18) returned 1 [0066.190] FindNextFileA (in: hFindFile=0x5b6c58, lpFindFileData=0xaf4e8 | out: lpFindFileData=0xaf4e8) returned 1 [0066.190] lstrcmpA (lpString1=".", lpString2="{90140000-0018-0409-1000-0000000FF1CE}-C") returned -1 [0066.190] lstrcmpA (lpString1="..", lpString2="{90140000-0018-0409-1000-0000000FF1CE}-C") returned -1 [0066.190] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\*.*") returned="*.*" [0066.190] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\", lpString2="{90140000-0018-0409-1000-0000000FF1CE}-C" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C") returned="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C" [0066.190] lstrlenA (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C") returned 62 [0066.190] FindFirstFileA (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\*.*", lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 0x5b6c18 [0066.202] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0066.202] FindNextFileA (in: hFindFile=0x5b6c18, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0066.202] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0066.202] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0066.202] FindNextFileA (in: hFindFile=0x5b6c18, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0066.202] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0066.202] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="PowerPointMUI.msi") returned -1 [0066.202] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PowerPointMUI.msi") returned -1 [0066.202] lstrcmpiA (lpString1="", lpString2="PowerPointMUI.msi") returned -1 [0066.202] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\*.*") returned="*.*" [0066.202] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\", lpString2="PowerPointMUI.msi" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi" [0066.202] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi", pszSpec="*.zip") returned 0 [0066.203] lstrlenA (lpString="*.zip") returned 5 [0066.203] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi", pszSpec="*.rar") returned 0 [0066.203] lstrlenA (lpString="*.rar") returned 5 [0066.203] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi", pszSpec="*.7z") returned 0 [0066.203] lstrlenA (lpString="*.7z") returned 4 [0066.203] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi", pszSpec="*.tar") returned 0 [0066.203] lstrlenA (lpString="*.tar") returned 5 [0066.203] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi", pszSpec="*.gzip") returned 0 [0066.203] lstrlenA (lpString="*.gzip") returned 6 [0066.203] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi", pszSpec="*.jpg") returned 0 [0066.203] lstrlenA (lpString="*.jpg") returned 5 [0066.203] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi", pszSpec="*.jpeg") returned 0 [0066.203] lstrlenA (lpString="*.jpeg") returned 6 [0066.203] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi", pszSpec="*.psd") returned 0 [0066.203] lstrlenA (lpString="*.psd") returned 5 [0066.203] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi", pszSpec="*.cdr") returned 0 [0066.203] lstrlenA (lpString="*.cdr") returned 5 [0066.203] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi", pszSpec="*.dwg") returned 0 [0066.203] lstrlenA (lpString="*.dwg") returned 5 [0066.203] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi", pszSpec="*.max") returned 0 [0066.203] lstrlenA (lpString="*.max") returned 5 [0066.203] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi", pszSpec="*.bmp") returned 0 [0066.203] lstrlenA (lpString="*.bmp") returned 5 [0066.203] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi", pszSpec="*.gif") returned 0 [0066.203] lstrlenA (lpString="*.gif") returned 5 [0066.203] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi", pszSpec="*.png") returned 0 [0066.203] lstrlenA (lpString="*.png") returned 5 [0066.203] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi", pszSpec="*.doc") returned 0 [0066.203] lstrlenA (lpString="*.doc") returned 5 [0066.203] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi", pszSpec="*.docx") returned 0 [0066.203] lstrlenA (lpString="*.docx") returned 6 [0066.203] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi", pszSpec="*.xls") returned 0 [0066.203] lstrlenA (lpString="*.xls") returned 5 [0066.203] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi", pszSpec="*.xlsx") returned 0 [0066.203] lstrlenA (lpString="*.xlsx") returned 6 [0066.204] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi", pszSpec="*.ppt") returned 0 [0066.204] lstrlenA (lpString="*.ppt") returned 5 [0066.204] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi", pszSpec="*.pptx") returned 0 [0066.204] lstrlenA (lpString="*.pptx") returned 6 [0066.204] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi", pszSpec="*.txt") returned 0 [0066.204] lstrlenA (lpString="*.txt") returned 5 [0066.204] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi", pszSpec="*.pdf") returned 0 [0066.204] lstrlenA (lpString="*.pdf") returned 5 [0066.204] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi", pszSpec="*.djvu") returned 0 [0066.204] lstrlenA (lpString="*.djvu") returned 6 [0066.204] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi", pszSpec="*.htm") returned 0 [0066.204] lstrlenA (lpString="*.htm") returned 5 [0066.204] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi", pszSpec="*.html") returned 0 [0066.204] lstrlenA (lpString="*.html") returned 6 [0066.204] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi", pszSpec="*.mdb") returned 0 [0066.204] lstrlenA (lpString="*.mdb") returned 5 [0066.204] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi", pszSpec="*.cer") returned 0 [0066.204] lstrlenA (lpString="*.cer") returned 5 [0066.204] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi", pszSpec="*.p12") returned 0 [0066.204] lstrlenA (lpString="*.p12") returned 5 [0066.204] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi", pszSpec="*.pfx") returned 0 [0066.204] lstrlenA (lpString="*.pfx") returned 5 [0066.204] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi", pszSpec="*.kwm") returned 0 [0066.204] lstrlenA (lpString="*.kwm") returned 5 [0066.204] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi", pszSpec="*.pwm") returned 0 [0066.204] lstrlenA (lpString="*.pwm") returned 5 [0066.204] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi", pszSpec="*.1cd") returned 0 [0066.204] lstrlenA (lpString="*.1cd") returned 5 [0066.204] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi", pszSpec="*.md") returned 0 [0066.204] lstrlenA (lpString="*.md") returned 4 [0066.204] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi", pszSpec="*.mdf") returned 0 [0066.204] lstrlenA (lpString="*.mdf") returned 5 [0066.204] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi", pszSpec="*.dbf") returned 0 [0066.204] lstrlenA (lpString="*.dbf") returned 5 [0066.205] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi", pszSpec="*.odt") returned 0 [0066.205] lstrlenA (lpString="*.odt") returned 5 [0066.205] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi", pszSpec="*.vob") returned 0 [0066.205] lstrlenA (lpString="*.vob") returned 5 [0066.205] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi", pszSpec="*.ifo") returned 0 [0066.205] lstrlenA (lpString="*.ifo") returned 5 [0066.205] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi", pszSpec="*.lnk") returned 0 [0066.205] lstrlenA (lpString="*.lnk") returned 5 [0066.205] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi", pszSpec="*.torrent") returned 0 [0066.205] lstrlenA (lpString="*.torrent") returned 9 [0066.205] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi", pszSpec="*.mov") returned 0 [0066.205] lstrlenA (lpString="*.mov") returned 5 [0066.205] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi", pszSpec="*.m2v") returned 0 [0066.205] lstrlenA (lpString="*.m2v") returned 5 [0066.205] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi", pszSpec="*.3gp") returned 0 [0066.205] lstrlenA (lpString="*.3gp") returned 5 [0066.205] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi", pszSpec="*.mpeg") returned 0 [0066.205] lstrlenA (lpString="*.mpeg") returned 6 [0066.205] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi", pszSpec="*.mpg") returned 0 [0066.205] lstrlenA (lpString="*.mpg") returned 5 [0066.205] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi", pszSpec="*.flv") returned 0 [0066.205] lstrlenA (lpString="*.flv") returned 5 [0066.205] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi", pszSpec="*.avi") returned 0 [0066.205] lstrlenA (lpString="*.avi") returned 5 [0066.205] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi", pszSpec="*.mp4") returned 0 [0066.205] lstrlenA (lpString="*.mp4") returned 5 [0066.205] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi", pszSpec="*.wmv") returned 0 [0066.205] lstrlenA (lpString="*.wmv") returned 5 [0066.205] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi", pszSpec="*.divx") returned 0 [0066.205] lstrlenA (lpString="*.divx") returned 6 [0066.205] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi", pszSpec="*.mkv") returned 0 [0066.205] lstrlenA (lpString="*.mkv") returned 5 [0066.205] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi", pszSpec="*.mp3") returned 0 [0066.206] lstrlenA (lpString="*.mp3") returned 5 [0066.206] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi", pszSpec="*.wav") returned 0 [0066.206] lstrlenA (lpString="*.wav") returned 5 [0066.206] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi", pszSpec="*.flac") returned 0 [0066.206] lstrlenA (lpString="*.flac") returned 6 [0066.206] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi", pszSpec="*.ape") returned 0 [0066.206] lstrlenA (lpString="*.ape") returned 5 [0066.206] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi", pszSpec="*.wma") returned 0 [0066.206] lstrlenA (lpString="*.wma") returned 5 [0066.206] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi", pszSpec="*.ac3") returned 0 [0066.206] lstrlenA (lpString="*.ac3") returned 5 [0066.206] FindNextFileA (in: hFindFile=0x5b6c18, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0066.206] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0066.206] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="PowerPointMUI.xml") returned -1 [0066.206] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PowerPointMUI.xml") returned -1 [0066.206] lstrcmpiA (lpString1="", lpString2="PowerPointMUI.xml") returned -1 [0066.206] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned="PowerPointMUI.msi" [0066.206] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\", lpString2="PowerPointMUI.xml" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml" [0066.206] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml", pszSpec="*.zip") returned 0 [0066.206] lstrlenA (lpString="*.zip") returned 5 [0066.206] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml", pszSpec="*.rar") returned 0 [0066.206] lstrlenA (lpString="*.rar") returned 5 [0066.206] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml", pszSpec="*.7z") returned 0 [0066.206] lstrlenA (lpString="*.7z") returned 4 [0066.206] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml", pszSpec="*.tar") returned 0 [0066.206] lstrlenA (lpString="*.tar") returned 5 [0066.206] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml", pszSpec="*.gzip") returned 0 [0066.206] lstrlenA (lpString="*.gzip") returned 6 [0066.206] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml", pszSpec="*.jpg") returned 0 [0066.206] lstrlenA (lpString="*.jpg") returned 5 [0066.206] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml", pszSpec="*.jpeg") returned 0 [0066.206] lstrlenA (lpString="*.jpeg") returned 6 [0066.206] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml", pszSpec="*.psd") returned 0 [0066.207] lstrlenA (lpString="*.psd") returned 5 [0066.207] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml", pszSpec="*.cdr") returned 0 [0066.207] lstrlenA (lpString="*.cdr") returned 5 [0066.207] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml", pszSpec="*.dwg") returned 0 [0066.207] lstrlenA (lpString="*.dwg") returned 5 [0066.207] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml", pszSpec="*.max") returned 0 [0066.207] lstrlenA (lpString="*.max") returned 5 [0066.207] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml", pszSpec="*.bmp") returned 0 [0066.207] lstrlenA (lpString="*.bmp") returned 5 [0066.207] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml", pszSpec="*.gif") returned 0 [0066.207] lstrlenA (lpString="*.gif") returned 5 [0066.207] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml", pszSpec="*.png") returned 0 [0066.207] lstrlenA (lpString="*.png") returned 5 [0066.207] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml", pszSpec="*.doc") returned 0 [0066.207] lstrlenA (lpString="*.doc") returned 5 [0066.207] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml", pszSpec="*.docx") returned 0 [0066.207] lstrlenA (lpString="*.docx") returned 6 [0066.207] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml", pszSpec="*.xls") returned 0 [0066.207] lstrlenA (lpString="*.xls") returned 5 [0066.207] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml", pszSpec="*.xlsx") returned 0 [0066.207] lstrlenA (lpString="*.xlsx") returned 6 [0066.207] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml", pszSpec="*.ppt") returned 0 [0066.207] lstrlenA (lpString="*.ppt") returned 5 [0066.207] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml", pszSpec="*.pptx") returned 0 [0066.207] lstrlenA (lpString="*.pptx") returned 6 [0066.207] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml", pszSpec="*.txt") returned 0 [0066.207] lstrlenA (lpString="*.txt") returned 5 [0066.208] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml", pszSpec="*.pdf") returned 0 [0066.208] lstrlenA (lpString="*.pdf") returned 5 [0066.208] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml", pszSpec="*.djvu") returned 0 [0066.208] lstrlenA (lpString="*.djvu") returned 6 [0066.208] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml", pszSpec="*.htm") returned 0 [0066.208] lstrlenA (lpString="*.htm") returned 5 [0066.208] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml", pszSpec="*.html") returned 0 [0066.208] lstrlenA (lpString="*.html") returned 6 [0066.208] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml", pszSpec="*.mdb") returned 0 [0066.208] lstrlenA (lpString="*.mdb") returned 5 [0066.208] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml", pszSpec="*.cer") returned 0 [0066.208] lstrlenA (lpString="*.cer") returned 5 [0066.208] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml", pszSpec="*.p12") returned 0 [0066.208] lstrlenA (lpString="*.p12") returned 5 [0066.208] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml", pszSpec="*.pfx") returned 0 [0066.208] lstrlenA (lpString="*.pfx") returned 5 [0066.208] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml", pszSpec="*.kwm") returned 0 [0066.208] lstrlenA (lpString="*.kwm") returned 5 [0066.208] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml", pszSpec="*.pwm") returned 0 [0066.208] lstrlenA (lpString="*.pwm") returned 5 [0066.208] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml", pszSpec="*.1cd") returned 0 [0066.208] lstrlenA (lpString="*.1cd") returned 5 [0066.208] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml", pszSpec="*.md") returned 0 [0066.208] lstrlenA (lpString="*.md") returned 4 [0066.208] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml", pszSpec="*.mdf") returned 0 [0066.208] lstrlenA (lpString="*.mdf") returned 5 [0066.208] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml", pszSpec="*.dbf") returned 0 [0066.208] lstrlenA (lpString="*.dbf") returned 5 [0066.208] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml", pszSpec="*.odt") returned 0 [0066.208] lstrlenA (lpString="*.odt") returned 5 [0066.208] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml", pszSpec="*.vob") returned 0 [0066.208] lstrlenA (lpString="*.vob") returned 5 [0066.208] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml", pszSpec="*.ifo") returned 0 [0066.208] lstrlenA (lpString="*.ifo") returned 5 [0066.208] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml", pszSpec="*.lnk") returned 0 [0066.209] lstrlenA (lpString="*.lnk") returned 5 [0066.209] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml", pszSpec="*.torrent") returned 0 [0066.209] lstrlenA (lpString="*.torrent") returned 9 [0066.209] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml", pszSpec="*.mov") returned 0 [0066.209] lstrlenA (lpString="*.mov") returned 5 [0066.209] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml", pszSpec="*.m2v") returned 0 [0066.209] lstrlenA (lpString="*.m2v") returned 5 [0066.209] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml", pszSpec="*.3gp") returned 0 [0066.209] lstrlenA (lpString="*.3gp") returned 5 [0066.209] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml", pszSpec="*.mpeg") returned 0 [0066.209] lstrlenA (lpString="*.mpeg") returned 6 [0066.209] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml", pszSpec="*.mpg") returned 0 [0066.209] lstrlenA (lpString="*.mpg") returned 5 [0066.209] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml", pszSpec="*.flv") returned 0 [0066.209] lstrlenA (lpString="*.flv") returned 5 [0066.209] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml", pszSpec="*.avi") returned 0 [0066.209] lstrlenA (lpString="*.avi") returned 5 [0066.209] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml", pszSpec="*.mp4") returned 0 [0066.209] lstrlenA (lpString="*.mp4") returned 5 [0066.209] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml", pszSpec="*.wmv") returned 0 [0066.209] lstrlenA (lpString="*.wmv") returned 5 [0066.209] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml", pszSpec="*.divx") returned 0 [0066.209] lstrlenA (lpString="*.divx") returned 6 [0066.209] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml", pszSpec="*.mkv") returned 0 [0066.209] lstrlenA (lpString="*.mkv") returned 5 [0066.209] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml", pszSpec="*.mp3") returned 0 [0066.209] lstrlenA (lpString="*.mp3") returned 5 [0066.209] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml", pszSpec="*.wav") returned 0 [0066.209] lstrlenA (lpString="*.wav") returned 5 [0066.209] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml", pszSpec="*.flac") returned 0 [0066.209] lstrlenA (lpString="*.flac") returned 6 [0066.209] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml", pszSpec="*.ape") returned 0 [0066.209] lstrlenA (lpString="*.ape") returned 5 [0066.209] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml", pszSpec="*.wma") returned 0 [0066.209] lstrlenA (lpString="*.wma") returned 5 [0066.209] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml", pszSpec="*.ac3") returned 0 [0066.209] lstrlenA (lpString="*.ac3") returned 5 [0066.209] FindNextFileA (in: hFindFile=0x5b6c18, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0066.210] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0066.210] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="PptLR.cab") returned -1 [0066.210] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PptLR.cab") returned -1 [0066.210] lstrcmpiA (lpString1="", lpString2="PptLR.cab") returned -1 [0066.210] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned="PowerPointMUI.xml" [0066.210] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\", lpString2="PptLR.cab" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab" [0066.210] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab", pszSpec="*.zip") returned 0 [0066.210] lstrlenA (lpString="*.zip") returned 5 [0066.210] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab", pszSpec="*.rar") returned 0 [0066.210] lstrlenA (lpString="*.rar") returned 5 [0066.210] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab", pszSpec="*.7z") returned 0 [0066.210] lstrlenA (lpString="*.7z") returned 4 [0066.210] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab", pszSpec="*.tar") returned 0 [0066.210] lstrlenA (lpString="*.tar") returned 5 [0066.210] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab", pszSpec="*.gzip") returned 0 [0066.210] lstrlenA (lpString="*.gzip") returned 6 [0066.210] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab", pszSpec="*.jpg") returned 0 [0066.210] lstrlenA (lpString="*.jpg") returned 5 [0066.210] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab", pszSpec="*.jpeg") returned 0 [0066.210] lstrlenA (lpString="*.jpeg") returned 6 [0066.210] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab", pszSpec="*.psd") returned 0 [0066.210] lstrlenA (lpString="*.psd") returned 5 [0066.210] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab", pszSpec="*.cdr") returned 0 [0066.210] lstrlenA (lpString="*.cdr") returned 5 [0066.210] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab", pszSpec="*.dwg") returned 0 [0066.210] lstrlenA (lpString="*.dwg") returned 5 [0066.210] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab", pszSpec="*.max") returned 0 [0066.210] lstrlenA (lpString="*.max") returned 5 [0066.210] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab", pszSpec="*.bmp") returned 0 [0066.210] lstrlenA (lpString="*.bmp") returned 5 [0066.210] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab", pszSpec="*.gif") returned 0 [0066.210] lstrlenA (lpString="*.gif") returned 5 [0066.210] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab", pszSpec="*.png") returned 0 [0066.210] lstrlenA (lpString="*.png") returned 5 [0066.210] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab", pszSpec="*.doc") returned 0 [0066.211] lstrlenA (lpString="*.doc") returned 5 [0066.211] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab", pszSpec="*.docx") returned 0 [0066.211] lstrlenA (lpString="*.docx") returned 6 [0066.211] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab", pszSpec="*.xls") returned 0 [0066.211] lstrlenA (lpString="*.xls") returned 5 [0066.211] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab", pszSpec="*.xlsx") returned 0 [0066.211] lstrlenA (lpString="*.xlsx") returned 6 [0066.211] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab", pszSpec="*.ppt") returned 0 [0066.211] lstrlenA (lpString="*.ppt") returned 5 [0066.211] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab", pszSpec="*.pptx") returned 0 [0066.211] lstrlenA (lpString="*.pptx") returned 6 [0066.211] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab", pszSpec="*.txt") returned 0 [0066.211] lstrlenA (lpString="*.txt") returned 5 [0066.211] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab", pszSpec="*.pdf") returned 0 [0066.211] lstrlenA (lpString="*.pdf") returned 5 [0066.211] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab", pszSpec="*.djvu") returned 0 [0066.211] lstrlenA (lpString="*.djvu") returned 6 [0066.211] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab", pszSpec="*.htm") returned 0 [0066.211] lstrlenA (lpString="*.htm") returned 5 [0066.211] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab", pszSpec="*.html") returned 0 [0066.211] lstrlenA (lpString="*.html") returned 6 [0066.211] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab", pszSpec="*.mdb") returned 0 [0066.211] lstrlenA (lpString="*.mdb") returned 5 [0066.211] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab", pszSpec="*.cer") returned 0 [0066.211] lstrlenA (lpString="*.cer") returned 5 [0066.211] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab", pszSpec="*.p12") returned 0 [0066.211] lstrlenA (lpString="*.p12") returned 5 [0066.211] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab", pszSpec="*.pfx") returned 0 [0066.211] lstrlenA (lpString="*.pfx") returned 5 [0066.211] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab", pszSpec="*.kwm") returned 0 [0066.211] lstrlenA (lpString="*.kwm") returned 5 [0066.211] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab", pszSpec="*.pwm") returned 0 [0066.211] lstrlenA (lpString="*.pwm") returned 5 [0066.211] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab", pszSpec="*.1cd") returned 0 [0066.211] lstrlenA (lpString="*.1cd") returned 5 [0066.212] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab", pszSpec="*.md") returned 0 [0066.212] lstrlenA (lpString="*.md") returned 4 [0066.212] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab", pszSpec="*.mdf") returned 0 [0066.212] lstrlenA (lpString="*.mdf") returned 5 [0066.212] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab", pszSpec="*.dbf") returned 0 [0066.212] lstrlenA (lpString="*.dbf") returned 5 [0066.212] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab", pszSpec="*.odt") returned 0 [0066.212] lstrlenA (lpString="*.odt") returned 5 [0066.212] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab", pszSpec="*.vob") returned 0 [0066.212] lstrlenA (lpString="*.vob") returned 5 [0066.212] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab", pszSpec="*.ifo") returned 0 [0066.212] lstrlenA (lpString="*.ifo") returned 5 [0066.212] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab", pszSpec="*.lnk") returned 0 [0066.212] lstrlenA (lpString="*.lnk") returned 5 [0066.212] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab", pszSpec="*.torrent") returned 0 [0066.212] lstrlenA (lpString="*.torrent") returned 9 [0066.212] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab", pszSpec="*.mov") returned 0 [0066.212] lstrlenA (lpString="*.mov") returned 5 [0066.212] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab", pszSpec="*.m2v") returned 0 [0066.212] lstrlenA (lpString="*.m2v") returned 5 [0066.212] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab", pszSpec="*.3gp") returned 0 [0066.212] lstrlenA (lpString="*.3gp") returned 5 [0066.212] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab", pszSpec="*.mpeg") returned 0 [0066.212] lstrlenA (lpString="*.mpeg") returned 6 [0066.212] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab", pszSpec="*.mpg") returned 0 [0066.212] lstrlenA (lpString="*.mpg") returned 5 [0066.212] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab", pszSpec="*.flv") returned 0 [0066.212] lstrlenA (lpString="*.flv") returned 5 [0066.212] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab", pszSpec="*.avi") returned 0 [0066.212] lstrlenA (lpString="*.avi") returned 5 [0066.212] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab", pszSpec="*.mp4") returned 0 [0066.212] lstrlenA (lpString="*.mp4") returned 5 [0066.212] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab", pszSpec="*.wmv") returned 0 [0066.212] lstrlenA (lpString="*.wmv") returned 5 [0066.212] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab", pszSpec="*.divx") returned 0 [0066.212] lstrlenA (lpString="*.divx") returned 6 [0066.212] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab", pszSpec="*.mkv") returned 0 [0066.212] lstrlenA (lpString="*.mkv") returned 5 [0066.212] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab", pszSpec="*.mp3") returned 0 [0066.212] lstrlenA (lpString="*.mp3") returned 5 [0066.212] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab", pszSpec="*.wav") returned 0 [0066.212] lstrlenA (lpString="*.wav") returned 5 [0066.212] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab", pszSpec="*.flac") returned 0 [0066.212] lstrlenA (lpString="*.flac") returned 6 [0066.213] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab", pszSpec="*.ape") returned 0 [0066.213] lstrlenA (lpString="*.ape") returned 5 [0066.213] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab", pszSpec="*.wma") returned 0 [0066.213] lstrlenA (lpString="*.wma") returned 5 [0066.213] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab", pszSpec="*.ac3") returned 0 [0066.213] lstrlenA (lpString="*.ac3") returned 5 [0066.213] FindNextFileA (in: hFindFile=0x5b6c18, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0066.213] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0066.213] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Setup.xml") returned -1 [0066.213] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Setup.xml") returned -1 [0066.213] lstrcmpiA (lpString1="", lpString2="Setup.xml") returned -1 [0066.213] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned="PptLR.cab" [0066.213] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\", lpString2="Setup.xml" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml" [0066.213] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.zip") returned 0 [0066.213] lstrlenA (lpString="*.zip") returned 5 [0066.213] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.rar") returned 0 [0066.213] lstrlenA (lpString="*.rar") returned 5 [0066.213] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.7z") returned 0 [0066.213] lstrlenA (lpString="*.7z") returned 4 [0066.213] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.tar") returned 0 [0066.213] lstrlenA (lpString="*.tar") returned 5 [0066.213] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.gzip") returned 0 [0066.213] lstrlenA (lpString="*.gzip") returned 6 [0066.213] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.jpg") returned 0 [0066.213] lstrlenA (lpString="*.jpg") returned 5 [0066.213] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.jpeg") returned 0 [0066.213] lstrlenA (lpString="*.jpeg") returned 6 [0066.213] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.psd") returned 0 [0066.213] lstrlenA (lpString="*.psd") returned 5 [0066.213] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.cdr") returned 0 [0066.213] lstrlenA (lpString="*.cdr") returned 5 [0066.213] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.dwg") returned 0 [0066.213] lstrlenA (lpString="*.dwg") returned 5 [0066.213] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.max") returned 0 [0066.213] lstrlenA (lpString="*.max") returned 5 [0066.213] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.bmp") returned 0 [0066.213] lstrlenA (lpString="*.bmp") returned 5 [0066.213] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.gif") returned 0 [0066.213] lstrlenA (lpString="*.gif") returned 5 [0066.213] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.png") returned 0 [0066.213] lstrlenA (lpString="*.png") returned 5 [0066.213] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.doc") returned 0 [0066.213] lstrlenA (lpString="*.doc") returned 5 [0066.213] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.docx") returned 0 [0066.214] lstrlenA (lpString="*.docx") returned 6 [0066.214] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.xls") returned 0 [0066.214] lstrlenA (lpString="*.xls") returned 5 [0066.214] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.xlsx") returned 0 [0066.214] lstrlenA (lpString="*.xlsx") returned 6 [0066.214] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.ppt") returned 0 [0066.214] lstrlenA (lpString="*.ppt") returned 5 [0066.214] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.pptx") returned 0 [0066.214] lstrlenA (lpString="*.pptx") returned 6 [0066.214] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.txt") returned 0 [0066.214] lstrlenA (lpString="*.txt") returned 5 [0066.214] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.pdf") returned 0 [0066.214] lstrlenA (lpString="*.pdf") returned 5 [0066.214] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.djvu") returned 0 [0066.214] lstrlenA (lpString="*.djvu") returned 6 [0066.214] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.htm") returned 0 [0066.214] lstrlenA (lpString="*.htm") returned 5 [0066.214] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.html") returned 0 [0066.214] lstrlenA (lpString="*.html") returned 6 [0066.214] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.mdb") returned 0 [0066.214] lstrlenA (lpString="*.mdb") returned 5 [0066.214] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.cer") returned 0 [0066.214] lstrlenA (lpString="*.cer") returned 5 [0066.214] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.p12") returned 0 [0066.214] lstrlenA (lpString="*.p12") returned 5 [0066.214] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.pfx") returned 0 [0066.214] lstrlenA (lpString="*.pfx") returned 5 [0066.214] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.kwm") returned 0 [0066.214] lstrlenA (lpString="*.kwm") returned 5 [0066.214] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.pwm") returned 0 [0066.214] lstrlenA (lpString="*.pwm") returned 5 [0066.214] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.1cd") returned 0 [0066.214] lstrlenA (lpString="*.1cd") returned 5 [0066.214] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.md") returned 0 [0066.214] lstrlenA (lpString="*.md") returned 4 [0066.214] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.mdf") returned 0 [0066.214] lstrlenA (lpString="*.mdf") returned 5 [0066.214] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.dbf") returned 0 [0066.214] lstrlenA (lpString="*.dbf") returned 5 [0066.215] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.odt") returned 0 [0066.215] lstrlenA (lpString="*.odt") returned 5 [0066.215] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.vob") returned 0 [0066.215] lstrlenA (lpString="*.vob") returned 5 [0066.215] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.ifo") returned 0 [0066.215] lstrlenA (lpString="*.ifo") returned 5 [0066.215] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.lnk") returned 0 [0066.215] lstrlenA (lpString="*.lnk") returned 5 [0066.215] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.torrent") returned 0 [0066.215] lstrlenA (lpString="*.torrent") returned 9 [0066.215] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.mov") returned 0 [0066.215] lstrlenA (lpString="*.mov") returned 5 [0066.215] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.m2v") returned 0 [0066.215] lstrlenA (lpString="*.m2v") returned 5 [0066.215] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.3gp") returned 0 [0066.215] lstrlenA (lpString="*.3gp") returned 5 [0066.215] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.mpeg") returned 0 [0066.215] lstrlenA (lpString="*.mpeg") returned 6 [0066.215] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.mpg") returned 0 [0066.215] lstrlenA (lpString="*.mpg") returned 5 [0066.215] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.flv") returned 0 [0066.215] lstrlenA (lpString="*.flv") returned 5 [0066.215] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.avi") returned 0 [0066.215] lstrlenA (lpString="*.avi") returned 5 [0066.215] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.mp4") returned 0 [0066.215] lstrlenA (lpString="*.mp4") returned 5 [0066.215] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.wmv") returned 0 [0066.215] lstrlenA (lpString="*.wmv") returned 5 [0066.215] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.divx") returned 0 [0066.215] lstrlenA (lpString="*.divx") returned 6 [0066.215] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.mkv") returned 0 [0066.215] lstrlenA (lpString="*.mkv") returned 5 [0066.215] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.mp3") returned 0 [0066.215] lstrlenA (lpString="*.mp3") returned 5 [0066.215] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.wav") returned 0 [0066.215] lstrlenA (lpString="*.wav") returned 5 [0066.215] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.flac") returned 0 [0066.215] lstrlenA (lpString="*.flac") returned 6 [0066.216] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.ape") returned 0 [0066.216] lstrlenA (lpString="*.ape") returned 5 [0066.216] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.wma") returned 0 [0066.216] lstrlenA (lpString="*.wma") returned 5 [0066.216] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml", pszSpec="*.ac3") returned 0 [0066.216] lstrlenA (lpString="*.ac3") returned 5 [0066.216] FindNextFileA (in: hFindFile=0x5b6c18, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 0 [0066.216] FindClose (in: hFindFile=0x5b6c18 | out: hFindFile=0x5b6c18) returned 1 [0066.216] FindNextFileA (in: hFindFile=0x5b6c58, lpFindFileData=0xaf4e8 | out: lpFindFileData=0xaf4e8) returned 1 [0066.217] lstrcmpA (lpString1=".", lpString2="{90140000-0019-0409-1000-0000000FF1CE}-C") returned -1 [0066.217] lstrcmpA (lpString1="..", lpString2="{90140000-0019-0409-1000-0000000FF1CE}-C") returned -1 [0066.217] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\*.*") returned="*.*" [0066.217] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\", lpString2="{90140000-0019-0409-1000-0000000FF1CE}-C" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C") returned="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C" [0066.217] lstrlenA (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C") returned 62 [0066.217] FindFirstFileA (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\*.*", lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 0x5b6c18 [0066.230] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0066.230] FindNextFileA (in: hFindFile=0x5b6c18, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0066.230] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0066.230] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0066.230] FindNextFileA (in: hFindFile=0x5b6c18, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0066.230] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0066.230] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="PublisherMUI.msi") returned -1 [0066.230] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PublisherMUI.msi") returned -1 [0066.230] lstrcmpiA (lpString1="", lpString2="PublisherMUI.msi") returned -1 [0066.230] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\*.*") returned="*.*" [0066.230] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\", lpString2="PublisherMUI.msi" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi" [0066.230] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi", pszSpec="*.zip") returned 0 [0066.230] lstrlenA (lpString="*.zip") returned 5 [0066.230] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi", pszSpec="*.rar") returned 0 [0066.230] lstrlenA (lpString="*.rar") returned 5 [0066.230] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi", pszSpec="*.7z") returned 0 [0066.230] lstrlenA (lpString="*.7z") returned 4 [0066.230] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi", pszSpec="*.tar") returned 0 [0066.230] lstrlenA (lpString="*.tar") returned 5 [0066.231] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi", pszSpec="*.gzip") returned 0 [0066.231] lstrlenA (lpString="*.gzip") returned 6 [0066.231] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi", pszSpec="*.jpg") returned 0 [0066.231] lstrlenA (lpString="*.jpg") returned 5 [0066.231] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi", pszSpec="*.jpeg") returned 0 [0066.231] lstrlenA (lpString="*.jpeg") returned 6 [0066.231] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi", pszSpec="*.psd") returned 0 [0066.231] lstrlenA (lpString="*.psd") returned 5 [0066.231] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi", pszSpec="*.cdr") returned 0 [0066.231] lstrlenA (lpString="*.cdr") returned 5 [0066.231] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi", pszSpec="*.dwg") returned 0 [0066.231] lstrlenA (lpString="*.dwg") returned 5 [0066.231] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi", pszSpec="*.max") returned 0 [0066.231] lstrlenA (lpString="*.max") returned 5 [0066.231] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi", pszSpec="*.bmp") returned 0 [0066.231] lstrlenA (lpString="*.bmp") returned 5 [0066.231] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi", pszSpec="*.gif") returned 0 [0066.231] lstrlenA (lpString="*.gif") returned 5 [0066.231] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi", pszSpec="*.png") returned 0 [0066.231] lstrlenA (lpString="*.png") returned 5 [0066.231] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi", pszSpec="*.doc") returned 0 [0066.231] lstrlenA (lpString="*.doc") returned 5 [0066.231] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi", pszSpec="*.docx") returned 0 [0066.231] lstrlenA (lpString="*.docx") returned 6 [0066.231] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi", pszSpec="*.xls") returned 0 [0066.231] lstrlenA (lpString="*.xls") returned 5 [0066.231] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi", pszSpec="*.xlsx") returned 0 [0066.231] lstrlenA (lpString="*.xlsx") returned 6 [0066.231] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi", pszSpec="*.ppt") returned 0 [0066.231] lstrlenA (lpString="*.ppt") returned 5 [0066.231] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi", pszSpec="*.pptx") returned 0 [0066.231] lstrlenA (lpString="*.pptx") returned 6 [0066.231] PathMatchSpecA (pszFile="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi", pszSpec="*.txt") returned 0 [0066.232] FindNextFileA (in: hFindFile=0x5b6c18, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0066.232] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0066.232] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="PublisherMUI.xml") returned -1 [0066.232] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PublisherMUI.xml") returned -1 [0066.232] lstrcmpiA (lpString1="", lpString2="PublisherMUI.xml") returned -1 [0066.232] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned="PublisherMUI.msi" [0066.232] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\", lpString2="PublisherMUI.xml" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml" [0066.232] FindNextFileA (in: hFindFile=0x5b6c18, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0066.232] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0066.232] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="PubLR.cab") returned -1 [0066.232] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PubLR.cab") returned -1 [0066.232] lstrcmpiA (lpString1="", lpString2="PubLR.cab") returned -1 [0066.232] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned="PublisherMUI.xml" [0066.232] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\", lpString2="PubLR.cab" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab" [0066.232] FindNextFileA (in: hFindFile=0x5b6c18, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0066.232] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0066.232] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Setup.xml") returned -1 [0066.232] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Setup.xml") returned -1 [0066.232] lstrcmpiA (lpString1="", lpString2="Setup.xml") returned -1 [0066.232] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned="PubLR.cab" [0066.232] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\", lpString2="Setup.xml" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml" [0066.232] FindNextFileA (in: hFindFile=0x5b6c18, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 0 [0066.233] FindClose (in: hFindFile=0x5b6c18 | out: hFindFile=0x5b6c18) returned 1 [0066.233] FindNextFileA (in: hFindFile=0x5b6c58, lpFindFileData=0xaf4e8 | out: lpFindFileData=0xaf4e8) returned 1 [0066.233] lstrcmpA (lpString1=".", lpString2="{90140000-001A-0409-1000-0000000FF1CE}-C") returned -1 [0066.233] lstrcmpA (lpString1="..", lpString2="{90140000-001A-0409-1000-0000000FF1CE}-C") returned -1 [0066.233] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\*.*") returned="*.*" [0066.233] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\", lpString2="{90140000-001A-0409-1000-0000000FF1CE}-C" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C") returned="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C" [0066.233] FindFirstFileA (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\*.*", lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 0x5b6c18 [0066.243] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0066.243] FindNextFileA (in: hFindFile=0x5b6c18, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0066.243] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0066.243] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0066.243] FindNextFileA (in: hFindFile=0x5b6c18, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0066.243] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0066.243] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="OutlkLR.cab") returned -1 [0066.243] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OutlkLR.cab") returned -1 [0066.243] lstrcmpiA (lpString1="", lpString2="OutlkLR.cab") returned -1 [0066.243] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\*.*") returned="*.*" [0066.243] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\", lpString2="OutlkLR.cab" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab" [0066.243] FindNextFileA (in: hFindFile=0x5b6c18, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0066.243] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0066.244] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="OutlookMUI.msi") returned -1 [0066.244] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OutlookMUI.msi") returned -1 [0066.244] lstrcmpiA (lpString1="", lpString2="OutlookMUI.msi") returned -1 [0066.244] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned="OutlkLR.cab" [0066.244] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\", lpString2="OutlookMUI.msi" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi" [0066.244] FindNextFileA (in: hFindFile=0x5b6c18, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0066.244] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0066.244] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="OutlookMUI.xml") returned -1 [0066.244] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OutlookMUI.xml") returned -1 [0066.244] lstrcmpiA (lpString1="", lpString2="OutlookMUI.xml") returned -1 [0066.244] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned="OutlookMUI.msi" [0066.244] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\", lpString2="OutlookMUI.xml" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml" [0066.244] FindNextFileA (in: hFindFile=0x5b6c18, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0066.244] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0066.244] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Setup.xml") returned -1 [0066.244] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Setup.xml") returned -1 [0066.244] lstrcmpiA (lpString1="", lpString2="Setup.xml") returned -1 [0066.244] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned="OutlookMUI.xml" [0066.244] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\", lpString2="Setup.xml" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml" [0066.244] FindNextFileA (in: hFindFile=0x5b6c18, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 0 [0066.244] FindClose (in: hFindFile=0x5b6c18 | out: hFindFile=0x5b6c18) returned 1 [0066.245] FindNextFileA (in: hFindFile=0x5b6c58, lpFindFileData=0xaf4e8 | out: lpFindFileData=0xaf4e8) returned 1 [0066.245] lstrcmpA (lpString1=".", lpString2="{90140000-001B-0409-1000-0000000FF1CE}-C") returned -1 [0066.245] lstrcmpA (lpString1="..", lpString2="{90140000-001B-0409-1000-0000000FF1CE}-C") returned -1 [0066.245] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\*.*") returned="*.*" [0066.245] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\", lpString2="{90140000-001B-0409-1000-0000000FF1CE}-C" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C") returned="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C" [0066.245] FindFirstFileA (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\*.*", lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 0x5b6c18 [0066.246] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0066.246] FindNextFileA (in: hFindFile=0x5b6c18, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0066.246] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0066.246] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0066.246] FindNextFileA (in: hFindFile=0x5b6c18, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0066.246] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0066.246] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Setup.xml") returned -1 [0066.246] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Setup.xml") returned -1 [0066.246] lstrcmpiA (lpString1="", lpString2="Setup.xml") returned -1 [0066.246] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\*.*") returned="*.*" [0066.246] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\", lpString2="Setup.xml" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml" [0066.246] FindNextFileA (in: hFindFile=0x5b6c18, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0066.246] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0066.246] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="WordLR.cab") returned -1 [0066.246] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WordLR.cab") returned -1 [0066.246] lstrcmpiA (lpString1="", lpString2="WordLR.cab") returned -1 [0066.246] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned="Setup.xml" [0066.246] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\", lpString2="WordLR.cab" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab" [0066.246] FindNextFileA (in: hFindFile=0x5b6c18, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0066.246] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0066.247] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="WordMUI.msi") returned -1 [0066.247] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WordMUI.msi") returned -1 [0066.247] lstrcmpiA (lpString1="", lpString2="WordMUI.msi") returned -1 [0066.247] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned="WordLR.cab" [0066.247] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\", lpString2="WordMUI.msi" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi" [0066.247] FindNextFileA (in: hFindFile=0x5b6c18, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0066.247] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0066.247] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="WordMUI.xml") returned -1 [0066.247] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WordMUI.xml") returned -1 [0066.247] lstrcmpiA (lpString1="", lpString2="WordMUI.xml") returned -1 [0066.247] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned="WordMUI.msi" [0066.247] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\", lpString2="WordMUI.xml" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml" [0066.247] FindNextFileA (in: hFindFile=0x5b6c18, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 0 [0066.247] FindClose (in: hFindFile=0x5b6c18 | out: hFindFile=0x5b6c18) returned 1 [0066.247] FindNextFileA (in: hFindFile=0x5b6c58, lpFindFileData=0xaf4e8 | out: lpFindFileData=0xaf4e8) returned 1 [0066.247] lstrcmpA (lpString1=".", lpString2="{90140000-002C-0409-1000-0000000FF1CE}-C") returned -1 [0066.247] lstrcmpA (lpString1="..", lpString2="{90140000-002C-0409-1000-0000000FF1CE}-C") returned -1 [0066.247] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\*.*") returned="*.*" [0066.247] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\", lpString2="{90140000-002C-0409-1000-0000000FF1CE}-C" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C") returned="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C" [0066.247] FindFirstFileA (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\*.*", lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 0x5b6c18 [0066.255] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0066.255] FindNextFileA (in: hFindFile=0x5b6c18, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0066.255] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0066.255] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0066.255] FindNextFileA (in: hFindFile=0x5b6c18, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0066.255] lstrcmpA (lpString1=".", lpString2="Proof.en") returned -1 [0066.255] lstrcmpA (lpString1="..", lpString2="Proof.en") returned -1 [0066.256] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\*.*") returned="*.*" [0066.256] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\", lpString2="Proof.en" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en") returned="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en" [0066.256] FindFirstFileA (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5b8d48 [0066.256] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0066.256] FindNextFileA (in: hFindFile=0x5b8d48, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0066.256] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0066.256] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0066.256] FindNextFileA (in: hFindFile=0x5b8d48, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0066.256] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0066.256] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Proof.cab") returned -1 [0066.256] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Proof.cab") returned -1 [0066.256] lstrcmpiA (lpString1="", lpString2="Proof.cab") returned -1 [0066.256] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\*.*") returned="*.*" [0066.256] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\", lpString2="Proof.cab" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab" [0066.256] FindNextFileA (in: hFindFile=0x5b8d48, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0066.256] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0066.256] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Proof.msi") returned -1 [0066.256] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Proof.msi") returned -1 [0066.256] lstrcmpiA (lpString1="", lpString2="Proof.msi") returned -1 [0066.256] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned="Proof.cab" [0066.256] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\", lpString2="Proof.msi" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi" [0066.257] FindNextFileA (in: hFindFile=0x5b8d48, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0066.257] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0066.257] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Proof.xml") returned -1 [0066.257] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Proof.xml") returned -1 [0066.257] lstrcmpiA (lpString1="", lpString2="Proof.xml") returned -1 [0066.257] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned="Proof.msi" [0066.257] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\", lpString2="Proof.xml" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml" [0066.257] FindNextFileA (in: hFindFile=0x5b8d48, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0 [0066.257] FindClose (in: hFindFile=0x5b8d48 | out: hFindFile=0x5b8d48) returned 1 [0066.257] FindNextFileA (in: hFindFile=0x5b6c18, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0066.257] lstrcmpA (lpString1=".", lpString2="Proof.es") returned -1 [0066.257] lstrcmpA (lpString1="..", lpString2="Proof.es") returned -1 [0066.257] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\*.*") returned="*.*" [0066.257] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\", lpString2="Proof.es" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es") returned="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es" [0066.257] FindFirstFileA (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5b8d48 [0066.258] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0066.258] FindNextFileA (in: hFindFile=0x5b8d48, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0066.258] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0066.258] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0066.258] FindNextFileA (in: hFindFile=0x5b8d48, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0066.258] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0066.258] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Proof.cab") returned -1 [0066.258] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Proof.cab") returned -1 [0066.258] lstrcmpiA (lpString1="", lpString2="Proof.cab") returned -1 [0066.258] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\*.*") returned="*.*" [0066.258] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\", lpString2="Proof.cab" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab" [0066.258] FindNextFileA (in: hFindFile=0x5b8d48, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0066.258] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0066.258] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Proof.msi") returned -1 [0066.258] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Proof.msi") returned -1 [0066.258] lstrcmpiA (lpString1="", lpString2="Proof.msi") returned -1 [0066.258] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned="Proof.cab" [0066.258] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\", lpString2="Proof.msi" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi" [0066.258] FindNextFileA (in: hFindFile=0x5b8d48, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0066.258] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0066.258] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Proof.xml") returned -1 [0066.258] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Proof.xml") returned -1 [0066.258] lstrcmpiA (lpString1="", lpString2="Proof.xml") returned -1 [0066.258] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned="Proof.msi" [0066.258] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\", lpString2="Proof.xml" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml" [0066.259] FindNextFileA (in: hFindFile=0x5b8d48, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0 [0066.259] FindClose (in: hFindFile=0x5b8d48 | out: hFindFile=0x5b8d48) returned 1 [0066.259] FindNextFileA (in: hFindFile=0x5b6c18, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0066.259] lstrcmpA (lpString1=".", lpString2="Proof.fr") returned -1 [0066.259] lstrcmpA (lpString1="..", lpString2="Proof.fr") returned -1 [0066.259] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\*.*") returned="*.*" [0066.259] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\", lpString2="Proof.fr" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr") returned="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr" [0066.259] FindFirstFileA (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5b8d48 [0066.259] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0066.259] FindNextFileA (in: hFindFile=0x5b8d48, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0066.259] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0066.259] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0066.259] FindNextFileA (in: hFindFile=0x5b8d48, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0066.259] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0066.259] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Proof.cab") returned -1 [0066.259] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Proof.cab") returned -1 [0066.259] lstrcmpiA (lpString1="", lpString2="Proof.cab") returned -1 [0066.259] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\*.*") returned="*.*" [0066.259] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\", lpString2="Proof.cab" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab" [0066.259] FindNextFileA (in: hFindFile=0x5b8d48, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0066.259] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0066.259] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Proof.msi") returned -1 [0066.259] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Proof.msi") returned -1 [0066.259] lstrcmpiA (lpString1="", lpString2="Proof.msi") returned -1 [0066.259] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned="Proof.cab" [0066.259] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\", lpString2="Proof.msi" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi" [0066.260] FindNextFileA (in: hFindFile=0x5b8d48, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0066.260] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0066.260] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Proof.xml") returned -1 [0066.260] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Proof.xml") returned -1 [0066.260] lstrcmpiA (lpString1="", lpString2="Proof.xml") returned -1 [0066.260] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned="Proof.msi" [0066.260] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\", lpString2="Proof.xml" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml" [0066.260] FindNextFileA (in: hFindFile=0x5b8d48, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0 [0066.260] FindClose (in: hFindFile=0x5b8d48 | out: hFindFile=0x5b8d48) returned 1 [0066.260] FindNextFileA (in: hFindFile=0x5b6c18, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0066.260] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0066.260] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Proofing.msi") returned -1 [0066.260] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Proofing.msi") returned -1 [0066.260] lstrcmpiA (lpString1="", lpString2="Proofing.msi") returned -1 [0066.260] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\*.*") returned="*.*" [0066.260] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\", lpString2="Proofing.msi" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi" [0066.260] FindNextFileA (in: hFindFile=0x5b6c18, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0066.260] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0066.260] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Proofing.xml") returned -1 [0066.260] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Proofing.xml") returned -1 [0066.260] lstrcmpiA (lpString1="", lpString2="Proofing.xml") returned -1 [0066.260] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned="Proofing.msi" [0066.260] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\", lpString2="Proofing.xml" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml" [0066.260] FindNextFileA (in: hFindFile=0x5b6c18, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0066.260] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0066.260] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Setup.xml") returned -1 [0066.260] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Setup.xml") returned -1 [0066.260] lstrcmpiA (lpString1="", lpString2="Setup.xml") returned -1 [0066.260] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned="Proofing.xml" [0066.261] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\", lpString2="Setup.xml" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml" [0066.261] FindNextFileA (in: hFindFile=0x5b6c18, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 0 [0066.261] FindClose (in: hFindFile=0x5b6c18 | out: hFindFile=0x5b6c18) returned 1 [0066.261] FindNextFileA (in: hFindFile=0x5b6c58, lpFindFileData=0xaf4e8 | out: lpFindFileData=0xaf4e8) returned 1 [0066.261] lstrcmpA (lpString1=".", lpString2="{90140000-0043-0409-1000-0000000FF1CE}-C") returned -1 [0066.261] lstrcmpA (lpString1="..", lpString2="{90140000-0043-0409-1000-0000000FF1CE}-C") returned -1 [0066.261] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\*.*") returned="*.*" [0066.261] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\", lpString2="{90140000-0043-0409-1000-0000000FF1CE}-C" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C") returned="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C" [0066.261] FindFirstFileA (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\*.*", lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 0x5b6c18 [0066.282] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0066.282] FindNextFileA (in: hFindFile=0x5b6c18, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0066.282] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0066.282] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0066.282] FindNextFileA (in: hFindFile=0x5b6c18, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0066.282] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0066.282] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Office32MUI.msi") returned -1 [0066.282] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Office32MUI.msi") returned -1 [0066.282] lstrcmpiA (lpString1="", lpString2="Office32MUI.msi") returned -1 [0066.282] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\*.*") returned="*.*" [0066.282] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\", lpString2="Office32MUI.msi" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi" [0066.282] FindNextFileA (in: hFindFile=0x5b6c18, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0066.282] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0066.282] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Office32MUI.xml") returned -1 [0066.282] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Office32MUI.xml") returned -1 [0066.282] lstrcmpiA (lpString1="", lpString2="Office32MUI.xml") returned -1 [0066.282] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned="Office32MUI.msi" [0066.283] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\", lpString2="Office32MUI.xml" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml" [0066.283] FindNextFileA (in: hFindFile=0x5b6c18, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0066.283] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0066.283] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="OWOW32LR.cab") returned -1 [0066.283] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OWOW32LR.cab") returned -1 [0066.283] lstrcmpiA (lpString1="", lpString2="OWOW32LR.cab") returned -1 [0066.283] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned="Office32MUI.xml" [0066.283] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\", lpString2="OWOW32LR.cab" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab" [0066.283] FindNextFileA (in: hFindFile=0x5b6c18, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0066.283] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0066.283] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Setup.xml") returned -1 [0066.283] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Setup.xml") returned -1 [0066.283] lstrcmpiA (lpString1="", lpString2="Setup.xml") returned -1 [0066.283] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned="OWOW32LR.cab" [0066.283] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\", lpString2="Setup.xml" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml" [0066.283] FindNextFileA (in: hFindFile=0x5b6c18, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 0 [0066.283] FindClose (in: hFindFile=0x5b6c18 | out: hFindFile=0x5b6c18) returned 1 [0066.284] FindNextFileA (in: hFindFile=0x5b6c58, lpFindFileData=0xaf4e8 | out: lpFindFileData=0xaf4e8) returned 1 [0066.284] lstrcmpA (lpString1=".", lpString2="{90140000-0044-0409-1000-0000000FF1CE}-C") returned -1 [0066.284] lstrcmpA (lpString1="..", lpString2="{90140000-0044-0409-1000-0000000FF1CE}-C") returned -1 [0066.284] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\*.*") returned="*.*" [0066.284] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\", lpString2="{90140000-0044-0409-1000-0000000FF1CE}-C" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C") returned="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C" [0066.284] FindFirstFileA (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\*.*", lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 0x5b6c18 [0066.290] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0066.290] FindNextFileA (in: hFindFile=0x5b6c18, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0066.290] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0066.290] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0066.291] FindNextFileA (in: hFindFile=0x5b6c18, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0066.291] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0066.291] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="InfLR.cab") returned -1 [0066.291] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="InfLR.cab") returned -1 [0066.291] lstrcmpiA (lpString1="", lpString2="InfLR.cab") returned -1 [0066.291] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\*.*") returned="*.*" [0066.291] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\", lpString2="InfLR.cab" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab" [0066.291] FindNextFileA (in: hFindFile=0x5b6c18, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0066.291] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0066.291] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="InfoPathMUI.msi") returned -1 [0066.291] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="InfoPathMUI.msi") returned -1 [0066.291] lstrcmpiA (lpString1="", lpString2="InfoPathMUI.msi") returned -1 [0066.291] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned="InfLR.cab" [0066.291] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\", lpString2="InfoPathMUI.msi" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi" [0066.291] FindNextFileA (in: hFindFile=0x5b6c18, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0066.291] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0066.291] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="InfoPathMUI.xml") returned -1 [0066.291] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="InfoPathMUI.xml") returned -1 [0066.291] lstrcmpiA (lpString1="", lpString2="InfoPathMUI.xml") returned -1 [0066.291] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned="InfoPathMUI.msi" [0066.291] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\", lpString2="InfoPathMUI.xml" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml" [0066.291] FindNextFileA (in: hFindFile=0x5b6c18, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0066.291] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0066.291] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Setup.xml") returned -1 [0066.291] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Setup.xml") returned -1 [0066.291] lstrcmpiA (lpString1="", lpString2="Setup.xml") returned -1 [0066.291] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned="InfoPathMUI.xml" [0066.291] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\", lpString2="Setup.xml" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml" [0066.291] FindNextFileA (in: hFindFile=0x5b6c18, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 0 [0066.291] FindClose (in: hFindFile=0x5b6c18 | out: hFindFile=0x5b6c18) returned 1 [0066.292] FindNextFileA (in: hFindFile=0x5b6c58, lpFindFileData=0xaf4e8 | out: lpFindFileData=0xaf4e8) returned 1 [0066.292] lstrcmpA (lpString1=".", lpString2="{90140000-0054-0409-1000-0000000FF1CE}-C") returned -1 [0066.292] lstrcmpA (lpString1="..", lpString2="{90140000-0054-0409-1000-0000000FF1CE}-C") returned -1 [0066.292] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\*.*") returned="*.*" [0066.292] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\", lpString2="{90140000-0054-0409-1000-0000000FF1CE}-C" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C") returned="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C" [0066.292] FindFirstFileA (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\*.*", lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 0x5b6c18 [0066.292] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0066.292] FindNextFileA (in: hFindFile=0x5b6c18, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0066.292] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0066.292] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0066.292] FindNextFileA (in: hFindFile=0x5b6c18, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0066.292] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0066.292] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Setup.xml") returned -1 [0066.292] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Setup.xml") returned -1 [0066.292] lstrcmpiA (lpString1="", lpString2="Setup.xml") returned -1 [0066.293] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\*.*") returned="*.*" [0066.293] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\", lpString2="Setup.xml" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml" [0066.293] FindNextFileA (in: hFindFile=0x5b6c18, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0066.293] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0066.293] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="VisioLR.cab") returned -1 [0066.293] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="VisioLR.cab") returned -1 [0066.293] lstrcmpiA (lpString1="", lpString2="VisioLR.cab") returned -1 [0066.293] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned="Setup.xml" [0066.293] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\", lpString2="VisioLR.cab" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab" [0066.293] FindNextFileA (in: hFindFile=0x5b6c18, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0066.293] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0066.293] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="VisioMUI.msi") returned -1 [0066.293] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="VisioMUI.msi") returned -1 [0066.293] lstrcmpiA (lpString1="", lpString2="VisioMUI.msi") returned -1 [0066.293] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned="VisioLR.cab" [0066.293] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\", lpString2="VisioMUI.msi" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi" [0066.293] FindNextFileA (in: hFindFile=0x5b6c18, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0066.293] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0066.293] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="VisioMUI.xml") returned -1 [0066.293] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="VisioMUI.xml") returned -1 [0066.293] lstrcmpiA (lpString1="", lpString2="VisioMUI.xml") returned -1 [0066.293] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned="VisioMUI.msi" [0066.293] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\", lpString2="VisioMUI.xml" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml" [0066.293] FindNextFileA (in: hFindFile=0x5b6c18, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 0 [0066.293] FindClose (in: hFindFile=0x5b6c18 | out: hFindFile=0x5b6c18) returned 1 [0066.293] FindNextFileA (in: hFindFile=0x5b6c58, lpFindFileData=0xaf4e8 | out: lpFindFileData=0xaf4e8) returned 1 [0066.293] lstrcmpA (lpString1=".", lpString2="{90140000-00A1-0409-1000-0000000FF1CE}-C") returned -1 [0066.293] lstrcmpA (lpString1="..", lpString2="{90140000-00A1-0409-1000-0000000FF1CE}-C") returned -1 [0066.293] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\*.*") returned="*.*" [0066.293] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\", lpString2="{90140000-00A1-0409-1000-0000000FF1CE}-C" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C") returned="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C" [0066.293] FindFirstFileA (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\*.*", lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 0x5b6c18 [0066.318] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0066.318] FindNextFileA (in: hFindFile=0x5b6c18, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0066.318] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0066.318] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0066.318] FindNextFileA (in: hFindFile=0x5b6c18, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0066.318] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0066.318] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="OneNoteMUI.msi") returned -1 [0066.318] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OneNoteMUI.msi") returned -1 [0066.318] lstrcmpiA (lpString1="", lpString2="OneNoteMUI.msi") returned -1 [0066.318] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\*.*") returned="*.*" [0066.318] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\", lpString2="OneNoteMUI.msi" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi" [0066.318] FindNextFileA (in: hFindFile=0x5b6c18, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0066.318] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0066.318] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="OneNoteMUI.xml") returned -1 [0066.318] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OneNoteMUI.xml") returned -1 [0066.318] lstrcmpiA (lpString1="", lpString2="OneNoteMUI.xml") returned -1 [0066.318] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned="OneNoteMUI.msi" [0066.318] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\", lpString2="OneNoteMUI.xml" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml" [0066.318] FindNextFileA (in: hFindFile=0x5b6c18, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0066.318] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0066.318] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="OnoteLR.cab") returned -1 [0066.318] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OnoteLR.cab") returned -1 [0066.318] lstrcmpiA (lpString1="", lpString2="OnoteLR.cab") returned -1 [0066.318] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned="OneNoteMUI.xml" [0066.318] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\", lpString2="OnoteLR.cab" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab" [0066.318] FindNextFileA (in: hFindFile=0x5b6c18, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0066.318] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0066.318] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Setup.xml") returned -1 [0066.318] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Setup.xml") returned -1 [0066.319] lstrcmpiA (lpString1="", lpString2="Setup.xml") returned -1 [0066.319] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned="OnoteLR.cab" [0066.319] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\", lpString2="Setup.xml" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml" [0066.319] FindNextFileA (in: hFindFile=0x5b6c18, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 0 [0066.319] FindClose (in: hFindFile=0x5b6c18 | out: hFindFile=0x5b6c18) returned 1 [0066.319] FindNextFileA (in: hFindFile=0x5b6c58, lpFindFileData=0xaf4e8 | out: lpFindFileData=0xaf4e8) returned 1 [0066.319] lstrcmpA (lpString1=".", lpString2="{90140000-00B4-0409-1000-0000000FF1CE}-C") returned -1 [0066.319] lstrcmpA (lpString1="..", lpString2="{90140000-00B4-0409-1000-0000000FF1CE}-C") returned -1 [0066.319] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\*.*") returned="*.*" [0066.319] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\", lpString2="{90140000-00B4-0409-1000-0000000FF1CE}-C" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C") returned="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C" [0066.319] FindFirstFileA (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\*.*", lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 0x5b6c18 [0066.344] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0066.345] FindNextFileA (in: hFindFile=0x5b6c18, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0066.345] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0066.345] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0066.345] FindNextFileA (in: hFindFile=0x5b6c18, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0066.345] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0066.345] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="ProjectMUI.msi") returned -1 [0066.345] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ProjectMUI.msi") returned -1 [0066.345] lstrcmpiA (lpString1="", lpString2="ProjectMUI.msi") returned -1 [0066.345] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\*.*") returned="*.*" [0066.345] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\", lpString2="ProjectMUI.msi" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi" [0066.345] FindNextFileA (in: hFindFile=0x5b6c18, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0066.345] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0066.345] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="ProjectMUI.xml") returned -1 [0066.345] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ProjectMUI.xml") returned -1 [0066.345] lstrcmpiA (lpString1="", lpString2="ProjectMUI.xml") returned -1 [0066.345] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned="ProjectMUI.msi" [0066.345] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\", lpString2="ProjectMUI.xml" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml" [0066.345] FindNextFileA (in: hFindFile=0x5b6c18, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0066.345] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0066.345] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="ProjLR.cab") returned -1 [0066.345] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ProjLR.cab") returned -1 [0066.345] lstrcmpiA (lpString1="", lpString2="ProjLR.cab") returned -1 [0066.345] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned="ProjectMUI.xml" [0066.345] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\", lpString2="ProjLR.cab" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab" [0066.345] FindNextFileA (in: hFindFile=0x5b6c18, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0066.345] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0066.345] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Setup.xml") returned -1 [0066.345] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Setup.xml") returned -1 [0066.345] lstrcmpiA (lpString1="", lpString2="Setup.xml") returned -1 [0066.345] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned="ProjLR.cab" [0066.345] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\", lpString2="Setup.xml" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml" [0066.345] FindNextFileA (in: hFindFile=0x5b6c18, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 0 [0066.345] FindClose (in: hFindFile=0x5b6c18 | out: hFindFile=0x5b6c18) returned 1 [0066.346] FindNextFileA (in: hFindFile=0x5b6c58, lpFindFileData=0xaf4e8 | out: lpFindFileData=0xaf4e8) returned 1 [0066.346] lstrcmpA (lpString1=".", lpString2="{90140000-00BA-0409-1000-0000000FF1CE}-C") returned -1 [0066.346] lstrcmpA (lpString1="..", lpString2="{90140000-00BA-0409-1000-0000000FF1CE}-C") returned -1 [0066.346] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\*.*") returned="*.*" [0066.346] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\", lpString2="{90140000-00BA-0409-1000-0000000FF1CE}-C" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C") returned="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C" [0066.346] FindFirstFileA (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\*.*", lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 0x5b6c18 [0066.356] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0066.356] FindNextFileA (in: hFindFile=0x5b6c18, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0066.356] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0066.356] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0066.356] FindNextFileA (in: hFindFile=0x5b6c18, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0066.356] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0066.356] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="GrooveLR.cab") returned -1 [0066.356] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="GrooveLR.cab") returned 1 [0066.356] lstrcmpiA (lpString1="", lpString2="GrooveLR.cab") returned -1 [0066.356] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\*.*") returned="*.*" [0066.356] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\", lpString2="GrooveLR.cab" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab" [0066.356] FindNextFileA (in: hFindFile=0x5b6c18, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0066.356] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0066.356] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="GrooveMUI.msi") returned -1 [0066.356] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="GrooveMUI.msi") returned 1 [0066.356] lstrcmpiA (lpString1="", lpString2="GrooveMUI.msi") returned -1 [0066.356] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned="GrooveLR.cab" [0066.356] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\", lpString2="GrooveMUI.msi" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi" [0066.356] FindNextFileA (in: hFindFile=0x5b6c18, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0066.356] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0066.356] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="GrooveMUI.xml") returned -1 [0066.356] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="GrooveMUI.xml") returned 1 [0066.357] lstrcmpiA (lpString1="", lpString2="GrooveMUI.xml") returned -1 [0066.357] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned="GrooveMUI.msi" [0066.357] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\", lpString2="GrooveMUI.xml" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml" [0066.357] FindNextFileA (in: hFindFile=0x5b6c18, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0066.357] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0066.357] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Setup.xml") returned -1 [0066.357] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Setup.xml") returned -1 [0066.357] lstrcmpiA (lpString1="", lpString2="Setup.xml") returned -1 [0066.357] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned="GrooveMUI.xml" [0066.357] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\", lpString2="Setup.xml" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml" [0066.357] FindNextFileA (in: hFindFile=0x5b6c18, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 0 [0066.357] FindClose (in: hFindFile=0x5b6c18 | out: hFindFile=0x5b6c18) returned 1 [0066.357] FindNextFileA (in: hFindFile=0x5b6c58, lpFindFileData=0xaf4e8 | out: lpFindFileData=0xaf4e8) returned 1 [0066.357] lstrcmpA (lpString1=".", lpString2="{90140000-0115-0409-1000-0000000FF1CE}-C") returned -1 [0066.358] lstrcmpA (lpString1="..", lpString2="{90140000-0115-0409-1000-0000000FF1CE}-C") returned -1 [0066.358] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\*.*") returned="*.*" [0066.358] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\", lpString2="{90140000-0115-0409-1000-0000000FF1CE}-C" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C") returned="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C" [0066.358] FindFirstFileA (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\*.*", lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 0x5b6c18 [0066.367] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0066.367] FindNextFileA (in: hFindFile=0x5b6c18, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0066.367] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0066.367] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0066.367] FindNextFileA (in: hFindFile=0x5b6c18, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0066.367] lstrcmpA (lpString1=".", lpString2="1033") returned -1 [0066.367] lstrcmpA (lpString1="..", lpString2="1033") returned -1 [0066.367] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\*.*") returned="*.*" [0066.367] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\", lpString2="1033" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033") returned="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033" [0066.367] FindFirstFileA (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5b9140 [0066.368] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0066.368] FindNextFileA (in: hFindFile=0x5b9140, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0066.368] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0066.368] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0066.368] FindNextFileA (in: hFindFile=0x5b9140, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0066.368] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0066.368] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="dwintl20.dll") returned 1 [0066.368] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="dwintl20.dll") returned 1 [0066.368] lstrcmpiA (lpString1="", lpString2="dwintl20.dll") returned -1 [0066.368] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\*.*") returned="*.*" [0066.369] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\", lpString2="dwintl20.dll" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll" [0066.369] FindNextFileA (in: hFindFile=0x5b9140, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0 [0066.369] FindClose (in: hFindFile=0x5b9140 | out: hFindFile=0x5b9140) returned 1 [0066.369] FindNextFileA (in: hFindFile=0x5b6c18, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0066.369] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0066.369] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="branding.xml") returned 1 [0066.369] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="branding.xml") returned 1 [0066.369] lstrcmpiA (lpString1="", lpString2="branding.xml") returned -1 [0066.369] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\*.*") returned="*.*" [0066.369] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\", lpString2="branding.xml" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml" [0066.369] FindNextFileA (in: hFindFile=0x5b6c18, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0066.369] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0066.369] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="DW20.EXE") returned 1 [0066.369] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DW20.EXE") returned 1 [0066.369] lstrcmpiA (lpString1="", lpString2="DW20.EXE") returned -1 [0066.369] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned="branding.xml" [0066.369] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\", lpString2="DW20.EXE" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE" [0066.369] FindNextFileA (in: hFindFile=0x5b6c18, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0066.369] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0066.369] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="dwdcw20.dll") returned 1 [0066.369] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="dwdcw20.dll") returned 1 [0066.369] lstrcmpiA (lpString1="", lpString2="dwdcw20.dll") returned -1 [0066.369] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned="DW20.EXE" [0066.369] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\", lpString2="dwdcw20.dll" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll" [0066.370] FindNextFileA (in: hFindFile=0x5b6c18, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0066.370] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0066.370] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="dwtrig20.exe") returned 1 [0066.370] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="dwtrig20.exe") returned 1 [0066.370] lstrcmpiA (lpString1="", lpString2="dwtrig20.exe") returned -1 [0066.370] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned="dwdcw20.dll" [0066.370] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\", lpString2="dwtrig20.exe" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe" [0066.370] FindNextFileA (in: hFindFile=0x5b6c18, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0066.370] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0066.370] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Microsoft.VC90.CRT.manifest") returned -1 [0066.370] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.VC90.CRT.manifest") returned -1 [0066.370] lstrcmpiA (lpString1="", lpString2="Microsoft.VC90.CRT.manifest") returned -1 [0066.370] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned="dwtrig20.exe" [0066.370] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\", lpString2="Microsoft.VC90.CRT.manifest" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest" [0066.370] FindNextFileA (in: hFindFile=0x5b6c18, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0066.370] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0066.370] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="msvcr90.dll") returned -1 [0066.370] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="msvcr90.dll") returned -1 [0066.370] lstrcmpiA (lpString1="", lpString2="msvcr90.dll") returned -1 [0066.370] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned="Microsoft.VC90.CRT.manifest" [0066.370] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\", lpString2="msvcr90.dll" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll" [0066.370] FindNextFileA (in: hFindFile=0x5b6c18, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0066.370] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0066.370] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="OfficeLR.cab") returned -1 [0066.371] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OfficeLR.cab") returned -1 [0066.371] lstrcmpiA (lpString1="", lpString2="OfficeLR.cab") returned -1 [0066.371] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned="msvcr90.dll" [0066.371] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\", lpString2="OfficeLR.cab" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab" [0066.371] FindNextFileA (in: hFindFile=0x5b6c18, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0066.371] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0066.371] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="OfficeMUI.msi") returned -1 [0066.371] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OfficeMUI.msi") returned -1 [0066.371] lstrcmpiA (lpString1="", lpString2="OfficeMUI.msi") returned -1 [0066.371] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned="OfficeLR.cab" [0066.371] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\", lpString2="OfficeMUI.msi" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi" [0066.371] FindNextFileA (in: hFindFile=0x5b6c18, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0066.371] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0066.371] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="OfficeMUI.xml") returned -1 [0066.371] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OfficeMUI.xml") returned -1 [0066.371] lstrcmpiA (lpString1="", lpString2="OfficeMUI.xml") returned -1 [0066.371] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned="OfficeMUI.msi" [0066.371] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\", lpString2="OfficeMUI.xml" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml" [0066.371] FindNextFileA (in: hFindFile=0x5b6c18, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0066.371] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0066.371] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="OfficeMUISet.msi") returned -1 [0066.371] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OfficeMUISet.msi") returned -1 [0066.371] lstrcmpiA (lpString1="", lpString2="OfficeMUISet.msi") returned -1 [0066.371] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned="OfficeMUI.xml" [0066.371] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\", lpString2="OfficeMUISet.msi" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi" [0066.371] FindNextFileA (in: hFindFile=0x5b6c18, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0066.371] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0066.372] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="OfficeMUISet.xml") returned -1 [0066.372] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OfficeMUISet.xml") returned -1 [0066.372] lstrcmpiA (lpString1="", lpString2="OfficeMUISet.xml") returned -1 [0066.372] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned="OfficeMUISet.msi" [0066.372] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\", lpString2="OfficeMUISet.xml" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml" [0066.372] FindNextFileA (in: hFindFile=0x5b6c18, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0066.372] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0066.372] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="osetupui.dll") returned -1 [0066.372] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="osetupui.dll") returned -1 [0066.372] lstrcmpiA (lpString1="", lpString2="osetupui.dll") returned -1 [0066.372] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned="OfficeMUISet.xml" [0066.372] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\", lpString2="osetupui.dll" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll" [0066.372] FindNextFileA (in: hFindFile=0x5b6c18, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0066.372] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0066.372] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="pss10r.chm") returned -1 [0066.372] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="pss10r.chm") returned -1 [0066.372] lstrcmpiA (lpString1="", lpString2="pss10r.chm") returned -1 [0066.372] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned="osetupui.dll" [0066.372] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\", lpString2="pss10r.chm" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm" [0066.372] FindNextFileA (in: hFindFile=0x5b6c18, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0066.372] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0066.372] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="setup.chm") returned -1 [0066.372] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="setup.chm") returned -1 [0066.372] lstrcmpiA (lpString1="", lpString2="setup.chm") returned -1 [0066.372] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned="pss10r.chm" [0066.372] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\", lpString2="setup.chm" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm" [0066.373] FindNextFileA (in: hFindFile=0x5b6c18, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0066.373] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0066.373] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Setup.xml") returned -1 [0066.373] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Setup.xml") returned -1 [0066.373] lstrcmpiA (lpString1="", lpString2="Setup.xml") returned -1 [0066.373] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned="setup.chm" [0066.373] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\", lpString2="Setup.xml" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml" [0066.373] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0066.373] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="ShellUI.MST") returned -1 [0066.373] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ShellUI.MST") returned -1 [0066.373] lstrcmpiA (lpString1="", lpString2="ShellUI.MST") returned -1 [0066.373] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned="Setup.xml" [0066.373] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\", lpString2="ShellUI.MST" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST" [0066.374] FindClose (in: hFindFile=0x5b6c18 | out: hFindFile=0x5b6c18) returned 1 [0066.374] lstrcmpA (lpString1=".", lpString2="{90140000-0117-0409-1000-0000000FF1CE}-C") returned -1 [0066.374] lstrcmpA (lpString1="..", lpString2="{90140000-0117-0409-1000-0000000FF1CE}-C") returned -1 [0066.374] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\*.*") returned="*.*" [0066.374] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\", lpString2="{90140000-0117-0409-1000-0000000FF1CE}-C" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C") returned="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C" [0066.374] FindFirstFileA (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\*.*", lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 0x5b6c18 [0066.405] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0066.405] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0066.405] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0066.405] lstrcmpA (lpString1=".", lpString2="Access.en-us") returned -1 [0066.405] lstrcmpA (lpString1="..", lpString2="Access.en-us") returned -1 [0066.405] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\*.*") returned="*.*" [0066.405] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\", lpString2="Access.en-us" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us") returned="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us" [0066.405] FindFirstFileA (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5b9150 [0066.415] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0066.416] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0066.416] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0066.416] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0066.416] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="AccessMUI.msi") returned 1 [0066.416] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AccessMUI.msi") returned 1 [0066.416] lstrcmpiA (lpString1="", lpString2="AccessMUI.msi") returned -1 [0066.416] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\*.*") returned="*.*" [0066.416] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\", lpString2="AccessMUI.msi" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi" [0066.416] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0066.416] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="AccessMUI.xml") returned 1 [0066.416] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AccessMUI.xml") returned 1 [0066.416] lstrcmpiA (lpString1="", lpString2="AccessMUI.xml") returned -1 [0066.416] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned="AccessMUI.msi" [0066.416] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\", lpString2="AccessMUI.xml" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml" [0066.416] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0066.416] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="AccLR.cab") returned 1 [0066.416] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AccLR.cab") returned 1 [0066.416] lstrcmpiA (lpString1="", lpString2="AccLR.cab") returned -1 [0066.416] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned="AccessMUI.xml" [0066.416] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\", lpString2="AccLR.cab" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab" [0066.417] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0066.417] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="branding.xml") returned 1 [0066.417] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="branding.xml") returned 1 [0066.417] lstrcmpiA (lpString1="", lpString2="branding.xml") returned -1 [0066.417] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned="AccLR.cab" [0066.417] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\", lpString2="branding.xml" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml" [0066.417] FindClose (in: hFindFile=0x5b9150 | out: hFindFile=0x5b9150) returned 1 [0066.418] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0066.418] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="AccessMUISet.msi") returned 1 [0066.418] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AccessMUISet.msi") returned 1 [0066.418] lstrcmpiA (lpString1="", lpString2="AccessMUISet.msi") returned -1 [0066.418] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\*.*") returned="*.*" [0066.418] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\", lpString2="AccessMUISet.msi" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi" [0066.418] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0066.418] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="AccessMUISet.xml") returned 1 [0066.418] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AccessMUISet.xml") returned 1 [0066.418] lstrcmpiA (lpString1="", lpString2="AccessMUISet.xml") returned -1 [0066.418] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned="AccessMUISet.msi" [0066.418] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\", lpString2="AccessMUISet.xml" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml" [0066.418] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0066.418] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Setup.xml") returned -1 [0066.418] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Setup.xml") returned -1 [0066.418] lstrcmpiA (lpString1="", lpString2="Setup.xml") returned -1 [0066.418] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned="AccessMUISet.xml" [0066.418] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\", lpString2="Setup.xml" | out: lpString1="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml" [0066.418] FindClose (in: hFindFile=0x5b6c18 | out: hFindFile=0x5b6c18) returned 1 [0066.418] lstrcmpA (lpString1=".", lpString2="{91140000-0011-0000-1000-0000000FF1CE}-C") returned -1 [0066.418] lstrcmpA (lpString1="..", lpString2="{91140000-0011-0000-1000-0000000FF1CE}-C") returned -1 [0066.418] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\*.*") returned="*.*" [0066.418] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\", lpString2="{91140000-0011-0000-1000-0000000FF1CE}-C" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C") returned="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C" [0066.419] FindFirstFileA (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\*.*", lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 0x5b6c18 [0066.427] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0066.427] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0066.427] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0066.427] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0066.427] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Office32WW.msi") returned -1 [0066.427] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Office32WW.msi") returned -1 [0066.427] lstrcmpiA (lpString1="", lpString2="Office32WW.msi") returned -1 [0066.427] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\*.*") returned="*.*" [0066.427] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\", lpString2="Office32WW.msi" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi" [0066.428] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0066.428] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Office32WW.xml") returned -1 [0066.428] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Office32WW.xml") returned -1 [0066.428] lstrcmpiA (lpString1="", lpString2="Office32WW.xml") returned -1 [0066.428] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned="Office32WW.msi" [0066.428] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\", lpString2="Office32WW.xml" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml" [0066.428] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0066.428] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="ose.exe") returned -1 [0066.428] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ose.exe") returned -1 [0066.428] lstrcmpiA (lpString1="", lpString2="ose.exe") returned -1 [0066.428] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned="Office32WW.xml" [0066.428] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\", lpString2="ose.exe" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe" [0066.428] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0066.428] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="osetup.dll") returned -1 [0066.428] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="osetup.dll") returned -1 [0066.428] lstrcmpiA (lpString1="", lpString2="osetup.dll") returned -1 [0066.428] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned="ose.exe" [0066.428] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\", lpString2="osetup.dll" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll" [0066.428] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0066.428] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="OWOW32WW.cab") returned -1 [0066.428] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OWOW32WW.cab") returned -1 [0066.428] lstrcmpiA (lpString1="", lpString2="OWOW32WW.cab") returned -1 [0066.428] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned="osetup.dll" [0066.428] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\", lpString2="OWOW32WW.cab" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" [0066.428] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0066.429] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="PidGenX.dll") returned -1 [0066.429] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PidGenX.dll") returned -1 [0066.429] lstrcmpiA (lpString1="", lpString2="PidGenX.dll") returned -1 [0066.429] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned="OWOW32WW.cab" [0066.429] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\", lpString2="PidGenX.dll" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll" [0066.429] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0066.429] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="pkeyconfig-office.xrm-ms") returned -1 [0066.429] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="pkeyconfig-office.xrm-ms") returned -1 [0066.429] lstrcmpiA (lpString1="", lpString2="pkeyconfig-office.xrm-ms") returned -1 [0066.429] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned="PidGenX.dll" [0066.429] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\", lpString2="pkeyconfig-office.xrm-ms" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" [0066.429] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0066.429] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned="pkeyconfig-office.xrm-ms" [0066.429] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\", lpString2="ProPlusrWW.msi" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi" [0066.429] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0066.429] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned="ProPlusrWW.msi" [0066.429] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\", lpString2="ProPlusrWW.xml" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml" [0066.429] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0066.429] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned="ProPlusrWW.xml" [0066.429] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\", lpString2="ProPrWW.cab" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab" [0066.430] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0066.430] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned="ProPrWW.cab" [0066.430] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\", lpString2="ProPrWW2.cab" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab" [0066.430] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0066.430] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned="ProPrWW2.cab" [0066.430] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\", lpString2="setup.exe" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe" [0066.430] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0066.430] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned="setup.exe" [0066.430] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\", lpString2="Setup.xml" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml" [0066.430] FindClose (in: hFindFile=0x5b6c18 | out: hFindFile=0x5b6c18) returned 1 [0066.431] lstrcmpA (lpString1=".", lpString2="{91140000-003B-0000-1000-0000000FF1CE}-C") returned -1 [0066.431] lstrcmpA (lpString1="..", lpString2="{91140000-003B-0000-1000-0000000FF1CE}-C") returned -1 [0066.431] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\*.*") returned="*.*" [0066.431] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\", lpString2="{91140000-003B-0000-1000-0000000FF1CE}-C" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C") returned="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C" [0066.431] FindFirstFileA (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\*.*", lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 0x5b6c18 [0066.443] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0066.443] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0066.443] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0066.443] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0066.443] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\*.*") returned="*.*" [0066.443] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\", lpString2="Office32WW.msi" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi" [0066.443] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0066.443] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned="Office32WW.msi" [0066.443] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\", lpString2="Office32WW.xml" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml" [0066.443] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0066.443] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned="Office32WW.xml" [0066.443] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\", lpString2="ose.exe" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe" [0066.443] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0066.443] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned="ose.exe" [0066.443] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\", lpString2="osetup.dll" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll") returned="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll" [0066.444] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0066.444] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll") returned="osetup.dll" [0066.444] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\", lpString2="OWOW32WW.cab" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" [0066.444] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0066.444] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned="OWOW32WW.cab" [0066.444] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\", lpString2="PidGenX.dll" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll" [0066.444] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0066.444] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned="PidGenX.dll" [0066.444] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\", lpString2="pkeyconfig-office.xrm-ms" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" [0066.444] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0066.444] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned="pkeyconfig-office.xrm-ms" [0066.444] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\", lpString2="PrjProrWW.msi" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi") returned="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi" [0066.444] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0066.444] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi") returned="PrjProrWW.msi" [0066.444] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\", lpString2="PrjProrWW.xml" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml" [0066.444] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0066.444] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned="PrjProrWW.xml" [0066.444] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\", lpString2="PrjPrrWW.cab" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab") returned="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab" [0066.444] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0066.445] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab") returned="PrjPrrWW.cab" [0066.445] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\", lpString2="setup.exe" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe") returned="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe" [0066.445] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0066.445] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe") returned="setup.exe" [0066.445] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\", lpString2="Setup.xml" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml" [0066.445] FindClose (in: hFindFile=0x5b6c18 | out: hFindFile=0x5b6c18) returned 1 [0066.446] lstrcmpA (lpString1=".", lpString2="{91140000-0057-0000-1000-0000000FF1CE}-C") returned -1 [0066.446] lstrcmpA (lpString1="..", lpString2="{91140000-0057-0000-1000-0000000FF1CE}-C") returned -1 [0066.446] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\*.*") returned="*.*" [0066.446] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\", lpString2="{91140000-0057-0000-1000-0000000FF1CE}-C" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C") returned="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C" [0066.446] FindFirstFileA (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\*.*", lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 0x5b6c18 [0066.450] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0066.450] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0066.450] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0066.450] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0066.450] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\*.*") returned="*.*" [0066.450] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\", lpString2="Office32WW.msi" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi" [0066.450] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0066.450] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned="Office32WW.msi" [0066.450] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\", lpString2="Office32WW.xml" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml" [0066.450] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0066.450] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned="Office32WW.xml" [0066.451] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\", lpString2="ose.exe" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe") returned="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe" [0066.451] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0066.451] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe") returned="ose.exe" [0066.451] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\", lpString2="osetup.dll" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll") returned="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll" [0066.451] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0066.451] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll") returned="osetup.dll" [0066.451] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\", lpString2="OWOW32WW.cab" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" [0066.451] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0066.451] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned="OWOW32WW.cab" [0066.451] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\", lpString2="PidGenX.dll" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll" [0066.451] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0066.451] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned="PidGenX.dll" [0066.451] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\", lpString2="pkeyconfig-office.xrm-ms" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" [0066.451] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0066.451] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned="pkeyconfig-office.xrm-ms" [0066.451] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\", lpString2="setup.exe" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe") returned="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe" [0066.451] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0066.451] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe") returned="setup.exe" [0066.451] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\", lpString2="Setup.xml" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml" [0066.452] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0066.452] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned="Setup.xml" [0066.452] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\", lpString2="VisiorWW.cab" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab") returned="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab" [0066.452] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0066.452] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab") returned="VisiorWW.cab" [0066.452] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\", lpString2="VisiorWW.msi" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi") returned="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi" [0066.452] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0066.452] PathFindFileNameA (pszPath="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi") returned="VisiorWW.msi" [0066.452] lstrcatA (in: lpString1="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\", lpString2="VisiorWW.xml" | out: lpString1="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml" [0066.452] FindClose (in: hFindFile=0x5b6c18 | out: hFindFile=0x5b6c18) returned 1 [0066.453] FindClose (in: hFindFile=0x5b6c58 | out: hFindFile=0x5b6c58) returned 1 [0066.453] FindClose (in: hFindFile=0x5b5bd0 | out: hFindFile=0x5b5bd0) returned 1 [0066.453] PeekMessageA (in: lpMsg=0xaf764, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf764) returned 0 [0066.453] PathFindFileNameA (pszPath="C:\\*.*") returned="*.*" [0066.453] lstrcatA (in: lpString1="C:\\", lpString2="pagefile.sys" | out: lpString1="C:\\pagefile.sys") returned="C:\\pagefile.sys" [0066.454] lstrcmpA (lpString1=".", lpString2="PerfLogs") returned -1 [0066.454] lstrcmpA (lpString1="..", lpString2="PerfLogs") returned -1 [0066.454] PathFindFileNameA (pszPath="C:\\pagefile.sys") returned="pagefile.sys" [0066.454] lstrcatA (in: lpString1="C:\\", lpString2="PerfLogs" | out: lpString1="C:\\PerfLogs") returned="C:\\PerfLogs" [0066.454] FindFirstFileA (in: lpFileName="C:\\PerfLogs\\*.*", lpFindFileData=0xaf638 | out: lpFindFileData=0xaf638) returned 0x5b90a8 [0066.454] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0066.454] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0066.454] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0066.454] lstrcmpA (lpString1=".", lpString2="Admin") returned -1 [0066.454] lstrcmpA (lpString1="..", lpString2="Admin") returned -1 [0066.454] PathFindFileNameA (pszPath="C:\\PerfLogs\\*.*") returned="*.*" [0066.454] lstrcatA (in: lpString1="C:\\PerfLogs\\", lpString2="Admin" | out: lpString1="C:\\PerfLogs\\Admin") returned="C:\\PerfLogs\\Admin" [0066.454] FindFirstFileA (in: lpFileName="C:\\PerfLogs\\Admin\\*.*", lpFindFileData=0xaf4e8 | out: lpFindFileData=0xaf4e8) returned 0x5ba128 [0066.454] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0066.454] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0066.455] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0066.455] FindClose (in: hFindFile=0x5ba128 | out: hFindFile=0x5ba128) returned 1 [0066.455] FindClose (in: hFindFile=0x5b90a8 | out: hFindFile=0x5b90a8) returned 1 [0066.455] lstrcmpA (lpString1=".", lpString2="Program Files") returned -1 [0066.455] lstrcmpA (lpString1="..", lpString2="Program Files") returned -1 [0066.455] PathFindFileNameA (pszPath="C:\\*.*") returned="*.*" [0066.455] lstrcatA (in: lpString1="C:\\", lpString2="Program Files" | out: lpString1="C:\\Program Files") returned="C:\\Program Files" [0066.455] FindFirstFileA (in: lpFileName="C:\\Program Files\\*.*", lpFindFileData=0xaf638 | out: lpFindFileData=0xaf638) returned 0x5b90e0 [0066.455] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0066.455] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0066.455] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0066.455] lstrcmpA (lpString1=".", lpString2="Common Files") returned -1 [0066.455] lstrcmpA (lpString1="..", lpString2="Common Files") returned -1 [0066.455] PathFindFileNameA (pszPath="C:\\Program Files\\*.*") returned="*.*" [0066.455] lstrcatA (in: lpString1="C:\\Program Files\\", lpString2="Common Files" | out: lpString1="C:\\Program Files\\Common Files") returned="C:\\Program Files\\Common Files" [0066.455] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\*.*", lpFindFileData=0xaf4e8 | out: lpFindFileData=0xaf4e8) returned 0x5ba178 [0066.455] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0066.455] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0066.456] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0066.456] lstrcmpA (lpString1=".", lpString2="DESIGNER") returned -1 [0066.456] lstrcmpA (lpString1="..", lpString2="DESIGNER") returned -1 [0066.456] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\*.*") returned="*.*" [0066.456] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\", lpString2="DESIGNER" | out: lpString1="C:\\Program Files\\Common Files\\DESIGNER") returned="C:\\Program Files\\Common Files\\DESIGNER" [0066.456] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\*.*", lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 0x5ba128 [0066.456] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0066.456] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0066.456] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0066.456] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0066.456] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\DESIGNER\\*.*") returned="*.*" [0066.456] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\DESIGNER\\", lpString2="MSADDNDR.DLL" | out: lpString1="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL") returned="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL" [0066.456] FindClose (in: hFindFile=0x5ba128 | out: hFindFile=0x5ba128) returned 1 [0066.456] lstrcmpA (lpString1=".", lpString2="Microsoft Shared") returned -1 [0066.456] lstrcmpA (lpString1="..", lpString2="Microsoft Shared") returned -1 [0066.456] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\*.*") returned="*.*" [0066.456] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\", lpString2="Microsoft Shared" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared") returned="C:\\Program Files\\Common Files\\Microsoft Shared" [0066.457] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\*.*", lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 0x5ba128 [0066.457] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0066.457] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0066.457] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0066.457] lstrcmpA (lpString1=".", lpString2="DW") returned -1 [0066.457] lstrcmpA (lpString1="..", lpString2="DW") returned -1 [0066.457] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\*.*") returned="*.*" [0066.457] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\", lpString2="DW" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\DW") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\DW" [0066.457] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5ba230 [0066.491] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0066.492] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0066.492] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0066.492] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0066.492] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\*.*") returned="*.*" [0066.492] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\", lpString2="DBGHELP.DLL" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL" [0066.492] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0066.492] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL") returned="DBGHELP.DLL" [0066.492] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\", lpString2="DW20.EXE" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE" [0066.492] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0066.492] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE") returned="DW20.EXE" [0066.492] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\", lpString2="DWTRIG20.EXE" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE" [0066.492] FindClose (in: hFindFile=0x5ba230 | out: hFindFile=0x5ba230) returned 1 [0066.492] lstrcmpA (lpString1=".", lpString2="EQUATION") returned -1 [0066.492] lstrcmpA (lpString1="..", lpString2="EQUATION") returned -1 [0066.492] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\*.*") returned="*.*" [0066.492] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\", lpString2="EQUATION" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION" [0066.492] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5ba1b8 [0066.493] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0066.493] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0066.493] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0066.493] lstrcmpA (lpString1=".", lpString2="1033") returned -1 [0066.493] lstrcmpA (lpString1="..", lpString2="1033") returned -1 [0066.493] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\*.*") returned="*.*" [0066.493] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\", lpString2="1033" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033" [0066.494] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5ba1f8 [0066.494] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0066.495] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0066.495] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0066.495] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0066.495] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\*.*") returned="*.*" [0066.495] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\", lpString2="EEINTL.DLL" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL" [0066.495] FindClose (in: hFindFile=0x5ba1f8 | out: hFindFile=0x5ba1f8) returned 1 [0066.495] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0066.495] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\*.*") returned="*.*" [0066.495] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\", lpString2="EQNEDT32.CNT" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT" [0066.495] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0066.495] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT") returned="EQNEDT32.CNT" [0066.495] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\", lpString2="EQNEDT32.EXE" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE" [0066.496] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0066.496] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE") returned="EQNEDT32.EXE" [0066.496] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\", lpString2="eqnedt32.exe.manifest" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest" [0066.496] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0066.496] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest") returned="eqnedt32.exe.manifest" [0066.496] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\", lpString2="EQNEDT32.HLP" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP" [0066.496] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0066.496] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP") returned="EQNEDT32.HLP" [0066.496] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\", lpString2="MTEXTRA.TTF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF" [0066.496] FindClose (in: hFindFile=0x5ba1b8 | out: hFindFile=0x5ba1b8) returned 1 [0066.496] lstrcmpA (lpString1=".", lpString2="EURO") returned -1 [0066.496] lstrcmpA (lpString1="..", lpString2="EURO") returned -1 [0066.496] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\*.*") returned="*.*" [0066.496] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\", lpString2="EURO" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO" [0066.496] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5b7c58 [0066.513] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0066.514] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0066.514] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0066.514] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0066.514] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\*.*") returned="*.*" [0066.514] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\", lpString2="MSOEURO.DLL" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL" [0066.514] FindClose (in: hFindFile=0x5b7c58 | out: hFindFile=0x5b7c58) returned 1 [0066.514] lstrcmpA (lpString1=".", lpString2="Filters") returned -1 [0066.514] lstrcmpA (lpString1="..", lpString2="Filters") returned -1 [0066.514] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\*.*") returned="*.*" [0066.514] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\", lpString2="Filters" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters" [0066.514] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5b7be0 [0066.515] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0066.515] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0066.515] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0066.515] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0066.515] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\*.*") returned="*.*" [0066.515] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\", lpString2="msgfilt.dll" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll" [0066.516] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0066.516] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll") returned="msgfilt.dll" [0066.516] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\", lpString2="odffilt.dll" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll" [0066.516] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0066.516] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll") returned="odffilt.dll" [0066.516] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\", lpString2="offfiltx.dll" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll" [0066.516] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0066.516] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll") returned="offfiltx.dll" [0066.516] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\", lpString2="VISFILT.DLL" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL" [0066.516] FindClose (in: hFindFile=0x5b7be0 | out: hFindFile=0x5b7be0) returned 1 [0066.516] lstrcmpA (lpString1=".", lpString2="GRPHFLT") returned -1 [0066.516] lstrcmpA (lpString1="..", lpString2="GRPHFLT") returned -1 [0066.516] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\*.*") returned="*.*" [0066.516] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\", lpString2="GRPHFLT" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT" [0066.516] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5b7be0 [0066.535] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0066.535] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0066.535] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0066.535] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0066.535] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\*.*") returned="*.*" [0066.535] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\", lpString2="CGMIMP32.CFG" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG" [0066.535] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0066.535] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG") returned="CGMIMP32.CFG" [0066.535] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\", lpString2="CGMIMP32.FLT" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT" [0066.535] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0066.535] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT") returned="CGMIMP32.FLT" [0066.535] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\", lpString2="CGMIMP32.FNT" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT" [0066.535] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0066.536] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT") returned="CGMIMP32.FNT" [0066.536] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\", lpString2="EPSIMP32.FLT" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT" [0066.536] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0066.536] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT") returned="EPSIMP32.FLT" [0066.536] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\", lpString2="GIFIMP32.FLT" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT" [0066.536] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0066.536] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT") returned="GIFIMP32.FLT" [0066.536] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\", lpString2="JPEGIM32.FLT" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT" [0066.536] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0066.536] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT") returned="JPEGIM32.FLT" [0066.536] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\", lpString2="MS.CGM" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM" [0066.536] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0066.536] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM") returned="MS.CGM" [0066.536] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\", lpString2="MS.EPS" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS" [0066.536] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0066.536] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned="MS.EPS" [0066.536] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\", lpString2="MS.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF" [0066.536] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF" [0066.536] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF" [0066.536] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF.") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF." [0066.537] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF. ") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF. " [0066.537] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c [0066.540] GetFileSize (in: hFile=0x8c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x42d [0066.540] GetFileTime (in: hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x916cf600, dwHighDateTime=0x1bcabec), lpLastAccessTime=0x407536*(dwLowDateTime=0xeee42ef0, dwHighDateTime=0x1d301be), lpLastWriteTime=0x40753e*(dwLowDateTime=0x916cf600, dwHighDateTime=0x1bcabec)) returned 1 [0066.540] SetFilePointer (in: hFile=0x8c, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0066.540] ReadFile (in: hFile=0x8c, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x3d3, lpOverlapped=0x0) returned 1 [0066.580] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned="MS.GIF" [0066.580] SetFilePointer (in: hFile=0x8c, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0066.580] WriteFile (in: hFile=0x8c, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x3d3, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x3d3, lpOverlapped=0x0) returned 1 [0066.580] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0066.580] CloseHandle (hObject=0x8c) returned 1 [0066.582] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF. " (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.gif. ")) returned 1 [0066.583] FindNextFileA (in: hFindFile=0x5b7be0, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0066.583] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0066.583] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="MS.JPG") returned -1 [0066.583] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MS.JPG") returned -1 [0066.583] lstrcmpiA (lpString1="", lpString2="MS.JPG") returned -1 [0066.583] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned="MS.GIF" [0066.583] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\", lpString2="MS.JPG" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG" [0066.583] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG", pszSpec="*.zip") returned 0 [0066.583] lstrlenA (lpString="*.zip") returned 5 [0066.583] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG", pszSpec="*.rar") returned 0 [0066.583] lstrlenA (lpString="*.rar") returned 5 [0066.583] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG", pszSpec="*.7z") returned 0 [0066.583] lstrlenA (lpString="*.7z") returned 4 [0066.583] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG", pszSpec="*.tar") returned 0 [0066.583] lstrlenA (lpString="*.tar") returned 5 [0066.583] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG", pszSpec="*.gzip") returned 0 [0066.583] lstrlenA (lpString="*.gzip") returned 6 [0066.583] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG", pszSpec="*.jpg") returned 1 [0066.583] lstrlenA (lpString="*.jpg") returned 5 [0066.583] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG" [0066.583] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG" [0066.583] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c [0066.584] GetFileSize (in: hFile=0x8c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x425 [0066.584] GetFileTime (in: hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x916cf600, dwHighDateTime=0x1bcabec), lpLastAccessTime=0x407536*(dwLowDateTime=0xeee42ef0, dwHighDateTime=0x1d301be), lpLastWriteTime=0x40753e*(dwLowDateTime=0x916cf600, dwHighDateTime=0x1bcabec)) returned 1 [0066.584] SetFilePointer (in: hFile=0x8c, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0066.584] ReadFile (in: hFile=0x8c, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x3cb, lpOverlapped=0x0) returned 1 [0066.605] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned="MS.JPG" [0066.605] SetFilePointer (in: hFile=0x8c, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0066.605] WriteFile (in: hFile=0x8c, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x3cb, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x3cb, lpOverlapped=0x0) returned 1 [0066.605] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0066.605] CloseHandle (hObject=0x8c) returned 1 [0066.610] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.jpg"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG. " (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.jpg. ")) returned 1 [0066.610] FindNextFileA (in: hFindFile=0x5b7be0, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0066.610] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0066.610] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="MS.PNG") returned -1 [0066.610] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MS.PNG") returned -1 [0066.610] lstrcmpiA (lpString1="", lpString2="MS.PNG") returned -1 [0066.610] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG", pszSpec="*.zip") returned 0 [0066.611] lstrlenA (lpString="*.zip") returned 5 [0066.611] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG", pszSpec="*.rar") returned 0 [0066.611] lstrlenA (lpString="*.rar") returned 5 [0066.611] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG", pszSpec="*.7z") returned 0 [0066.611] lstrlenA (lpString="*.7z") returned 4 [0066.611] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG", pszSpec="*.tar") returned 0 [0066.611] lstrlenA (lpString="*.tar") returned 5 [0066.611] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG", pszSpec="*.gzip") returned 0 [0066.611] lstrlenA (lpString="*.gzip") returned 6 [0066.611] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG", pszSpec="*.jpg") returned 0 [0066.611] lstrlenA (lpString="*.jpg") returned 5 [0066.611] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG", pszSpec="*.jpeg") returned 0 [0066.611] lstrlenA (lpString="*.jpeg") returned 6 [0066.611] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG", pszSpec="*.psd") returned 0 [0066.611] lstrlenA (lpString="*.psd") returned 5 [0066.611] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG", pszSpec="*.cdr") returned 0 [0066.611] lstrlenA (lpString="*.cdr") returned 5 [0066.611] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG", pszSpec="*.dwg") returned 0 [0066.611] lstrlenA (lpString="*.dwg") returned 5 [0066.611] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG", pszSpec="*.max") returned 0 [0066.611] lstrlenA (lpString="*.max") returned 5 [0066.611] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG", pszSpec="*.bmp") returned 0 [0066.611] lstrlenA (lpString="*.bmp") returned 5 [0066.611] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG", pszSpec="*.gif") returned 0 [0066.611] lstrlenA (lpString="*.gif") returned 5 [0066.611] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG", pszSpec="*.png") returned 1 [0066.611] lstrlenA (lpString="*.png") returned 5 [0066.611] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG" [0066.611] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG" [0066.611] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG.") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG." [0066.611] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG. ") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG. " [0066.611] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c [0066.611] GetFileSize (in: hFile=0x8c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x692 [0066.611] GetFileTime (in: hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x916cf600, dwHighDateTime=0x1bcabec), lpLastAccessTime=0x407536*(dwLowDateTime=0xeee42ef0, dwHighDateTime=0x1d301be), lpLastWriteTime=0x40753e*(dwLowDateTime=0x916cf600, dwHighDateTime=0x1bcabec)) returned 1 [0066.612] SetFilePointer (in: hFile=0x8c, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0066.612] ReadFile (in: hFile=0x8c, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x638, lpOverlapped=0x0) returned 1 [0066.645] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0066.646] CloseHandle (hObject=0x8c) returned 1 [0066.646] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG. " (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.png. ")) returned 1 [0066.646] FindNextFileA (in: hFindFile=0x5b7be0, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0066.646] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0066.646] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="MS.WPG") returned -1 [0066.646] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MS.WPG") returned -1 [0066.646] lstrcmpiA (lpString1="", lpString2="MS.WPG") returned -1 [0066.646] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\", lpString2="MS.WPG" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG" [0066.646] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", pszSpec="*.zip") returned 0 [0066.646] lstrlenA (lpString="*.zip") returned 5 [0066.646] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", pszSpec="*.rar") returned 0 [0066.646] lstrlenA (lpString="*.rar") returned 5 [0066.646] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", pszSpec="*.7z") returned 0 [0066.646] lstrlenA (lpString="*.7z") returned 4 [0066.646] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", pszSpec="*.tar") returned 0 [0066.646] lstrlenA (lpString="*.tar") returned 5 [0066.646] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", pszSpec="*.gzip") returned 0 [0066.646] lstrlenA (lpString="*.gzip") returned 6 [0066.647] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", pszSpec="*.jpg") returned 0 [0066.647] lstrlenA (lpString="*.jpg") returned 5 [0066.647] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", pszSpec="*.jpeg") returned 0 [0066.647] lstrlenA (lpString="*.jpeg") returned 6 [0066.647] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", pszSpec="*.psd") returned 0 [0066.647] lstrlenA (lpString="*.psd") returned 5 [0066.647] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", pszSpec="*.cdr") returned 0 [0066.647] lstrlenA (lpString="*.cdr") returned 5 [0066.647] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", pszSpec="*.dwg") returned 0 [0066.647] lstrlenA (lpString="*.dwg") returned 5 [0066.647] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", pszSpec="*.max") returned 0 [0066.647] lstrlenA (lpString="*.max") returned 5 [0066.647] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", pszSpec="*.bmp") returned 0 [0066.647] lstrlenA (lpString="*.bmp") returned 5 [0066.647] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", pszSpec="*.gif") returned 0 [0066.647] lstrlenA (lpString="*.gif") returned 5 [0066.647] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", pszSpec="*.png") returned 0 [0066.647] lstrlenA (lpString="*.png") returned 5 [0066.647] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", pszSpec="*.doc") returned 0 [0066.647] lstrlenA (lpString="*.doc") returned 5 [0066.647] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", pszSpec="*.docx") returned 0 [0066.647] lstrlenA (lpString="*.docx") returned 6 [0066.647] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", pszSpec="*.xls") returned 0 [0066.647] lstrlenA (lpString="*.xls") returned 5 [0066.647] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", pszSpec="*.xlsx") returned 0 [0066.647] lstrlenA (lpString="*.xlsx") returned 6 [0066.647] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", pszSpec="*.ppt") returned 0 [0066.647] lstrlenA (lpString="*.ppt") returned 5 [0066.647] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", pszSpec="*.pptx") returned 0 [0066.647] lstrlenA (lpString="*.pptx") returned 6 [0066.647] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", pszSpec="*.txt") returned 0 [0066.647] lstrlenA (lpString="*.txt") returned 5 [0066.647] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", pszSpec="*.pdf") returned 0 [0066.647] lstrlenA (lpString="*.pdf") returned 5 [0066.647] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", pszSpec="*.djvu") returned 0 [0066.647] lstrlenA (lpString="*.djvu") returned 6 [0066.647] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", pszSpec="*.htm") returned 0 [0066.647] lstrlenA (lpString="*.htm") returned 5 [0066.647] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", pszSpec="*.html") returned 0 [0066.647] lstrlenA (lpString="*.html") returned 6 [0066.647] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", pszSpec="*.mdb") returned 0 [0066.647] lstrlenA (lpString="*.mdb") returned 5 [0066.647] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", pszSpec="*.cer") returned 0 [0066.647] lstrlenA (lpString="*.cer") returned 5 [0066.647] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", pszSpec="*.p12") returned 0 [0066.647] lstrlenA (lpString="*.p12") returned 5 [0066.647] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", pszSpec="*.pfx") returned 0 [0066.647] lstrlenA (lpString="*.pfx") returned 5 [0066.647] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", pszSpec="*.kwm") returned 0 [0066.647] lstrlenA (lpString="*.kwm") returned 5 [0066.648] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", pszSpec="*.pwm") returned 0 [0066.648] lstrlenA (lpString="*.pwm") returned 5 [0066.648] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", pszSpec="*.1cd") returned 0 [0066.648] lstrlenA (lpString="*.1cd") returned 5 [0066.648] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", pszSpec="*.md") returned 0 [0066.648] lstrlenA (lpString="*.md") returned 4 [0066.648] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", pszSpec="*.mdf") returned 0 [0066.648] lstrlenA (lpString="*.mdf") returned 5 [0066.648] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", pszSpec="*.dbf") returned 0 [0066.648] lstrlenA (lpString="*.dbf") returned 5 [0066.648] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", pszSpec="*.odt") returned 0 [0066.648] lstrlenA (lpString="*.odt") returned 5 [0066.648] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", pszSpec="*.vob") returned 0 [0066.648] lstrlenA (lpString="*.vob") returned 5 [0066.648] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", pszSpec="*.ifo") returned 0 [0066.648] lstrlenA (lpString="*.ifo") returned 5 [0066.648] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", pszSpec="*.lnk") returned 0 [0066.648] lstrlenA (lpString="*.lnk") returned 5 [0066.648] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", pszSpec="*.torrent") returned 0 [0066.648] lstrlenA (lpString="*.torrent") returned 9 [0066.648] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", pszSpec="*.mov") returned 0 [0066.648] lstrlenA (lpString="*.mov") returned 5 [0066.648] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", pszSpec="*.m2v") returned 0 [0066.648] lstrlenA (lpString="*.m2v") returned 5 [0066.648] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", pszSpec="*.3gp") returned 0 [0066.648] lstrlenA (lpString="*.3gp") returned 5 [0066.648] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", pszSpec="*.mpeg") returned 0 [0066.648] lstrlenA (lpString="*.mpeg") returned 6 [0066.648] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", pszSpec="*.mpg") returned 0 [0066.648] lstrlenA (lpString="*.mpg") returned 5 [0066.648] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", pszSpec="*.flv") returned 0 [0066.648] lstrlenA (lpString="*.flv") returned 5 [0066.648] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", pszSpec="*.avi") returned 0 [0066.648] lstrlenA (lpString="*.avi") returned 5 [0066.648] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", pszSpec="*.mp4") returned 0 [0066.648] lstrlenA (lpString="*.mp4") returned 5 [0066.648] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", pszSpec="*.wmv") returned 0 [0066.648] lstrlenA (lpString="*.wmv") returned 5 [0066.648] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", pszSpec="*.divx") returned 0 [0066.648] lstrlenA (lpString="*.divx") returned 6 [0066.648] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", pszSpec="*.mkv") returned 0 [0066.648] lstrlenA (lpString="*.mkv") returned 5 [0066.648] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", pszSpec="*.mp3") returned 0 [0066.648] lstrlenA (lpString="*.mp3") returned 5 [0066.648] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", pszSpec="*.wav") returned 0 [0066.648] lstrlenA (lpString="*.wav") returned 5 [0066.648] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", pszSpec="*.flac") returned 0 [0066.648] lstrlenA (lpString="*.flac") returned 6 [0066.649] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", pszSpec="*.ape") returned 0 [0066.649] lstrlenA (lpString="*.ape") returned 5 [0066.649] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", pszSpec="*.wma") returned 0 [0066.649] lstrlenA (lpString="*.wma") returned 5 [0066.649] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", pszSpec="*.ac3") returned 0 [0066.649] lstrlenA (lpString="*.ac3") returned 5 [0066.649] FindNextFileA (in: hFindFile=0x5b7be0, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0066.649] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0066.649] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="PICTIM32.FLT") returned -1 [0066.649] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PICTIM32.FLT") returned -1 [0066.649] lstrcmpiA (lpString1="", lpString2="PICTIM32.FLT") returned -1 [0066.649] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\", lpString2="PICTIM32.FLT" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT" [0066.649] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", pszSpec="*.zip") returned 0 [0066.649] lstrlenA (lpString="*.zip") returned 5 [0066.649] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", pszSpec="*.rar") returned 0 [0066.649] lstrlenA (lpString="*.rar") returned 5 [0066.649] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", pszSpec="*.7z") returned 0 [0066.649] lstrlenA (lpString="*.7z") returned 4 [0066.649] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", pszSpec="*.tar") returned 0 [0066.649] lstrlenA (lpString="*.tar") returned 5 [0066.649] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", pszSpec="*.gzip") returned 0 [0066.649] lstrlenA (lpString="*.gzip") returned 6 [0066.649] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", pszSpec="*.jpg") returned 0 [0066.649] lstrlenA (lpString="*.jpg") returned 5 [0066.649] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", pszSpec="*.jpeg") returned 0 [0066.649] lstrlenA (lpString="*.jpeg") returned 6 [0066.649] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", pszSpec="*.psd") returned 0 [0066.649] lstrlenA (lpString="*.psd") returned 5 [0066.649] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", pszSpec="*.cdr") returned 0 [0066.649] lstrlenA (lpString="*.cdr") returned 5 [0066.649] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", pszSpec="*.dwg") returned 0 [0066.649] lstrlenA (lpString="*.dwg") returned 5 [0066.649] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", pszSpec="*.max") returned 0 [0066.649] lstrlenA (lpString="*.max") returned 5 [0066.649] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", pszSpec="*.bmp") returned 0 [0066.649] lstrlenA (lpString="*.bmp") returned 5 [0066.649] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", pszSpec="*.gif") returned 0 [0066.649] lstrlenA (lpString="*.gif") returned 5 [0066.649] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", pszSpec="*.png") returned 0 [0066.649] lstrlenA (lpString="*.png") returned 5 [0066.649] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", pszSpec="*.doc") returned 0 [0066.649] lstrlenA (lpString="*.doc") returned 5 [0066.649] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", pszSpec="*.docx") returned 0 [0066.649] lstrlenA (lpString="*.docx") returned 6 [0066.649] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", pszSpec="*.xls") returned 0 [0066.649] lstrlenA (lpString="*.xls") returned 5 [0066.650] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", pszSpec="*.xlsx") returned 0 [0066.650] lstrlenA (lpString="*.xlsx") returned 6 [0066.650] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", pszSpec="*.ppt") returned 0 [0066.650] lstrlenA (lpString="*.ppt") returned 5 [0066.650] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", pszSpec="*.pptx") returned 0 [0066.650] lstrlenA (lpString="*.pptx") returned 6 [0066.650] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", pszSpec="*.txt") returned 0 [0066.650] lstrlenA (lpString="*.txt") returned 5 [0066.650] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", pszSpec="*.pdf") returned 0 [0066.650] lstrlenA (lpString="*.pdf") returned 5 [0066.650] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", pszSpec="*.djvu") returned 0 [0066.650] lstrlenA (lpString="*.djvu") returned 6 [0066.650] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", pszSpec="*.htm") returned 0 [0066.650] lstrlenA (lpString="*.htm") returned 5 [0066.650] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", pszSpec="*.html") returned 0 [0066.650] lstrlenA (lpString="*.html") returned 6 [0066.650] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", pszSpec="*.mdb") returned 0 [0066.650] lstrlenA (lpString="*.mdb") returned 5 [0066.650] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", pszSpec="*.cer") returned 0 [0066.650] lstrlenA (lpString="*.cer") returned 5 [0066.650] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", pszSpec="*.p12") returned 0 [0066.650] lstrlenA (lpString="*.p12") returned 5 [0066.650] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", pszSpec="*.pfx") returned 0 [0066.650] lstrlenA (lpString="*.pfx") returned 5 [0066.650] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", pszSpec="*.kwm") returned 0 [0066.650] lstrlenA (lpString="*.kwm") returned 5 [0066.650] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", pszSpec="*.pwm") returned 0 [0066.650] lstrlenA (lpString="*.pwm") returned 5 [0066.650] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", pszSpec="*.1cd") returned 0 [0066.650] lstrlenA (lpString="*.1cd") returned 5 [0066.650] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", pszSpec="*.md") returned 0 [0066.650] lstrlenA (lpString="*.md") returned 4 [0066.650] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", pszSpec="*.mdf") returned 0 [0066.650] lstrlenA (lpString="*.mdf") returned 5 [0066.650] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", pszSpec="*.dbf") returned 0 [0066.650] lstrlenA (lpString="*.dbf") returned 5 [0066.650] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", pszSpec="*.odt") returned 0 [0066.650] lstrlenA (lpString="*.odt") returned 5 [0066.650] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", pszSpec="*.vob") returned 0 [0066.650] lstrlenA (lpString="*.vob") returned 5 [0066.650] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", pszSpec="*.ifo") returned 0 [0066.650] lstrlenA (lpString="*.ifo") returned 5 [0066.650] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", pszSpec="*.lnk") returned 0 [0066.650] lstrlenA (lpString="*.lnk") returned 5 [0066.651] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", pszSpec="*.torrent") returned 0 [0066.651] lstrlenA (lpString="*.torrent") returned 9 [0066.651] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", pszSpec="*.mov") returned 0 [0066.651] lstrlenA (lpString="*.mov") returned 5 [0066.651] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", pszSpec="*.m2v") returned 0 [0066.651] lstrlenA (lpString="*.m2v") returned 5 [0066.651] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", pszSpec="*.3gp") returned 0 [0066.651] lstrlenA (lpString="*.3gp") returned 5 [0066.651] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", pszSpec="*.mpeg") returned 0 [0066.651] lstrlenA (lpString="*.mpeg") returned 6 [0066.651] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", pszSpec="*.mpg") returned 0 [0066.651] lstrlenA (lpString="*.mpg") returned 5 [0066.651] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", pszSpec="*.flv") returned 0 [0066.651] lstrlenA (lpString="*.flv") returned 5 [0066.651] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", pszSpec="*.avi") returned 0 [0066.651] lstrlenA (lpString="*.avi") returned 5 [0066.651] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", pszSpec="*.mp4") returned 0 [0066.651] lstrlenA (lpString="*.mp4") returned 5 [0066.651] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", pszSpec="*.wmv") returned 0 [0066.651] lstrlenA (lpString="*.wmv") returned 5 [0066.651] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", pszSpec="*.divx") returned 0 [0066.651] lstrlenA (lpString="*.divx") returned 6 [0066.651] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", pszSpec="*.mkv") returned 0 [0066.651] lstrlenA (lpString="*.mkv") returned 5 [0066.651] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", pszSpec="*.mp3") returned 0 [0066.651] lstrlenA (lpString="*.mp3") returned 5 [0066.651] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", pszSpec="*.wav") returned 0 [0066.651] lstrlenA (lpString="*.wav") returned 5 [0066.651] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", pszSpec="*.flac") returned 0 [0066.651] lstrlenA (lpString="*.flac") returned 6 [0066.651] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", pszSpec="*.ape") returned 0 [0066.651] lstrlenA (lpString="*.ape") returned 5 [0066.651] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", pszSpec="*.wma") returned 0 [0066.651] lstrlenA (lpString="*.wma") returned 5 [0066.651] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", pszSpec="*.ac3") returned 0 [0066.651] lstrlenA (lpString="*.ac3") returned 5 [0066.651] FindNextFileA (in: hFindFile=0x5b7be0, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0066.651] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0066.652] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="PNG32.FLT") returned -1 [0066.652] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PNG32.FLT") returned -1 [0066.652] lstrcmpiA (lpString1="", lpString2="PNG32.FLT") returned -1 [0066.652] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\", lpString2="PNG32.FLT" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT" [0066.652] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT", pszSpec="*.zip") returned 0 [0066.652] lstrlenA (lpString="*.zip") returned 5 [0066.652] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT", pszSpec="*.rar") returned 0 [0066.652] lstrlenA (lpString="*.rar") returned 5 [0066.652] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT", pszSpec="*.7z") returned 0 [0066.652] lstrlenA (lpString="*.7z") returned 4 [0066.652] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT", pszSpec="*.tar") returned 0 [0066.652] lstrlenA (lpString="*.tar") returned 5 [0066.652] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT", pszSpec="*.gzip") returned 0 [0066.652] lstrlenA (lpString="*.gzip") returned 6 [0066.652] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT", pszSpec="*.jpg") returned 0 [0066.652] lstrlenA (lpString="*.jpg") returned 5 [0066.652] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT", pszSpec="*.jpeg") returned 0 [0066.652] lstrlenA (lpString="*.jpeg") returned 6 [0066.652] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT", pszSpec="*.psd") returned 0 [0066.652] lstrlenA (lpString="*.psd") returned 5 [0066.652] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT", pszSpec="*.cdr") returned 0 [0066.652] lstrlenA (lpString="*.cdr") returned 5 [0066.652] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT", pszSpec="*.dwg") returned 0 [0066.652] lstrlenA (lpString="*.dwg") returned 5 [0066.652] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT", pszSpec="*.max") returned 0 [0066.652] lstrlenA (lpString="*.max") returned 5 [0066.652] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT", pszSpec="*.bmp") returned 0 [0066.652] lstrlenA (lpString="*.bmp") returned 5 [0066.652] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT", pszSpec="*.gif") returned 0 [0066.652] lstrlenA (lpString="*.gif") returned 5 [0066.652] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT", pszSpec="*.png") returned 0 [0066.652] lstrlenA (lpString="*.png") returned 5 [0066.652] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT", pszSpec="*.doc") returned 0 [0066.652] lstrlenA (lpString="*.doc") returned 5 [0066.652] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT", pszSpec="*.docx") returned 0 [0066.652] lstrlenA (lpString="*.docx") returned 6 [0066.653] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT", pszSpec="*.xls") returned 0 [0066.653] lstrlenA (lpString="*.xls") returned 5 [0066.653] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT", pszSpec="*.xlsx") returned 0 [0066.653] lstrlenA (lpString="*.xlsx") returned 6 [0066.653] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT", pszSpec="*.ppt") returned 0 [0066.653] lstrlenA (lpString="*.ppt") returned 5 [0066.653] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT", pszSpec="*.pptx") returned 0 [0066.653] lstrlenA (lpString="*.pptx") returned 6 [0066.653] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT", pszSpec="*.txt") returned 0 [0066.653] lstrlenA (lpString="*.txt") returned 5 [0066.653] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT", pszSpec="*.pdf") returned 0 [0066.653] lstrlenA (lpString="*.pdf") returned 5 [0066.653] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT", pszSpec="*.djvu") returned 0 [0066.653] lstrlenA (lpString="*.djvu") returned 6 [0066.653] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT", pszSpec="*.htm") returned 0 [0066.653] lstrlenA (lpString="*.htm") returned 5 [0066.653] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT", pszSpec="*.html") returned 0 [0066.653] lstrlenA (lpString="*.html") returned 6 [0066.653] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT", pszSpec="*.mdb") returned 0 [0066.653] lstrlenA (lpString="*.mdb") returned 5 [0066.653] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT", pszSpec="*.cer") returned 0 [0066.653] lstrlenA (lpString="*.cer") returned 5 [0066.653] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT", pszSpec="*.p12") returned 0 [0066.653] lstrlenA (lpString="*.p12") returned 5 [0066.653] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT", pszSpec="*.pfx") returned 0 [0066.653] lstrlenA (lpString="*.pfx") returned 5 [0066.653] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT", pszSpec="*.kwm") returned 0 [0066.653] lstrlenA (lpString="*.kwm") returned 5 [0066.653] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT", pszSpec="*.pwm") returned 0 [0066.653] lstrlenA (lpString="*.pwm") returned 5 [0066.653] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT", pszSpec="*.1cd") returned 0 [0066.653] lstrlenA (lpString="*.1cd") returned 5 [0066.653] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT", pszSpec="*.md") returned 0 [0066.653] lstrlenA (lpString="*.md") returned 4 [0066.653] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT", pszSpec="*.mdf") returned 0 [0066.653] lstrlenA (lpString="*.mdf") returned 5 [0066.653] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT", pszSpec="*.dbf") returned 0 [0066.653] lstrlenA (lpString="*.dbf") returned 5 [0066.653] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT", pszSpec="*.odt") returned 0 [0066.653] lstrlenA (lpString="*.odt") returned 5 [0066.653] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT", pszSpec="*.vob") returned 0 [0066.653] lstrlenA (lpString="*.vob") returned 5 [0066.653] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT", pszSpec="*.ifo") returned 0 [0066.653] lstrlenA (lpString="*.ifo") returned 5 [0066.653] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT", pszSpec="*.lnk") returned 0 [0066.653] lstrlenA (lpString="*.lnk") returned 5 [0066.653] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT", pszSpec="*.torrent") returned 0 [0066.653] lstrlenA (lpString="*.torrent") returned 9 [0066.653] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT", pszSpec="*.mov") returned 0 [0066.654] lstrlenA (lpString="*.mov") returned 5 [0066.654] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT", pszSpec="*.m2v") returned 0 [0066.654] lstrlenA (lpString="*.m2v") returned 5 [0066.654] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT", pszSpec="*.3gp") returned 0 [0066.654] lstrlenA (lpString="*.3gp") returned 5 [0066.654] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT", pszSpec="*.mpeg") returned 0 [0066.654] lstrlenA (lpString="*.mpeg") returned 6 [0066.654] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT", pszSpec="*.mpg") returned 0 [0066.654] lstrlenA (lpString="*.mpg") returned 5 [0066.654] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT", pszSpec="*.flv") returned 0 [0066.654] lstrlenA (lpString="*.flv") returned 5 [0066.654] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT", pszSpec="*.avi") returned 0 [0066.654] lstrlenA (lpString="*.avi") returned 5 [0066.654] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT", pszSpec="*.mp4") returned 0 [0066.654] lstrlenA (lpString="*.mp4") returned 5 [0066.654] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT", pszSpec="*.wmv") returned 0 [0066.654] lstrlenA (lpString="*.wmv") returned 5 [0066.654] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT", pszSpec="*.divx") returned 0 [0066.654] lstrlenA (lpString="*.divx") returned 6 [0066.654] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT", pszSpec="*.mkv") returned 0 [0066.654] lstrlenA (lpString="*.mkv") returned 5 [0066.654] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT", pszSpec="*.mp3") returned 0 [0066.654] lstrlenA (lpString="*.mp3") returned 5 [0066.654] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT", pszSpec="*.wav") returned 0 [0066.654] lstrlenA (lpString="*.wav") returned 5 [0066.654] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT", pszSpec="*.flac") returned 0 [0066.654] lstrlenA (lpString="*.flac") returned 6 [0066.654] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT", pszSpec="*.ape") returned 0 [0066.654] lstrlenA (lpString="*.ape") returned 5 [0066.654] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT", pszSpec="*.wma") returned 0 [0066.654] lstrlenA (lpString="*.wma") returned 5 [0066.654] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT", pszSpec="*.ac3") returned 0 [0066.654] lstrlenA (lpString="*.ac3") returned 5 [0066.654] FindNextFileA (in: hFindFile=0x5b7be0, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0066.654] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0066.654] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="WPGIMP32.FLT") returned -1 [0066.654] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WPGIMP32.FLT") returned -1 [0066.654] lstrcmpiA (lpString1="", lpString2="WPGIMP32.FLT") returned -1 [0066.654] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\", lpString2="WPGIMP32.FLT" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT" [0066.654] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT", pszSpec="*.zip") returned 0 [0066.655] lstrlenA (lpString="*.zip") returned 5 [0066.655] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT", pszSpec="*.rar") returned 0 [0066.655] lstrlenA (lpString="*.rar") returned 5 [0066.655] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT", pszSpec="*.7z") returned 0 [0066.655] lstrlenA (lpString="*.7z") returned 4 [0066.655] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT", pszSpec="*.tar") returned 0 [0066.655] lstrlenA (lpString="*.tar") returned 5 [0066.655] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT", pszSpec="*.gzip") returned 0 [0066.655] lstrlenA (lpString="*.gzip") returned 6 [0066.655] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT", pszSpec="*.jpg") returned 0 [0066.655] lstrlenA (lpString="*.jpg") returned 5 [0066.655] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT", pszSpec="*.jpeg") returned 0 [0066.655] lstrlenA (lpString="*.jpeg") returned 6 [0066.655] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT", pszSpec="*.psd") returned 0 [0066.655] lstrlenA (lpString="*.psd") returned 5 [0066.655] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT", pszSpec="*.cdr") returned 0 [0066.655] lstrlenA (lpString="*.cdr") returned 5 [0066.655] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT", pszSpec="*.dwg") returned 0 [0066.655] lstrlenA (lpString="*.dwg") returned 5 [0066.655] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT", pszSpec="*.max") returned 0 [0066.655] lstrlenA (lpString="*.max") returned 5 [0066.655] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT", pszSpec="*.bmp") returned 0 [0066.655] lstrlenA (lpString="*.bmp") returned 5 [0066.655] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT", pszSpec="*.gif") returned 0 [0066.655] lstrlenA (lpString="*.gif") returned 5 [0066.655] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT", pszSpec="*.png") returned 0 [0066.655] lstrlenA (lpString="*.png") returned 5 [0066.655] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT", pszSpec="*.doc") returned 0 [0066.655] lstrlenA (lpString="*.doc") returned 5 [0066.655] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT", pszSpec="*.docx") returned 0 [0066.655] lstrlenA (lpString="*.docx") returned 6 [0066.655] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT", pszSpec="*.xls") returned 0 [0066.655] lstrlenA (lpString="*.xls") returned 5 [0066.655] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT", pszSpec="*.xlsx") returned 0 [0066.655] lstrlenA (lpString="*.xlsx") returned 6 [0066.655] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT", pszSpec="*.ppt") returned 0 [0066.655] lstrlenA (lpString="*.ppt") returned 5 [0066.656] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT", pszSpec="*.pptx") returned 0 [0066.656] lstrlenA (lpString="*.pptx") returned 6 [0066.656] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT", pszSpec="*.txt") returned 0 [0066.656] lstrlenA (lpString="*.txt") returned 5 [0066.656] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT", pszSpec="*.pdf") returned 0 [0066.656] lstrlenA (lpString="*.pdf") returned 5 [0066.656] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT", pszSpec="*.djvu") returned 0 [0066.656] lstrlenA (lpString="*.djvu") returned 6 [0066.656] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT", pszSpec="*.htm") returned 0 [0066.656] lstrlenA (lpString="*.htm") returned 5 [0066.656] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT", pszSpec="*.html") returned 0 [0066.656] lstrlenA (lpString="*.html") returned 6 [0066.656] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT", pszSpec="*.mdb") returned 0 [0066.656] lstrlenA (lpString="*.mdb") returned 5 [0066.656] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT", pszSpec="*.cer") returned 0 [0066.656] lstrlenA (lpString="*.cer") returned 5 [0066.656] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT", pszSpec="*.p12") returned 0 [0066.656] lstrlenA (lpString="*.p12") returned 5 [0066.656] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT", pszSpec="*.pfx") returned 0 [0066.656] lstrlenA (lpString="*.pfx") returned 5 [0066.656] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT", pszSpec="*.kwm") returned 0 [0066.656] lstrlenA (lpString="*.kwm") returned 5 [0066.656] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT", pszSpec="*.pwm") returned 0 [0066.656] lstrlenA (lpString="*.pwm") returned 5 [0066.656] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT", pszSpec="*.1cd") returned 0 [0066.656] lstrlenA (lpString="*.1cd") returned 5 [0066.656] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT", pszSpec="*.md") returned 0 [0066.656] lstrlenA (lpString="*.md") returned 4 [0066.656] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT", pszSpec="*.mdf") returned 0 [0066.656] lstrlenA (lpString="*.mdf") returned 5 [0066.656] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT", pszSpec="*.dbf") returned 0 [0066.656] lstrlenA (lpString="*.dbf") returned 5 [0066.656] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT", pszSpec="*.odt") returned 0 [0066.656] lstrlenA (lpString="*.odt") returned 5 [0066.656] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT", pszSpec="*.vob") returned 0 [0066.656] lstrlenA (lpString="*.vob") returned 5 [0066.656] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT", pszSpec="*.ifo") returned 0 [0066.656] lstrlenA (lpString="*.ifo") returned 5 [0066.656] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT", pszSpec="*.lnk") returned 0 [0066.656] lstrlenA (lpString="*.lnk") returned 5 [0066.656] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT", pszSpec="*.torrent") returned 0 [0066.656] lstrlenA (lpString="*.torrent") returned 9 [0066.656] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT", pszSpec="*.mov") returned 0 [0066.656] lstrlenA (lpString="*.mov") returned 5 [0066.656] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT", pszSpec="*.m2v") returned 0 [0066.656] lstrlenA (lpString="*.m2v") returned 5 [0066.656] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT", pszSpec="*.3gp") returned 0 [0066.657] lstrlenA (lpString="*.3gp") returned 5 [0066.657] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT", pszSpec="*.mpeg") returned 0 [0066.657] lstrlenA (lpString="*.mpeg") returned 6 [0066.657] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT", pszSpec="*.mpg") returned 0 [0066.657] lstrlenA (lpString="*.mpg") returned 5 [0066.657] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT", pszSpec="*.flv") returned 0 [0066.657] lstrlenA (lpString="*.flv") returned 5 [0066.657] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT", pszSpec="*.avi") returned 0 [0066.657] lstrlenA (lpString="*.avi") returned 5 [0066.657] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT", pszSpec="*.mp4") returned 0 [0066.657] lstrlenA (lpString="*.mp4") returned 5 [0066.657] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT", pszSpec="*.wmv") returned 0 [0066.657] lstrlenA (lpString="*.wmv") returned 5 [0066.657] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT", pszSpec="*.divx") returned 0 [0066.657] lstrlenA (lpString="*.divx") returned 6 [0066.657] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT", pszSpec="*.mkv") returned 0 [0066.657] lstrlenA (lpString="*.mkv") returned 5 [0066.657] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT", pszSpec="*.mp3") returned 0 [0066.657] lstrlenA (lpString="*.mp3") returned 5 [0066.657] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT", pszSpec="*.wav") returned 0 [0066.657] lstrlenA (lpString="*.wav") returned 5 [0066.657] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT", pszSpec="*.flac") returned 0 [0066.657] lstrlenA (lpString="*.flac") returned 6 [0066.657] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT", pszSpec="*.ape") returned 0 [0066.657] lstrlenA (lpString="*.ape") returned 5 [0066.657] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT", pszSpec="*.wma") returned 0 [0066.657] lstrlenA (lpString="*.wma") returned 5 [0066.657] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT", pszSpec="*.ac3") returned 0 [0066.657] lstrlenA (lpString="*.ac3") returned 5 [0066.657] FindNextFileA (in: hFindFile=0x5b7be0, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0 [0066.657] FindClose (in: hFindFile=0x5b7be0 | out: hFindFile=0x5b7be0) returned 1 [0066.657] FindNextFileA (in: hFindFile=0x5ba128, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0066.657] lstrcmpA (lpString1=".", lpString2="Help") returned -1 [0066.657] lstrcmpA (lpString1="..", lpString2="Help") returned -1 [0066.657] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\*.*") returned="*.*" [0066.657] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\", lpString2="Help" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Help") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Help" [0066.657] lstrlenA (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help") returned 51 [0066.657] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5b7c58 [0066.658] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0066.658] FindNextFileA (in: hFindFile=0x5b7c58, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0066.658] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0066.658] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0066.658] FindNextFileA (in: hFindFile=0x5b7c58, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0066.658] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0066.658] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="hxds.dll") returned -1 [0066.658] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="hxds.dll") returned -1 [0066.658] lstrcmpiA (lpString1="", lpString2="hxds.dll") returned -1 [0066.658] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\*.*") returned="*.*" [0066.659] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\", lpString2="hxds.dll" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll" [0066.659] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll", pszSpec="*.zip") returned 0 [0066.659] lstrlenA (lpString="*.zip") returned 5 [0066.659] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll", pszSpec="*.rar") returned 0 [0066.659] lstrlenA (lpString="*.rar") returned 5 [0066.659] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll", pszSpec="*.7z") returned 0 [0066.659] lstrlenA (lpString="*.7z") returned 4 [0066.659] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll", pszSpec="*.tar") returned 0 [0066.659] lstrlenA (lpString="*.tar") returned 5 [0066.659] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll", pszSpec="*.gzip") returned 0 [0066.659] lstrlenA (lpString="*.gzip") returned 6 [0066.659] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll", pszSpec="*.jpg") returned 0 [0066.659] lstrlenA (lpString="*.jpg") returned 5 [0066.659] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll", pszSpec="*.jpeg") returned 0 [0066.659] FindNextFileA (in: hFindFile=0x5b7c58, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0066.659] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0066.659] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="ITIRCL55.DLL") returned -1 [0066.659] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ITIRCL55.DLL") returned -1 [0066.659] lstrcmpiA (lpString1="", lpString2="ITIRCL55.DLL") returned -1 [0066.659] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll") returned="hxds.dll" [0066.659] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\", lpString2="ITIRCL55.DLL" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL" [0066.659] FindNextFileA (in: hFindFile=0x5b7c58, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0066.659] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0066.659] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="msitss55.dll") returned -1 [0066.659] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="msitss55.dll") returned -1 [0066.659] lstrcmpiA (lpString1="", lpString2="msitss55.dll") returned -1 [0066.659] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL") returned="ITIRCL55.DLL" [0066.659] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\", lpString2="msitss55.dll" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll" [0066.660] FindNextFileA (in: hFindFile=0x5b7c58, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0 [0066.660] FindClose (in: hFindFile=0x5b7c58 | out: hFindFile=0x5b7c58) returned 1 [0066.660] FindNextFileA (in: hFindFile=0x5ba128, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0066.660] lstrcmpA (lpString1=".", lpString2="ink") returned -1 [0066.660] lstrcmpA (lpString1="..", lpString2="ink") returned -1 [0066.660] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\*.*") returned="*.*" [0066.660] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\", lpString2="ink" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink" [0066.660] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5b7c58 [0066.660] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0066.660] FindNextFileA (in: hFindFile=0x5b7c58, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0066.660] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0066.660] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0066.660] FindNextFileA (in: hFindFile=0x5b7c58, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0066.660] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0066.660] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Alphabet.xml") returned 1 [0066.660] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Alphabet.xml") returned 1 [0066.660] lstrcmpiA (lpString1="", lpString2="Alphabet.xml") returned -1 [0066.660] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*") returned="*.*" [0066.660] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="Alphabet.xml" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml" [0066.661] FindNextFileA (in: hFindFile=0x5b7c58, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0066.661] lstrcmpA (lpString1=".", lpString2="ar-SA") returned -1 [0066.661] lstrcmpA (lpString1="..", lpString2="ar-SA") returned -1 [0066.661] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned="Alphabet.xml" [0066.661] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="ar-SA" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA" [0066.661] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5b7be0 [0066.661] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0066.661] FindNextFileA (in: hFindFile=0x5b7be0, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0066.661] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0066.662] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0066.662] FindNextFileA (in: hFindFile=0x5b7be0, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0066.662] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0066.662] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="tipresx.dll.mui") returned -1 [0066.662] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="tipresx.dll.mui") returned -1 [0066.662] lstrcmpiA (lpString1="", lpString2="tipresx.dll.mui") returned -1 [0066.662] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\*.*") returned="*.*" [0066.662] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\", lpString2="tipresx.dll.mui" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui" [0066.662] FindNextFileA (in: hFindFile=0x5b7be0, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0 [0066.662] FindClose (in: hFindFile=0x5b7be0 | out: hFindFile=0x5b7be0) returned 1 [0066.662] FindNextFileA (in: hFindFile=0x5b7c58, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0066.662] lstrcmpA (lpString1=".", lpString2="bg-BG") returned -1 [0066.662] lstrcmpA (lpString1="..", lpString2="bg-BG") returned -1 [0066.662] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*") returned="*.*" [0066.662] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="bg-BG" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG" [0066.662] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5b7be0 [0066.662] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0066.663] FindNextFileA (in: hFindFile=0x5b7be0, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0066.663] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0066.663] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0066.663] FindNextFileA (in: hFindFile=0x5b7be0, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0066.663] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0066.663] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="tipresx.dll.mui") returned -1 [0066.663] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="tipresx.dll.mui") returned -1 [0066.663] lstrcmpiA (lpString1="", lpString2="tipresx.dll.mui") returned -1 [0066.663] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\*.*") returned="*.*" [0066.663] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\", lpString2="tipresx.dll.mui" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui" [0066.663] FindNextFileA (in: hFindFile=0x5b7be0, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0 [0066.663] FindClose (in: hFindFile=0x5b7be0 | out: hFindFile=0x5b7be0) returned 1 [0066.663] FindNextFileA (in: hFindFile=0x5b7c58, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0066.663] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0066.663] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Content.xml") returned 1 [0066.663] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Content.xml") returned 1 [0066.663] lstrcmpiA (lpString1="", lpString2="Content.xml") returned -1 [0066.663] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*") returned="*.*" [0066.663] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="Content.xml" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml" [0066.663] FindNextFileA (in: hFindFile=0x5b7c58, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0066.663] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0066.663] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="ConvertInkStore.exe") returned 1 [0066.663] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ConvertInkStore.exe") returned 1 [0066.663] lstrcmpiA (lpString1="", lpString2="ConvertInkStore.exe") returned -1 [0066.663] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned="Content.xml" [0066.663] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="ConvertInkStore.exe" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe" [0066.663] FindNextFileA (in: hFindFile=0x5b7c58, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0066.663] lstrcmpA (lpString1=".", lpString2="cs-CZ") returned -1 [0066.663] lstrcmpA (lpString1="..", lpString2="cs-CZ") returned -1 [0066.663] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe") returned="ConvertInkStore.exe" [0066.663] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="cs-CZ" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ" [0066.663] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5b7be0 [0066.664] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0066.664] FindNextFileA (in: hFindFile=0x5b7be0, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0066.664] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0066.664] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0066.664] FindNextFileA (in: hFindFile=0x5b7be0, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0066.664] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0066.664] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="tipresx.dll.mui") returned -1 [0066.664] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="tipresx.dll.mui") returned -1 [0066.664] lstrcmpiA (lpString1="", lpString2="tipresx.dll.mui") returned -1 [0066.664] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\*.*") returned="*.*" [0066.664] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\", lpString2="tipresx.dll.mui" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui" [0066.664] FindNextFileA (in: hFindFile=0x5b7be0, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0 [0066.664] FindClose (in: hFindFile=0x5b7be0 | out: hFindFile=0x5b7be0) returned 1 [0066.664] FindNextFileA (in: hFindFile=0x5b7c58, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0066.664] lstrcmpA (lpString1=".", lpString2="da-DK") returned -1 [0066.664] lstrcmpA (lpString1="..", lpString2="da-DK") returned -1 [0066.664] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*") returned="*.*" [0066.664] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="da-DK" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK" [0066.664] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5b7be0 [0066.665] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0066.665] FindNextFileA (in: hFindFile=0x5b7be0, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0066.665] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0066.665] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0066.665] FindNextFileA (in: hFindFile=0x5b7be0, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0066.665] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0066.665] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="tipresx.dll.mui") returned -1 [0066.665] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="tipresx.dll.mui") returned -1 [0066.665] lstrcmpiA (lpString1="", lpString2="tipresx.dll.mui") returned -1 [0066.665] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\*.*") returned="*.*" [0066.665] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\", lpString2="tipresx.dll.mui" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui" [0066.665] FindNextFileA (in: hFindFile=0x5b7be0, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0 [0066.665] FindClose (in: hFindFile=0x5b7be0 | out: hFindFile=0x5b7be0) returned 1 [0066.665] FindNextFileA (in: hFindFile=0x5b7c58, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0066.665] lstrcmpA (lpString1=".", lpString2="de-DE") returned -1 [0066.665] lstrcmpA (lpString1="..", lpString2="de-DE") returned -1 [0066.665] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*") returned="*.*" [0066.665] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="de-DE" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE" [0066.665] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5b7be0 [0066.666] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0066.666] FindNextFileA (in: hFindFile=0x5b7be0, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0066.666] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0066.666] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0066.666] FindNextFileA (in: hFindFile=0x5b7be0, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0066.666] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0066.666] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="tipresx.dll.mui") returned -1 [0066.666] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="tipresx.dll.mui") returned -1 [0066.666] lstrcmpiA (lpString1="", lpString2="tipresx.dll.mui") returned -1 [0066.666] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\*.*") returned="*.*" [0066.666] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\", lpString2="tipresx.dll.mui" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui" [0066.666] FindNextFileA (in: hFindFile=0x5b7be0, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0 [0066.666] FindClose (in: hFindFile=0x5b7be0 | out: hFindFile=0x5b7be0) returned 1 [0066.667] FindNextFileA (in: hFindFile=0x5b7c58, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0066.667] lstrcmpA (lpString1=".", lpString2="el-GR") returned -1 [0066.667] lstrcmpA (lpString1="..", lpString2="el-GR") returned -1 [0066.667] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*") returned="*.*" [0066.667] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="el-GR" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR" [0066.667] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5b7be0 [0066.667] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0066.667] FindNextFileA (in: hFindFile=0x5b7be0, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0066.667] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0066.667] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0066.667] FindNextFileA (in: hFindFile=0x5b7be0, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0066.667] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0066.667] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="tipresx.dll.mui") returned -1 [0066.667] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="tipresx.dll.mui") returned -1 [0066.667] lstrcmpiA (lpString1="", lpString2="tipresx.dll.mui") returned -1 [0066.667] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\*.*") returned="*.*" [0066.667] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\", lpString2="tipresx.dll.mui" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui" [0066.667] FindNextFileA (in: hFindFile=0x5b7be0, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0 [0066.667] FindClose (in: hFindFile=0x5b7be0 | out: hFindFile=0x5b7be0) returned 1 [0066.667] FindNextFileA (in: hFindFile=0x5b7c58, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0066.667] lstrcmpA (lpString1=".", lpString2="en-US") returned -1 [0066.667] lstrcmpA (lpString1="..", lpString2="en-US") returned -1 [0066.667] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*") returned="*.*" [0066.667] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="en-US" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US" [0066.668] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5b7be0 [0066.671] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0066.671] FindNextFileA (in: hFindFile=0x5b7be0, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0066.671] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0066.671] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0066.671] FindNextFileA (in: hFindFile=0x5b7be0, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0066.671] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0066.671] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="boxed-correct.avi") returned 1 [0066.671] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="boxed-correct.avi") returned 1 [0066.671] lstrcmpiA (lpString1="", lpString2="boxed-correct.avi") returned -1 [0066.671] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\*.*") returned="*.*" [0066.671] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\", lpString2="boxed-correct.avi" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi" [0066.671] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi" [0066.671] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi" [0066.671] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi.") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi." [0066.671] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi. ") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi. " [0066.671] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.682] FindNextFileA (in: hFindFile=0x5b7be0, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0066.682] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0066.682] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="boxed-delete.avi") returned 1 [0066.682] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="boxed-delete.avi") returned 1 [0066.682] lstrcmpiA (lpString1="", lpString2="boxed-delete.avi") returned -1 [0066.682] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned="boxed-correct.avi" [0066.682] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\", lpString2="boxed-delete.avi" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi" [0066.682] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi" [0066.682] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi" [0066.682] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi.") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi." [0066.682] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi. ") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi. " [0066.682] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.686] FindNextFileA (in: hFindFile=0x5b7be0, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0066.686] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0066.686] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="boxed-join.avi") returned 1 [0066.686] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="boxed-join.avi") returned 1 [0066.686] lstrcmpiA (lpString1="", lpString2="boxed-join.avi") returned -1 [0066.686] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned="boxed-delete.avi" [0066.686] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\", lpString2="boxed-join.avi" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi" [0066.686] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi" [0066.686] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi" [0066.686] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi.") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi." [0066.686] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi. ") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi. " [0066.687] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.687] FindNextFileA (in: hFindFile=0x5b7be0, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0066.687] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0066.687] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="boxed-split.avi") returned 1 [0066.687] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="boxed-split.avi") returned 1 [0066.687] lstrcmpiA (lpString1="", lpString2="boxed-split.avi") returned -1 [0066.687] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned="boxed-join.avi" [0066.687] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\", lpString2="boxed-split.avi" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi" [0066.687] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi" [0066.687] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi" [0066.687] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi.") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi." [0066.687] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi. ") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi. " [0066.687] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.687] FindNextFileA (in: hFindFile=0x5b7be0, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0066.687] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0066.687] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="correct.avi") returned 1 [0066.688] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="correct.avi") returned 1 [0066.688] lstrcmpiA (lpString1="", lpString2="correct.avi") returned -1 [0066.688] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned="boxed-split.avi" [0066.688] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\", lpString2="correct.avi" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi" [0066.688] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi" [0066.688] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi" [0066.688] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi.") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi." [0066.688] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi. ") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi. " [0066.688] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.688] FindNextFileA (in: hFindFile=0x5b7be0, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0066.688] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0066.688] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="delete.avi") returned 1 [0066.688] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="delete.avi") returned 1 [0066.688] lstrcmpiA (lpString1="", lpString2="delete.avi") returned -1 [0066.688] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned="correct.avi" [0066.688] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\", lpString2="delete.avi" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi" [0066.688] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi" [0066.688] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi" [0066.688] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi.") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi." [0066.688] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi. ") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi. " [0066.688] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.689] FindNextFileA (in: hFindFile=0x5b7be0, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0066.689] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0066.690] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="FlickLearningWizard.exe.mui") returned -1 [0066.690] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FlickLearningWizard.exe.mui") returned 1 [0066.690] lstrcmpiA (lpString1="", lpString2="FlickLearningWizard.exe.mui") returned -1 [0066.690] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned="delete.avi" [0066.690] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\", lpString2="FlickLearningWizard.exe.mui" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\FlickLearningWizard.exe.mui") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\FlickLearningWizard.exe.mui" [0066.690] FindNextFileA (in: hFindFile=0x5b7be0, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0066.690] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0066.690] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="InkObj.dll.mui") returned -1 [0066.690] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="InkObj.dll.mui") returned -1 [0066.690] lstrcmpiA (lpString1="", lpString2="InkObj.dll.mui") returned -1 [0066.690] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\FlickLearningWizard.exe.mui") returned="FlickLearningWizard.exe.mui" [0066.690] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\", lpString2="InkObj.dll.mui" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui" [0066.690] FindNextFileA (in: hFindFile=0x5b7be0, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0066.690] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0066.690] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="InkWatson.exe.mui") returned -1 [0066.690] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="InkWatson.exe.mui") returned -1 [0066.690] lstrcmpiA (lpString1="", lpString2="InkWatson.exe.mui") returned -1 [0066.690] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui") returned="InkObj.dll.mui" [0066.690] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\", lpString2="InkWatson.exe.mui" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkWatson.exe.mui") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkWatson.exe.mui" [0066.690] FindNextFileA (in: hFindFile=0x5b7be0, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0066.690] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0066.690] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="InputPersonalization.exe.mui") returned -1 [0066.690] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="InputPersonalization.exe.mui") returned -1 [0066.690] lstrcmpiA (lpString1="", lpString2="InputPersonalization.exe.mui") returned -1 [0066.690] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkWatson.exe.mui") returned="InkWatson.exe.mui" [0066.690] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\", lpString2="InputPersonalization.exe.mui" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InputPersonalization.exe.mui") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InputPersonalization.exe.mui" [0066.691] FindNextFileA (in: hFindFile=0x5b7be0, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0066.691] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0066.691] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="IPSEventLogMsg.dll.mui") returned -1 [0066.691] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="IPSEventLogMsg.dll.mui") returned -1 [0066.691] lstrcmpiA (lpString1="", lpString2="IPSEventLogMsg.dll.mui") returned -1 [0066.691] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InputPersonalization.exe.mui") returned="InputPersonalization.exe.mui" [0066.691] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\", lpString2="IPSEventLogMsg.dll.mui" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IPSEventLogMsg.dll.mui") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IPSEventLogMsg.dll.mui" [0066.691] FindNextFileA (in: hFindFile=0x5b7be0, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0066.691] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0066.691] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="IpsMigrationPlugin.dll.mui") returned -1 [0066.691] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="IpsMigrationPlugin.dll.mui") returned -1 [0066.691] lstrcmpiA (lpString1="", lpString2="IpsMigrationPlugin.dll.mui") returned -1 [0066.691] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IPSEventLogMsg.dll.mui") returned="IPSEventLogMsg.dll.mui" [0066.691] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\", lpString2="IpsMigrationPlugin.dll.mui" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui" [0066.691] FindNextFileA (in: hFindFile=0x5b7be0, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0066.691] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0066.691] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="join.avi") returned -1 [0066.691] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="join.avi") returned -1 [0066.691] lstrcmpiA (lpString1="", lpString2="join.avi") returned -1 [0066.691] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui") returned="IpsMigrationPlugin.dll.mui" [0066.691] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\", lpString2="join.avi" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi" [0066.691] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi" [0066.692] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi" [0066.692] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi.") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi." [0066.692] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi. ") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi. " [0066.692] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.692] FindNextFileA (in: hFindFile=0x5b7be0, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0066.692] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0066.692] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="micaut.dll.mui") returned -1 [0066.692] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="micaut.dll.mui") returned -1 [0066.692] lstrcmpiA (lpString1="", lpString2="micaut.dll.mui") returned -1 [0066.692] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned="join.avi" [0066.692] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\", lpString2="micaut.dll.mui" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\micaut.dll.mui") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\micaut.dll.mui" [0066.692] FindNextFileA (in: hFindFile=0x5b7be0, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0066.692] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0066.692] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="mip.exe.mui") returned -1 [0066.692] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="mip.exe.mui") returned -1 [0066.692] lstrcmpiA (lpString1="", lpString2="mip.exe.mui") returned -1 [0066.692] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\micaut.dll.mui") returned="micaut.dll.mui" [0066.692] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\", lpString2="mip.exe.mui" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mip.exe.mui") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mip.exe.mui" [0066.692] FindNextFileA (in: hFindFile=0x5b7be0, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0066.692] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0066.692] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="mshwLatin.dll.mui") returned -1 [0066.692] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="mshwLatin.dll.mui") returned -1 [0066.692] lstrcmpiA (lpString1="", lpString2="mshwLatin.dll.mui") returned -1 [0066.692] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mip.exe.mui") returned="mip.exe.mui" [0066.692] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\", lpString2="mshwLatin.dll.mui" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mshwLatin.dll.mui") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mshwLatin.dll.mui" [0066.693] FindNextFileA (in: hFindFile=0x5b7be0, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0066.693] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0066.693] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="rtscom.dll.mui") returned -1 [0066.693] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="rtscom.dll.mui") returned -1 [0066.693] lstrcmpiA (lpString1="", lpString2="rtscom.dll.mui") returned -1 [0066.693] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mshwLatin.dll.mui") returned="mshwLatin.dll.mui" [0066.693] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\", lpString2="rtscom.dll.mui" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\rtscom.dll.mui") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\rtscom.dll.mui" [0066.693] FindNextFileA (in: hFindFile=0x5b7be0, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0066.693] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0066.693] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="ShapeCollector.exe.mui") returned -1 [0066.693] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ShapeCollector.exe.mui") returned -1 [0066.693] lstrcmpiA (lpString1="", lpString2="ShapeCollector.exe.mui") returned -1 [0066.693] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\rtscom.dll.mui") returned="rtscom.dll.mui" [0066.693] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\", lpString2="ShapeCollector.exe.mui" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\ShapeCollector.exe.mui") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\ShapeCollector.exe.mui" [0066.693] FindNextFileA (in: hFindFile=0x5b7be0, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0066.693] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0066.693] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="split.avi") returned -1 [0066.693] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="split.avi") returned -1 [0066.693] lstrcmpiA (lpString1="", lpString2="split.avi") returned -1 [0066.693] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\ShapeCollector.exe.mui") returned="ShapeCollector.exe.mui" [0066.693] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\", lpString2="split.avi" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi" [0066.693] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi" [0066.693] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi" [0066.693] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi.") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi." [0066.693] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi. ") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi. " [0066.693] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\split.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.694] FindNextFileA (in: hFindFile=0x5b7be0, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0066.694] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0066.694] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="tabskb.dll.mui") returned -1 [0066.694] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="tabskb.dll.mui") returned -1 [0066.694] lstrcmpiA (lpString1="", lpString2="tabskb.dll.mui") returned -1 [0066.694] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned="split.avi" [0066.694] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\", lpString2="tabskb.dll.mui" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tabskb.dll.mui") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tabskb.dll.mui" [0066.694] FindNextFileA (in: hFindFile=0x5b7be0, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0066.694] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0066.694] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="TipBand.dll.mui") returned -1 [0066.694] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TipBand.dll.mui") returned -1 [0066.694] lstrcmpiA (lpString1="", lpString2="TipBand.dll.mui") returned -1 [0066.694] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tabskb.dll.mui") returned="tabskb.dll.mui" [0066.694] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\", lpString2="TipBand.dll.mui" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipBand.dll.mui") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipBand.dll.mui" [0066.694] FindNextFileA (in: hFindFile=0x5b7be0, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0066.694] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0066.694] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="TipRes.dll.mui") returned -1 [0066.694] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TipRes.dll.mui") returned -1 [0066.694] lstrcmpiA (lpString1="", lpString2="TipRes.dll.mui") returned -1 [0066.694] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipBand.dll.mui") returned="TipBand.dll.mui" [0066.694] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\", lpString2="TipRes.dll.mui" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipRes.dll.mui") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipRes.dll.mui" [0066.694] FindNextFileA (in: hFindFile=0x5b7be0, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0066.694] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0066.694] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="tipresx.dll.mui") returned -1 [0066.694] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="tipresx.dll.mui") returned -1 [0066.694] lstrcmpiA (lpString1="", lpString2="tipresx.dll.mui") returned -1 [0066.695] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipRes.dll.mui") returned="TipRes.dll.mui" [0066.695] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\", lpString2="tipresx.dll.mui" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tipresx.dll.mui") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tipresx.dll.mui" [0066.695] FindNextFileA (in: hFindFile=0x5b7be0, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0066.695] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0066.695] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="TipTsf.dll.mui") returned -1 [0066.695] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TipTsf.dll.mui") returned -1 [0066.695] lstrcmpiA (lpString1="", lpString2="TipTsf.dll.mui") returned -1 [0066.695] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tipresx.dll.mui") returned="tipresx.dll.mui" [0066.695] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\", lpString2="TipTsf.dll.mui" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipTsf.dll.mui") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipTsf.dll.mui" [0066.695] FindNextFileA (in: hFindFile=0x5b7be0, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0 [0066.695] FindClose (in: hFindFile=0x5b7be0 | out: hFindFile=0x5b7be0) returned 1 [0066.696] FindNextFileA (in: hFindFile=0x5b7c58, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0066.696] lstrcmpA (lpString1=".", lpString2="es-ES") returned -1 [0066.696] lstrcmpA (lpString1="..", lpString2="es-ES") returned -1 [0066.696] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*") returned="*.*" [0066.696] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="es-ES" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES" [0066.696] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5b7be0 [0066.696] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0066.696] FindNextFileA (in: hFindFile=0x5b7be0, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0066.696] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0066.696] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0066.696] FindNextFileA (in: hFindFile=0x5b7be0, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0066.696] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0066.696] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="tipresx.dll.mui") returned -1 [0066.697] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="tipresx.dll.mui") returned -1 [0066.697] lstrcmpiA (lpString1="", lpString2="tipresx.dll.mui") returned -1 [0066.697] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES\\*.*") returned="*.*" [0066.697] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES\\", lpString2="tipresx.dll.mui" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES\\tipresx.dll.mui") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES\\tipresx.dll.mui" [0066.697] FindNextFileA (in: hFindFile=0x5b7be0, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0 [0066.697] FindClose (in: hFindFile=0x5b7be0 | out: hFindFile=0x5b7be0) returned 1 [0066.697] FindNextFileA (in: hFindFile=0x5b7c58, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0066.697] lstrcmpA (lpString1=".", lpString2="et-EE") returned -1 [0066.697] lstrcmpA (lpString1="..", lpString2="et-EE") returned -1 [0066.697] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*") returned="*.*" [0066.697] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="et-EE" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\et-EE") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\et-EE" [0066.697] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\et-EE\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5b7be0 [0066.698] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0066.698] FindNextFileA (in: hFindFile=0x5b7be0, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0066.698] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0066.698] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0066.698] FindNextFileA (in: hFindFile=0x5b7be0, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0066.698] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0066.698] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="tipresx.dll.mui") returned -1 [0066.698] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="tipresx.dll.mui") returned -1 [0066.698] lstrcmpiA (lpString1="", lpString2="tipresx.dll.mui") returned -1 [0066.698] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\et-EE\\*.*") returned="*.*" [0066.698] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\et-EE\\", lpString2="tipresx.dll.mui" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\et-EE\\tipresx.dll.mui") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\et-EE\\tipresx.dll.mui" [0066.699] FindNextFileA (in: hFindFile=0x5b7be0, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0 [0066.699] FindClose (in: hFindFile=0x5b7be0 | out: hFindFile=0x5b7be0) returned 1 [0066.699] FindNextFileA (in: hFindFile=0x5b7c58, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0066.699] lstrcmpA (lpString1=".", lpString2="fi-FI") returned -1 [0066.699] lstrcmpA (lpString1="..", lpString2="fi-FI") returned -1 [0066.699] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*") returned="*.*" [0066.699] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="fi-FI" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fi-FI") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fi-FI" [0066.699] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fi-FI\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5b7be0 [0066.699] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0066.699] FindNextFileA (in: hFindFile=0x5b7be0, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0066.699] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0066.699] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0066.699] FindNextFileA (in: hFindFile=0x5b7be0, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0066.699] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0066.699] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="tipresx.dll.mui") returned -1 [0066.700] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="tipresx.dll.mui") returned -1 [0066.700] lstrcmpiA (lpString1="", lpString2="tipresx.dll.mui") returned -1 [0066.700] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fi-FI\\*.*") returned="*.*" [0066.700] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fi-FI\\", lpString2="tipresx.dll.mui" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fi-FI\\tipresx.dll.mui") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fi-FI\\tipresx.dll.mui" [0066.700] FindNextFileA (in: hFindFile=0x5b7be0, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0 [0066.700] FindClose (in: hFindFile=0x5b7be0 | out: hFindFile=0x5b7be0) returned 1 [0066.700] FindNextFileA (in: hFindFile=0x5b7c58, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0066.700] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0066.700] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="FlickAnimation.avi") returned -1 [0066.700] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FlickAnimation.avi") returned 1 [0066.700] lstrcmpiA (lpString1="", lpString2="FlickAnimation.avi") returned -1 [0066.700] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*") returned="*.*" [0066.700] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="FlickAnimation.avi" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi" [0066.700] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi" [0066.700] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi" [0066.700] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi.") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi." [0066.700] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi. ") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi. " [0066.700] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.700] FindNextFileA (in: hFindFile=0x5b7c58, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0066.700] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0066.700] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="FlickLearningWizard.exe") returned -1 [0066.700] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FlickLearningWizard.exe") returned 1 [0066.700] lstrcmpiA (lpString1="", lpString2="FlickLearningWizard.exe") returned -1 [0066.701] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi") returned="FlickAnimation.avi" [0066.701] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="FlickLearningWizard.exe" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickLearningWizard.exe") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickLearningWizard.exe" [0066.701] FindNextFileA (in: hFindFile=0x5b7c58, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0066.701] lstrcmpA (lpString1=".", lpString2="fr-FR") returned -1 [0066.701] lstrcmpA (lpString1="..", lpString2="fr-FR") returned -1 [0066.701] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickLearningWizard.exe") returned="FlickLearningWizard.exe" [0066.701] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="fr-FR" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fr-FR") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fr-FR" [0066.701] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fr-FR\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5b7be0 [0066.701] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0066.701] FindNextFileA (in: hFindFile=0x5b7be0, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0066.701] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0066.701] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0066.701] FindNextFileA (in: hFindFile=0x5b7be0, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0066.701] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0066.701] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="tipresx.dll.mui") returned -1 [0066.701] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="tipresx.dll.mui") returned -1 [0066.701] lstrcmpiA (lpString1="", lpString2="tipresx.dll.mui") returned -1 [0066.701] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fr-FR\\*.*") returned="*.*" [0066.701] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fr-FR\\", lpString2="tipresx.dll.mui" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fr-FR\\tipresx.dll.mui") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fr-FR\\tipresx.dll.mui" [0066.702] FindNextFileA (in: hFindFile=0x5b7be0, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0 [0066.702] FindClose (in: hFindFile=0x5b7be0 | out: hFindFile=0x5b7be0) returned 1 [0066.702] FindNextFileA (in: hFindFile=0x5b7c58, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0066.702] lstrcmpA (lpString1=".", lpString2="fsdefinitions") returned -1 [0066.702] lstrcmpA (lpString1="..", lpString2="fsdefinitions") returned -1 [0066.702] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*") returned="*.*" [0066.702] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="fsdefinitions" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions" [0066.702] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5b7be0 [0066.703] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0066.703] FindNextFileA (in: hFindFile=0x5b7be0, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0066.704] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0066.704] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0066.704] FindNextFileA (in: hFindFile=0x5b7be0, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0066.704] lstrcmpA (lpString1=".", lpString2="auxpad") returned -1 [0066.704] lstrcmpA (lpString1="..", lpString2="auxpad") returned -1 [0066.704] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\*.*") returned="*.*" [0066.704] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\", lpString2="auxpad" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad" [0066.704] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5bb260 [0066.705] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0066.705] FindNextFileA (in: hFindFile=0x5bb260, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0066.705] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0066.705] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0066.705] FindNextFileA (in: hFindFile=0x5bb260, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0066.705] PeekMessageA (in: lpMsg=0xaef84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaef84) returned 0 [0066.705] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="auxbase.xml") returned 1 [0066.705] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="auxbase.xml") returned 1 [0066.705] lstrcmpiA (lpString1="", lpString2="auxbase.xml") returned -1 [0066.705] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\*.*") returned="*.*" [0066.705] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\", lpString2="auxbase.xml" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml" [0066.705] FindNextFileA (in: hFindFile=0x5bb260, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0 [0066.705] FindClose (in: hFindFile=0x5bb260 | out: hFindFile=0x5bb260) returned 1 [0066.705] FindNextFileA (in: hFindFile=0x5b7be0, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0066.705] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0066.705] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="auxpad.xml") returned 1 [0066.705] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="auxpad.xml") returned 1 [0066.705] lstrcmpiA (lpString1="", lpString2="auxpad.xml") returned -1 [0066.705] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\*.*") returned="*.*" [0066.705] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\", lpString2="auxpad.xml" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml" [0066.705] FindNextFileA (in: hFindFile=0x5b7be0, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0066.705] lstrcmpA (lpString1=".", lpString2="keypad") returned -1 [0066.705] lstrcmpA (lpString1="..", lpString2="keypad") returned -1 [0066.705] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned="auxpad.xml" [0066.705] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\", lpString2="keypad" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad" [0066.706] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5bb260 [0066.706] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0066.706] FindNextFileA (in: hFindFile=0x5bb260, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0066.706] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0066.706] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0066.706] FindNextFileA (in: hFindFile=0x5bb260, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0066.706] PeekMessageA (in: lpMsg=0xaef84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaef84) returned 0 [0066.706] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="ea.xml") returned 1 [0066.706] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ea.xml") returned 1 [0066.706] lstrcmpiA (lpString1="", lpString2="ea.xml") returned -1 [0066.706] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\*.*") returned="*.*" [0066.706] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\", lpString2="ea.xml" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml" [0066.706] FindNextFileA (in: hFindFile=0x5bb260, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0066.706] PeekMessageA (in: lpMsg=0xaef84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaef84) returned 0 [0066.706] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="keypadbase.xml") returned -1 [0066.706] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="keypadbase.xml") returned -1 [0066.706] lstrcmpiA (lpString1="", lpString2="keypadbase.xml") returned -1 [0066.706] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned="ea.xml" [0066.707] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\", lpString2="keypadbase.xml" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml" [0066.707] FindNextFileA (in: hFindFile=0x5bb260, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0066.707] PeekMessageA (in: lpMsg=0xaef84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaef84) returned 0 [0066.707] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="kor-kor.xml") returned -1 [0066.707] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="kor-kor.xml") returned -1 [0066.707] lstrcmpiA (lpString1="", lpString2="kor-kor.xml") returned -1 [0066.707] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned="keypadbase.xml" [0066.707] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\", lpString2="kor-kor.xml" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml" [0066.707] FindNextFileA (in: hFindFile=0x5bb260, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0 [0066.707] FindClose (in: hFindFile=0x5bb260 | out: hFindFile=0x5bb260) returned 1 [0066.707] FindNextFileA (in: hFindFile=0x5b7be0, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0066.707] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0066.707] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="keypad.xml") returned -1 [0066.707] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="keypad.xml") returned -1 [0066.707] lstrcmpiA (lpString1="", lpString2="keypad.xml") returned -1 [0066.707] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\*.*") returned="*.*" [0066.707] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\", lpString2="keypad.xml" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml" [0066.707] FindNextFileA (in: hFindFile=0x5b7be0, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0066.707] lstrcmpA (lpString1=".", lpString2="main") returned -1 [0066.707] lstrcmpA (lpString1="..", lpString2="main") returned -1 [0066.707] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml") returned="keypad.xml" [0066.707] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\", lpString2="main" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main" [0066.707] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5bb260 [0066.730] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0066.730] FindNextFileA (in: hFindFile=0x5bb260, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0066.730] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0066.730] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0066.730] FindNextFileA (in: hFindFile=0x5bb260, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0066.730] PeekMessageA (in: lpMsg=0xaef84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaef84) returned 0 [0066.730] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="base.xml") returned 1 [0066.730] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="base.xml") returned 1 [0066.730] lstrcmpiA (lpString1="", lpString2="base.xml") returned -1 [0066.730] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\*.*") returned="*.*" [0066.730] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\", lpString2="base.xml" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml" [0066.730] FindNextFileA (in: hFindFile=0x5bb260, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0066.730] PeekMessageA (in: lpMsg=0xaef84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaef84) returned 0 [0066.730] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="baseAltGr_rtl.xml") returned 1 [0066.730] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="baseAltGr_rtl.xml") returned 1 [0066.731] lstrcmpiA (lpString1="", lpString2="baseAltGr_rtl.xml") returned -1 [0066.731] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml") returned="base.xml" [0066.731] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\", lpString2="baseAltGr_rtl.xml" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml" [0066.731] FindNextFileA (in: hFindFile=0x5bb260, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0066.731] PeekMessageA (in: lpMsg=0xaef84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaef84) returned 0 [0066.731] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="base_altgr.xml") returned 1 [0066.731] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="base_altgr.xml") returned 1 [0066.731] lstrcmpiA (lpString1="", lpString2="base_altgr.xml") returned -1 [0066.731] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml") returned="baseAltGr_rtl.xml" [0066.731] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\", lpString2="base_altgr.xml" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml" [0066.731] FindNextFileA (in: hFindFile=0x5bb260, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0066.731] PeekMessageA (in: lpMsg=0xaef84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaef84) returned 0 [0066.731] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="base_ca.xml") returned 1 [0066.731] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="base_ca.xml") returned 1 [0066.731] lstrcmpiA (lpString1="", lpString2="base_ca.xml") returned -1 [0066.731] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml") returned="base_altgr.xml" [0066.731] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\", lpString2="base_ca.xml" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml" [0066.731] FindNextFileA (in: hFindFile=0x5bb260, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0066.731] PeekMessageA (in: lpMsg=0xaef84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaef84) returned 0 [0066.731] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="base_heb.xml") returned 1 [0066.731] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="base_heb.xml") returned 1 [0066.731] lstrcmpiA (lpString1="", lpString2="base_heb.xml") returned -1 [0066.731] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned="base_ca.xml" [0066.731] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\", lpString2="base_heb.xml" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml" [0066.731] FindNextFileA (in: hFindFile=0x5bb260, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0066.731] PeekMessageA (in: lpMsg=0xaef84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaef84) returned 0 [0066.731] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="base_jpn.xml") returned 1 [0066.731] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="base_jpn.xml") returned 1 [0066.731] lstrcmpiA (lpString1="", lpString2="base_jpn.xml") returned -1 [0066.732] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned="base_heb.xml" [0066.732] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\", lpString2="base_jpn.xml" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml" [0066.732] FindNextFileA (in: hFindFile=0x5bb260, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0066.732] PeekMessageA (in: lpMsg=0xaef84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaef84) returned 0 [0066.732] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="base_kor.xml") returned 1 [0066.732] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="base_kor.xml") returned 1 [0066.732] lstrcmpiA (lpString1="", lpString2="base_kor.xml") returned -1 [0066.732] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned="base_jpn.xml" [0066.732] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\", lpString2="base_kor.xml" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml" [0066.732] FindNextFileA (in: hFindFile=0x5bb260, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0066.732] PeekMessageA (in: lpMsg=0xaef84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaef84) returned 0 [0066.732] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="base_rtl.xml") returned 1 [0066.732] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="base_rtl.xml") returned 1 [0066.732] lstrcmpiA (lpString1="", lpString2="base_rtl.xml") returned -1 [0066.732] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml") returned="base_kor.xml" [0066.732] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\", lpString2="base_rtl.xml" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml" [0066.732] FindNextFileA (in: hFindFile=0x5bb260, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0066.732] PeekMessageA (in: lpMsg=0xaef84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaef84) returned 0 [0066.732] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="ja-jp.xml") returned -1 [0066.732] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ja-jp.xml") returned -1 [0066.732] lstrcmpiA (lpString1="", lpString2="ja-jp.xml") returned -1 [0066.732] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned="base_rtl.xml" [0066.732] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\", lpString2="ja-jp.xml" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml" [0066.732] FindNextFileA (in: hFindFile=0x5bb260, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0066.732] PeekMessageA (in: lpMsg=0xaef84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaef84) returned 0 [0066.732] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="ko-kr.xml") returned -1 [0066.732] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ko-kr.xml") returned -1 [0066.732] lstrcmpiA (lpString1="", lpString2="ko-kr.xml") returned -1 [0066.732] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml") returned="ja-jp.xml" [0066.733] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\", lpString2="ko-kr.xml" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ko-kr.xml") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ko-kr.xml" [0066.733] FindNextFileA (in: hFindFile=0x5bb260, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0066.733] PeekMessageA (in: lpMsg=0xaef84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaef84) returned 0 [0066.733] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="zh-changjei.xml") returned -1 [0066.733] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="zh-changjei.xml") returned -1 [0066.733] lstrcmpiA (lpString1="", lpString2="zh-changjei.xml") returned -1 [0066.733] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ko-kr.xml") returned="ko-kr.xml" [0066.733] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\", lpString2="zh-changjei.xml" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-changjei.xml") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-changjei.xml" [0066.733] FindNextFileA (in: hFindFile=0x5bb260, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0066.733] PeekMessageA (in: lpMsg=0xaef84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaef84) returned 0 [0066.733] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="zh-dayi.xml") returned -1 [0066.733] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="zh-dayi.xml") returned -1 [0066.733] lstrcmpiA (lpString1="", lpString2="zh-dayi.xml") returned -1 [0066.733] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-changjei.xml") returned="zh-changjei.xml" [0066.733] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\", lpString2="zh-dayi.xml" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-dayi.xml") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-dayi.xml" [0066.733] FindNextFileA (in: hFindFile=0x5bb260, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0066.733] PeekMessageA (in: lpMsg=0xaef84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaef84) returned 0 [0066.733] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="zh-phonetic.xml") returned -1 [0066.733] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="zh-phonetic.xml") returned -1 [0066.733] lstrcmpiA (lpString1="", lpString2="zh-phonetic.xml") returned -1 [0066.733] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-dayi.xml") returned="zh-dayi.xml" [0066.733] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\", lpString2="zh-phonetic.xml" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml" [0066.733] FindNextFileA (in: hFindFile=0x5bb260, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0 [0066.733] FindClose (in: hFindFile=0x5bb260 | out: hFindFile=0x5bb260) returned 1 [0066.734] FindNextFileA (in: hFindFile=0x5b7be0, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0066.734] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0066.734] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="main.xml") returned -1 [0066.734] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="main.xml") returned -1 [0066.734] lstrcmpiA (lpString1="", lpString2="main.xml") returned -1 [0066.734] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\*.*") returned="*.*" [0066.734] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\", lpString2="main.xml" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main.xml") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main.xml" [0066.734] FindNextFileA (in: hFindFile=0x5b7be0, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0066.735] lstrcmpA (lpString1=".", lpString2="numbers") returned -1 [0066.735] lstrcmpA (lpString1="..", lpString2="numbers") returned -1 [0066.735] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main.xml") returned="main.xml" [0066.735] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\", lpString2="numbers" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers" [0066.735] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5bb268 [0066.735] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0066.735] FindNextFileA (in: hFindFile=0x5bb268, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0066.735] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0066.735] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0066.735] FindNextFileA (in: hFindFile=0x5bb268, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0066.735] PeekMessageA (in: lpMsg=0xaef84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaef84) returned 0 [0066.735] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="numbase.xml") returned -1 [0066.735] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="numbase.xml") returned -1 [0066.735] lstrcmpiA (lpString1="", lpString2="numbase.xml") returned -1 [0066.735] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\*.*") returned="*.*" [0066.735] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\", lpString2="numbase.xml" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\numbase.xml") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\numbase.xml" [0066.735] FindNextFileA (in: hFindFile=0x5bb268, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0 [0066.735] FindClose (in: hFindFile=0x5bb268 | out: hFindFile=0x5bb268) returned 1 [0066.736] FindNextFileA (in: hFindFile=0x5b7be0, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0066.736] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0066.736] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="numbers.xml") returned -1 [0066.736] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="numbers.xml") returned -1 [0066.736] lstrcmpiA (lpString1="", lpString2="numbers.xml") returned -1 [0066.736] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\*.*") returned="*.*" [0066.736] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\", lpString2="numbers.xml" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers.xml") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers.xml" [0066.736] FindNextFileA (in: hFindFile=0x5b7be0, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0066.736] lstrcmpA (lpString1=".", lpString2="oskmenu") returned -1 [0066.736] lstrcmpA (lpString1="..", lpString2="oskmenu") returned -1 [0066.736] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers.xml") returned="numbers.xml" [0066.736] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\", lpString2="oskmenu" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu" [0066.736] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5bb268 [0066.737] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0066.737] FindNextFileA (in: hFindFile=0x5bb268, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0066.737] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0066.737] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0066.737] FindNextFileA (in: hFindFile=0x5bb268, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0066.737] PeekMessageA (in: lpMsg=0xaef84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaef84) returned 0 [0066.737] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="oskmenubase.xml") returned -1 [0066.737] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="oskmenubase.xml") returned -1 [0066.737] lstrcmpiA (lpString1="", lpString2="oskmenubase.xml") returned -1 [0066.737] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\*.*") returned="*.*" [0066.737] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\", lpString2="oskmenubase.xml" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml" [0066.737] FindNextFileA (in: hFindFile=0x5bb268, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0 [0066.737] FindClose (in: hFindFile=0x5bb268 | out: hFindFile=0x5bb268) returned 1 [0066.737] FindNextFileA (in: hFindFile=0x5b7be0, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0066.737] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0066.737] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="oskmenu.xml") returned -1 [0066.737] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="oskmenu.xml") returned -1 [0066.737] lstrcmpiA (lpString1="", lpString2="oskmenu.xml") returned -1 [0066.737] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\*.*") returned="*.*" [0066.738] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\", lpString2="oskmenu.xml" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu.xml") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu.xml" [0066.738] FindNextFileA (in: hFindFile=0x5b7be0, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0066.738] lstrcmpA (lpString1=".", lpString2="osknumpad") returned -1 [0066.738] lstrcmpA (lpString1="..", lpString2="osknumpad") returned -1 [0066.738] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu.xml") returned="oskmenu.xml" [0066.738] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\", lpString2="osknumpad" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad" [0066.738] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5bb268 [0066.738] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0066.738] FindNextFileA (in: hFindFile=0x5bb268, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0066.738] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0066.738] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0066.738] FindNextFileA (in: hFindFile=0x5bb268, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0066.738] PeekMessageA (in: lpMsg=0xaef84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaef84) returned 0 [0066.738] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="osknumpadbase.xml") returned -1 [0066.738] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="osknumpadbase.xml") returned -1 [0066.738] lstrcmpiA (lpString1="", lpString2="osknumpadbase.xml") returned -1 [0066.738] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\*.*") returned="*.*" [0066.738] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\", lpString2="osknumpadbase.xml" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml" [0066.738] FindNextFileA (in: hFindFile=0x5bb268, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0 [0066.738] FindClose (in: hFindFile=0x5bb268 | out: hFindFile=0x5bb268) returned 1 [0066.739] FindNextFileA (in: hFindFile=0x5b7be0, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0066.739] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0066.739] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="osknumpad.xml") returned -1 [0066.739] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="osknumpad.xml") returned -1 [0066.739] lstrcmpiA (lpString1="", lpString2="osknumpad.xml") returned -1 [0066.739] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\*.*") returned="*.*" [0066.739] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\", lpString2="osknumpad.xml" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad.xml") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad.xml" [0066.739] FindNextFileA (in: hFindFile=0x5b7be0, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0066.739] lstrcmpA (lpString1=".", lpString2="oskpred") returned -1 [0066.739] lstrcmpA (lpString1="..", lpString2="oskpred") returned -1 [0066.739] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad.xml") returned="osknumpad.xml" [0066.739] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\", lpString2="oskpred" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred" [0066.739] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5bb268 [0066.739] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0066.739] FindNextFileA (in: hFindFile=0x5bb268, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0066.739] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0066.739] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0066.739] FindNextFileA (in: hFindFile=0x5bb268, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0066.739] PeekMessageA (in: lpMsg=0xaef84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaef84) returned 0 [0066.739] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="oskpredbase.xml") returned -1 [0066.739] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="oskpredbase.xml") returned -1 [0066.739] lstrcmpiA (lpString1="", lpString2="oskpredbase.xml") returned -1 [0066.739] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\*.*") returned="*.*" [0066.739] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\", lpString2="oskpredbase.xml" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml" [0066.740] FindNextFileA (in: hFindFile=0x5bb268, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0 [0066.740] FindClose (in: hFindFile=0x5bb268 | out: hFindFile=0x5bb268) returned 1 [0066.740] FindNextFileA (in: hFindFile=0x5b7be0, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0066.740] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0066.740] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="oskpred.xml") returned -1 [0066.740] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="oskpred.xml") returned -1 [0066.740] lstrcmpiA (lpString1="", lpString2="oskpred.xml") returned -1 [0066.740] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\*.*") returned="*.*" [0066.740] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\", lpString2="oskpred.xml" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred.xml") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred.xml" [0066.740] FindNextFileA (in: hFindFile=0x5b7be0, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0066.740] lstrcmpA (lpString1=".", lpString2="symbols") returned -1 [0066.740] lstrcmpA (lpString1="..", lpString2="symbols") returned -1 [0066.740] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred.xml") returned="oskpred.xml" [0066.740] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\", lpString2="symbols" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols" [0066.740] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5bb268 [0066.740] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0066.740] FindNextFileA (in: hFindFile=0x5bb268, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0066.740] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0066.741] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0066.741] FindNextFileA (in: hFindFile=0x5bb268, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0066.741] PeekMessageA (in: lpMsg=0xaef84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaef84) returned 0 [0066.741] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="ea-sym.xml") returned -1 [0066.741] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ea-sym.xml") returned 1 [0066.741] lstrcmpiA (lpString1="", lpString2="ea-sym.xml") returned -1 [0066.741] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\*.*") returned="*.*" [0066.741] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\", lpString2="ea-sym.xml" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml" [0066.741] FindNextFileA (in: hFindFile=0x5bb268, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0066.741] PeekMessageA (in: lpMsg=0xaef84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaef84) returned 0 [0066.741] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="ja-jp-sym.xml") returned -1 [0066.741] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ja-jp-sym.xml") returned -1 [0066.741] lstrcmpiA (lpString1="", lpString2="ja-jp-sym.xml") returned -1 [0066.741] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml") returned="ea-sym.xml" [0066.741] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\", lpString2="ja-jp-sym.xml" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml" [0066.741] FindNextFileA (in: hFindFile=0x5bb268, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0066.741] PeekMessageA (in: lpMsg=0xaef84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaef84) returned 0 [0066.741] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="symbase.xml") returned -1 [0066.741] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="symbase.xml") returned -1 [0066.741] lstrcmpiA (lpString1="", lpString2="symbase.xml") returned -1 [0066.741] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml") returned="ja-jp-sym.xml" [0066.741] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\", lpString2="symbase.xml" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\symbase.xml") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\symbase.xml" [0066.741] FindNextFileA (in: hFindFile=0x5bb268, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0 [0066.741] FindClose (in: hFindFile=0x5bb268 | out: hFindFile=0x5bb268) returned 1 [0066.741] FindNextFileA (in: hFindFile=0x5b7be0, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0066.741] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0066.741] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="symbols.xml") returned -1 [0066.742] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="symbols.xml") returned -1 [0066.742] lstrcmpiA (lpString1="", lpString2="symbols.xml") returned -1 [0066.742] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\*.*") returned="*.*" [0066.742] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\", lpString2="symbols.xml" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols.xml") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols.xml" [0066.742] FindNextFileA (in: hFindFile=0x5b7be0, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0066.742] lstrcmpA (lpString1=".", lpString2="web") returned -1 [0066.742] lstrcmpA (lpString1="..", lpString2="web") returned -1 [0066.742] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols.xml") returned="symbols.xml" [0066.742] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\", lpString2="web" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web" [0066.742] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5bb260 [0066.743] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0066.743] FindNextFileA (in: hFindFile=0x5bb260, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0066.743] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0066.743] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0066.743] FindNextFileA (in: hFindFile=0x5bb260, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0066.743] PeekMessageA (in: lpMsg=0xaef84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaef84) returned 0 [0066.743] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="webbase.xml") returned -1 [0066.743] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="webbase.xml") returned -1 [0066.743] lstrcmpiA (lpString1="", lpString2="webbase.xml") returned -1 [0066.743] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\*.*") returned="*.*" [0066.743] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\", lpString2="webbase.xml" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\webbase.xml") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\webbase.xml" [0066.743] FindNextFileA (in: hFindFile=0x5bb260, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0 [0066.743] FindClose (in: hFindFile=0x5bb260 | out: hFindFile=0x5bb260) returned 1 [0066.743] FindNextFileA (in: hFindFile=0x5b7be0, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0066.743] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0066.743] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="web.xml") returned -1 [0066.743] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="web.xml") returned -1 [0066.743] lstrcmpiA (lpString1="", lpString2="web.xml") returned -1 [0066.743] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\*.*") returned="*.*" [0066.743] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\", lpString2="web.xml" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web.xml") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web.xml" [0066.743] FindNextFileA (in: hFindFile=0x5b7be0, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0 [0066.744] FindClose (in: hFindFile=0x5b7be0 | out: hFindFile=0x5b7be0) returned 1 [0066.744] FindNextFileA (in: hFindFile=0x5b7c58, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0066.744] lstrcmpA (lpString1=".", lpString2="he-IL") returned -1 [0066.744] lstrcmpA (lpString1="..", lpString2="he-IL") returned -1 [0066.744] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*") returned="*.*" [0066.744] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="he-IL" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\he-IL") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\he-IL" [0066.744] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\he-IL\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5b7be0 [0066.744] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0066.744] FindNextFileA (in: hFindFile=0x5b7be0, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0066.744] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0066.744] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0066.744] FindNextFileA (in: hFindFile=0x5b7be0, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0066.744] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0066.745] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="tipresx.dll.mui") returned -1 [0066.745] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="tipresx.dll.mui") returned -1 [0066.745] lstrcmpiA (lpString1="", lpString2="tipresx.dll.mui") returned -1 [0066.745] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\he-IL\\*.*") returned="*.*" [0066.745] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\he-IL\\", lpString2="tipresx.dll.mui" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\he-IL\\tipresx.dll.mui") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\he-IL\\tipresx.dll.mui" [0066.745] FindNextFileA (in: hFindFile=0x5b7be0, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0 [0066.745] FindClose (in: hFindFile=0x5b7be0 | out: hFindFile=0x5b7be0) returned 1 [0066.745] FindNextFileA (in: hFindFile=0x5b7c58, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0066.745] lstrcmpA (lpString1=".", lpString2="hr-HR") returned -1 [0066.745] lstrcmpA (lpString1="..", lpString2="hr-HR") returned -1 [0066.745] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*") returned="*.*" [0066.745] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="hr-HR" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hr-HR") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hr-HR" [0066.745] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hr-HR\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5b7be0 [0066.745] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0066.745] FindNextFileA (in: hFindFile=0x5b7be0, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0066.745] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0066.745] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0066.746] FindNextFileA (in: hFindFile=0x5b7be0, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0066.746] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0066.746] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="tipresx.dll.mui") returned -1 [0066.746] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="tipresx.dll.mui") returned -1 [0066.746] lstrcmpiA (lpString1="", lpString2="tipresx.dll.mui") returned -1 [0066.746] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hr-HR\\*.*") returned="*.*" [0066.746] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hr-HR\\", lpString2="tipresx.dll.mui" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hr-HR\\tipresx.dll.mui") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hr-HR\\tipresx.dll.mui" [0066.746] FindNextFileA (in: hFindFile=0x5b7be0, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0 [0066.746] FindClose (in: hFindFile=0x5b7be0 | out: hFindFile=0x5b7be0) returned 1 [0066.746] FindNextFileA (in: hFindFile=0x5b7c58, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0066.746] lstrcmpA (lpString1=".", lpString2="hu-HU") returned -1 [0066.746] lstrcmpA (lpString1="..", lpString2="hu-HU") returned -1 [0066.746] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*") returned="*.*" [0066.746] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="hu-HU" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hu-HU") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hu-HU" [0066.746] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hu-HU\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5b7be0 [0066.746] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0066.746] FindNextFileA (in: hFindFile=0x5b7be0, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0066.747] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0066.747] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0066.747] FindNextFileA (in: hFindFile=0x5b7be0, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0066.747] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0066.747] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hu-HU\\*.*") returned="*.*" [0066.747] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hu-HU\\", lpString2="tipresx.dll.mui" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hu-HU\\tipresx.dll.mui") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hu-HU\\tipresx.dll.mui" [0066.747] FindNextFileA (in: hFindFile=0x5b7be0, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0 [0066.747] FindClose (in: hFindFile=0x5b7be0 | out: hFindFile=0x5b7be0) returned 1 [0066.747] FindNextFileA (in: hFindFile=0x5b7c58, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0066.747] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0066.747] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*") returned="*.*" [0066.747] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="hwrcommonlm.dat" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrcommonlm.dat") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrcommonlm.dat" [0066.747] FindNextFileA (in: hFindFile=0x5b7c58, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0066.747] lstrcmpA (lpString1=".", lpString2="HWRCustomization") returned -1 [0066.747] lstrcmpA (lpString1="..", lpString2="HWRCustomization") returned -1 [0066.747] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrcommonlm.dat") returned="hwrcommonlm.dat" [0066.747] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="HWRCustomization" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HWRCustomization") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HWRCustomization" [0066.747] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HWRCustomization\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5b7be0 [0066.748] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0066.748] FindNextFileA (in: hFindFile=0x5b7be0, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0066.748] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0066.748] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0066.748] FindNextFileA (in: hFindFile=0x5b7be0, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0 [0066.749] FindClose (in: hFindFile=0x5b7be0 | out: hFindFile=0x5b7be0) returned 1 [0066.749] FindNextFileA (in: hFindFile=0x5b7c58, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0066.749] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0066.749] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*") returned="*.*" [0066.749] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="hwrenalm.dat" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenalm.dat") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenalm.dat" [0066.749] FindNextFileA (in: hFindFile=0x5b7c58, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0066.749] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0066.749] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenalm.dat") returned="hwrenalm.dat" [0066.749] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="hwrenclm.dat" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat" [0066.749] FindNextFileA (in: hFindFile=0x5b7c58, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0066.749] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0066.749] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat") returned="hwrenclm.dat" [0066.749] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="hwrlatinlm.dat" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat" [0066.749] FindNextFileA (in: hFindFile=0x5b7c58, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0066.749] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0066.749] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat") returned="hwrlatinlm.dat" [0066.749] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="hwruklm.dat" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat" [0066.749] FindNextFileA (in: hFindFile=0x5b7c58, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0066.749] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0066.749] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat") returned="hwruklm.dat" [0066.749] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="hwruksh.dat" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat" [0066.749] FindNextFileA (in: hFindFile=0x5b7c58, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0066.750] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0066.750] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat") returned="hwruksh.dat" [0066.750] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="hwrusalm.dat" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat" [0066.750] FindNextFileA (in: hFindFile=0x5b7c58, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0066.750] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0066.750] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat") returned="hwrusalm.dat" [0066.750] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="hwrusash.dat" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat" [0066.750] FindNextFileA (in: hFindFile=0x5b7c58, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0066.750] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0066.750] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat") returned="hwrusash.dat" [0066.750] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="InkDiv.dll" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkDiv.dll") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkDiv.dll" [0066.750] FindNextFileA (in: hFindFile=0x5b7c58, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0066.750] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0066.750] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkDiv.dll") returned="InkDiv.dll" [0066.750] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="InkObj.dll" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkObj.dll") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkObj.dll" [0066.750] FindNextFileA (in: hFindFile=0x5b7c58, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0066.750] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0066.750] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkObj.dll") returned="InkObj.dll" [0066.750] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="InkWatson.exe" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkWatson.exe") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkWatson.exe" [0066.750] FindNextFileA (in: hFindFile=0x5b7c58, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0066.750] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0066.750] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkWatson.exe") returned="InkWatson.exe" [0066.750] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="InputPersonalization.exe" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InputPersonalization.exe") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InputPersonalization.exe" [0066.751] FindNextFileA (in: hFindFile=0x5b7c58, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0066.751] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0066.751] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InputPersonalization.exe") returned="InputPersonalization.exe" [0066.751] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="ipscat.xml" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml" [0066.751] FindNextFileA (in: hFindFile=0x5b7c58, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0066.751] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0066.751] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml") returned="ipscat.xml" [0066.751] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="ipschs.xml" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipschs.xml") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipschs.xml" [0066.751] FindNextFileA (in: hFindFile=0x5b7c58, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0066.751] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0066.751] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipschs.xml") returned="ipschs.xml" [0066.751] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="ipscht.xml" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscht.xml") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscht.xml" [0066.751] FindNextFileA (in: hFindFile=0x5b7c58, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0066.751] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0066.751] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscht.xml") returned="ipscht.xml" [0066.751] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="ipscsy.xml" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscsy.xml") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscsy.xml" [0066.751] FindNextFileA (in: hFindFile=0x5b7c58, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0066.751] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0066.751] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscsy.xml") returned="ipscsy.xml" [0066.751] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="ipsdan.xml" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdan.xml") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdan.xml" [0066.752] FindNextFileA (in: hFindFile=0x5b7c58, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0066.752] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0066.752] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdan.xml") returned="ipsdan.xml" [0066.752] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="ipsdeu.xml" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdeu.xml") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdeu.xml" [0066.752] FindNextFileA (in: hFindFile=0x5b7c58, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0066.752] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0066.752] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdeu.xml") returned="ipsdeu.xml" [0066.752] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="ipsen.xml" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsen.xml") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsen.xml" [0066.752] FindNextFileA (in: hFindFile=0x5b7c58, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0066.752] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0066.752] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsen.xml") returned="ipsen.xml" [0066.752] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="ipsesp.xml" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsesp.xml") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsesp.xml" [0066.752] FindNextFileA (in: hFindFile=0x5b7c58, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0066.752] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0066.752] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsesp.xml") returned="ipsesp.xml" [0066.752] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="IPSEventLogMsg.dll" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IPSEventLogMsg.dll") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IPSEventLogMsg.dll" [0066.752] FindNextFileA (in: hFindFile=0x5b7c58, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0066.752] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0066.752] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IPSEventLogMsg.dll") returned="IPSEventLogMsg.dll" [0066.752] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="ipsfin.xml" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfin.xml") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfin.xml" [0066.752] FindNextFileA (in: hFindFile=0x5b7c58, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0066.752] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0066.752] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfin.xml") returned="ipsfin.xml" [0066.752] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="ipsfra.xml" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfra.xml") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfra.xml" [0066.753] FindNextFileA (in: hFindFile=0x5b7c58, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0066.753] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0066.753] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfra.xml") returned="ipsfra.xml" [0066.753] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="ipshrv.xml" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml" [0066.753] FindNextFileA (in: hFindFile=0x5b7c58, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0066.753] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0066.753] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml") returned="ipshrv.xml" [0066.753] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="ipsita.xml" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml" [0066.753] FindNextFileA (in: hFindFile=0x5b7c58, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0066.753] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0066.753] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml") returned="ipsita.xml" [0066.753] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="ipsjpn.xml" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml" [0066.753] FindNextFileA (in: hFindFile=0x5b7c58, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0066.753] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0066.753] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml") returned="ipsjpn.xml" [0066.753] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="ipskor.xml" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml" [0066.753] FindNextFileA (in: hFindFile=0x5b7c58, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0066.753] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0066.754] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml") returned="ipskor.xml" [0066.754] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="IpsMigrationPlugin.dll" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IpsMigrationPlugin.dll") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IpsMigrationPlugin.dll" [0066.754] FindNextFileA (in: hFindFile=0x5b7c58, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0066.754] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0066.754] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IpsMigrationPlugin.dll") returned="IpsMigrationPlugin.dll" [0066.754] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="ipsnld.xml" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnld.xml") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnld.xml" [0066.754] FindNextFileA (in: hFindFile=0x5b7c58, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0066.754] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0066.754] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnld.xml") returned="ipsnld.xml" [0066.754] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="ipsnor.xml" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnor.xml") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnor.xml" [0066.754] FindNextFileA (in: hFindFile=0x5b7c58, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0066.754] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0066.754] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnor.xml") returned="ipsnor.xml" [0066.754] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="ipsplk.xml" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsplk.xml") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsplk.xml" [0066.754] FindNextFileA (in: hFindFile=0x5b7c58, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0066.754] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0066.754] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsplk.xml") returned="ipsplk.xml" [0066.754] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="IpsPlugin.dll" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IpsPlugin.dll") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IpsPlugin.dll" [0066.754] FindNextFileA (in: hFindFile=0x5b7c58, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0066.754] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0066.754] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IpsPlugin.dll") returned="IpsPlugin.dll" [0066.754] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="ipsptb.xml" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptb.xml") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptb.xml" [0066.755] FindNextFileA (in: hFindFile=0x5b7c58, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0066.755] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0066.769] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptb.xml") returned="ipsptb.xml" [0066.769] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="ipsptg.xml" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptg.xml") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptg.xml" [0066.769] FindNextFileA (in: hFindFile=0x5b7c58, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0066.769] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0066.769] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptg.xml") returned="ipsptg.xml" [0066.769] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="ipsrom.xml" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrom.xml") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrom.xml" [0066.769] FindNextFileA (in: hFindFile=0x5b7c58, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0066.769] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0066.769] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrom.xml") returned="ipsrom.xml" [0066.769] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="ipsrus.xml" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrus.xml") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrus.xml" [0066.769] FindNextFileA (in: hFindFile=0x5b7c58, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0066.769] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0066.770] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrus.xml") returned="ipsrus.xml" [0066.770] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="ipssrb.xml" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrb.xml") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrb.xml" [0066.770] FindNextFileA (in: hFindFile=0x5b7c58, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0066.770] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0066.770] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrb.xml") returned="ipssrb.xml" [0066.770] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="ipssrl.xml" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrl.xml") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrl.xml" [0066.770] FindNextFileA (in: hFindFile=0x5b7c58, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0066.770] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0066.770] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrl.xml") returned="ipssrl.xml" [0066.770] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="ipssve.xml" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssve.xml") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssve.xml" [0066.770] FindNextFileA (in: hFindFile=0x5b7c58, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0066.770] lstrcmpA (lpString1=".", lpString2="it-IT") returned -1 [0066.770] lstrcmpA (lpString1="..", lpString2="it-IT") returned -1 [0066.770] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssve.xml") returned="ipssve.xml" [0066.770] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="it-IT" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT" [0066.770] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5b7be0 [0066.771] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0066.771] FindNextFileA (in: hFindFile=0x5b7be0, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0066.771] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0066.771] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0066.771] FindNextFileA (in: hFindFile=0x5b7be0, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0066.771] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0066.771] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT\\*.*") returned="*.*" [0066.771] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT\\", lpString2="tipresx.dll.mui" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT\\tipresx.dll.mui") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT\\tipresx.dll.mui" [0066.771] FindNextFileA (in: hFindFile=0x5b7be0, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0 [0066.771] FindClose (in: hFindFile=0x5b7be0 | out: hFindFile=0x5b7be0) returned 1 [0066.771] FindNextFileA (in: hFindFile=0x5b7c58, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0066.771] lstrcmpA (lpString1=".", lpString2="ja-JP") returned -1 [0066.771] lstrcmpA (lpString1="..", lpString2="ja-JP") returned -1 [0066.771] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*") returned="*.*" [0066.771] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="ja-JP" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ja-JP") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ja-JP" [0066.771] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ja-JP\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5b7be0 [0066.772] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0066.772] FindNextFileA (in: hFindFile=0x5b7be0, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0066.772] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0066.772] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0066.772] FindNextFileA (in: hFindFile=0x5b7be0, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0066.772] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0066.772] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ja-JP\\*.*") returned="*.*" [0066.772] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ja-JP\\", lpString2="tipresx.dll.mui" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ja-JP\\tipresx.dll.mui") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ja-JP\\tipresx.dll.mui" [0066.772] FindNextFileA (in: hFindFile=0x5b7be0, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0 [0066.772] FindClose (in: hFindFile=0x5b7be0 | out: hFindFile=0x5b7be0) returned 1 [0066.772] FindNextFileA (in: hFindFile=0x5b7c58, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0066.772] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0066.772] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*") returned="*.*" [0066.772] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="journal.dll" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\journal.dll") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\journal.dll" [0066.772] FindNextFileA (in: hFindFile=0x5b7c58, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0066.772] lstrcmpA (lpString1=".", lpString2="ko-KR") returned -1 [0066.772] lstrcmpA (lpString1="..", lpString2="ko-KR") returned -1 [0066.772] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\journal.dll") returned="journal.dll" [0066.772] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="ko-KR" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ko-KR") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ko-KR" [0066.772] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ko-KR\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5b7be0 [0066.773] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0066.773] FindNextFileA (in: hFindFile=0x5b7be0, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0066.773] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0066.773] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0066.773] FindNextFileA (in: hFindFile=0x5b7be0, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0066.773] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0066.773] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ko-KR\\*.*") returned="*.*" [0066.773] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ko-KR\\", lpString2="tipresx.dll.mui" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ko-KR\\tipresx.dll.mui") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ko-KR\\tipresx.dll.mui" [0066.773] FindNextFileA (in: hFindFile=0x5b7be0, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0 [0066.773] FindClose (in: hFindFile=0x5b7be0 | out: hFindFile=0x5b7be0) returned 1 [0066.773] FindNextFileA (in: hFindFile=0x5b7c58, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0066.773] lstrcmpA (lpString1=".", lpString2="lt-LT") returned -1 [0066.773] lstrcmpA (lpString1="..", lpString2="lt-LT") returned -1 [0066.773] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*") returned="*.*" [0066.773] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="lt-LT" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lt-LT") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lt-LT" [0066.773] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lt-LT\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5b7be0 [0066.774] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0066.774] FindNextFileA (in: hFindFile=0x5b7be0, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0066.774] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0066.774] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0066.774] FindNextFileA (in: hFindFile=0x5b7be0, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0066.774] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0066.775] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lt-LT\\*.*") returned="*.*" [0066.775] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lt-LT\\", lpString2="tipresx.dll.mui" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lt-LT\\tipresx.dll.mui") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lt-LT\\tipresx.dll.mui" [0066.775] FindNextFileA (in: hFindFile=0x5b7be0, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0 [0066.775] FindClose (in: hFindFile=0x5b7be0 | out: hFindFile=0x5b7be0) returned 1 [0066.775] FindNextFileA (in: hFindFile=0x5b7c58, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0066.775] lstrcmpA (lpString1=".", lpString2="lv-LV") returned -1 [0066.775] lstrcmpA (lpString1="..", lpString2="lv-LV") returned -1 [0066.775] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*") returned="*.*" [0066.775] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="lv-LV" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV" [0066.775] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5b7be0 [0066.775] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0066.775] FindNextFileA (in: hFindFile=0x5b7be0, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0066.775] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0066.775] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0066.776] FindNextFileA (in: hFindFile=0x5b7be0, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0066.776] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0066.776] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV\\*.*") returned="*.*" [0066.776] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV\\", lpString2="tipresx.dll.mui" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV\\tipresx.dll.mui") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV\\tipresx.dll.mui" [0066.776] FindNextFileA (in: hFindFile=0x5b7be0, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0 [0066.776] FindClose (in: hFindFile=0x5b7be0 | out: hFindFile=0x5b7be0) returned 1 [0066.776] FindNextFileA (in: hFindFile=0x5b7c58, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0066.776] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0066.776] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*") returned="*.*" [0066.776] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="micaut.dll" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\micaut.dll") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\micaut.dll" [0066.776] FindNextFileA (in: hFindFile=0x5b7c58, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0066.776] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0066.776] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\micaut.dll") returned="micaut.dll" [0066.776] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="Microsoft.Ink.dll" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Microsoft.Ink.dll") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Microsoft.Ink.dll" [0066.776] FindNextFileA (in: hFindFile=0x5b7c58, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0066.776] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0066.776] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Microsoft.Ink.dll") returned="Microsoft.Ink.dll" [0066.776] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="mip.exe" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mip.exe") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mip.exe" [0066.776] FindNextFileA (in: hFindFile=0x5b7c58, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0066.776] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0066.777] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mip.exe") returned="mip.exe" [0066.777] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="mraut.dll" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mraut.dll") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mraut.dll" [0066.777] FindNextFileA (in: hFindFile=0x5b7c58, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0066.777] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0066.777] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mraut.dll") returned="mraut.dll" [0066.777] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="mshwgst.dll" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mshwgst.dll") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mshwgst.dll" [0066.777] FindNextFileA (in: hFindFile=0x5b7c58, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0066.777] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0066.777] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mshwgst.dll") returned="mshwgst.dll" [0066.777] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="mshwLatin.dll" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mshwLatin.dll") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mshwLatin.dll" [0066.777] FindNextFileA (in: hFindFile=0x5b7c58, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0066.777] lstrcmpA (lpString1=".", lpString2="nb-NO") returned -1 [0066.777] lstrcmpA (lpString1="..", lpString2="nb-NO") returned -1 [0066.777] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mshwLatin.dll") returned="mshwLatin.dll" [0066.777] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="nb-NO" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nb-NO") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nb-NO" [0066.777] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nb-NO\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5b7be0 [0066.778] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0066.778] FindNextFileA (in: hFindFile=0x5b7be0, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0066.778] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0066.778] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0066.778] FindNextFileA (in: hFindFile=0x5b7be0, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0066.778] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0066.778] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nb-NO\\*.*") returned="*.*" [0066.778] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nb-NO\\", lpString2="tipresx.dll.mui" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nb-NO\\tipresx.dll.mui") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nb-NO\\tipresx.dll.mui" [0066.778] FindNextFileA (in: hFindFile=0x5b7be0, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0 [0066.778] FindClose (in: hFindFile=0x5b7be0 | out: hFindFile=0x5b7be0) returned 1 [0066.778] FindNextFileA (in: hFindFile=0x5b7c58, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0066.778] lstrcmpA (lpString1=".", lpString2="nl-NL") returned -1 [0066.778] lstrcmpA (lpString1="..", lpString2="nl-NL") returned -1 [0066.778] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*") returned="*.*" [0066.778] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="nl-NL" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nl-NL") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nl-NL" [0066.778] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nl-NL\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5b7be0 [0066.779] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0066.779] FindNextFileA (in: hFindFile=0x5b7be0, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0066.779] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0066.779] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0066.779] FindNextFileA (in: hFindFile=0x5b7be0, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0066.779] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0066.779] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nl-NL\\*.*") returned="*.*" [0066.779] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nl-NL\\", lpString2="tipresx.dll.mui" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nl-NL\\tipresx.dll.mui") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nl-NL\\tipresx.dll.mui" [0066.779] FindNextFileA (in: hFindFile=0x5b7be0, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0 [0066.779] FindClose (in: hFindFile=0x5b7be0 | out: hFindFile=0x5b7be0) returned 1 [0066.779] FindNextFileA (in: hFindFile=0x5b7c58, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0066.779] lstrcmpA (lpString1=".", lpString2="pl-PL") returned -1 [0066.779] lstrcmpA (lpString1="..", lpString2="pl-PL") returned -1 [0066.779] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*") returned="*.*" [0066.779] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="pl-PL" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pl-PL") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pl-PL" [0066.779] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pl-PL\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5b7be0 [0066.780] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0066.780] FindNextFileA (in: hFindFile=0x5b7be0, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0066.780] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0066.780] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0066.780] FindNextFileA (in: hFindFile=0x5b7be0, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0066.780] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0066.781] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pl-PL\\*.*") returned="*.*" [0066.781] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pl-PL\\", lpString2="tipresx.dll.mui" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pl-PL\\tipresx.dll.mui") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pl-PL\\tipresx.dll.mui" [0066.781] FindNextFileA (in: hFindFile=0x5b7be0, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0 [0066.781] FindClose (in: hFindFile=0x5b7be0 | out: hFindFile=0x5b7be0) returned 1 [0066.781] FindNextFileA (in: hFindFile=0x5b7c58, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0066.781] lstrcmpA (lpString1=".", lpString2="pt-BR") returned -1 [0066.781] lstrcmpA (lpString1="..", lpString2="pt-BR") returned -1 [0066.781] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*") returned="*.*" [0066.781] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="pt-BR" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR" [0066.781] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5b7be0 [0066.781] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0066.781] FindNextFileA (in: hFindFile=0x5b7be0, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0066.781] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0066.781] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0066.781] FindNextFileA (in: hFindFile=0x5b7be0, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0066.782] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0066.782] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR\\*.*") returned="*.*" [0066.782] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR\\", lpString2="tipresx.dll.mui" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR\\tipresx.dll.mui") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR\\tipresx.dll.mui" [0066.782] FindNextFileA (in: hFindFile=0x5b7be0, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0 [0066.782] FindClose (in: hFindFile=0x5b7be0 | out: hFindFile=0x5b7be0) returned 1 [0066.782] FindNextFileA (in: hFindFile=0x5b7c58, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0066.782] lstrcmpA (lpString1=".", lpString2="pt-PT") returned -1 [0066.782] lstrcmpA (lpString1="..", lpString2="pt-PT") returned -1 [0066.782] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*") returned="*.*" [0066.782] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="pt-PT" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-PT") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-PT" [0066.782] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-PT\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5b7be0 [0066.782] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0066.782] FindNextFileA (in: hFindFile=0x5b7be0, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0066.782] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0066.782] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0066.783] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0066.783] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-PT\\*.*") returned="*.*" [0066.783] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-PT\\", lpString2="tipresx.dll.mui" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-PT\\tipresx.dll.mui") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-PT\\tipresx.dll.mui" [0066.783] FindClose (in: hFindFile=0x5b7be0 | out: hFindFile=0x5b7be0) returned 1 [0066.783] lstrcmpA (lpString1=".", lpString2="ro-RO") returned -1 [0066.783] lstrcmpA (lpString1="..", lpString2="ro-RO") returned -1 [0066.783] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*") returned="*.*" [0066.783] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="ro-RO" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO" [0066.783] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5b7be0 [0066.784] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0066.784] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0066.784] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0066.784] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0066.784] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO\\*.*") returned="*.*" [0066.784] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO\\", lpString2="tipresx.dll.mui" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO\\tipresx.dll.mui") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO\\tipresx.dll.mui" [0066.784] FindClose (in: hFindFile=0x5b7be0 | out: hFindFile=0x5b7be0) returned 1 [0066.784] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0066.784] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*") returned="*.*" [0066.784] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="rtscom.dll" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\rtscom.dll") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\rtscom.dll" [0066.784] lstrcmpA (lpString1=".", lpString2="ru-RU") returned -1 [0066.784] lstrcmpA (lpString1="..", lpString2="ru-RU") returned -1 [0066.784] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\rtscom.dll") returned="rtscom.dll" [0066.784] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="ru-RU" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ru-RU") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ru-RU" [0066.784] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ru-RU\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5b7be0 [0066.785] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0066.785] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0066.786] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0066.786] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0066.786] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ru-RU\\*.*") returned="*.*" [0066.786] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ru-RU\\", lpString2="tipresx.dll.mui" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ru-RU\\tipresx.dll.mui") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ru-RU\\tipresx.dll.mui" [0066.786] FindClose (in: hFindFile=0x5b7be0 | out: hFindFile=0x5b7be0) returned 1 [0066.786] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0066.786] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*") returned="*.*" [0066.786] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="ShapeCollector.exe" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ShapeCollector.exe") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ShapeCollector.exe" [0066.786] lstrcmpA (lpString1=".", lpString2="sk-SK") returned -1 [0066.786] lstrcmpA (lpString1="..", lpString2="sk-SK") returned -1 [0066.786] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ShapeCollector.exe") returned="ShapeCollector.exe" [0066.786] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="sk-SK" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sk-SK") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sk-SK" [0066.786] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sk-SK\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5b7be0 [0066.787] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0066.787] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0066.787] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0066.787] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0066.787] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sk-SK\\*.*") returned="*.*" [0066.787] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sk-SK\\", lpString2="tipresx.dll.mui" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sk-SK\\tipresx.dll.mui") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sk-SK\\tipresx.dll.mui" [0066.787] FindClose (in: hFindFile=0x5b7be0 | out: hFindFile=0x5b7be0) returned 1 [0066.787] lstrcmpA (lpString1=".", lpString2="sl-SI") returned -1 [0066.787] lstrcmpA (lpString1="..", lpString2="sl-SI") returned -1 [0066.787] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*") returned="*.*" [0066.787] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="sl-SI" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sl-SI") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sl-SI" [0066.787] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sl-SI\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5b7be0 [0066.787] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0066.787] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0066.788] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0066.788] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0066.788] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sl-SI\\*.*") returned="*.*" [0066.788] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sl-SI\\", lpString2="tipresx.dll.mui" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sl-SI\\tipresx.dll.mui") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sl-SI\\tipresx.dll.mui" [0066.788] FindClose (in: hFindFile=0x5b7be0 | out: hFindFile=0x5b7be0) returned 1 [0066.788] lstrcmpA (lpString1=".", lpString2="sr-Latn-CS") returned -1 [0066.788] lstrcmpA (lpString1="..", lpString2="sr-Latn-CS") returned -1 [0066.788] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*") returned="*.*" [0066.788] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="sr-Latn-CS" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sr-Latn-CS") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sr-Latn-CS" [0066.788] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sr-Latn-CS\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5b7be0 [0066.788] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0066.788] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0066.788] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0066.788] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0066.789] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sr-Latn-CS\\*.*") returned="*.*" [0066.789] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sr-Latn-CS\\", lpString2="tipresx.dll.mui" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sr-Latn-CS\\tipresx.dll.mui") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sr-Latn-CS\\tipresx.dll.mui" [0066.789] FindClose (in: hFindFile=0x5b7be0 | out: hFindFile=0x5b7be0) returned 1 [0066.789] lstrcmpA (lpString1=".", lpString2="sv-SE") returned -1 [0066.789] lstrcmpA (lpString1="..", lpString2="sv-SE") returned -1 [0066.789] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*") returned="*.*" [0066.789] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="sv-SE" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sv-SE") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sv-SE" [0066.789] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sv-SE\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5b7be0 [0066.790] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0066.790] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0066.790] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0066.790] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0066.790] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sv-SE\\*.*") returned="*.*" [0066.790] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sv-SE\\", lpString2="tipresx.dll.mui" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sv-SE\\tipresx.dll.mui") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sv-SE\\tipresx.dll.mui" [0066.790] FindClose (in: hFindFile=0x5b7be0 | out: hFindFile=0x5b7be0) returned 1 [0066.790] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0066.790] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*") returned="*.*" [0066.790] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="TabIpsps.dll" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TabIpsps.dll") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TabIpsps.dll" [0066.791] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0066.791] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TabIpsps.dll") returned="TabIpsps.dll" [0066.791] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="tabskb.dll" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tabskb.dll") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tabskb.dll" [0066.791] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0066.791] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tabskb.dll") returned="tabskb.dll" [0066.791] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="TabTip.exe" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TabTip.exe") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TabTip.exe" [0066.791] lstrcmpA (lpString1=".", lpString2="th-TH") returned -1 [0066.791] lstrcmpA (lpString1="..", lpString2="th-TH") returned -1 [0066.791] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TabTip.exe") returned="TabTip.exe" [0066.791] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="th-TH" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\th-TH") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\th-TH" [0066.791] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\th-TH\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5b7be0 [0066.791] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0066.791] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0066.791] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0066.791] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0066.792] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\th-TH\\*.*") returned="*.*" [0066.792] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\th-TH\\", lpString2="tipresx.dll.mui" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\th-TH\\tipresx.dll.mui") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\th-TH\\tipresx.dll.mui" [0066.792] FindClose (in: hFindFile=0x5b7be0 | out: hFindFile=0x5b7be0) returned 1 [0066.792] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0066.792] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*") returned="*.*" [0066.792] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="TipBand.dll" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TipBand.dll") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TipBand.dll" [0066.792] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0066.792] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TipBand.dll") returned="TipBand.dll" [0066.792] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="TipRes.dll" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TipRes.dll") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TipRes.dll" [0066.792] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0066.792] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TipRes.dll") returned="TipRes.dll" [0066.792] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="tipresx.dll" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tipresx.dll") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tipresx.dll" [0066.792] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0066.792] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tipresx.dll") returned="tipresx.dll" [0066.792] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="tipskins.dll" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tipskins.dll") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tipskins.dll" [0066.792] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0066.792] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tipskins.dll") returned="tipskins.dll" [0066.792] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="tiptsf.dll" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tiptsf.dll") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tiptsf.dll" [0066.793] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0066.793] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tiptsf.dll") returned="tiptsf.dll" [0066.793] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="tpcps.dll" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tpcps.dll") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tpcps.dll" [0066.793] lstrcmpA (lpString1=".", lpString2="tr-TR") returned -1 [0066.793] lstrcmpA (lpString1="..", lpString2="tr-TR") returned -1 [0066.793] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tpcps.dll") returned="tpcps.dll" [0066.793] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="tr-TR" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tr-TR") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tr-TR" [0066.793] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tr-TR\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5b7be0 [0066.793] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0066.793] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0066.793] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0066.793] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0066.793] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tr-TR\\*.*") returned="*.*" [0066.793] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tr-TR\\", lpString2="tipresx.dll.mui" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tr-TR\\tipresx.dll.mui") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tr-TR\\tipresx.dll.mui" [0066.794] FindClose (in: hFindFile=0x5b7be0 | out: hFindFile=0x5b7be0) returned 1 [0066.794] lstrcmpA (lpString1=".", lpString2="uk-UA") returned -1 [0066.794] lstrcmpA (lpString1="..", lpString2="uk-UA") returned -1 [0066.794] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*") returned="*.*" [0066.794] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="uk-UA" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\uk-UA") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\uk-UA" [0066.794] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\uk-UA\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5b7be0 [0066.794] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0066.794] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0066.794] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0066.794] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0066.794] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\uk-UA\\*.*") returned="*.*" [0066.794] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\uk-UA\\", lpString2="tipresx.dll.mui" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\uk-UA\\tipresx.dll.mui") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\uk-UA\\tipresx.dll.mui" [0066.794] FindClose (in: hFindFile=0x5b7be0 | out: hFindFile=0x5b7be0) returned 1 [0066.795] lstrcmpA (lpString1=".", lpString2="zh-CN") returned -1 [0066.795] lstrcmpA (lpString1="..", lpString2="zh-CN") returned -1 [0066.795] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*") returned="*.*" [0066.795] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="zh-CN" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-CN") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-CN" [0066.795] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-CN\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5b7be0 [0066.796] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0066.796] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0066.796] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0066.796] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0066.796] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-CN\\*.*") returned="*.*" [0066.796] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-CN\\", lpString2="tipresx.dll.mui" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-CN\\tipresx.dll.mui") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-CN\\tipresx.dll.mui" [0066.796] FindClose (in: hFindFile=0x5b7be0 | out: hFindFile=0x5b7be0) returned 1 [0066.796] lstrcmpA (lpString1=".", lpString2="zh-TW") returned -1 [0066.796] lstrcmpA (lpString1="..", lpString2="zh-TW") returned -1 [0066.796] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*") returned="*.*" [0066.796] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpString2="zh-TW" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-TW") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-TW" [0066.796] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-TW\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5b7be0 [0066.797] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0066.797] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0066.797] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0066.797] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0066.797] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-TW\\*.*") returned="*.*" [0066.797] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-TW\\", lpString2="tipresx.dll.mui" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-TW\\tipresx.dll.mui") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-TW\\tipresx.dll.mui" [0066.797] FindClose (in: hFindFile=0x5b7be0 | out: hFindFile=0x5b7be0) returned 1 [0066.797] FindClose (in: hFindFile=0x5b7c58 | out: hFindFile=0x5b7c58) returned 1 [0066.797] lstrcmpA (lpString1=".", lpString2="MSClientDataMgr") returned -1 [0066.797] lstrcmpA (lpString1="..", lpString2="MSClientDataMgr") returned -1 [0066.797] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\*.*") returned="*.*" [0066.797] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\", lpString2="MSClientDataMgr" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr" [0066.797] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5b7c70 [0066.801] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0066.801] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0066.801] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0066.801] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0066.801] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\*.*") returned="*.*" [0066.801] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\", lpString2="MSCDM.DLL" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL" [0066.801] FindClose (in: hFindFile=0x5b7c70 | out: hFindFile=0x5b7c70) returned 1 [0066.801] lstrcmpA (lpString1=".", lpString2="MSInfo") returned -1 [0066.801] lstrcmpA (lpString1="..", lpString2="MSInfo") returned -1 [0066.801] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\*.*") returned="*.*" [0066.801] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\", lpString2="MSInfo" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo" [0066.801] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5b7be0 [0066.802] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0066.802] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0066.802] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\*.*") returned="*.*" [0066.802] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\", lpString2="en-US" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US" [0066.802] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5b8c28 [0066.802] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0066.802] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\*.*") returned="*.*" [0066.802] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\", lpString2="msinfo32.exe.mui" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui" [0066.802] FindClose (in: hFindFile=0x5b8c28 | out: hFindFile=0x5b8c28) returned 1 [0066.803] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0066.803] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\*.*") returned="*.*" [0066.803] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\", lpString2="msinfo32.exe" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\msinfo32.exe") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\msinfo32.exe" [0066.803] FindClose (in: hFindFile=0x5b7be0 | out: hFindFile=0x5b7be0) returned 1 [0066.803] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\*.*") returned="*.*" [0066.803] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\", lpString2="OFFICE14" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14" [0066.803] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5b7be0 [0066.803] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\*.*") returned="*.*" [0066.803] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\", lpString2="1033" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033" [0066.803] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5b8c28 [0066.804] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0066.804] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\*.*") returned="*.*" [0066.804] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\", lpString2="ACEINTL.DLL" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL" [0066.804] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0066.804] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL") returned="ACEINTL.DLL" [0066.804] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\", lpString2="ACEODBCI.DLL" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL" [0066.804] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0066.804] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL") returned="ACEODBCI.DLL" [0066.804] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\", lpString2="ACERECR.DLL" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL" [0066.805] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0066.805] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL") returned="ACERECR.DLL" [0066.805] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\", lpString2="ACEWSTR.DLL" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL" [0066.805] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0066.805] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL") returned="ACEWSTR.DLL" [0066.805] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\", lpString2="ADO210.CHM" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM" [0066.805] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0066.805] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned="ADO210.CHM" [0066.805] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\", lpString2="ALRTINTL.DLL" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL" [0066.805] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0066.805] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL") returned="ALRTINTL.DLL" [0066.805] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\", lpString2="MSOINTL.DLL" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL" [0066.805] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0066.805] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL") returned="MSOINTL.DLL" [0066.805] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\", lpString2="MSOINTL.DLL.IDX_DLL" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL" [0066.805] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0066.805] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL") returned="MSOINTL.DLL.IDX_DLL" [0066.805] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\", lpString2="MSOINTL.REST.IDX_DLL" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL" [0066.805] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0066.806] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL") returned="MSOINTL.REST.IDX_DLL" [0066.806] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\", lpString2="MSSOAPR3.DLL" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL" [0066.806] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0066.806] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL") returned="MSSOAPR3.DLL" [0066.806] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\", lpString2="OARPMANR.DLL" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL" [0066.806] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0066.806] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL") returned="OARPMANR.DLL" [0066.806] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\", lpString2="README.HTM" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM" [0066.806] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM" [0066.806] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM" [0066.809] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x795 [0066.809] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x4d183e00, dwHighDateTime=0x1ca520c), lpLastAccessTime=0x407536*(dwLowDateTime=0xef0320d0, dwHighDateTime=0x1d301be), lpLastWriteTime=0x40753e*(dwLowDateTime=0x4d183e00, dwHighDateTime=0x1ca520c)) returned 1 [0066.809] SetFilePointer (in: hFile=0x90, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0066.809] ReadFile (in: hFile=0x90, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x73b, lpOverlapped=0x0) returned 1 [0066.816] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned="README.HTM" [0066.817] SetFilePointer (in: hFile=0x90, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0066.817] WriteFile (in: hFile=0x90, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x73b, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x73b, lpOverlapped=0x0) returned 1 [0066.817] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0066.817] CloseHandle (hObject=0x90) returned 1 [0066.817] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\readme.htm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM. " (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\readme.htm. ")) returned 1 [0066.818] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0066.818] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="xlsrvintl.dll") returned -1 [0066.818] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="xlsrvintl.dll") returned -1 [0066.818] lstrcmpiA (lpString1="", lpString2="xlsrvintl.dll") returned -1 [0066.818] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned="README.HTM" [0066.818] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll", pszSpec="*.zip") returned 0 [0066.818] lstrlenA (lpString="*.zip") returned 5 [0066.818] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll", pszSpec="*.rar") returned 0 [0066.818] lstrlenA (lpString="*.rar") returned 5 [0066.818] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll", pszSpec="*.7z") returned 0 [0066.818] lstrlenA (lpString="*.7z") returned 4 [0066.818] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll", pszSpec="*.tar") returned 0 [0066.818] lstrlenA (lpString="*.tar") returned 5 [0066.818] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll", pszSpec="*.gzip") returned 0 [0066.818] lstrlenA (lpString="*.gzip") returned 6 [0066.818] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll", pszSpec="*.jpg") returned 0 [0066.818] lstrlenA (lpString="*.jpg") returned 5 [0066.818] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll", pszSpec="*.jpeg") returned 0 [0066.818] lstrlenA (lpString="*.jpeg") returned 6 [0066.818] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll", pszSpec="*.psd") returned 0 [0066.818] lstrlenA (lpString="*.psd") returned 5 [0066.818] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll", pszSpec="*.cdr") returned 0 [0066.818] lstrlenA (lpString="*.cdr") returned 5 [0066.818] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll", pszSpec="*.dwg") returned 0 [0066.819] lstrlenA (lpString="*.dwg") returned 5 [0066.819] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll", pszSpec="*.max") returned 0 [0066.819] lstrlenA (lpString="*.max") returned 5 [0066.819] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll", pszSpec="*.bmp") returned 0 [0066.819] lstrlenA (lpString="*.bmp") returned 5 [0066.819] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll", pszSpec="*.gif") returned 0 [0066.819] lstrlenA (lpString="*.gif") returned 5 [0066.819] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll", pszSpec="*.png") returned 0 [0066.819] lstrlenA (lpString="*.png") returned 5 [0066.819] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll", pszSpec="*.doc") returned 0 [0066.819] lstrlenA (lpString="*.doc") returned 5 [0066.819] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll", pszSpec="*.docx") returned 0 [0066.819] lstrlenA (lpString="*.docx") returned 6 [0066.819] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll", pszSpec="*.xls") returned 0 [0066.819] lstrlenA (lpString="*.xls") returned 5 [0066.819] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll", pszSpec="*.xlsx") returned 0 [0066.819] lstrlenA (lpString="*.xlsx") returned 6 [0066.819] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll", pszSpec="*.ppt") returned 0 [0066.819] lstrlenA (lpString="*.ppt") returned 5 [0066.819] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll", pszSpec="*.pptx") returned 0 [0066.819] lstrlenA (lpString="*.pptx") returned 6 [0066.819] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll", pszSpec="*.txt") returned 0 [0066.819] lstrlenA (lpString="*.txt") returned 5 [0066.819] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll", pszSpec="*.pdf") returned 0 [0066.819] lstrlenA (lpString="*.pdf") returned 5 [0066.819] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll", pszSpec="*.djvu") returned 0 [0066.819] lstrlenA (lpString="*.djvu") returned 6 [0066.819] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll", pszSpec="*.htm") returned 0 [0066.819] lstrlenA (lpString="*.htm") returned 5 [0066.819] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll", pszSpec="*.html") returned 0 [0066.819] lstrlenA (lpString="*.html") returned 6 [0066.819] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll", pszSpec="*.mdb") returned 0 [0066.819] lstrlenA (lpString="*.mdb") returned 5 [0066.819] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll", pszSpec="*.cer") returned 0 [0066.819] lstrlenA (lpString="*.cer") returned 5 [0066.819] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll", pszSpec="*.p12") returned 0 [0066.819] lstrlenA (lpString="*.p12") returned 5 [0066.820] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll", pszSpec="*.pfx") returned 0 [0066.820] lstrlenA (lpString="*.pfx") returned 5 [0066.820] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll", pszSpec="*.kwm") returned 0 [0066.820] lstrlenA (lpString="*.kwm") returned 5 [0066.820] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll", pszSpec="*.pwm") returned 0 [0066.820] lstrlenA (lpString="*.pwm") returned 5 [0066.820] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll", pszSpec="*.1cd") returned 0 [0066.820] lstrlenA (lpString="*.1cd") returned 5 [0066.820] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll", pszSpec="*.md") returned 0 [0066.820] lstrlenA (lpString="*.md") returned 4 [0066.820] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll", pszSpec="*.mdf") returned 0 [0066.820] lstrlenA (lpString="*.mdf") returned 5 [0066.820] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll", pszSpec="*.dbf") returned 0 [0066.820] lstrlenA (lpString="*.dbf") returned 5 [0066.820] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll", pszSpec="*.odt") returned 0 [0066.820] lstrlenA (lpString="*.odt") returned 5 [0066.820] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll", pszSpec="*.vob") returned 0 [0066.820] lstrlenA (lpString="*.vob") returned 5 [0066.820] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll", pszSpec="*.ifo") returned 0 [0066.820] lstrlenA (lpString="*.ifo") returned 5 [0066.820] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll", pszSpec="*.lnk") returned 0 [0066.820] lstrlenA (lpString="*.lnk") returned 5 [0066.820] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll", pszSpec="*.torrent") returned 0 [0066.820] lstrlenA (lpString="*.torrent") returned 9 [0066.820] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll", pszSpec="*.mov") returned 0 [0066.820] lstrlenA (lpString="*.mov") returned 5 [0066.820] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll", pszSpec="*.m2v") returned 0 [0066.820] lstrlenA (lpString="*.m2v") returned 5 [0066.820] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll", pszSpec="*.3gp") returned 0 [0066.820] lstrlenA (lpString="*.3gp") returned 5 [0066.820] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll", pszSpec="*.mpeg") returned 0 [0066.820] lstrlenA (lpString="*.mpeg") returned 6 [0066.820] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll", pszSpec="*.mpg") returned 0 [0066.820] lstrlenA (lpString="*.mpg") returned 5 [0066.820] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll", pszSpec="*.flv") returned 0 [0066.820] lstrlenA (lpString="*.flv") returned 5 [0066.820] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll", pszSpec="*.avi") returned 0 [0066.820] lstrlenA (lpString="*.avi") returned 5 [0066.820] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll", pszSpec="*.mp4") returned 0 [0066.821] lstrlenA (lpString="*.mp4") returned 5 [0066.821] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll", pszSpec="*.wmv") returned 0 [0066.821] lstrlenA (lpString="*.wmv") returned 5 [0066.821] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll", pszSpec="*.divx") returned 0 [0066.821] lstrlenA (lpString="*.divx") returned 6 [0066.821] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll", pszSpec="*.mkv") returned 0 [0066.821] lstrlenA (lpString="*.mkv") returned 5 [0066.821] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll", pszSpec="*.mp3") returned 0 [0066.821] lstrlenA (lpString="*.mp3") returned 5 [0066.821] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll", pszSpec="*.wav") returned 0 [0066.821] lstrlenA (lpString="*.wav") returned 5 [0066.821] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll", pszSpec="*.flac") returned 0 [0066.821] lstrlenA (lpString="*.flac") returned 6 [0066.821] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll", pszSpec="*.ape") returned 0 [0066.821] lstrlenA (lpString="*.ape") returned 5 [0066.821] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll", pszSpec="*.wma") returned 0 [0066.821] lstrlenA (lpString="*.wma") returned 5 [0066.821] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll", pszSpec="*.ac3") returned 0 [0066.821] lstrlenA (lpString="*.ac3") returned 5 [0066.821] FindNextFileA (in: hFindFile=0x5b8c28, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0 [0066.821] FindClose (in: hFindFile=0x5b8c28 | out: hFindFile=0x5b8c28) returned 1 [0066.821] FindNextFileA (in: hFindFile=0x5b7be0, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0066.821] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0066.821] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="ACECORE.DLL") returned 1 [0066.821] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ACECORE.DLL") returned 1 [0066.821] lstrcmpiA (lpString1="", lpString2="ACECORE.DLL") returned -1 [0066.821] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\*.*") returned="*.*" [0066.821] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL", pszSpec="*.zip") returned 0 [0066.821] lstrlenA (lpString="*.zip") returned 5 [0066.821] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL", pszSpec="*.rar") returned 0 [0066.821] lstrlenA (lpString="*.rar") returned 5 [0066.821] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL", pszSpec="*.7z") returned 0 [0066.822] lstrlenA (lpString="*.7z") returned 4 [0066.822] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL", pszSpec="*.tar") returned 0 [0066.822] lstrlenA (lpString="*.tar") returned 5 [0066.822] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL", pszSpec="*.gzip") returned 0 [0066.822] lstrlenA (lpString="*.gzip") returned 6 [0066.822] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL", pszSpec="*.jpg") returned 0 [0066.822] lstrlenA (lpString="*.jpg") returned 5 [0066.822] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL", pszSpec="*.jpeg") returned 0 [0066.822] lstrlenA (lpString="*.jpeg") returned 6 [0066.822] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL", pszSpec="*.psd") returned 0 [0066.822] lstrlenA (lpString="*.psd") returned 5 [0066.822] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL", pszSpec="*.cdr") returned 0 [0066.822] lstrlenA (lpString="*.cdr") returned 5 [0066.822] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL", pszSpec="*.dwg") returned 0 [0066.822] lstrlenA (lpString="*.dwg") returned 5 [0066.822] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL", pszSpec="*.max") returned 0 [0066.822] lstrlenA (lpString="*.max") returned 5 [0066.822] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL", pszSpec="*.bmp") returned 0 [0066.822] lstrlenA (lpString="*.bmp") returned 5 [0066.822] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL", pszSpec="*.gif") returned 0 [0066.822] lstrlenA (lpString="*.gif") returned 5 [0066.822] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL", pszSpec="*.png") returned 0 [0066.822] lstrlenA (lpString="*.png") returned 5 [0066.822] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL", pszSpec="*.doc") returned 0 [0066.822] lstrlenA (lpString="*.doc") returned 5 [0066.822] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL", pszSpec="*.docx") returned 0 [0066.822] lstrlenA (lpString="*.docx") returned 6 [0066.822] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL", pszSpec="*.xls") returned 0 [0066.822] lstrlenA (lpString="*.xls") returned 5 [0066.822] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL", pszSpec="*.xlsx") returned 0 [0066.822] lstrlenA (lpString="*.xlsx") returned 6 [0066.822] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL", pszSpec="*.ppt") returned 0 [0066.822] lstrlenA (lpString="*.ppt") returned 5 [0066.822] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL", pszSpec="*.pptx") returned 0 [0066.822] lstrlenA (lpString="*.pptx") returned 6 [0066.822] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL", pszSpec="*.txt") returned 0 [0066.822] lstrlenA (lpString="*.txt") returned 5 [0066.822] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL", pszSpec="*.pdf") returned 0 [0066.823] lstrlenA (lpString="*.pdf") returned 5 [0066.823] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL", pszSpec="*.djvu") returned 0 [0066.823] lstrlenA (lpString="*.djvu") returned 6 [0066.823] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL", pszSpec="*.htm") returned 0 [0066.823] lstrlenA (lpString="*.htm") returned 5 [0066.823] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL", pszSpec="*.html") returned 0 [0066.823] lstrlenA (lpString="*.html") returned 6 [0066.823] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL", pszSpec="*.mdb") returned 0 [0066.823] lstrlenA (lpString="*.mdb") returned 5 [0066.823] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL", pszSpec="*.cer") returned 0 [0066.823] lstrlenA (lpString="*.cer") returned 5 [0066.823] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL", pszSpec="*.p12") returned 0 [0066.823] lstrlenA (lpString="*.p12") returned 5 [0066.823] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL", pszSpec="*.pfx") returned 0 [0066.823] lstrlenA (lpString="*.pfx") returned 5 [0066.823] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL", pszSpec="*.kwm") returned 0 [0066.823] lstrlenA (lpString="*.kwm") returned 5 [0066.823] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL", pszSpec="*.pwm") returned 0 [0066.823] lstrlenA (lpString="*.pwm") returned 5 [0066.823] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL", pszSpec="*.1cd") returned 0 [0066.823] lstrlenA (lpString="*.1cd") returned 5 [0066.823] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL", pszSpec="*.md") returned 0 [0066.823] lstrlenA (lpString="*.md") returned 4 [0066.823] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL", pszSpec="*.mdf") returned 0 [0066.823] lstrlenA (lpString="*.mdf") returned 5 [0066.823] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL", pszSpec="*.dbf") returned 0 [0066.823] lstrlenA (lpString="*.dbf") returned 5 [0066.823] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL", pszSpec="*.odt") returned 0 [0066.823] lstrlenA (lpString="*.odt") returned 5 [0066.823] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL", pszSpec="*.vob") returned 0 [0066.823] lstrlenA (lpString="*.vob") returned 5 [0066.823] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL", pszSpec="*.ifo") returned 0 [0066.823] lstrlenA (lpString="*.ifo") returned 5 [0066.823] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL", pszSpec="*.lnk") returned 0 [0066.823] lstrlenA (lpString="*.lnk") returned 5 [0066.823] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL", pszSpec="*.torrent") returned 0 [0066.823] lstrlenA (lpString="*.torrent") returned 9 [0066.823] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL", pszSpec="*.mov") returned 0 [0066.823] lstrlenA (lpString="*.mov") returned 5 [0066.824] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL", pszSpec="*.m2v") returned 0 [0066.824] lstrlenA (lpString="*.m2v") returned 5 [0066.824] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL", pszSpec="*.3gp") returned 0 [0066.824] lstrlenA (lpString="*.3gp") returned 5 [0066.824] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL", pszSpec="*.mpeg") returned 0 [0066.824] lstrlenA (lpString="*.mpeg") returned 6 [0066.824] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL", pszSpec="*.mpg") returned 0 [0066.824] lstrlenA (lpString="*.mpg") returned 5 [0066.824] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL", pszSpec="*.flv") returned 0 [0066.824] lstrlenA (lpString="*.flv") returned 5 [0066.824] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL", pszSpec="*.avi") returned 0 [0066.824] lstrlenA (lpString="*.avi") returned 5 [0066.824] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL", pszSpec="*.mp4") returned 0 [0066.824] lstrlenA (lpString="*.mp4") returned 5 [0066.824] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL", pszSpec="*.wmv") returned 0 [0066.824] lstrlenA (lpString="*.wmv") returned 5 [0066.824] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL", pszSpec="*.divx") returned 0 [0066.824] lstrlenA (lpString="*.divx") returned 6 [0066.824] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL", pszSpec="*.mkv") returned 0 [0066.824] lstrlenA (lpString="*.mkv") returned 5 [0066.824] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL", pszSpec="*.mp3") returned 0 [0066.824] lstrlenA (lpString="*.mp3") returned 5 [0066.824] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL", pszSpec="*.wav") returned 0 [0066.824] lstrlenA (lpString="*.wav") returned 5 [0066.824] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL", pszSpec="*.flac") returned 0 [0066.824] lstrlenA (lpString="*.flac") returned 6 [0066.824] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL", pszSpec="*.ape") returned 0 [0066.824] lstrlenA (lpString="*.ape") returned 5 [0066.824] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL", pszSpec="*.wma") returned 0 [0066.824] lstrlenA (lpString="*.wma") returned 5 [0066.824] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL", pszSpec="*.ac3") returned 0 [0066.824] lstrlenA (lpString="*.ac3") returned 5 [0066.824] FindNextFileA (in: hFindFile=0x5b7be0, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0066.824] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0066.824] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="ACEDAO.DLL") returned 1 [0066.824] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ACEDAO.DLL") returned 1 [0066.824] lstrcmpiA (lpString1="", lpString2="ACEDAO.DLL") returned -1 [0066.824] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL") returned="ACECORE.DLL" [0066.825] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL", pszSpec="*.zip") returned 0 [0066.825] lstrlenA (lpString="*.zip") returned 5 [0066.825] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL", pszSpec="*.rar") returned 0 [0066.825] lstrlenA (lpString="*.rar") returned 5 [0066.825] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL", pszSpec="*.7z") returned 0 [0066.825] lstrlenA (lpString="*.7z") returned 4 [0066.825] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL", pszSpec="*.tar") returned 0 [0066.825] lstrlenA (lpString="*.tar") returned 5 [0066.825] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL", pszSpec="*.gzip") returned 0 [0066.825] lstrlenA (lpString="*.gzip") returned 6 [0066.825] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL", pszSpec="*.jpg") returned 0 [0066.825] lstrlenA (lpString="*.jpg") returned 5 [0066.825] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL", pszSpec="*.jpeg") returned 0 [0066.825] lstrlenA (lpString="*.jpeg") returned 6 [0066.825] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL", pszSpec="*.psd") returned 0 [0066.825] lstrlenA (lpString="*.psd") returned 5 [0066.825] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL", pszSpec="*.cdr") returned 0 [0066.825] lstrlenA (lpString="*.cdr") returned 5 [0066.825] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL", pszSpec="*.dwg") returned 0 [0066.825] lstrlenA (lpString="*.dwg") returned 5 [0066.825] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL", pszSpec="*.max") returned 0 [0066.825] lstrlenA (lpString="*.max") returned 5 [0066.825] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL", pszSpec="*.bmp") returned 0 [0066.825] lstrlenA (lpString="*.bmp") returned 5 [0066.825] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL", pszSpec="*.gif") returned 0 [0066.825] lstrlenA (lpString="*.gif") returned 5 [0066.825] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL", pszSpec="*.png") returned 0 [0066.825] lstrlenA (lpString="*.png") returned 5 [0066.825] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL", pszSpec="*.doc") returned 0 [0066.825] lstrlenA (lpString="*.doc") returned 5 [0066.825] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL", pszSpec="*.docx") returned 0 [0066.825] lstrlenA (lpString="*.docx") returned 6 [0066.825] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL", pszSpec="*.xls") returned 0 [0066.825] lstrlenA (lpString="*.xls") returned 5 [0066.825] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL", pszSpec="*.xlsx") returned 0 [0066.825] lstrlenA (lpString="*.xlsx") returned 6 [0066.825] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL", pszSpec="*.ppt") returned 0 [0066.826] lstrlenA (lpString="*.ppt") returned 5 [0066.826] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL", pszSpec="*.pptx") returned 0 [0066.826] lstrlenA (lpString="*.pptx") returned 6 [0066.826] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL", pszSpec="*.txt") returned 0 [0066.826] lstrlenA (lpString="*.txt") returned 5 [0066.826] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL", pszSpec="*.pdf") returned 0 [0066.826] lstrlenA (lpString="*.pdf") returned 5 [0066.826] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL", pszSpec="*.djvu") returned 0 [0066.826] lstrlenA (lpString="*.djvu") returned 6 [0066.826] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL", pszSpec="*.htm") returned 0 [0066.826] lstrlenA (lpString="*.htm") returned 5 [0066.826] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL", pszSpec="*.html") returned 0 [0066.826] lstrlenA (lpString="*.html") returned 6 [0066.826] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL", pszSpec="*.mdb") returned 0 [0066.826] lstrlenA (lpString="*.mdb") returned 5 [0066.826] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL", pszSpec="*.cer") returned 0 [0066.826] lstrlenA (lpString="*.cer") returned 5 [0066.826] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL", pszSpec="*.p12") returned 0 [0066.826] lstrlenA (lpString="*.p12") returned 5 [0066.826] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL", pszSpec="*.pfx") returned 0 [0066.826] lstrlenA (lpString="*.pfx") returned 5 [0066.826] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL", pszSpec="*.kwm") returned 0 [0066.826] lstrlenA (lpString="*.kwm") returned 5 [0066.826] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL", pszSpec="*.pwm") returned 0 [0066.826] lstrlenA (lpString="*.pwm") returned 5 [0066.826] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL", pszSpec="*.1cd") returned 0 [0066.826] lstrlenA (lpString="*.1cd") returned 5 [0066.826] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL", pszSpec="*.md") returned 0 [0066.826] lstrlenA (lpString="*.md") returned 4 [0066.826] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL", pszSpec="*.mdf") returned 0 [0066.826] lstrlenA (lpString="*.mdf") returned 5 [0066.826] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL", pszSpec="*.dbf") returned 0 [0066.826] lstrlenA (lpString="*.dbf") returned 5 [0066.826] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL", pszSpec="*.odt") returned 0 [0066.826] lstrlenA (lpString="*.odt") returned 5 [0066.826] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL", pszSpec="*.vob") returned 0 [0066.826] lstrlenA (lpString="*.vob") returned 5 [0066.826] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL", pszSpec="*.ifo") returned 0 [0066.826] lstrlenA (lpString="*.ifo") returned 5 [0066.827] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL", pszSpec="*.lnk") returned 0 [0066.827] lstrlenA (lpString="*.lnk") returned 5 [0066.827] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL", pszSpec="*.torrent") returned 0 [0066.827] lstrlenA (lpString="*.torrent") returned 9 [0066.827] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL", pszSpec="*.mov") returned 0 [0066.827] lstrlenA (lpString="*.mov") returned 5 [0066.827] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL", pszSpec="*.m2v") returned 0 [0066.827] lstrlenA (lpString="*.m2v") returned 5 [0066.827] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL", pszSpec="*.3gp") returned 0 [0066.827] lstrlenA (lpString="*.3gp") returned 5 [0066.827] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL", pszSpec="*.mpeg") returned 0 [0066.827] lstrlenA (lpString="*.mpeg") returned 6 [0066.827] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL", pszSpec="*.mpg") returned 0 [0066.827] lstrlenA (lpString="*.mpg") returned 5 [0066.827] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL", pszSpec="*.flv") returned 0 [0066.827] lstrlenA (lpString="*.flv") returned 5 [0066.827] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL", pszSpec="*.avi") returned 0 [0066.827] lstrlenA (lpString="*.avi") returned 5 [0066.827] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL", pszSpec="*.mp4") returned 0 [0066.827] lstrlenA (lpString="*.mp4") returned 5 [0066.827] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL", pszSpec="*.wmv") returned 0 [0066.827] lstrlenA (lpString="*.wmv") returned 5 [0066.827] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL", pszSpec="*.divx") returned 0 [0066.827] lstrlenA (lpString="*.divx") returned 6 [0066.827] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL", pszSpec="*.mkv") returned 0 [0066.827] lstrlenA (lpString="*.mkv") returned 5 [0066.827] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL", pszSpec="*.mp3") returned 0 [0066.827] lstrlenA (lpString="*.mp3") returned 5 [0066.827] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL", pszSpec="*.wav") returned 0 [0066.827] lstrlenA (lpString="*.wav") returned 5 [0066.827] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL", pszSpec="*.flac") returned 0 [0066.827] lstrlenA (lpString="*.flac") returned 6 [0066.827] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL", pszSpec="*.ape") returned 0 [0066.827] lstrlenA (lpString="*.ape") returned 5 [0066.827] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL", pszSpec="*.wma") returned 0 [0066.827] lstrlenA (lpString="*.wma") returned 5 [0066.827] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL", pszSpec="*.ac3") returned 0 [0066.827] lstrlenA (lpString="*.ac3") returned 5 [0066.827] FindNextFileA (in: hFindFile=0x5b7be0, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0066.828] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0066.828] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="ACEERR.DLL") returned 1 [0066.828] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ACEERR.DLL") returned 1 [0066.828] lstrcmpiA (lpString1="", lpString2="ACEERR.DLL") returned -1 [0066.828] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL") returned="ACEDAO.DLL" [0066.828] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL", pszSpec="*.zip") returned 0 [0066.828] lstrlenA (lpString="*.zip") returned 5 [0066.828] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL", pszSpec="*.rar") returned 0 [0066.828] lstrlenA (lpString="*.rar") returned 5 [0066.828] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL", pszSpec="*.7z") returned 0 [0066.828] lstrlenA (lpString="*.7z") returned 4 [0066.828] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL", pszSpec="*.tar") returned 0 [0066.828] lstrlenA (lpString="*.tar") returned 5 [0066.828] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL", pszSpec="*.gzip") returned 0 [0066.828] lstrlenA (lpString="*.gzip") returned 6 [0066.828] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL", pszSpec="*.jpg") returned 0 [0066.828] lstrlenA (lpString="*.jpg") returned 5 [0066.828] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL", pszSpec="*.jpeg") returned 0 [0066.828] lstrlenA (lpString="*.jpeg") returned 6 [0066.828] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL", pszSpec="*.psd") returned 0 [0066.828] lstrlenA (lpString="*.psd") returned 5 [0066.828] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL", pszSpec="*.cdr") returned 0 [0066.828] lstrlenA (lpString="*.cdr") returned 5 [0066.828] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL", pszSpec="*.dwg") returned 0 [0066.828] lstrlenA (lpString="*.dwg") returned 5 [0066.828] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL", pszSpec="*.max") returned 0 [0066.828] lstrlenA (lpString="*.max") returned 5 [0066.828] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL", pszSpec="*.bmp") returned 0 [0066.828] lstrlenA (lpString="*.bmp") returned 5 [0066.828] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL", pszSpec="*.gif") returned 0 [0066.828] lstrlenA (lpString="*.gif") returned 5 [0066.828] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL", pszSpec="*.png") returned 0 [0066.828] lstrlenA (lpString="*.png") returned 5 [0066.828] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL", pszSpec="*.doc") returned 0 [0066.828] lstrlenA (lpString="*.doc") returned 5 [0066.828] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL", pszSpec="*.docx") returned 0 [0066.828] lstrlenA (lpString="*.docx") returned 6 [0066.829] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL", pszSpec="*.xls") returned 0 [0066.829] lstrlenA (lpString="*.xls") returned 5 [0066.829] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL", pszSpec="*.xlsx") returned 0 [0066.829] lstrlenA (lpString="*.xlsx") returned 6 [0066.829] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL", pszSpec="*.ppt") returned 0 [0066.829] lstrlenA (lpString="*.ppt") returned 5 [0066.829] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL", pszSpec="*.pptx") returned 0 [0066.829] lstrlenA (lpString="*.pptx") returned 6 [0066.829] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL", pszSpec="*.txt") returned 0 [0066.829] lstrlenA (lpString="*.txt") returned 5 [0066.829] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL", pszSpec="*.pdf") returned 0 [0066.829] lstrlenA (lpString="*.pdf") returned 5 [0066.829] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL", pszSpec="*.djvu") returned 0 [0066.829] lstrlenA (lpString="*.djvu") returned 6 [0066.829] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL", pszSpec="*.htm") returned 0 [0066.829] lstrlenA (lpString="*.htm") returned 5 [0066.829] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL", pszSpec="*.html") returned 0 [0066.829] lstrlenA (lpString="*.html") returned 6 [0066.829] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL", pszSpec="*.mdb") returned 0 [0066.829] lstrlenA (lpString="*.mdb") returned 5 [0066.829] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL", pszSpec="*.cer") returned 0 [0066.829] lstrlenA (lpString="*.cer") returned 5 [0066.829] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL", pszSpec="*.p12") returned 0 [0066.829] lstrlenA (lpString="*.p12") returned 5 [0066.829] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL", pszSpec="*.pfx") returned 0 [0066.829] lstrlenA (lpString="*.pfx") returned 5 [0066.829] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL", pszSpec="*.kwm") returned 0 [0066.829] lstrlenA (lpString="*.kwm") returned 5 [0066.829] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL", pszSpec="*.pwm") returned 0 [0066.829] lstrlenA (lpString="*.pwm") returned 5 [0066.829] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL", pszSpec="*.1cd") returned 0 [0066.829] lstrlenA (lpString="*.1cd") returned 5 [0066.829] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL", pszSpec="*.md") returned 0 [0066.829] lstrlenA (lpString="*.md") returned 4 [0066.829] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL", pszSpec="*.mdf") returned 0 [0066.829] lstrlenA (lpString="*.mdf") returned 5 [0066.829] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL", pszSpec="*.dbf") returned 0 [0066.829] lstrlenA (lpString="*.dbf") returned 5 [0066.830] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL", pszSpec="*.odt") returned 0 [0066.830] lstrlenA (lpString="*.odt") returned 5 [0066.830] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL", pszSpec="*.vob") returned 0 [0066.830] lstrlenA (lpString="*.vob") returned 5 [0066.830] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL", pszSpec="*.ifo") returned 0 [0066.830] lstrlenA (lpString="*.ifo") returned 5 [0066.830] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL", pszSpec="*.lnk") returned 0 [0066.830] lstrlenA (lpString="*.lnk") returned 5 [0066.830] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL", pszSpec="*.torrent") returned 0 [0066.830] lstrlenA (lpString="*.torrent") returned 9 [0066.830] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL", pszSpec="*.mov") returned 0 [0066.830] lstrlenA (lpString="*.mov") returned 5 [0066.830] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL", pszSpec="*.m2v") returned 0 [0066.830] lstrlenA (lpString="*.m2v") returned 5 [0066.830] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL", pszSpec="*.3gp") returned 0 [0066.830] lstrlenA (lpString="*.3gp") returned 5 [0066.830] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL", pszSpec="*.mpeg") returned 0 [0066.830] lstrlenA (lpString="*.mpeg") returned 6 [0066.830] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL", pszSpec="*.mpg") returned 0 [0066.830] lstrlenA (lpString="*.mpg") returned 5 [0066.830] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL", pszSpec="*.flv") returned 0 [0066.830] lstrlenA (lpString="*.flv") returned 5 [0066.830] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL", pszSpec="*.avi") returned 0 [0066.830] lstrlenA (lpString="*.avi") returned 5 [0066.830] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL", pszSpec="*.mp4") returned 0 [0066.830] lstrlenA (lpString="*.mp4") returned 5 [0066.830] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL", pszSpec="*.wmv") returned 0 [0066.830] lstrlenA (lpString="*.wmv") returned 5 [0066.830] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL", pszSpec="*.divx") returned 0 [0066.830] lstrlenA (lpString="*.divx") returned 6 [0066.830] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL", pszSpec="*.mkv") returned 0 [0066.830] lstrlenA (lpString="*.mkv") returned 5 [0066.830] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL", pszSpec="*.mp3") returned 0 [0066.830] lstrlenA (lpString="*.mp3") returned 5 [0066.830] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL", pszSpec="*.wav") returned 0 [0066.830] lstrlenA (lpString="*.wav") returned 5 [0066.830] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL", pszSpec="*.flac") returned 0 [0066.830] lstrlenA (lpString="*.flac") returned 6 [0066.830] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL", pszSpec="*.ape") returned 0 [0066.831] lstrlenA (lpString="*.ape") returned 5 [0066.831] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL", pszSpec="*.wma") returned 0 [0066.831] lstrlenA (lpString="*.wma") returned 5 [0066.831] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL", pszSpec="*.ac3") returned 0 [0066.831] lstrlenA (lpString="*.ac3") returned 5 [0066.831] FindNextFileA (in: hFindFile=0x5b7be0, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0066.831] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0066.831] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="ACEES.DLL") returned 1 [0066.831] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ACEES.DLL") returned 1 [0066.831] lstrcmpiA (lpString1="", lpString2="ACEES.DLL") returned -1 [0066.831] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL") returned="ACEERR.DLL" [0066.831] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL", pszSpec="*.zip") returned 0 [0066.831] lstrlenA (lpString="*.zip") returned 5 [0066.831] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL", pszSpec="*.rar") returned 0 [0066.831] lstrlenA (lpString="*.rar") returned 5 [0066.831] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL", pszSpec="*.7z") returned 0 [0066.831] lstrlenA (lpString="*.7z") returned 4 [0066.831] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL", pszSpec="*.tar") returned 0 [0066.831] lstrlenA (lpString="*.tar") returned 5 [0066.831] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL", pszSpec="*.gzip") returned 0 [0066.831] lstrlenA (lpString="*.gzip") returned 6 [0066.831] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL", pszSpec="*.jpg") returned 0 [0066.832] lstrlenA (lpString="*.jpg") returned 5 [0066.832] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL", pszSpec="*.jpeg") returned 0 [0066.832] lstrlenA (lpString="*.jpeg") returned 6 [0066.832] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL", pszSpec="*.psd") returned 0 [0066.832] lstrlenA (lpString="*.psd") returned 5 [0066.832] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL", pszSpec="*.cdr") returned 0 [0066.832] lstrlenA (lpString="*.cdr") returned 5 [0066.832] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL", pszSpec="*.dwg") returned 0 [0066.832] lstrlenA (lpString="*.dwg") returned 5 [0066.832] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL", pszSpec="*.max") returned 0 [0066.832] lstrlenA (lpString="*.max") returned 5 [0066.832] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL", pszSpec="*.bmp") returned 0 [0066.832] lstrlenA (lpString="*.bmp") returned 5 [0066.832] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL", pszSpec="*.gif") returned 0 [0066.832] lstrlenA (lpString="*.gif") returned 5 [0066.832] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL", pszSpec="*.png") returned 0 [0066.832] lstrlenA (lpString="*.png") returned 5 [0066.832] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL", pszSpec="*.doc") returned 0 [0066.832] lstrlenA (lpString="*.doc") returned 5 [0066.832] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL", pszSpec="*.docx") returned 0 [0066.832] lstrlenA (lpString="*.docx") returned 6 [0066.832] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL", pszSpec="*.xls") returned 0 [0066.832] lstrlenA (lpString="*.xls") returned 5 [0066.832] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL", pszSpec="*.xlsx") returned 0 [0066.832] lstrlenA (lpString="*.xlsx") returned 6 [0066.832] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL", pszSpec="*.ppt") returned 0 [0066.832] lstrlenA (lpString="*.ppt") returned 5 [0066.832] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL", pszSpec="*.pptx") returned 0 [0066.832] lstrlenA (lpString="*.pptx") returned 6 [0066.832] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL", pszSpec="*.txt") returned 0 [0066.832] lstrlenA (lpString="*.txt") returned 5 [0066.832] FindNextFileA (in: hFindFile=0x5b7be0, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0066.833] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0066.833] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="ACEEXCH.DLL") returned 1 [0066.833] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ACEEXCH.DLL") returned 1 [0066.833] lstrcmpiA (lpString1="", lpString2="ACEEXCH.DLL") returned -1 [0066.833] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL") returned="ACEES.DLL" [0066.833] FindNextFileA (in: hFindFile=0x5b7be0, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0066.833] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0066.833] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="ACEEXCL.DLL") returned 1 [0066.833] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ACEEXCL.DLL") returned 1 [0066.833] lstrcmpiA (lpString1="", lpString2="ACEEXCL.DLL") returned -1 [0066.833] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCH.DLL") returned="ACEEXCH.DLL" [0066.833] FindNextFileA (in: hFindFile=0x5b7be0, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0066.833] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0066.833] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="ACEODBC.DLL") returned 1 [0066.833] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ACEODBC.DLL") returned 1 [0066.833] lstrcmpiA (lpString1="", lpString2="ACEODBC.DLL") returned -1 [0066.833] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL") returned="ACEEXCL.DLL" [0066.833] FindNextFileA (in: hFindFile=0x5b7be0, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0066.833] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0066.833] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="ACEODDBS.DLL") returned 1 [0066.833] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ACEODDBS.DLL") returned 1 [0066.833] lstrcmpiA (lpString1="", lpString2="ACEODDBS.DLL") returned -1 [0066.833] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODBC.DLL") returned="ACEODBC.DLL" [0066.833] FindNextFileA (in: hFindFile=0x5b7be0, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0066.833] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0066.833] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="ACEODEXL.DLL") returned 1 [0066.833] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ACEODEXL.DLL") returned 1 [0066.834] lstrcmpiA (lpString1="", lpString2="ACEODEXL.DLL") returned -1 [0066.834] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL") returned="ACEODDBS.DLL" [0066.834] FindNextFileA (in: hFindFile=0x5b7be0, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0066.834] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0066.834] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="ACEODTXT.DLL") returned 1 [0066.834] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ACEODTXT.DLL") returned 1 [0066.834] lstrcmpiA (lpString1="", lpString2="ACEODTXT.DLL") returned -1 [0066.834] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL") returned="ACEODEXL.DLL" [0066.834] FindNextFileA (in: hFindFile=0x5b7be0, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0066.834] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0066.834] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="ACEOLEDB.DLL") returned 1 [0066.834] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ACEOLEDB.DLL") returned 1 [0066.834] lstrcmpiA (lpString1="", lpString2="ACEOLEDB.DLL") returned -1 [0066.834] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODTXT.DLL") returned="ACEODTXT.DLL" [0066.834] FindNextFileA (in: hFindFile=0x5b7be0, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0066.834] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0066.834] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="ACER3X.DLL") returned 1 [0066.834] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ACER3X.DLL") returned 1 [0066.834] lstrcmpiA (lpString1="", lpString2="ACER3X.DLL") returned -1 [0066.834] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEOLEDB.DLL") returned="ACEOLEDB.DLL" [0066.834] FindNextFileA (in: hFindFile=0x5b7be0, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0066.834] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0066.834] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="ACERCLR.DLL") returned 1 [0066.834] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ACERCLR.DLL") returned 1 [0066.835] lstrcmpiA (lpString1="", lpString2="ACERCLR.DLL") returned -1 [0066.835] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACER3X.DLL") returned="ACER3X.DLL" [0066.835] FindNextFileA (in: hFindFile=0x5b7be0, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0066.835] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0066.835] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="ACEREP.DLL") returned 1 [0066.835] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ACEREP.DLL") returned 1 [0066.835] lstrcmpiA (lpString1="", lpString2="ACEREP.DLL") returned -1 [0066.835] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACERCLR.DLL") returned="ACERCLR.DLL" [0066.835] FindNextFileA (in: hFindFile=0x5b7be0, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0066.835] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0066.835] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="ACETXT.DLL") returned 1 [0066.835] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ACETXT.DLL") returned 1 [0066.835] lstrcmpiA (lpString1="", lpString2="ACETXT.DLL") returned -1 [0066.835] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEREP.DLL") returned="ACEREP.DLL" [0066.835] FindNextFileA (in: hFindFile=0x5b7be0, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0066.835] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0066.835] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="ACEWDAT.DLL") returned 1 [0066.835] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ACEWDAT.DLL") returned 1 [0066.835] lstrcmpiA (lpString1="", lpString2="ACEWDAT.DLL") returned -1 [0066.835] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACETXT.DLL") returned="ACETXT.DLL" [0066.835] FindNextFileA (in: hFindFile=0x5b7be0, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0066.835] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0066.835] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="ACEWSS.DLL") returned 1 [0066.835] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ACEWSS.DLL") returned 1 [0066.835] lstrcmpiA (lpString1="", lpString2="ACEWSS.DLL") returned -1 [0066.836] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWDAT.DLL") returned="ACEWDAT.DLL" [0066.836] FindNextFileA (in: hFindFile=0x5b7be0, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0066.836] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0066.836] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="ACEXBE.DLL") returned 1 [0066.836] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ACEXBE.DLL") returned 1 [0066.836] lstrcmpiA (lpString1="", lpString2="ACEXBE.DLL") returned -1 [0066.836] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWSS.DLL") returned="ACEWSS.DLL" [0066.836] FindNextFileA (in: hFindFile=0x5b7be0, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0066.836] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0066.836] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="ATLCONV.DLL") returned 1 [0066.836] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ATLCONV.DLL") returned 1 [0066.836] lstrcmpiA (lpString1="", lpString2="ATLCONV.DLL") returned -1 [0066.836] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEXBE.DLL") returned="ACEXBE.DLL" [0066.836] FindNextFileA (in: hFindFile=0x5b7be0, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0066.836] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0066.836] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Csi.dll") returned 1 [0066.836] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Csi.dll") returned 1 [0066.836] lstrcmpiA (lpString1="", lpString2="Csi.dll") returned -1 [0066.836] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ATLCONV.DLL") returned="ATLCONV.DLL" [0066.836] FindNextFileA (in: hFindFile=0x5b7be0, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0066.836] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0066.836] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="CsiSoap.dll") returned 1 [0066.836] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="CsiSoap.dll") returned 1 [0066.836] lstrcmpiA (lpString1="", lpString2="CsiSoap.dll") returned -1 [0066.836] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Csi.dll") returned="Csi.dll" [0066.837] FindNextFileA (in: hFindFile=0x5b7be0, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0066.837] lstrcmpA (lpString1=".", lpString2="Cultures") returned -1 [0066.837] lstrcmpA (lpString1="..", lpString2="Cultures") returned -1 [0066.837] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\CsiSoap.dll") returned="CsiSoap.dll" [0066.837] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\", lpString2="Cultures" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures" [0066.837] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5b8c28 [0066.838] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0066.838] FindNextFileA (in: hFindFile=0x5b8c28, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0066.838] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0066.838] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0066.838] FindNextFileA (in: hFindFile=0x5b8c28, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0066.838] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0066.838] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="OFFICE.ODF") returned -1 [0066.838] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OFFICE.ODF") returned -1 [0066.838] lstrcmpiA (lpString1="", lpString2="OFFICE.ODF") returned -1 [0066.838] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\", lpString2="OFFICE.ODF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF" [0066.839] FindNextFileA (in: hFindFile=0x5b8c28, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0 [0066.839] FindClose (in: hFindFile=0x5b8c28 | out: hFindFile=0x5b8c28) returned 1 [0066.839] FindNextFileA (in: hFindFile=0x5b7be0, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0066.839] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0066.839] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="EXPSRV.DLL") returned -1 [0066.839] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="EXPSRV.DLL") returned 1 [0066.839] lstrcmpiA (lpString1="", lpString2="EXPSRV.DLL") returned -1 [0066.839] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\", lpString2="EXPSRV.DLL" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXPSRV.DLL") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXPSRV.DLL" [0066.839] FindNextFileA (in: hFindFile=0x5b7be0, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0066.839] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0066.839] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="EXP_PDF.DLL") returned -1 [0066.839] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="EXP_PDF.DLL") returned 1 [0066.839] lstrcmpiA (lpString1="", lpString2="EXP_PDF.DLL") returned -1 [0066.839] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\", lpString2="EXP_PDF.DLL" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_PDF.DLL") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_PDF.DLL" [0066.839] FindNextFileA (in: hFindFile=0x5b7be0, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0066.839] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0066.839] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="EXP_XPS.DLL") returned -1 [0066.839] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="EXP_XPS.DLL") returned 1 [0066.839] lstrcmpiA (lpString1="", lpString2="EXP_XPS.DLL") returned -1 [0066.839] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\", lpString2="EXP_XPS.DLL" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_XPS.DLL") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_XPS.DLL" [0066.839] FindNextFileA (in: hFindFile=0x5b7be0, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0066.839] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0066.840] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="FLTLDR.EXE") returned -1 [0066.840] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FLTLDR.EXE") returned 1 [0066.840] lstrcmpiA (lpString1="", lpString2="FLTLDR.EXE") returned -1 [0066.840] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\", lpString2="FLTLDR.EXE" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\FLTLDR.EXE") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\FLTLDR.EXE" [0066.840] FindNextFileA (in: hFindFile=0x5b7be0, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0066.840] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0066.840] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="IACOM2.DLL") returned -1 [0066.840] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="IACOM2.DLL") returned -1 [0066.840] lstrcmpiA (lpString1="", lpString2="IACOM2.DLL") returned -1 [0066.840] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\", lpString2="IACOM2.DLL" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\IACOM2.DLL") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\IACOM2.DLL" [0066.840] FindNextFileA (in: hFindFile=0x5b7be0, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0066.840] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0066.840] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="LICLUA.EXE") returned -1 [0066.840] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="LICLUA.EXE") returned -1 [0066.840] lstrcmpiA (lpString1="", lpString2="LICLUA.EXE") returned -1 [0066.840] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\", lpString2="LICLUA.EXE" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\LICLUA.EXE") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\LICLUA.EXE" [0066.840] FindNextFileA (in: hFindFile=0x5b7be0, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0066.840] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0066.840] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="MSO.DLL") returned -1 [0066.840] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSO.DLL") returned -1 [0066.840] lstrcmpiA (lpString1="", lpString2="MSO.DLL") returned -1 [0066.840] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\", lpString2="MSO.DLL" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL" [0066.840] FindNextFileA (in: hFindFile=0x5b7be0, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0066.840] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0066.840] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="MSOICONS.EXE") returned -1 [0066.840] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSOICONS.EXE") returned -1 [0066.841] lstrcmpiA (lpString1="", lpString2="MSOICONS.EXE") returned -1 [0066.841] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\", lpString2="MSOICONS.EXE" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOICONS.EXE") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOICONS.EXE" [0066.841] FindNextFileA (in: hFindFile=0x5b7be0, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0066.841] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0066.841] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="MSORES.DLL") returned -1 [0066.841] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSORES.DLL") returned -1 [0066.841] lstrcmpiA (lpString1="", lpString2="MSORES.DLL") returned -1 [0066.841] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\", lpString2="MSORES.DLL" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSORES.DLL") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSORES.DLL" [0066.841] FindNextFileA (in: hFindFile=0x5b7be0, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0066.841] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0066.841] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="msoshext.dll") returned -1 [0066.841] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="msoshext.dll") returned -1 [0066.841] lstrcmpiA (lpString1="", lpString2="msoshext.dll") returned -1 [0066.841] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\", lpString2="msoshext.dll" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\msoshext.dll") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\msoshext.dll" [0066.841] FindNextFileA (in: hFindFile=0x5b7be0, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0066.841] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0066.841] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="MSOXEV.DLL") returned -1 [0066.841] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSOXEV.DLL") returned -1 [0066.841] lstrcmpiA (lpString1="", lpString2="MSOXEV.DLL") returned -1 [0066.841] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\", lpString2="MSOXEV.DLL" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXEV.DLL") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXEV.DLL" [0066.841] FindNextFileA (in: hFindFile=0x5b7be0, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0066.841] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0066.842] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="MSOXMLED.EXE") returned -1 [0066.842] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSOXMLED.EXE") returned -1 [0066.842] lstrcmpiA (lpString1="", lpString2="MSOXMLED.EXE") returned -1 [0066.842] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\", lpString2="MSOXMLED.EXE" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLED.EXE") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLED.EXE" [0066.842] FindNextFileA (in: hFindFile=0x5b7be0, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0066.842] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0066.842] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="MSOXMLMF.DLL") returned -1 [0066.842] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSOXMLMF.DLL") returned -1 [0066.842] lstrcmpiA (lpString1="", lpString2="MSOXMLMF.DLL") returned -1 [0066.842] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\", lpString2="MSOXMLMF.DLL" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLMF.DLL") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLMF.DLL" [0066.842] FindNextFileA (in: hFindFile=0x5b7be0, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0066.842] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0066.842] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="MSPTLS.DLL") returned -1 [0066.842] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSPTLS.DLL") returned -1 [0066.842] lstrcmpiA (lpString1="", lpString2="MSPTLS.DLL") returned -1 [0066.842] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\", lpString2="MSPTLS.DLL" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSPTLS.DLL") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSPTLS.DLL" [0066.842] FindNextFileA (in: hFindFile=0x5b7be0, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0066.842] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0066.842] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="MSSOAP30.DLL") returned -1 [0066.842] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSSOAP30.DLL") returned -1 [0066.842] lstrcmpiA (lpString1="", lpString2="MSSOAP30.DLL") returned -1 [0066.842] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\", lpString2="MSSOAP30.DLL" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSSOAP30.DLL") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSSOAP30.DLL" [0066.842] FindNextFileA (in: hFindFile=0x5b7be0, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0066.842] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0066.842] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="MUAUTH.CAB") returned -1 [0066.843] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MUAUTH.CAB") returned -1 [0066.843] lstrcmpiA (lpString1="", lpString2="MUAUTH.CAB") returned -1 [0066.843] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\", lpString2="MUAUTH.CAB" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUAUTH.CAB") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUAUTH.CAB" [0066.843] FindNextFileA (in: hFindFile=0x5b7be0, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0066.843] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0066.843] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="MUOPTIN.DLL") returned -1 [0066.843] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MUOPTIN.DLL") returned -1 [0066.843] lstrcmpiA (lpString1="", lpString2="MUOPTIN.DLL") returned -1 [0066.843] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\", lpString2="MUOPTIN.DLL" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUOPTIN.DLL") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUOPTIN.DLL" [0066.843] FindNextFileA (in: hFindFile=0x5b7be0, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0066.843] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0066.843] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Oarpmany.exe") returned -1 [0066.843] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Oarpmany.exe") returned -1 [0066.843] lstrcmpiA (lpString1="", lpString2="Oarpmany.exe") returned -1 [0066.843] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\", lpString2="Oarpmany.exe" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe" [0066.843] FindNextFileA (in: hFindFile=0x5b7be0, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0066.843] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0066.843] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="ODBCMON.DLL") returned -1 [0066.843] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ODBCMON.DLL") returned -1 [0066.844] lstrcmpiA (lpString1="", lpString2="ODBCMON.DLL") returned -1 [0066.844] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\", lpString2="ODBCMON.DLL" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ODBCMON.DLL") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ODBCMON.DLL" [0066.844] FindNextFileA (in: hFindFile=0x5b7be0, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0066.844] lstrcmpA (lpString1=".", lpString2="Office Setup Controller") returned -1 [0066.844] lstrcmpA (lpString1="..", lpString2="Office Setup Controller") returned -1 [0066.844] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\", lpString2="Office Setup Controller" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller" [0066.844] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5b8c28 [0066.851] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0066.851] FindNextFileA (in: hFindFile=0x5b8c28, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0066.851] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0066.851] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0066.851] FindNextFileA (in: hFindFile=0x5b8c28, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0066.851] lstrcmpA (lpString1=".", lpString2="Access.en-us") returned -1 [0066.851] lstrcmpA (lpString1="..", lpString2="Access.en-us") returned -1 [0066.852] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\", lpString2="Access.en-us" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us" [0066.852] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5b8c68 [0066.859] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0066.859] FindNextFileA (in: hFindFile=0x5b8c68, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0066.859] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0066.859] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0066.859] FindNextFileA (in: hFindFile=0x5b8c68, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0066.860] PeekMessageA (in: lpMsg=0xaef84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaef84) returned 0 [0066.860] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="AccessMUI.XML") returned 1 [0066.860] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AccessMUI.XML") returned 1 [0066.860] lstrcmpiA (lpString1="", lpString2="AccessMUI.XML") returned -1 [0066.860] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\", lpString2="AccessMUI.XML" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML" [0066.860] FindNextFileA (in: hFindFile=0x5b8c68, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0066.860] PeekMessageA (in: lpMsg=0xaef84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaef84) returned 0 [0066.860] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="AccessMUISet.XML") returned 1 [0066.860] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AccessMUISet.XML") returned 1 [0066.860] lstrcmpiA (lpString1="", lpString2="AccessMUISet.XML") returned -1 [0066.860] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\", lpString2="AccessMUISet.XML" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML" [0066.860] FindNextFileA (in: hFindFile=0x5b8c68, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0066.860] PeekMessageA (in: lpMsg=0xaef84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaef84) returned 0 [0066.860] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="SETUP.XML") returned -1 [0066.860] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SETUP.XML") returned -1 [0066.860] lstrcmpiA (lpString1="", lpString2="SETUP.XML") returned -1 [0066.860] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\", lpString2="SETUP.XML" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML" [0066.860] FindNextFileA (in: hFindFile=0x5b8c68, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0 [0066.860] FindClose (in: hFindFile=0x5b8c68 | out: hFindFile=0x5b8c68) returned 1 [0066.861] FindNextFileA (in: hFindFile=0x5b8c28, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0066.861] lstrcmpA (lpString1=".", lpString2="Excel.en-us") returned -1 [0066.861] lstrcmpA (lpString1="..", lpString2="Excel.en-us") returned -1 [0066.861] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\", lpString2="Excel.en-us" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us" [0066.861] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5b8c68 [0066.862] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0066.862] FindNextFileA (in: hFindFile=0x5b8c68, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0066.862] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0066.862] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0066.862] FindNextFileA (in: hFindFile=0x5b8c68, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0066.862] PeekMessageA (in: lpMsg=0xaef84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaef84) returned 0 [0066.862] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="ExcelMUI.XML") returned -1 [0066.862] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ExcelMUI.XML") returned 1 [0066.862] lstrcmpiA (lpString1="", lpString2="ExcelMUI.XML") returned -1 [0066.862] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\", lpString2="ExcelMUI.XML" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML" [0066.862] FindNextFileA (in: hFindFile=0x5b8c68, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0066.862] PeekMessageA (in: lpMsg=0xaef84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaef84) returned 0 [0066.862] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="SETUP.XML") returned -1 [0066.863] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SETUP.XML") returned -1 [0066.863] lstrcmpiA (lpString1="", lpString2="SETUP.XML") returned -1 [0066.863] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\", lpString2="SETUP.XML" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML" [0066.863] FindNextFileA (in: hFindFile=0x5b8c68, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0 [0066.863] FindClose (in: hFindFile=0x5b8c68 | out: hFindFile=0x5b8c68) returned 1 [0066.863] FindNextFileA (in: hFindFile=0x5b8c28, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0066.863] lstrcmpA (lpString1=".", lpString2="Groove.en-us") returned -1 [0066.863] lstrcmpA (lpString1="..", lpString2="Groove.en-us") returned -1 [0066.863] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\", lpString2="Groove.en-us" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us" [0066.863] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5b8c68 [0066.866] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0066.866] FindNextFileA (in: hFindFile=0x5b8c68, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0066.866] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0066.866] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0066.866] FindNextFileA (in: hFindFile=0x5b8c68, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0066.866] PeekMessageA (in: lpMsg=0xaef84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaef84) returned 0 [0066.866] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="GrooveMUI.XML") returned -1 [0066.866] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="GrooveMUI.XML") returned 1 [0066.867] lstrcmpiA (lpString1="", lpString2="GrooveMUI.XML") returned -1 [0066.867] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\", lpString2="GrooveMUI.XML" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML" [0066.867] FindNextFileA (in: hFindFile=0x5b8c68, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0066.867] PeekMessageA (in: lpMsg=0xaef84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaef84) returned 0 [0066.867] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="SETUP.XML") returned -1 [0066.867] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SETUP.XML") returned -1 [0066.867] lstrcmpiA (lpString1="", lpString2="SETUP.XML") returned -1 [0066.867] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\", lpString2="SETUP.XML" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML" [0066.867] FindNextFileA (in: hFindFile=0x5b8c68, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0 [0066.867] FindClose (in: hFindFile=0x5b8c68 | out: hFindFile=0x5b8c68) returned 1 [0066.867] FindNextFileA (in: hFindFile=0x5b8c28, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0066.867] lstrcmpA (lpString1=".", lpString2="InfoPath.en-us") returned -1 [0066.867] lstrcmpA (lpString1="..", lpString2="InfoPath.en-us") returned -1 [0066.867] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\", lpString2="InfoPath.en-us" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us" [0066.867] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5b8c68 [0066.868] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0066.868] FindNextFileA (in: hFindFile=0x5b8c68, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0066.868] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0066.868] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0066.868] FindNextFileA (in: hFindFile=0x5b8c68, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0066.868] PeekMessageA (in: lpMsg=0xaef84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaef84) returned 0 [0066.868] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="InfoPathMUI.XML") returned -1 [0066.868] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="InfoPathMUI.XML") returned -1 [0066.868] lstrcmpiA (lpString1="", lpString2="InfoPathMUI.XML") returned -1 [0066.868] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\", lpString2="InfoPathMUI.XML" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML" [0066.868] FindNextFileA (in: hFindFile=0x5b8c68, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0066.868] PeekMessageA (in: lpMsg=0xaef84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaef84) returned 0 [0066.868] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="SETUP.XML") returned -1 [0066.868] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SETUP.XML") returned -1 [0066.868] lstrcmpiA (lpString1="", lpString2="SETUP.XML") returned -1 [0066.869] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\", lpString2="SETUP.XML" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML" [0066.869] FindNextFileA (in: hFindFile=0x5b8c68, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0 [0066.869] FindClose (in: hFindFile=0x5b8c68 | out: hFindFile=0x5b8c68) returned 1 [0066.869] FindNextFileA (in: hFindFile=0x5b8c28, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0066.869] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0066.869] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="ODeploy.exe") returned -1 [0066.869] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ODeploy.exe") returned -1 [0066.869] lstrcmpiA (lpString1="", lpString2="ODeploy.exe") returned -1 [0066.869] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\", lpString2="ODeploy.exe" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\ODeploy.exe") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\ODeploy.exe" [0066.869] FindNextFileA (in: hFindFile=0x5b8c28, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0066.869] lstrcmpA (lpString1=".", lpString2="Office.en-us") returned -1 [0066.869] lstrcmpA (lpString1="..", lpString2="Office.en-us") returned -1 [0066.869] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\", lpString2="Office.en-us" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us" [0066.869] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5b8c68 [0066.898] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0066.898] FindNextFileA (in: hFindFile=0x5b8c68, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0066.898] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0066.898] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0066.898] FindNextFileA (in: hFindFile=0x5b8c68, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0066.898] PeekMessageA (in: lpMsg=0xaef84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaef84) returned 0 [0066.898] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BRANDING.DLL") returned 1 [0066.898] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BRANDING.DLL") returned 1 [0066.898] lstrcmpiA (lpString1="", lpString2="BRANDING.DLL") returned -1 [0066.898] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\", lpString2="BRANDING.DLL" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.DLL") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.DLL" [0066.899] FindNextFileA (in: hFindFile=0x5b8c68, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0066.899] PeekMessageA (in: lpMsg=0xaef84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaef84) returned 0 [0066.899] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BRANDING.XML") returned 1 [0066.899] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BRANDING.XML") returned 1 [0066.899] lstrcmpiA (lpString1="", lpString2="BRANDING.XML") returned -1 [0066.899] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\", lpString2="BRANDING.XML" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML" [0066.899] FindNextFileA (in: hFindFile=0x5b8c68, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0066.899] PeekMessageA (in: lpMsg=0xaef84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaef84) returned 0 [0066.899] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="OCT.CHM") returned -1 [0066.899] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OCT.CHM") returned -1 [0066.899] lstrcmpiA (lpString1="", lpString2="OCT.CHM") returned -1 [0066.899] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\", lpString2="OCT.CHM" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM" [0066.899] FindNextFileA (in: hFindFile=0x5b8c68, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0066.899] PeekMessageA (in: lpMsg=0xaef84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaef84) returned 0 [0066.899] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="OfficeMUI.XML") returned -1 [0066.899] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OfficeMUI.XML") returned -1 [0066.899] lstrcmpiA (lpString1="", lpString2="OfficeMUI.XML") returned -1 [0066.899] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\", lpString2="OfficeMUI.XML" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML" [0066.899] FindNextFileA (in: hFindFile=0x5b8c68, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0066.899] PeekMessageA (in: lpMsg=0xaef84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaef84) returned 0 [0066.899] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="OfficeMUISet.XML") returned -1 [0066.899] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OfficeMUISet.XML") returned -1 [0066.900] lstrcmpiA (lpString1="", lpString2="OfficeMUISet.XML") returned -1 [0066.900] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\", lpString2="OfficeMUISet.XML" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML" [0066.900] FindNextFileA (in: hFindFile=0x5b8c68, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0066.900] PeekMessageA (in: lpMsg=0xaef84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaef84) returned 0 [0066.900] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="OSETUPUI.DLL") returned -1 [0066.900] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OSETUPUI.DLL") returned -1 [0066.900] lstrcmpiA (lpString1="", lpString2="OSETUPUI.DLL") returned -1 [0066.900] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\", lpString2="OSETUPUI.DLL" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OSETUPUI.DLL") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OSETUPUI.DLL" [0066.900] FindNextFileA (in: hFindFile=0x5b8c68, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0066.900] PeekMessageA (in: lpMsg=0xaef84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaef84) returned 0 [0066.900] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="promointl.dll") returned -1 [0066.900] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="promointl.dll") returned -1 [0066.900] lstrcmpiA (lpString1="", lpString2="promointl.dll") returned -1 [0066.900] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\", lpString2="promointl.dll" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\promointl.dll") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\promointl.dll" [0066.900] FindNextFileA (in: hFindFile=0x5b8c68, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0066.900] PeekMessageA (in: lpMsg=0xaef84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaef84) returned 0 [0066.900] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="PSCONFIG.CHM") returned -1 [0066.900] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PSCONFIG.CHM") returned -1 [0066.900] lstrcmpiA (lpString1="", lpString2="PSCONFIG.CHM") returned -1 [0066.900] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\", lpString2="PSCONFIG.CHM" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM" [0066.900] FindNextFileA (in: hFindFile=0x5b8c68, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0066.900] PeekMessageA (in: lpMsg=0xaef84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaef84) returned 0 [0066.900] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="PSS10O.CHM") returned -1 [0066.900] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PSS10O.CHM") returned -1 [0066.901] lstrcmpiA (lpString1="", lpString2="PSS10O.CHM") returned -1 [0066.901] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\", lpString2="PSS10O.CHM" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM" [0066.901] FindNextFileA (in: hFindFile=0x5b8c68, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0066.901] PeekMessageA (in: lpMsg=0xaef84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaef84) returned 0 [0066.901] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="PSS10R.CHM") returned -1 [0066.901] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PSS10R.CHM") returned -1 [0066.901] lstrcmpiA (lpString1="", lpString2="PSS10R.CHM") returned -1 [0066.901] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\", lpString2="PSS10R.CHM" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM" [0066.901] FindNextFileA (in: hFindFile=0x5b8c68, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0066.901] PeekMessageA (in: lpMsg=0xaef84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaef84) returned 0 [0066.901] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="SETUP.CHM") returned -1 [0066.901] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SETUP.CHM") returned -1 [0066.901] lstrcmpiA (lpString1="", lpString2="SETUP.CHM") returned -1 [0066.901] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\", lpString2="SETUP.CHM" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM" [0066.901] FindNextFileA (in: hFindFile=0x5b8c68, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0066.901] PeekMessageA (in: lpMsg=0xaef84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaef84) returned 0 [0066.901] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="SETUP.XML") returned -1 [0066.901] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SETUP.XML") returned -1 [0066.901] lstrcmpiA (lpString1="", lpString2="SETUP.XML") returned -1 [0066.901] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\", lpString2="SETUP.XML" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML" [0066.901] FindNextFileA (in: hFindFile=0x5b8c68, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0 [0066.901] FindClose (in: hFindFile=0x5b8c68 | out: hFindFile=0x5b8c68) returned 1 [0066.902] FindNextFileA (in: hFindFile=0x5b8c28, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0066.902] lstrcmpA (lpString1=".", lpString2="Office32.en-us") returned -1 [0066.902] lstrcmpA (lpString1="..", lpString2="Office32.en-us") returned -1 [0066.902] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\", lpString2="Office32.en-us" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us" [0066.902] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5b8c68 [0066.903] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0066.903] FindNextFileA (in: hFindFile=0x5b8c68, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0066.903] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0066.903] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0066.903] FindNextFileA (in: hFindFile=0x5b8c68, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0066.903] PeekMessageA (in: lpMsg=0xaef84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaef84) returned 0 [0066.903] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Office32MUI.XML") returned -1 [0066.903] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Office32MUI.XML") returned -1 [0066.903] lstrcmpiA (lpString1="", lpString2="Office32MUI.XML") returned -1 [0066.904] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\", lpString2="Office32MUI.XML" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML" [0066.904] FindNextFileA (in: hFindFile=0x5b8c68, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0066.904] PeekMessageA (in: lpMsg=0xaef84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaef84) returned 0 [0066.904] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="SETUP.XML") returned -1 [0066.904] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SETUP.XML") returned -1 [0066.904] lstrcmpiA (lpString1="", lpString2="SETUP.XML") returned -1 [0066.904] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\", lpString2="SETUP.XML" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML" [0066.904] FindNextFileA (in: hFindFile=0x5b8c68, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0 [0066.904] FindClose (in: hFindFile=0x5b8c68 | out: hFindFile=0x5b8c68) returned 1 [0066.904] FindNextFileA (in: hFindFile=0x5b8c28, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0066.904] lstrcmpA (lpString1=".", lpString2="Office32.WW") returned -1 [0066.904] lstrcmpA (lpString1="..", lpString2="Office32.WW") returned -1 [0066.904] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\", lpString2="Office32.WW" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW" [0066.904] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5b8c68 [0066.912] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0066.912] FindNextFileA (in: hFindFile=0x5b8c68, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0066.912] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0066.912] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0066.912] FindNextFileA (in: hFindFile=0x5b8c68, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0066.912] PeekMessageA (in: lpMsg=0xaef84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaef84) returned 0 [0066.912] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Office32WW.XML") returned -1 [0066.912] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Office32WW.XML") returned -1 [0066.912] lstrcmpiA (lpString1="", lpString2="Office32WW.XML") returned -1 [0066.913] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\", lpString2="Office32WW.XML" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML" [0066.913] FindNextFileA (in: hFindFile=0x5b8c68, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0 [0066.913] FindClose (in: hFindFile=0x5b8c68 | out: hFindFile=0x5b8c68) returned 1 [0066.913] FindNextFileA (in: hFindFile=0x5b8c28, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0066.913] lstrcmpA (lpString1=".", lpString2="OneNote.en-us") returned -1 [0066.913] lstrcmpA (lpString1="..", lpString2="OneNote.en-us") returned -1 [0066.913] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\", lpString2="OneNote.en-us" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us" [0066.913] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5b8c68 [0066.914] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0066.914] FindNextFileA (in: hFindFile=0x5b8c68, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0066.914] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0066.914] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0066.914] FindNextFileA (in: hFindFile=0x5b8c68, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0066.914] PeekMessageA (in: lpMsg=0xaef84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaef84) returned 0 [0066.914] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="OneNoteMUI.XML") returned -1 [0066.914] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OneNoteMUI.XML") returned -1 [0066.914] lstrcmpiA (lpString1="", lpString2="OneNoteMUI.XML") returned -1 [0066.914] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\", lpString2="OneNoteMUI.XML" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML" [0066.914] FindNextFileA (in: hFindFile=0x5b8c68, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0066.914] PeekMessageA (in: lpMsg=0xaef84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaef84) returned 0 [0066.914] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="SETUP.XML") returned -1 [0066.914] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SETUP.XML") returned -1 [0066.914] lstrcmpiA (lpString1="", lpString2="SETUP.XML") returned -1 [0066.914] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\", lpString2="SETUP.XML" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML" [0066.914] FindNextFileA (in: hFindFile=0x5b8c68, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0 [0066.914] FindClose (in: hFindFile=0x5b8c68 | out: hFindFile=0x5b8c68) returned 1 [0066.914] FindNextFileA (in: hFindFile=0x5b8c28, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0066.915] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0066.915] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="OSETUP.DLL") returned -1 [0066.915] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OSETUP.DLL") returned -1 [0066.915] lstrcmpiA (lpString1="", lpString2="OSETUP.DLL") returned -1 [0066.915] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\", lpString2="OSETUP.DLL" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSETUP.DLL") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSETUP.DLL" [0066.915] FindNextFileA (in: hFindFile=0x5b8c28, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0066.915] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0066.915] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="OSetupPS.dll") returned -1 [0066.915] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OSetupPS.dll") returned -1 [0066.915] lstrcmpiA (lpString1="", lpString2="OSetupPS.dll") returned -1 [0066.915] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\", lpString2="OSetupPS.dll" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSetupPS.dll") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSetupPS.dll" [0066.915] FindNextFileA (in: hFindFile=0x5b8c28, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0066.915] lstrcmpA (lpString1=".", lpString2="Outlook.en-us") returned -1 [0066.915] lstrcmpA (lpString1="..", lpString2="Outlook.en-us") returned -1 [0066.915] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\", lpString2="Outlook.en-us" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us" [0066.915] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5b8c68 [0066.916] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0066.916] FindNextFileA (in: hFindFile=0x5b8c68, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0066.916] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0066.916] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0066.916] FindNextFileA (in: hFindFile=0x5b8c68, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0066.916] PeekMessageA (in: lpMsg=0xaef84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaef84) returned 0 [0066.916] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="OutlookMUI.XML") returned -1 [0066.916] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OutlookMUI.XML") returned -1 [0066.916] lstrcmpiA (lpString1="", lpString2="OutlookMUI.XML") returned -1 [0066.916] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\", lpString2="OutlookMUI.XML" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML" [0066.916] FindNextFileA (in: hFindFile=0x5b8c68, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0066.916] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="SETUP.XML") returned -1 [0066.916] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SETUP.XML") returned -1 [0066.916] lstrcmpiA (lpString1="", lpString2="SETUP.XML") returned -1 [0066.916] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\", lpString2="SETUP.XML" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML" [0066.917] FindNextFileA (in: hFindFile=0x5b8c68, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0 [0066.917] FindClose (in: hFindFile=0x5b8c68 | out: hFindFile=0x5b8c68) returned 1 [0066.917] FindNextFileA (in: hFindFile=0x5b8c28, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0066.917] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="pidgenx.dll") returned -1 [0066.917] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="pidgenx.dll") returned -1 [0066.917] lstrcmpiA (lpString1="", lpString2="pidgenx.dll") returned -1 [0066.917] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\", lpString2="pidgenx.dll" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pidgenx.dll") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pidgenx.dll" [0066.917] FindNextFileA (in: hFindFile=0x5b8c28, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0066.917] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="pkeyconfig-office.xrm-ms") returned -1 [0066.917] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="pkeyconfig-office.xrm-ms") returned -1 [0066.917] lstrcmpiA (lpString1="", lpString2="pkeyconfig-office.xrm-ms") returned -1 [0066.917] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\", lpString2="pkeyconfig-office.xrm-ms" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig-office.xrm-ms") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig-office.xrm-ms" [0066.917] FindNextFileA (in: hFindFile=0x5b8c28, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0066.917] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="pkeyconfig.companion.dll") returned -1 [0066.917] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="pkeyconfig.companion.dll") returned -1 [0066.917] lstrcmpiA (lpString1="", lpString2="pkeyconfig.companion.dll") returned -1 [0066.917] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\", lpString2="pkeyconfig.companion.dll" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig.companion.dll") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig.companion.dll" [0066.917] FindNextFileA (in: hFindFile=0x5b8c28, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0066.917] lstrcmpA (lpString1=".", lpString2="PowerPoint.en-us") returned -1 [0066.917] lstrcmpA (lpString1="..", lpString2="PowerPoint.en-us") returned -1 [0066.918] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\", lpString2="PowerPoint.en-us" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us" [0066.918] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5b8c68 [0066.918] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0066.918] FindNextFileA (in: hFindFile=0x5b8c68, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0066.918] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0066.918] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0066.919] FindNextFileA (in: hFindFile=0x5b8c68, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0066.919] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="PowerPointMUI.XML") returned -1 [0066.919] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PowerPointMUI.XML") returned -1 [0066.919] lstrcmpiA (lpString1="", lpString2="PowerPointMUI.XML") returned -1 [0066.919] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\", lpString2="PowerPointMUI.XML" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML" [0066.919] FindNextFileA (in: hFindFile=0x5b8c68, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0066.919] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="SETUP.XML") returned -1 [0066.919] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SETUP.XML") returned -1 [0066.919] lstrcmpiA (lpString1="", lpString2="SETUP.XML") returned -1 [0066.919] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\", lpString2="SETUP.XML" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML" [0066.919] FindNextFileA (in: hFindFile=0x5b8c68, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0 [0066.919] FindClose (in: hFindFile=0x5b8c68 | out: hFindFile=0x5b8c68) returned 1 [0066.919] FindNextFileA (in: hFindFile=0x5b8c28, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0066.919] lstrcmpA (lpString1=".", lpString2="PRJPROR") returned -1 [0066.919] lstrcmpA (lpString1="..", lpString2="PRJPROR") returned -1 [0066.919] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\", lpString2="PRJPROR" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR" [0066.919] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5b8c68 [0066.938] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0066.938] FindNextFileA (in: hFindFile=0x5b8c68, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0066.938] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0066.938] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0066.938] FindNextFileA (in: hFindFile=0x5b8c68, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0066.938] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="PrjProrWW.XML") returned -1 [0066.938] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PrjProrWW.XML") returned -1 [0066.938] lstrcmpiA (lpString1="", lpString2="PrjProrWW.XML") returned -1 [0066.938] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\", lpString2="PrjProrWW.XML" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML" [0066.938] FindNextFileA (in: hFindFile=0x5b8c68, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0066.938] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="SETUP.XML") returned -1 [0066.938] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SETUP.XML") returned -1 [0066.938] lstrcmpiA (lpString1="", lpString2="SETUP.XML") returned -1 [0066.938] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\", lpString2="SETUP.XML" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML" [0066.938] FindNextFileA (in: hFindFile=0x5b8c68, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0 [0066.938] FindClose (in: hFindFile=0x5b8c68 | out: hFindFile=0x5b8c68) returned 1 [0066.939] FindNextFileA (in: hFindFile=0x5b8c28, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0066.939] lstrcmpA (lpString1=".", lpString2="Project.en-us") returned -1 [0066.939] lstrcmpA (lpString1="..", lpString2="Project.en-us") returned -1 [0066.939] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\", lpString2="Project.en-us" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us" [0066.939] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5b8c68 [0066.939] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0066.939] FindNextFileA (in: hFindFile=0x5b8c68, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0066.940] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0066.940] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0066.940] FindNextFileA (in: hFindFile=0x5b8c68, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0066.940] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="ProjectMUI.XML") returned -1 [0066.940] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ProjectMUI.XML") returned -1 [0066.940] lstrcmpiA (lpString1="", lpString2="ProjectMUI.XML") returned -1 [0066.940] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\", lpString2="ProjectMUI.XML" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML" [0066.940] FindNextFileA (in: hFindFile=0x5b8c68, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0066.940] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="SETUP.XML") returned -1 [0066.940] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SETUP.XML") returned -1 [0066.940] lstrcmpiA (lpString1="", lpString2="SETUP.XML") returned -1 [0066.940] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\", lpString2="SETUP.XML" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML" [0066.940] FindNextFileA (in: hFindFile=0x5b8c68, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0 [0066.940] FindClose (in: hFindFile=0x5b8c68 | out: hFindFile=0x5b8c68) returned 1 [0066.940] FindNextFileA (in: hFindFile=0x5b8c28, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0066.940] lstrcmpA (lpString1=".", lpString2="Proof.en") returned -1 [0066.941] lstrcmpA (lpString1="..", lpString2="Proof.en") returned -1 [0066.941] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\", lpString2="Proof.en" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en" [0066.941] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5b8c68 [0066.942] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0066.942] FindNextFileA (in: hFindFile=0x5b8c68, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0066.942] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0066.942] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0066.942] FindNextFileA (in: hFindFile=0x5b8c68, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0066.942] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Proof.XML") returned -1 [0066.942] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Proof.XML") returned -1 [0066.942] lstrcmpiA (lpString1="", lpString2="Proof.XML") returned -1 [0066.942] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\", lpString2="Proof.XML" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML" [0066.942] FindNextFileA (in: hFindFile=0x5b8c68, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0 [0066.942] FindClose (in: hFindFile=0x5b8c68 | out: hFindFile=0x5b8c68) returned 1 [0066.942] FindNextFileA (in: hFindFile=0x5b8c28, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0066.942] lstrcmpA (lpString1=".", lpString2="Proof.es") returned -1 [0066.942] lstrcmpA (lpString1="..", lpString2="Proof.es") returned -1 [0066.942] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\", lpString2="Proof.es" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es" [0066.942] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5b8c68 [0066.943] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0066.943] FindNextFileA (in: hFindFile=0x5b8c68, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0066.943] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0066.943] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0066.943] FindNextFileA (in: hFindFile=0x5b8c68, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0066.943] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\", lpString2="Proof.XML" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML" [0066.944] FindNextFileA (in: hFindFile=0x5b8c68, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0 [0066.944] FindClose (in: hFindFile=0x5b8c68 | out: hFindFile=0x5b8c68) returned 1 [0066.944] FindNextFileA (in: hFindFile=0x5b8c28, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0066.944] lstrcmpA (lpString1=".", lpString2="Proof.fr") returned -1 [0066.944] lstrcmpA (lpString1="..", lpString2="Proof.fr") returned -1 [0066.944] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\", lpString2="Proof.fr" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr" [0066.944] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5b8c68 [0066.945] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0066.945] FindNextFileA (in: hFindFile=0x5b8c68, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0066.945] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0066.945] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0066.945] FindNextFileA (in: hFindFile=0x5b8c68, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0066.945] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\", lpString2="Proof.XML" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML" [0066.945] FindNextFileA (in: hFindFile=0x5b8c68, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0 [0066.945] FindClose (in: hFindFile=0x5b8c68 | out: hFindFile=0x5b8c68) returned 1 [0066.945] FindNextFileA (in: hFindFile=0x5b8c28, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0066.945] lstrcmpA (lpString1=".", lpString2="Proofing.en-us") returned -1 [0066.945] lstrcmpA (lpString1="..", lpString2="Proofing.en-us") returned -1 [0066.945] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\", lpString2="Proofing.en-us" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us" [0066.945] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5b8c68 [0066.945] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0066.946] FindNextFileA (in: hFindFile=0x5b8c68, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0066.946] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0066.946] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0066.946] FindNextFileA (in: hFindFile=0x5b8c68, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0066.946] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\", lpString2="Proofing.XML" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML" [0066.946] FindNextFileA (in: hFindFile=0x5b8c68, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0066.946] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\", lpString2="SETUP.XML" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML" [0066.946] FindNextFileA (in: hFindFile=0x5b8c68, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0 [0066.946] FindClose (in: hFindFile=0x5b8c68 | out: hFindFile=0x5b8c68) returned 1 [0066.946] FindNextFileA (in: hFindFile=0x5b8c28, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0066.946] lstrcmpA (lpString1=".", lpString2="PROPLUSR") returned -1 [0066.946] lstrcmpA (lpString1="..", lpString2="PROPLUSR") returned -1 [0066.946] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\", lpString2="PROPLUSR" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR" [0066.946] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5b8c68 [0066.992] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0066.992] FindNextFileA (in: hFindFile=0x5b8c68, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0066.992] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0066.992] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0066.992] FindNextFileA (in: hFindFile=0x5b8c68, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0066.992] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\", lpString2="ProPlusrWW.XML" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML" [0066.992] FindNextFileA (in: hFindFile=0x5b8c68, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0066.992] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\", lpString2="SETUP.XML" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML" [0066.992] FindNextFileA (in: hFindFile=0x5b8c68, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0 [0066.992] FindClose (in: hFindFile=0x5b8c68 | out: hFindFile=0x5b8c68) returned 1 [0066.992] FindNextFileA (in: hFindFile=0x5b8c28, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0066.992] lstrcmpA (lpString1=".", lpString2="Publisher.en-us") returned -1 [0066.992] lstrcmpA (lpString1="..", lpString2="Publisher.en-us") returned -1 [0066.993] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\", lpString2="Publisher.en-us" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us" [0066.993] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5b8c68 [0066.996] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0066.996] FindNextFileA (in: hFindFile=0x5b8c68, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0066.996] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0066.996] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0066.996] FindNextFileA (in: hFindFile=0x5b8c68, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0066.996] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\", lpString2="PublisherMUI.XML" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML" [0066.996] FindNextFileA (in: hFindFile=0x5b8c68, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0066.996] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\", lpString2="SETUP.XML" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML" [0066.996] FindNextFileA (in: hFindFile=0x5b8c68, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0 [0066.996] FindClose (in: hFindFile=0x5b8c68 | out: hFindFile=0x5b8c68) returned 1 [0066.996] FindNextFileA (in: hFindFile=0x5b8c28, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0066.996] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\", lpString2="Setup.exe" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Setup.exe") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Setup.exe" [0066.996] FindNextFileA (in: hFindFile=0x5b8c28, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0066.996] lstrcmpA (lpString1=".", lpString2="Visio.en-us") returned -1 [0066.997] lstrcmpA (lpString1="..", lpString2="Visio.en-us") returned -1 [0066.997] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\", lpString2="Visio.en-us" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us" [0066.997] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5b8c68 [0066.998] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0066.998] FindNextFileA (in: hFindFile=0x5b8c68, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0066.998] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0066.998] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0066.998] FindNextFileA (in: hFindFile=0x5b8c68, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0066.998] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\", lpString2="SETUP.XML" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML" [0066.998] FindNextFileA (in: hFindFile=0x5b8c68, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0066.998] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\", lpString2="VisioMUI.XML" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML" [0066.998] FindNextFileA (in: hFindFile=0x5b8c68, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0 [0066.999] FindClose (in: hFindFile=0x5b8c68 | out: hFindFile=0x5b8c68) returned 1 [0066.999] FindNextFileA (in: hFindFile=0x5b8c28, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0066.999] lstrcmpA (lpString1=".", lpString2="VISIOR") returned -1 [0066.999] lstrcmpA (lpString1="..", lpString2="VISIOR") returned -1 [0066.999] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\", lpString2="VISIOR" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR" [0066.999] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5b8c68 [0066.999] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0066.999] FindNextFileA (in: hFindFile=0x5b8c68, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0066.999] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0066.999] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0066.999] FindNextFileA (in: hFindFile=0x5b8c68, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0066.999] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\", lpString2="SETUP.XML" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML" [0066.999] FindNextFileA (in: hFindFile=0x5b8c68, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0066.999] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\", lpString2="VisiorWW.XML" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML" [0066.999] FindNextFileA (in: hFindFile=0x5b8c68, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0 [0066.999] FindClose (in: hFindFile=0x5b8c68 | out: hFindFile=0x5b8c68) returned 1 [0066.999] FindNextFileA (in: hFindFile=0x5b8c28, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0066.999] lstrcmpA (lpString1=".", lpString2="Word.en-us") returned -1 [0066.999] lstrcmpA (lpString1="..", lpString2="Word.en-us") returned -1 [0067.000] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\", lpString2="Word.en-us" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us" [0067.000] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5b8c68 [0067.000] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0067.000] FindNextFileA (in: hFindFile=0x5b8c68, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0067.000] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0067.000] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0067.000] FindNextFileA (in: hFindFile=0x5b8c68, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0067.001] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\", lpString2="SETUP.XML" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML" [0067.001] FindNextFileA (in: hFindFile=0x5b8c68, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0067.001] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\", lpString2="WordMUI.XML" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML" [0067.001] FindNextFileA (in: hFindFile=0x5b8c68, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0 [0067.001] FindClose (in: hFindFile=0x5b8c68 | out: hFindFile=0x5b8c68) returned 1 [0067.001] FindNextFileA (in: hFindFile=0x5b8c28, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0 [0067.001] FindClose (in: hFindFile=0x5b8c28 | out: hFindFile=0x5b8c28) returned 1 [0067.001] FindNextFileA (in: hFindFile=0x5b7be0, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0067.001] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\", lpString2="OFFREL.DLL" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OFFREL.DLL") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OFFREL.DLL" [0067.001] FindNextFileA (in: hFindFile=0x5b7be0, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0067.001] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\", lpString2="OPHPROXY.DLL" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPHPROXY.DLL") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPHPROXY.DLL" [0067.001] FindNextFileA (in: hFindFile=0x5b7be0, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0067.001] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\", lpString2="OPTINPS.DLL" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPTINPS.DLL") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPTINPS.DLL" [0067.001] FindNextFileA (in: hFindFile=0x5b7be0, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0067.001] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\", lpString2="PJ11OD11.DLL" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJ11OD11.DLL") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJ11OD11.DLL" [0067.001] FindNextFileA (in: hFindFile=0x5b7be0, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0067.002] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\", lpString2="PJRESC.DLL" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJRESC.DLL") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJRESC.DLL" [0067.002] FindNextFileA (in: hFindFile=0x5b7be0, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0067.002] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\", lpString2="PRJRES.DLL" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PRJRES.DLL") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PRJRES.DLL" [0067.002] FindNextFileA (in: hFindFile=0x5b7be0, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0067.002] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\", lpString2="RICHED20.DLL" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\RICHED20.DLL") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\RICHED20.DLL" [0067.002] FindNextFileA (in: hFindFile=0x5b7be0, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0067.002] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\", lpString2="SERCONV.DLL" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\SERCONV.DLL") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\SERCONV.DLL" [0067.002] FindNextFileA (in: hFindFile=0x5b7be0, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0067.002] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\", lpString2="USP10.DLL" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\USP10.DLL") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\USP10.DLL" [0067.002] FindNextFileA (in: hFindFile=0x5b7be0, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0067.002] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\", lpString2="VBAJET32.DLL" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\VBAJET32.DLL") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\VBAJET32.DLL" [0067.002] FindNextFileA (in: hFindFile=0x5b7be0, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0067.002] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\", lpString2="WISC30.DLL" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\WISC30.DLL") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\WISC30.DLL" [0067.002] FindNextFileA (in: hFindFile=0x5b7be0, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0 [0067.002] FindClose (in: hFindFile=0x5b7be0 | out: hFindFile=0x5b7be0) returned 1 [0067.002] FindNextFileA (in: hFindFile=0x5ba128, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0067.002] lstrcmpA (lpString1=".", lpString2="OfficeSoftwareProtectionPlatform") returned -1 [0067.003] lstrcmpA (lpString1="..", lpString2="OfficeSoftwareProtectionPlatform") returned -1 [0067.003] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\", lpString2="OfficeSoftwareProtectionPlatform" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform" [0067.003] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5b7c90 [0067.004] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0067.004] FindNextFileA (in: hFindFile=0x5b7c90, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0067.004] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0067.004] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0067.004] FindNextFileA (in: hFindFile=0x5b7c90, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0067.004] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\", lpString2="OSPPC.DLL" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPC.DLL") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPC.DLL" [0067.004] FindNextFileA (in: hFindFile=0x5b7c90, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0067.004] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\", lpString2="OSPPCEXT.DLL" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPCEXT.DLL") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPCEXT.DLL" [0067.004] FindNextFileA (in: hFindFile=0x5b7c90, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0067.004] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\", lpString2="osppobjs-spp-plugin-manifest-signed.xrm-ms" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms" [0067.004] FindNextFileA (in: hFindFile=0x5b7c90, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0067.004] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\", lpString2="OSPPOBJS.DLL" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPOBJS.DLL") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPOBJS.DLL" [0067.004] FindNextFileA (in: hFindFile=0x5b7c90, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0067.004] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\", lpString2="OSPPREARM.EXE" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPREARM.EXE") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPREARM.EXE" [0067.004] FindNextFileA (in: hFindFile=0x5b7c90, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0067.004] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\", lpString2="OSPPSVC.EXE" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPSVC.EXE") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPSVC.EXE" [0067.004] FindNextFileA (in: hFindFile=0x5b7c90, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0067.004] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\", lpString2="OSPPWMI.DLL" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.DLL") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.DLL" [0067.005] FindNextFileA (in: hFindFile=0x5b7c90, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0067.005] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\", lpString2="OSPPWMI.MOF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.MOF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.MOF" [0067.005] FindNextFileA (in: hFindFile=0x5b7c90, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0 [0067.005] FindClose (in: hFindFile=0x5b7c90 | out: hFindFile=0x5b7c90) returned 1 [0067.005] FindNextFileA (in: hFindFile=0x5ba128, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0067.006] lstrcmpA (lpString1=".", lpString2="PROOF") returned -1 [0067.006] lstrcmpA (lpString1="..", lpString2="PROOF") returned -1 [0067.006] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\", lpString2="PROOF" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF" [0067.006] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5b7be0 [0067.007] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0067.007] FindNextFileA (in: hFindFile=0x5b7be0, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0067.007] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0067.007] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0067.007] FindNextFileA (in: hFindFile=0x5b7be0, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0067.007] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\", lpString2="MSLID.DLL" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSLID.DLL") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSLID.DLL" [0067.007] FindNextFileA (in: hFindFile=0x5b7be0, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0067.007] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\", lpString2="MSWDS_EN.LEX" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_EN.LEX") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_EN.LEX" [0067.007] FindNextFileA (in: hFindFile=0x5b7be0, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0067.007] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\", lpString2="MSWDS_ES.LEX" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_ES.LEX") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_ES.LEX" [0067.007] FindNextFileA (in: hFindFile=0x5b7be0, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0067.007] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\", lpString2="MSWDS_FR.LEX" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_FR.LEX") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_FR.LEX" [0067.007] FindNextFileA (in: hFindFile=0x5b7be0, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0 [0067.007] FindClose (in: hFindFile=0x5b7be0 | out: hFindFile=0x5b7be0) returned 1 [0067.007] FindNextFileA (in: hFindFile=0x5ba128, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0067.007] lstrcmpA (lpString1=".", lpString2="Smart Tag") returned -1 [0067.007] lstrcmpA (lpString1="..", lpString2="Smart Tag") returned -1 [0067.007] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\", lpString2="Smart Tag" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag" [0067.008] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5b7c68 [0067.015] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0067.015] FindNextFileA (in: hFindFile=0x5b7c68, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0067.015] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0067.015] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0067.015] FindNextFileA (in: hFindFile=0x5b7c68, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0067.015] lstrcmpA (lpString1=".", lpString2="1033") returned -1 [0067.015] lstrcmpA (lpString1="..", lpString2="1033") returned -1 [0067.016] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\", lpString2="1033" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033" [0067.016] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5b7be0 [0067.017] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0067.017] FindNextFileA (in: hFindFile=0x5b7be0, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0067.017] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0067.017] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0067.017] FindNextFileA (in: hFindFile=0x5b7be0, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0067.017] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\", lpString2="MCABOUT.HTM" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM" [0067.017] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM" [0067.017] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM" [0067.017] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM.") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM." [0067.018] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM. ") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM. " [0067.018] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\mcabout.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0067.018] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2cc7 [0067.018] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xc52bb100, dwHighDateTime=0x1ca6185), lpLastAccessTime=0x407536*(dwLowDateTime=0xeee1cd90, dwHighDateTime=0x1d301be), lpLastWriteTime=0x40753e*(dwLowDateTime=0xc52bb100, dwHighDateTime=0x1ca6185)) returned 1 [0067.018] SetFilePointer (in: hFile=0x90, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0067.018] ReadFile (in: hFile=0x90, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x2c6d, lpOverlapped=0x0) returned 1 [0067.028] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0067.028] CloseHandle (hObject=0x90) returned 1 [0067.028] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\mcabout.htm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM. " (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\mcabout.htm. ")) returned 1 [0067.029] FindNextFileA (in: hFindFile=0x5b7be0, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0067.029] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0067.029] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned="MCABOUT.HTM" [0067.029] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\", lpString2="STINTL.DLL" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL" [0067.029] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL", pszSpec="*.zip") returned 0 [0067.029] lstrlenA (lpString="*.zip") returned 5 [0067.029] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL", pszSpec="*.rar") returned 0 [0067.029] lstrlenA (lpString="*.rar") returned 5 [0067.029] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL", pszSpec="*.7z") returned 0 [0067.029] lstrlenA (lpString="*.7z") returned 4 [0067.029] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL", pszSpec="*.tar") returned 0 [0067.029] lstrlenA (lpString="*.tar") returned 5 [0067.029] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL", pszSpec="*.gzip") returned 0 [0067.029] lstrlenA (lpString="*.gzip") returned 6 [0067.029] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL", pszSpec="*.jpg") returned 0 [0067.029] lstrlenA (lpString="*.jpg") returned 5 [0067.029] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL", pszSpec="*.jpeg") returned 0 [0067.029] lstrlenA (lpString="*.jpeg") returned 6 [0067.029] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL", pszSpec="*.psd") returned 0 [0067.029] lstrlenA (lpString="*.psd") returned 5 [0067.029] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL", pszSpec="*.cdr") returned 0 [0067.029] lstrlenA (lpString="*.cdr") returned 5 [0067.029] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL", pszSpec="*.dwg") returned 0 [0067.029] lstrlenA (lpString="*.dwg") returned 5 [0067.029] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL", pszSpec="*.max") returned 0 [0067.029] lstrlenA (lpString="*.max") returned 5 [0067.030] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL", pszSpec="*.bmp") returned 0 [0067.030] lstrlenA (lpString="*.bmp") returned 5 [0067.030] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL", pszSpec="*.gif") returned 0 [0067.030] lstrlenA (lpString="*.gif") returned 5 [0067.030] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL", pszSpec="*.png") returned 0 [0067.030] lstrlenA (lpString="*.png") returned 5 [0067.030] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL", pszSpec="*.doc") returned 0 [0067.030] lstrlenA (lpString="*.doc") returned 5 [0067.030] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL", pszSpec="*.docx") returned 0 [0067.030] lstrlenA (lpString="*.docx") returned 6 [0067.030] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL", pszSpec="*.xls") returned 0 [0067.030] lstrlenA (lpString="*.xls") returned 5 [0067.030] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL", pszSpec="*.xlsx") returned 0 [0067.030] lstrlenA (lpString="*.xlsx") returned 6 [0067.030] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL", pszSpec="*.ppt") returned 0 [0067.030] lstrlenA (lpString="*.ppt") returned 5 [0067.030] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL", pszSpec="*.pptx") returned 0 [0067.030] lstrlenA (lpString="*.pptx") returned 6 [0067.030] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL", pszSpec="*.txt") returned 0 [0067.030] lstrlenA (lpString="*.txt") returned 5 [0067.030] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL", pszSpec="*.pdf") returned 0 [0067.030] lstrlenA (lpString="*.pdf") returned 5 [0067.030] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL", pszSpec="*.djvu") returned 0 [0067.030] lstrlenA (lpString="*.djvu") returned 6 [0067.030] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL", pszSpec="*.htm") returned 0 [0067.030] lstrlenA (lpString="*.htm") returned 5 [0067.030] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL", pszSpec="*.html") returned 0 [0067.030] lstrlenA (lpString="*.html") returned 6 [0067.030] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL", pszSpec="*.mdb") returned 0 [0067.030] lstrlenA (lpString="*.mdb") returned 5 [0067.030] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL", pszSpec="*.cer") returned 0 [0067.030] lstrlenA (lpString="*.cer") returned 5 [0067.030] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL", pszSpec="*.p12") returned 0 [0067.030] lstrlenA (lpString="*.p12") returned 5 [0067.030] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL", pszSpec="*.pfx") returned 0 [0067.030] lstrlenA (lpString="*.pfx") returned 5 [0067.030] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL", pszSpec="*.kwm") returned 0 [0067.030] lstrlenA (lpString="*.kwm") returned 5 [0067.030] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL", pszSpec="*.pwm") returned 0 [0067.031] lstrlenA (lpString="*.pwm") returned 5 [0067.031] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL", pszSpec="*.1cd") returned 0 [0067.031] lstrlenA (lpString="*.1cd") returned 5 [0067.031] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL", pszSpec="*.md") returned 0 [0067.031] lstrlenA (lpString="*.md") returned 4 [0067.031] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL", pszSpec="*.mdf") returned 0 [0067.031] lstrlenA (lpString="*.mdf") returned 5 [0067.031] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL", pszSpec="*.dbf") returned 0 [0067.031] lstrlenA (lpString="*.dbf") returned 5 [0067.031] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL", pszSpec="*.odt") returned 0 [0067.031] lstrlenA (lpString="*.odt") returned 5 [0067.031] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL", pszSpec="*.vob") returned 0 [0067.031] lstrlenA (lpString="*.vob") returned 5 [0067.031] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL", pszSpec="*.ifo") returned 0 [0067.031] lstrlenA (lpString="*.ifo") returned 5 [0067.031] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL", pszSpec="*.lnk") returned 0 [0067.031] lstrlenA (lpString="*.lnk") returned 5 [0067.031] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL", pszSpec="*.torrent") returned 0 [0067.031] lstrlenA (lpString="*.torrent") returned 9 [0067.031] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL", pszSpec="*.mov") returned 0 [0067.031] lstrlenA (lpString="*.mov") returned 5 [0067.031] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL", pszSpec="*.m2v") returned 0 [0067.031] lstrlenA (lpString="*.m2v") returned 5 [0067.031] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL", pszSpec="*.3gp") returned 0 [0067.031] lstrlenA (lpString="*.3gp") returned 5 [0067.031] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL", pszSpec="*.mpeg") returned 0 [0067.031] lstrlenA (lpString="*.mpeg") returned 6 [0067.031] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL", pszSpec="*.mpg") returned 0 [0067.031] lstrlenA (lpString="*.mpg") returned 5 [0067.031] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL", pszSpec="*.flv") returned 0 [0067.031] lstrlenA (lpString="*.flv") returned 5 [0067.031] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL", pszSpec="*.avi") returned 0 [0067.031] lstrlenA (lpString="*.avi") returned 5 [0067.031] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL", pszSpec="*.mp4") returned 0 [0067.031] lstrlenA (lpString="*.mp4") returned 5 [0067.031] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL", pszSpec="*.wmv") returned 0 [0067.031] lstrlenA (lpString="*.wmv") returned 5 [0067.031] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL", pszSpec="*.divx") returned 0 [0067.031] lstrlenA (lpString="*.divx") returned 6 [0067.032] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL", pszSpec="*.mkv") returned 0 [0067.032] lstrlenA (lpString="*.mkv") returned 5 [0067.032] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL", pszSpec="*.mp3") returned 0 [0067.032] lstrlenA (lpString="*.mp3") returned 5 [0067.032] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL", pszSpec="*.wav") returned 0 [0067.032] lstrlenA (lpString="*.wav") returned 5 [0067.032] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL", pszSpec="*.flac") returned 0 [0067.032] lstrlenA (lpString="*.flac") returned 6 [0067.032] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL", pszSpec="*.ape") returned 0 [0067.032] lstrlenA (lpString="*.ape") returned 5 [0067.032] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL", pszSpec="*.wma") returned 0 [0067.032] lstrlenA (lpString="*.wma") returned 5 [0067.032] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL", pszSpec="*.ac3") returned 0 [0067.032] lstrlenA (lpString="*.ac3") returned 5 [0067.032] FindNextFileA (in: hFindFile=0x5b7be0, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0067.032] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0067.032] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="STINTL.DLL.IDX_DLL") returned -1 [0067.032] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="STINTL.DLL.IDX_DLL") returned -1 [0067.032] lstrcmpiA (lpString1="", lpString2="STINTL.DLL.IDX_DLL") returned -1 [0067.032] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL") returned="STINTL.DLL" [0067.032] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\", lpString2="STINTL.DLL.IDX_DLL" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL" [0067.032] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL", pszSpec="*.zip") returned 0 [0067.032] lstrlenA (lpString="*.zip") returned 5 [0067.032] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL", pszSpec="*.rar") returned 0 [0067.032] lstrlenA (lpString="*.rar") returned 5 [0067.032] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL", pszSpec="*.7z") returned 0 [0067.032] lstrlenA (lpString="*.7z") returned 4 [0067.032] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL", pszSpec="*.tar") returned 0 [0067.032] lstrlenA (lpString="*.tar") returned 5 [0067.032] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL", pszSpec="*.gzip") returned 0 [0067.032] lstrlenA (lpString="*.gzip") returned 6 [0067.032] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL", pszSpec="*.jpg") returned 0 [0067.032] lstrlenA (lpString="*.jpg") returned 5 [0067.032] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL", pszSpec="*.jpeg") returned 0 [0067.032] lstrlenA (lpString="*.jpeg") returned 6 [0067.032] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL", pszSpec="*.psd") returned 0 [0067.032] lstrlenA (lpString="*.psd") returned 5 [0067.032] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL", pszSpec="*.cdr") returned 0 [0067.033] lstrlenA (lpString="*.cdr") returned 5 [0067.033] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL", pszSpec="*.dwg") returned 0 [0067.033] lstrlenA (lpString="*.dwg") returned 5 [0067.033] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL", pszSpec="*.max") returned 0 [0067.033] lstrlenA (lpString="*.max") returned 5 [0067.033] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL", pszSpec="*.bmp") returned 0 [0067.033] lstrlenA (lpString="*.bmp") returned 5 [0067.033] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL", pszSpec="*.gif") returned 0 [0067.033] lstrlenA (lpString="*.gif") returned 5 [0067.033] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL", pszSpec="*.png") returned 0 [0067.033] lstrlenA (lpString="*.png") returned 5 [0067.033] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL", pszSpec="*.doc") returned 0 [0067.033] lstrlenA (lpString="*.doc") returned 5 [0067.033] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL", pszSpec="*.docx") returned 0 [0067.033] lstrlenA (lpString="*.docx") returned 6 [0067.033] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL", pszSpec="*.xls") returned 0 [0067.033] lstrlenA (lpString="*.xls") returned 5 [0067.033] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL", pszSpec="*.xlsx") returned 0 [0067.033] lstrlenA (lpString="*.xlsx") returned 6 [0067.033] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL", pszSpec="*.ppt") returned 0 [0067.033] lstrlenA (lpString="*.ppt") returned 5 [0067.033] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL", pszSpec="*.pptx") returned 0 [0067.033] lstrlenA (lpString="*.pptx") returned 6 [0067.033] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL", pszSpec="*.txt") returned 0 [0067.033] lstrlenA (lpString="*.txt") returned 5 [0067.033] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL", pszSpec="*.pdf") returned 0 [0067.033] lstrlenA (lpString="*.pdf") returned 5 [0067.033] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL", pszSpec="*.djvu") returned 0 [0067.033] lstrlenA (lpString="*.djvu") returned 6 [0067.033] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL", pszSpec="*.htm") returned 0 [0067.033] lstrlenA (lpString="*.htm") returned 5 [0067.033] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL", pszSpec="*.html") returned 0 [0067.033] lstrlenA (lpString="*.html") returned 6 [0067.033] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL", pszSpec="*.mdb") returned 0 [0067.033] lstrlenA (lpString="*.mdb") returned 5 [0067.033] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL", pszSpec="*.cer") returned 0 [0067.033] lstrlenA (lpString="*.cer") returned 5 [0067.033] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL", pszSpec="*.p12") returned 0 [0067.033] lstrlenA (lpString="*.p12") returned 5 [0067.034] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL", pszSpec="*.pfx") returned 0 [0067.034] lstrlenA (lpString="*.pfx") returned 5 [0067.034] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL", pszSpec="*.kwm") returned 0 [0067.034] lstrlenA (lpString="*.kwm") returned 5 [0067.034] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL", pszSpec="*.pwm") returned 0 [0067.034] lstrlenA (lpString="*.pwm") returned 5 [0067.034] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL", pszSpec="*.1cd") returned 0 [0067.034] lstrlenA (lpString="*.1cd") returned 5 [0067.034] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL", pszSpec="*.md") returned 0 [0067.034] lstrlenA (lpString="*.md") returned 4 [0067.034] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL", pszSpec="*.mdf") returned 0 [0067.034] lstrlenA (lpString="*.mdf") returned 5 [0067.034] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL", pszSpec="*.dbf") returned 0 [0067.034] lstrlenA (lpString="*.dbf") returned 5 [0067.034] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL", pszSpec="*.odt") returned 0 [0067.034] lstrlenA (lpString="*.odt") returned 5 [0067.034] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL", pszSpec="*.vob") returned 0 [0067.034] lstrlenA (lpString="*.vob") returned 5 [0067.034] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL", pszSpec="*.ifo") returned 0 [0067.034] lstrlenA (lpString="*.ifo") returned 5 [0067.034] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL", pszSpec="*.lnk") returned 0 [0067.034] lstrlenA (lpString="*.lnk") returned 5 [0067.034] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL", pszSpec="*.torrent") returned 0 [0067.034] lstrlenA (lpString="*.torrent") returned 9 [0067.034] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL", pszSpec="*.mov") returned 0 [0067.034] lstrlenA (lpString="*.mov") returned 5 [0067.034] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL", pszSpec="*.m2v") returned 0 [0067.034] lstrlenA (lpString="*.m2v") returned 5 [0067.034] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL", pszSpec="*.3gp") returned 0 [0067.034] lstrlenA (lpString="*.3gp") returned 5 [0067.034] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL", pszSpec="*.mpeg") returned 0 [0067.034] lstrlenA (lpString="*.mpeg") returned 6 [0067.035] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL", pszSpec="*.mpg") returned 0 [0067.035] lstrlenA (lpString="*.mpg") returned 5 [0067.035] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL", pszSpec="*.flv") returned 0 [0067.035] lstrlenA (lpString="*.flv") returned 5 [0067.035] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL", pszSpec="*.avi") returned 0 [0067.035] lstrlenA (lpString="*.avi") returned 5 [0067.035] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL", pszSpec="*.mp4") returned 0 [0067.035] lstrlenA (lpString="*.mp4") returned 5 [0067.035] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL", pszSpec="*.wmv") returned 0 [0067.035] lstrlenA (lpString="*.wmv") returned 5 [0067.035] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL", pszSpec="*.divx") returned 0 [0067.035] lstrlenA (lpString="*.divx") returned 6 [0067.035] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL", pszSpec="*.mkv") returned 0 [0067.035] lstrlenA (lpString="*.mkv") returned 5 [0067.035] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL", pszSpec="*.mp3") returned 0 [0067.035] lstrlenA (lpString="*.mp3") returned 5 [0067.035] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL", pszSpec="*.wav") returned 0 [0067.035] lstrlenA (lpString="*.wav") returned 5 [0067.035] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL", pszSpec="*.flac") returned 0 [0067.035] lstrlenA (lpString="*.flac") returned 6 [0067.035] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL", pszSpec="*.ape") returned 0 [0067.035] lstrlenA (lpString="*.ape") returned 5 [0067.035] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL", pszSpec="*.wma") returned 0 [0067.035] lstrlenA (lpString="*.wma") returned 5 [0067.035] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL", pszSpec="*.ac3") returned 0 [0067.035] lstrlenA (lpString="*.ac3") returned 5 [0067.035] FindNextFileA (in: hFindFile=0x5b7be0, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0 [0067.035] FindClose (in: hFindFile=0x5b7be0 | out: hFindFile=0x5b7be0) returned 1 [0067.035] FindNextFileA (in: hFindFile=0x5b7c68, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0067.035] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0067.035] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="FBIBLIO.DLL") returned -1 [0067.035] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FBIBLIO.DLL") returned 1 [0067.035] lstrcmpiA (lpString1="", lpString2="FBIBLIO.DLL") returned -1 [0067.035] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\*.*") returned="*.*" [0067.036] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\", lpString2="FBIBLIO.DLL" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL" [0067.036] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL", pszSpec="*.zip") returned 0 [0067.036] lstrlenA (lpString="*.zip") returned 5 [0067.036] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL", pszSpec="*.rar") returned 0 [0067.036] lstrlenA (lpString="*.rar") returned 5 [0067.036] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL", pszSpec="*.7z") returned 0 [0067.036] lstrlenA (lpString="*.7z") returned 4 [0067.036] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL", pszSpec="*.tar") returned 0 [0067.036] lstrlenA (lpString="*.tar") returned 5 [0067.036] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL", pszSpec="*.gzip") returned 0 [0067.036] lstrlenA (lpString="*.gzip") returned 6 [0067.036] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL", pszSpec="*.jpg") returned 0 [0067.036] lstrlenA (lpString="*.jpg") returned 5 [0067.036] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL", pszSpec="*.jpeg") returned 0 [0067.036] lstrlenA (lpString="*.jpeg") returned 6 [0067.036] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL", pszSpec="*.psd") returned 0 [0067.036] lstrlenA (lpString="*.psd") returned 5 [0067.036] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL", pszSpec="*.cdr") returned 0 [0067.036] lstrlenA (lpString="*.cdr") returned 5 [0067.036] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL", pszSpec="*.dwg") returned 0 [0067.036] lstrlenA (lpString="*.dwg") returned 5 [0067.036] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL", pszSpec="*.max") returned 0 [0067.036] lstrlenA (lpString="*.max") returned 5 [0067.036] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL", pszSpec="*.bmp") returned 0 [0067.036] lstrlenA (lpString="*.bmp") returned 5 [0067.036] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL", pszSpec="*.gif") returned 0 [0067.036] lstrlenA (lpString="*.gif") returned 5 [0067.036] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL", pszSpec="*.png") returned 0 [0067.036] lstrlenA (lpString="*.png") returned 5 [0067.036] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL", pszSpec="*.doc") returned 0 [0067.036] lstrlenA (lpString="*.doc") returned 5 [0067.036] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL", pszSpec="*.docx") returned 0 [0067.036] lstrlenA (lpString="*.docx") returned 6 [0067.036] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL", pszSpec="*.xls") returned 0 [0067.036] lstrlenA (lpString="*.xls") returned 5 [0067.036] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL", pszSpec="*.xlsx") returned 0 [0067.036] lstrlenA (lpString="*.xlsx") returned 6 [0067.036] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL", pszSpec="*.ppt") returned 0 [0067.036] lstrlenA (lpString="*.ppt") returned 5 [0067.037] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL", pszSpec="*.pptx") returned 0 [0067.037] lstrlenA (lpString="*.pptx") returned 6 [0067.037] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL", pszSpec="*.txt") returned 0 [0067.037] lstrlenA (lpString="*.txt") returned 5 [0067.037] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL", pszSpec="*.pdf") returned 0 [0067.037] lstrlenA (lpString="*.pdf") returned 5 [0067.037] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL", pszSpec="*.djvu") returned 0 [0067.037] lstrlenA (lpString="*.djvu") returned 6 [0067.037] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL", pszSpec="*.htm") returned 0 [0067.037] lstrlenA (lpString="*.htm") returned 5 [0067.037] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL", pszSpec="*.html") returned 0 [0067.037] lstrlenA (lpString="*.html") returned 6 [0067.037] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL", pszSpec="*.mdb") returned 0 [0067.037] lstrlenA (lpString="*.mdb") returned 5 [0067.037] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL", pszSpec="*.cer") returned 0 [0067.037] lstrlenA (lpString="*.cer") returned 5 [0067.037] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL", pszSpec="*.p12") returned 0 [0067.037] lstrlenA (lpString="*.p12") returned 5 [0067.037] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL", pszSpec="*.pfx") returned 0 [0067.037] lstrlenA (lpString="*.pfx") returned 5 [0067.037] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL", pszSpec="*.kwm") returned 0 [0067.037] lstrlenA (lpString="*.kwm") returned 5 [0067.037] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL", pszSpec="*.pwm") returned 0 [0067.037] lstrlenA (lpString="*.pwm") returned 5 [0067.037] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL", pszSpec="*.1cd") returned 0 [0067.037] lstrlenA (lpString="*.1cd") returned 5 [0067.037] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL", pszSpec="*.md") returned 0 [0067.037] lstrlenA (lpString="*.md") returned 4 [0067.037] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL", pszSpec="*.mdf") returned 0 [0067.037] lstrlenA (lpString="*.mdf") returned 5 [0067.037] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL", pszSpec="*.dbf") returned 0 [0067.037] lstrlenA (lpString="*.dbf") returned 5 [0067.037] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL", pszSpec="*.odt") returned 0 [0067.037] lstrlenA (lpString="*.odt") returned 5 [0067.037] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL", pszSpec="*.vob") returned 0 [0067.037] lstrlenA (lpString="*.vob") returned 5 [0067.037] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL", pszSpec="*.ifo") returned 0 [0067.037] lstrlenA (lpString="*.ifo") returned 5 [0067.037] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL", pszSpec="*.lnk") returned 0 [0067.038] lstrlenA (lpString="*.lnk") returned 5 [0067.038] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL", pszSpec="*.torrent") returned 0 [0067.038] lstrlenA (lpString="*.torrent") returned 9 [0067.038] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL", pszSpec="*.mov") returned 0 [0067.038] lstrlenA (lpString="*.mov") returned 5 [0067.038] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL", pszSpec="*.m2v") returned 0 [0067.038] lstrlenA (lpString="*.m2v") returned 5 [0067.038] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL", pszSpec="*.3gp") returned 0 [0067.038] lstrlenA (lpString="*.3gp") returned 5 [0067.038] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL", pszSpec="*.mpeg") returned 0 [0067.038] lstrlenA (lpString="*.mpeg") returned 6 [0067.038] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL", pszSpec="*.mpg") returned 0 [0067.038] lstrlenA (lpString="*.mpg") returned 5 [0067.038] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL", pszSpec="*.flv") returned 0 [0067.038] lstrlenA (lpString="*.flv") returned 5 [0067.038] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL", pszSpec="*.avi") returned 0 [0067.038] lstrlenA (lpString="*.avi") returned 5 [0067.038] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL", pszSpec="*.mp4") returned 0 [0067.038] lstrlenA (lpString="*.mp4") returned 5 [0067.038] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL", pszSpec="*.wmv") returned 0 [0067.038] lstrlenA (lpString="*.wmv") returned 5 [0067.038] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL", pszSpec="*.divx") returned 0 [0067.038] lstrlenA (lpString="*.divx") returned 6 [0067.038] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL", pszSpec="*.mkv") returned 0 [0067.038] lstrlenA (lpString="*.mkv") returned 5 [0067.038] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL", pszSpec="*.mp3") returned 0 [0067.038] lstrlenA (lpString="*.mp3") returned 5 [0067.038] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL", pszSpec="*.wav") returned 0 [0067.038] lstrlenA (lpString="*.wav") returned 5 [0067.038] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL", pszSpec="*.flac") returned 0 [0067.038] lstrlenA (lpString="*.flac") returned 6 [0067.038] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL", pszSpec="*.ape") returned 0 [0067.038] lstrlenA (lpString="*.ape") returned 5 [0067.038] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL", pszSpec="*.wma") returned 0 [0067.038] lstrlenA (lpString="*.wma") returned 5 [0067.038] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL", pszSpec="*.ac3") returned 0 [0067.038] lstrlenA (lpString="*.ac3") returned 5 [0067.038] FindNextFileA (in: hFindFile=0x5b7c68, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0067.038] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0067.039] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="FDATE.DLL") returned -1 [0067.039] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FDATE.DLL") returned 1 [0067.039] lstrcmpiA (lpString1="", lpString2="FDATE.DLL") returned -1 [0067.039] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL") returned="FBIBLIO.DLL" [0067.039] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\", lpString2="FDATE.DLL" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL" [0067.039] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL", pszSpec="*.zip") returned 0 [0067.039] lstrlenA (lpString="*.zip") returned 5 [0067.039] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL", pszSpec="*.rar") returned 0 [0067.039] lstrlenA (lpString="*.rar") returned 5 [0067.039] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL", pszSpec="*.7z") returned 0 [0067.039] lstrlenA (lpString="*.7z") returned 4 [0067.039] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL", pszSpec="*.tar") returned 0 [0067.039] lstrlenA (lpString="*.tar") returned 5 [0067.039] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL", pszSpec="*.gzip") returned 0 [0067.039] lstrlenA (lpString="*.gzip") returned 6 [0067.039] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL", pszSpec="*.jpg") returned 0 [0067.039] lstrlenA (lpString="*.jpg") returned 5 [0067.039] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL", pszSpec="*.jpeg") returned 0 [0067.039] lstrlenA (lpString="*.jpeg") returned 6 [0067.039] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL", pszSpec="*.psd") returned 0 [0067.039] lstrlenA (lpString="*.psd") returned 5 [0067.039] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL", pszSpec="*.cdr") returned 0 [0067.039] lstrlenA (lpString="*.cdr") returned 5 [0067.039] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL", pszSpec="*.dwg") returned 0 [0067.039] lstrlenA (lpString="*.dwg") returned 5 [0067.039] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL", pszSpec="*.max") returned 0 [0067.039] lstrlenA (lpString="*.max") returned 5 [0067.039] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL", pszSpec="*.bmp") returned 0 [0067.039] lstrlenA (lpString="*.bmp") returned 5 [0067.039] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL", pszSpec="*.gif") returned 0 [0067.039] lstrlenA (lpString="*.gif") returned 5 [0067.039] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL", pszSpec="*.png") returned 0 [0067.039] lstrlenA (lpString="*.png") returned 5 [0067.039] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL", pszSpec="*.doc") returned 0 [0067.039] lstrlenA (lpString="*.doc") returned 5 [0067.039] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL", pszSpec="*.docx") returned 0 [0067.039] lstrlenA (lpString="*.docx") returned 6 [0067.039] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL", pszSpec="*.xls") returned 0 [0067.039] lstrlenA (lpString="*.xls") returned 5 [0067.040] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL", pszSpec="*.xlsx") returned 0 [0067.040] lstrlenA (lpString="*.xlsx") returned 6 [0067.040] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL", pszSpec="*.ppt") returned 0 [0067.040] lstrlenA (lpString="*.ppt") returned 5 [0067.040] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL", pszSpec="*.pptx") returned 0 [0067.040] lstrlenA (lpString="*.pptx") returned 6 [0067.040] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL", pszSpec="*.txt") returned 0 [0067.040] lstrlenA (lpString="*.txt") returned 5 [0067.040] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL", pszSpec="*.pdf") returned 0 [0067.040] lstrlenA (lpString="*.pdf") returned 5 [0067.040] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL", pszSpec="*.djvu") returned 0 [0067.040] lstrlenA (lpString="*.djvu") returned 6 [0067.040] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL", pszSpec="*.htm") returned 0 [0067.040] lstrlenA (lpString="*.htm") returned 5 [0067.040] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL", pszSpec="*.html") returned 0 [0067.040] lstrlenA (lpString="*.html") returned 6 [0067.040] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL", pszSpec="*.mdb") returned 0 [0067.040] lstrlenA (lpString="*.mdb") returned 5 [0067.040] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL", pszSpec="*.cer") returned 0 [0067.040] lstrlenA (lpString="*.cer") returned 5 [0067.040] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL", pszSpec="*.p12") returned 0 [0067.040] lstrlenA (lpString="*.p12") returned 5 [0067.040] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL", pszSpec="*.pfx") returned 0 [0067.040] lstrlenA (lpString="*.pfx") returned 5 [0067.040] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL", pszSpec="*.kwm") returned 0 [0067.040] lstrlenA (lpString="*.kwm") returned 5 [0067.040] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL", pszSpec="*.pwm") returned 0 [0067.040] lstrlenA (lpString="*.pwm") returned 5 [0067.040] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL", pszSpec="*.1cd") returned 0 [0067.040] lstrlenA (lpString="*.1cd") returned 5 [0067.040] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL", pszSpec="*.md") returned 0 [0067.040] lstrlenA (lpString="*.md") returned 4 [0067.040] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL", pszSpec="*.mdf") returned 0 [0067.040] lstrlenA (lpString="*.mdf") returned 5 [0067.040] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL", pszSpec="*.dbf") returned 0 [0067.040] lstrlenA (lpString="*.dbf") returned 5 [0067.040] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL", pszSpec="*.odt") returned 0 [0067.040] lstrlenA (lpString="*.odt") returned 5 [0067.040] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL", pszSpec="*.vob") returned 0 [0067.041] lstrlenA (lpString="*.vob") returned 5 [0067.041] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL", pszSpec="*.ifo") returned 0 [0067.041] lstrlenA (lpString="*.ifo") returned 5 [0067.041] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL", pszSpec="*.lnk") returned 0 [0067.041] lstrlenA (lpString="*.lnk") returned 5 [0067.041] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL", pszSpec="*.torrent") returned 0 [0067.041] lstrlenA (lpString="*.torrent") returned 9 [0067.041] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL", pszSpec="*.mov") returned 0 [0067.041] lstrlenA (lpString="*.mov") returned 5 [0067.041] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL", pszSpec="*.m2v") returned 0 [0067.041] lstrlenA (lpString="*.m2v") returned 5 [0067.041] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL", pszSpec="*.3gp") returned 0 [0067.041] lstrlenA (lpString="*.3gp") returned 5 [0067.041] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL", pszSpec="*.mpeg") returned 0 [0067.041] lstrlenA (lpString="*.mpeg") returned 6 [0067.041] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL", pszSpec="*.mpg") returned 0 [0067.041] lstrlenA (lpString="*.mpg") returned 5 [0067.041] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL", pszSpec="*.flv") returned 0 [0067.041] lstrlenA (lpString="*.flv") returned 5 [0067.041] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL", pszSpec="*.avi") returned 0 [0067.041] lstrlenA (lpString="*.avi") returned 5 [0067.041] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL", pszSpec="*.mp4") returned 0 [0067.041] lstrlenA (lpString="*.mp4") returned 5 [0067.041] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL", pszSpec="*.wmv") returned 0 [0067.041] lstrlenA (lpString="*.wmv") returned 5 [0067.041] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL", pszSpec="*.divx") returned 0 [0067.041] lstrlenA (lpString="*.divx") returned 6 [0067.041] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL", pszSpec="*.mkv") returned 0 [0067.041] lstrlenA (lpString="*.mkv") returned 5 [0067.041] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL", pszSpec="*.mp3") returned 0 [0067.041] lstrlenA (lpString="*.mp3") returned 5 [0067.041] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL", pszSpec="*.wav") returned 0 [0067.041] lstrlenA (lpString="*.wav") returned 5 [0067.041] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL", pszSpec="*.flac") returned 0 [0067.041] lstrlenA (lpString="*.flac") returned 6 [0067.041] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL", pszSpec="*.ape") returned 0 [0067.041] lstrlenA (lpString="*.ape") returned 5 [0067.041] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL", pszSpec="*.wma") returned 0 [0067.041] lstrlenA (lpString="*.wma") returned 5 [0067.042] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL", pszSpec="*.ac3") returned 0 [0067.042] lstrlenA (lpString="*.ac3") returned 5 [0067.042] FindNextFileA (in: hFindFile=0x5b7c68, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0067.042] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0067.042] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="FPERSON.DLL") returned -1 [0067.042] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FPERSON.DLL") returned 1 [0067.042] lstrcmpiA (lpString1="", lpString2="FPERSON.DLL") returned -1 [0067.042] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL") returned="FDATE.DLL" [0067.042] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\", lpString2="FPERSON.DLL" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPERSON.DLL") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPERSON.DLL" [0067.042] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPERSON.DLL", pszSpec="*.zip") returned 0 [0067.042] lstrlenA (lpString="*.zip") returned 5 [0067.042] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPERSON.DLL", pszSpec="*.rar") returned 0 [0067.042] lstrlenA (lpString="*.rar") returned 5 [0067.042] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPERSON.DLL", pszSpec="*.7z") returned 0 [0067.042] lstrlenA (lpString="*.7z") returned 4 [0067.042] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPERSON.DLL", pszSpec="*.tar") returned 0 [0067.042] lstrlenA (lpString="*.tar") returned 5 [0067.042] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPERSON.DLL", pszSpec="*.gzip") returned 0 [0067.042] lstrlenA (lpString="*.gzip") returned 6 [0067.042] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPERSON.DLL", pszSpec="*.jpg") returned 0 [0067.042] lstrlenA (lpString="*.jpg") returned 5 [0067.042] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPERSON.DLL", pszSpec="*.jpeg") returned 0 [0067.042] lstrlenA (lpString="*.jpeg") returned 6 [0067.042] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPERSON.DLL", pszSpec="*.psd") returned 0 [0067.042] lstrlenA (lpString="*.psd") returned 5 [0067.042] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPERSON.DLL", pszSpec="*.cdr") returned 0 [0067.042] lstrlenA (lpString="*.cdr") returned 5 [0067.042] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPERSON.DLL", pszSpec="*.dwg") returned 0 [0067.042] lstrlenA (lpString="*.dwg") returned 5 [0067.042] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPERSON.DLL", pszSpec="*.max") returned 0 [0067.042] lstrlenA (lpString="*.max") returned 5 [0067.042] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPERSON.DLL", pszSpec="*.bmp") returned 0 [0067.042] lstrlenA (lpString="*.bmp") returned 5 [0067.042] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPERSON.DLL", pszSpec="*.gif") returned 0 [0067.042] lstrlenA (lpString="*.gif") returned 5 [0067.042] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPERSON.DLL", pszSpec="*.png") returned 0 [0067.042] lstrlenA (lpString="*.png") returned 5 [0067.042] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPERSON.DLL", pszSpec="*.doc") returned 0 [0067.042] lstrlenA (lpString="*.doc") returned 5 [0067.043] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPERSON.DLL", pszSpec="*.docx") returned 0 [0067.043] lstrlenA (lpString="*.docx") returned 6 [0067.043] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPERSON.DLL", pszSpec="*.xls") returned 0 [0067.043] lstrlenA (lpString="*.xls") returned 5 [0067.043] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPERSON.DLL", pszSpec="*.xlsx") returned 0 [0067.043] lstrlenA (lpString="*.xlsx") returned 6 [0067.043] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPERSON.DLL", pszSpec="*.ppt") returned 0 [0067.043] lstrlenA (lpString="*.ppt") returned 5 [0067.043] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPERSON.DLL", pszSpec="*.pptx") returned 0 [0067.043] lstrlenA (lpString="*.pptx") returned 6 [0067.043] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPERSON.DLL", pszSpec="*.txt") returned 0 [0067.043] lstrlenA (lpString="*.txt") returned 5 [0067.043] FindNextFileA (in: hFindFile=0x5b7c68, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0067.043] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0067.043] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="FPLACE.DLL") returned -1 [0067.043] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FPLACE.DLL") returned 1 [0067.043] lstrcmpiA (lpString1="", lpString2="FPLACE.DLL") returned -1 [0067.043] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPERSON.DLL") returned="FPERSON.DLL" [0067.043] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\", lpString2="FPLACE.DLL" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPLACE.DLL") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPLACE.DLL" [0067.043] FindNextFileA (in: hFindFile=0x5b7c68, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0067.043] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0067.043] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="FSTOCK.DLL") returned -1 [0067.043] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FSTOCK.DLL") returned 1 [0067.043] lstrcmpiA (lpString1="", lpString2="FSTOCK.DLL") returned -1 [0067.043] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPLACE.DLL") returned="FPLACE.DLL" [0067.043] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\", lpString2="FSTOCK.DLL" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FSTOCK.DLL") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FSTOCK.DLL" [0067.044] FindNextFileA (in: hFindFile=0x5b7c68, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0067.044] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0067.044] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="IETAG.DLL") returned -1 [0067.044] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="IETAG.DLL") returned -1 [0067.044] lstrcmpiA (lpString1="", lpString2="IETAG.DLL") returned -1 [0067.044] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FSTOCK.DLL") returned="FSTOCK.DLL" [0067.044] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\", lpString2="IETAG.DLL" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IETAG.DLL") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IETAG.DLL" [0067.044] FindNextFileA (in: hFindFile=0x5b7c68, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0067.044] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0067.044] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="IMCONTACT.DLL") returned -1 [0067.044] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="IMCONTACT.DLL") returned -1 [0067.044] lstrcmpiA (lpString1="", lpString2="IMCONTACT.DLL") returned -1 [0067.044] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IETAG.DLL") returned="IETAG.DLL" [0067.044] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\", lpString2="IMCONTACT.DLL" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IMCONTACT.DLL") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IMCONTACT.DLL" [0067.044] FindNextFileA (in: hFindFile=0x5b7c68, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0067.044] lstrcmpA (lpString1=".", lpString2="LISTS") returned -1 [0067.044] lstrcmpA (lpString1="..", lpString2="LISTS") returned -1 [0067.044] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IMCONTACT.DLL") returned="IMCONTACT.DLL" [0067.044] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\", lpString2="LISTS" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS" [0067.044] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5b7be0 [0067.045] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0067.045] FindNextFileA (in: hFindFile=0x5b7be0, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0067.045] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0067.045] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0067.045] FindNextFileA (in: hFindFile=0x5b7be0, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0067.045] lstrcmpA (lpString1=".", lpString2="1033") returned -1 [0067.046] lstrcmpA (lpString1="..", lpString2="1033") returned -1 [0067.046] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\*.*") returned="*.*" [0067.046] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\", lpString2="1033" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033" [0067.046] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5b7c20 [0067.046] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0067.046] FindNextFileA (in: hFindFile=0x5b7c20, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0067.046] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0067.046] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0067.046] FindNextFileA (in: hFindFile=0x5b7c20, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0067.046] PeekMessageA (in: lpMsg=0xaef84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaef84) returned 0 [0067.046] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="DATES.XML") returned 1 [0067.046] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DATES.XML") returned 1 [0067.046] lstrcmpiA (lpString1="", lpString2="DATES.XML") returned -1 [0067.046] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\*.*") returned="*.*" [0067.046] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\", lpString2="DATES.XML" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML" [0067.046] FindNextFileA (in: hFindFile=0x5b7c20, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0067.046] PeekMessageA (in: lpMsg=0xaef84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaef84) returned 0 [0067.046] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="PHONE.XML") returned -1 [0067.046] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PHONE.XML") returned -1 [0067.046] lstrcmpiA (lpString1="", lpString2="PHONE.XML") returned -1 [0067.046] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned="DATES.XML" [0067.047] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\", lpString2="PHONE.XML" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML" [0067.047] FindNextFileA (in: hFindFile=0x5b7c20, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0067.047] PeekMessageA (in: lpMsg=0xaef84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaef84) returned 0 [0067.047] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="STOCKS.DAT") returned -1 [0067.047] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="STOCKS.DAT") returned -1 [0067.047] lstrcmpiA (lpString1="", lpString2="STOCKS.DAT") returned -1 [0067.047] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned="PHONE.XML" [0067.047] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\", lpString2="STOCKS.DAT" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT" [0067.047] FindNextFileA (in: hFindFile=0x5b7c20, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0067.047] PeekMessageA (in: lpMsg=0xaef84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaef84) returned 0 [0067.047] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="STOCKS.XML") returned -1 [0067.047] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="STOCKS.XML") returned -1 [0067.047] lstrcmpiA (lpString1="", lpString2="STOCKS.XML") returned -1 [0067.047] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned="STOCKS.DAT" [0067.047] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\", lpString2="STOCKS.XML" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML" [0067.047] FindNextFileA (in: hFindFile=0x5b7c20, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0067.047] PeekMessageA (in: lpMsg=0xaef84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaef84) returned 0 [0067.047] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="TIME.XML") returned -1 [0067.047] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TIME.XML") returned -1 [0067.047] lstrcmpiA (lpString1="", lpString2="TIME.XML") returned -1 [0067.047] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned="STOCKS.XML" [0067.047] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\", lpString2="TIME.XML" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML" [0067.047] FindNextFileA (in: hFindFile=0x5b7c20, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0 [0067.047] FindClose (in: hFindFile=0x5b7c20 | out: hFindFile=0x5b7c20) returned 1 [0067.047] FindNextFileA (in: hFindFile=0x5b7be0, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0067.047] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0067.048] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BASMLA.XSL") returned 1 [0067.048] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BASMLA.XSL") returned 1 [0067.048] lstrcmpiA (lpString1="", lpString2="BASMLA.XSL") returned -1 [0067.048] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\*.*") returned="*.*" [0067.048] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\", lpString2="BASMLA.XSL" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL" [0067.048] FindNextFileA (in: hFindFile=0x5b7be0, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0 [0067.048] FindClose (in: hFindFile=0x5b7be0 | out: hFindFile=0x5b7be0) returned 1 [0067.048] FindNextFileA (in: hFindFile=0x5b7c68, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0067.048] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0067.048] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="METCONV.DLL") returned -1 [0067.048] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="METCONV.DLL") returned -1 [0067.048] lstrcmpiA (lpString1="", lpString2="METCONV.DLL") returned -1 [0067.048] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\*.*") returned="*.*" [0067.048] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\", lpString2="METCONV.DLL" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.DLL") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.DLL" [0067.048] FindNextFileA (in: hFindFile=0x5b7c68, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0067.048] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0067.048] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="METCONV.TXT") returned -1 [0067.048] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="METCONV.TXT") returned -1 [0067.048] lstrcmpiA (lpString1="", lpString2="METCONV.TXT") returned -1 [0067.048] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.DLL") returned="METCONV.DLL" [0067.048] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\", lpString2="METCONV.TXT" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT" [0067.048] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT" [0067.048] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT" [0067.048] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT.") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT." [0067.048] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT. ") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT. " [0067.048] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\metconv.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c [0067.049] GetFileSize (in: hFile=0x8c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x120eb8 [0067.049] GetFileTime (in: hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x85f12000, dwHighDateTime=0x1c9a11f), lpLastAccessTime=0x407536*(dwLowDateTime=0x69a83910, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x85f12000, dwHighDateTime=0x1c9a11f)) returned 1 [0067.049] SetFilePointer (in: hFile=0x8c, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0067.049] ReadFile (in: hFile=0x8c, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x120e5e, lpOverlapped=0x0) returned 1 [0067.129] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned="METCONV.TXT" [0067.134] SetFilePointer (in: hFile=0x8c, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0067.134] WriteFile (in: hFile=0x8c, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x120e5e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x120e5e, lpOverlapped=0x0) returned 1 [0067.140] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0067.140] CloseHandle (hObject=0x8c) returned 1 [0067.152] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\metconv.txt"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT. " (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\metconv.txt. ")) returned 1 [0067.153] FindNextFileA (in: hFindFile=0x5b7c68, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0067.153] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0067.153] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="MOFL.DLL") returned -1 [0067.153] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MOFL.DLL") returned -1 [0067.153] lstrcmpiA (lpString1="", lpString2="MOFL.DLL") returned -1 [0067.153] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned="METCONV.TXT" [0067.153] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\", lpString2="MOFL.DLL" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL" [0067.153] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL", pszSpec="*.zip") returned 0 [0067.153] lstrlenA (lpString="*.zip") returned 5 [0067.153] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL", pszSpec="*.rar") returned 0 [0067.153] lstrlenA (lpString="*.rar") returned 5 [0067.153] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL", pszSpec="*.7z") returned 0 [0067.153] lstrlenA (lpString="*.7z") returned 4 [0067.153] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL", pszSpec="*.tar") returned 0 [0067.153] lstrlenA (lpString="*.tar") returned 5 [0067.153] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL", pszSpec="*.gzip") returned 0 [0067.153] lstrlenA (lpString="*.gzip") returned 6 [0067.153] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL", pszSpec="*.jpg") returned 0 [0067.153] lstrlenA (lpString="*.jpg") returned 5 [0067.153] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL", pszSpec="*.jpeg") returned 0 [0067.153] lstrlenA (lpString="*.jpeg") returned 6 [0067.153] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL", pszSpec="*.psd") returned 0 [0067.153] lstrlenA (lpString="*.psd") returned 5 [0067.153] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL", pszSpec="*.cdr") returned 0 [0067.153] lstrlenA (lpString="*.cdr") returned 5 [0067.153] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL", pszSpec="*.dwg") returned 0 [0067.154] lstrlenA (lpString="*.dwg") returned 5 [0067.154] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL", pszSpec="*.max") returned 0 [0067.154] lstrlenA (lpString="*.max") returned 5 [0067.154] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL", pszSpec="*.bmp") returned 0 [0067.154] lstrlenA (lpString="*.bmp") returned 5 [0067.154] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL", pszSpec="*.gif") returned 0 [0067.154] lstrlenA (lpString="*.gif") returned 5 [0067.154] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL", pszSpec="*.png") returned 0 [0067.154] lstrlenA (lpString="*.png") returned 5 [0067.154] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL", pszSpec="*.doc") returned 0 [0067.154] lstrlenA (lpString="*.doc") returned 5 [0067.154] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL", pszSpec="*.docx") returned 0 [0067.154] lstrlenA (lpString="*.docx") returned 6 [0067.154] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL", pszSpec="*.xls") returned 0 [0067.154] lstrlenA (lpString="*.xls") returned 5 [0067.154] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL", pszSpec="*.xlsx") returned 0 [0067.154] lstrlenA (lpString="*.xlsx") returned 6 [0067.154] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL", pszSpec="*.ppt") returned 0 [0067.154] lstrlenA (lpString="*.ppt") returned 5 [0067.154] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL", pszSpec="*.pptx") returned 0 [0067.154] lstrlenA (lpString="*.pptx") returned 6 [0067.154] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL", pszSpec="*.txt") returned 0 [0067.154] lstrlenA (lpString="*.txt") returned 5 [0067.154] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL", pszSpec="*.pdf") returned 0 [0067.154] lstrlenA (lpString="*.pdf") returned 5 [0067.154] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL", pszSpec="*.djvu") returned 0 [0067.154] lstrlenA (lpString="*.djvu") returned 6 [0067.154] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL", pszSpec="*.htm") returned 0 [0067.154] lstrlenA (lpString="*.htm") returned 5 [0067.154] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL", pszSpec="*.html") returned 0 [0067.154] lstrlenA (lpString="*.html") returned 6 [0067.154] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL", pszSpec="*.mdb") returned 0 [0067.154] lstrlenA (lpString="*.mdb") returned 5 [0067.154] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL", pszSpec="*.cer") returned 0 [0067.154] lstrlenA (lpString="*.cer") returned 5 [0067.155] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL", pszSpec="*.p12") returned 0 [0067.155] lstrlenA (lpString="*.p12") returned 5 [0067.155] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL", pszSpec="*.pfx") returned 0 [0067.155] lstrlenA (lpString="*.pfx") returned 5 [0067.155] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL", pszSpec="*.kwm") returned 0 [0067.155] lstrlenA (lpString="*.kwm") returned 5 [0067.155] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL", pszSpec="*.pwm") returned 0 [0067.155] lstrlenA (lpString="*.pwm") returned 5 [0067.155] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL", pszSpec="*.1cd") returned 0 [0067.155] lstrlenA (lpString="*.1cd") returned 5 [0067.155] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL", pszSpec="*.md") returned 0 [0067.155] lstrlenA (lpString="*.md") returned 4 [0067.155] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL", pszSpec="*.mdf") returned 0 [0067.155] lstrlenA (lpString="*.mdf") returned 5 [0067.155] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL", pszSpec="*.dbf") returned 0 [0067.155] lstrlenA (lpString="*.dbf") returned 5 [0067.155] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL", pszSpec="*.odt") returned 0 [0067.155] lstrlenA (lpString="*.odt") returned 5 [0067.155] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL", pszSpec="*.vob") returned 0 [0067.155] lstrlenA (lpString="*.vob") returned 5 [0067.155] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL", pszSpec="*.ifo") returned 0 [0067.155] lstrlenA (lpString="*.ifo") returned 5 [0067.155] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL", pszSpec="*.lnk") returned 0 [0067.155] lstrlenA (lpString="*.lnk") returned 5 [0067.155] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL", pszSpec="*.torrent") returned 0 [0067.155] lstrlenA (lpString="*.torrent") returned 9 [0067.155] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL", pszSpec="*.mov") returned 0 [0067.155] lstrlenA (lpString="*.mov") returned 5 [0067.155] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL", pszSpec="*.m2v") returned 0 [0067.155] lstrlenA (lpString="*.m2v") returned 5 [0067.155] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL", pszSpec="*.3gp") returned 0 [0067.155] lstrlenA (lpString="*.3gp") returned 5 [0067.155] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL", pszSpec="*.mpeg") returned 0 [0067.155] lstrlenA (lpString="*.mpeg") returned 6 [0067.155] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL", pszSpec="*.mpg") returned 0 [0067.155] lstrlenA (lpString="*.mpg") returned 5 [0067.156] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL", pszSpec="*.flv") returned 0 [0067.156] lstrlenA (lpString="*.flv") returned 5 [0067.156] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL", pszSpec="*.avi") returned 0 [0067.156] lstrlenA (lpString="*.avi") returned 5 [0067.156] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL", pszSpec="*.mp4") returned 0 [0067.156] lstrlenA (lpString="*.mp4") returned 5 [0067.156] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL", pszSpec="*.wmv") returned 0 [0067.156] lstrlenA (lpString="*.wmv") returned 5 [0067.156] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL", pszSpec="*.divx") returned 0 [0067.156] lstrlenA (lpString="*.divx") returned 6 [0067.156] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL", pszSpec="*.mkv") returned 0 [0067.156] lstrlenA (lpString="*.mkv") returned 5 [0067.156] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL", pszSpec="*.mp3") returned 0 [0067.156] lstrlenA (lpString="*.mp3") returned 5 [0067.156] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL", pszSpec="*.wav") returned 0 [0067.156] lstrlenA (lpString="*.wav") returned 5 [0067.156] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL", pszSpec="*.flac") returned 0 [0067.156] lstrlenA (lpString="*.flac") returned 6 [0067.156] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL", pszSpec="*.ape") returned 0 [0067.156] lstrlenA (lpString="*.ape") returned 5 [0067.156] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL", pszSpec="*.wma") returned 0 [0067.156] lstrlenA (lpString="*.wma") returned 5 [0067.156] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL", pszSpec="*.ac3") returned 0 [0067.156] lstrlenA (lpString="*.ac3") returned 5 [0067.156] FindNextFileA (in: hFindFile=0x5b7c68, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0067.156] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0067.156] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="MSTAG.TLB") returned -1 [0067.156] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSTAG.TLB") returned -1 [0067.156] lstrcmpiA (lpString1="", lpString2="MSTAG.TLB") returned -1 [0067.156] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL") returned="MOFL.DLL" [0067.157] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\", lpString2="MSTAG.TLB" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB" [0067.157] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB", pszSpec="*.zip") returned 0 [0067.157] lstrlenA (lpString="*.zip") returned 5 [0067.157] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB", pszSpec="*.rar") returned 0 [0067.157] lstrlenA (lpString="*.rar") returned 5 [0067.157] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB", pszSpec="*.7z") returned 0 [0067.157] lstrlenA (lpString="*.7z") returned 4 [0067.157] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB", pszSpec="*.tar") returned 0 [0067.157] lstrlenA (lpString="*.tar") returned 5 [0067.157] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB", pszSpec="*.gzip") returned 0 [0067.157] lstrlenA (lpString="*.gzip") returned 6 [0067.157] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB", pszSpec="*.jpg") returned 0 [0067.157] lstrlenA (lpString="*.jpg") returned 5 [0067.157] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB", pszSpec="*.jpeg") returned 0 [0067.157] lstrlenA (lpString="*.jpeg") returned 6 [0067.157] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB", pszSpec="*.psd") returned 0 [0067.157] lstrlenA (lpString="*.psd") returned 5 [0067.157] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB", pszSpec="*.cdr") returned 0 [0067.157] lstrlenA (lpString="*.cdr") returned 5 [0067.157] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB", pszSpec="*.dwg") returned 0 [0067.157] lstrlenA (lpString="*.dwg") returned 5 [0067.157] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB", pszSpec="*.max") returned 0 [0067.157] lstrlenA (lpString="*.max") returned 5 [0067.157] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB", pszSpec="*.bmp") returned 0 [0067.157] lstrlenA (lpString="*.bmp") returned 5 [0067.157] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB", pszSpec="*.gif") returned 0 [0067.157] lstrlenA (lpString="*.gif") returned 5 [0067.157] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB", pszSpec="*.png") returned 0 [0067.157] lstrlenA (lpString="*.png") returned 5 [0067.157] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB", pszSpec="*.doc") returned 0 [0067.157] lstrlenA (lpString="*.doc") returned 5 [0067.157] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB", pszSpec="*.docx") returned 0 [0067.157] lstrlenA (lpString="*.docx") returned 6 [0067.157] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB", pszSpec="*.xls") returned 0 [0067.157] lstrlenA (lpString="*.xls") returned 5 [0067.157] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB", pszSpec="*.xlsx") returned 0 [0067.158] lstrlenA (lpString="*.xlsx") returned 6 [0067.158] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB", pszSpec="*.ppt") returned 0 [0067.158] lstrlenA (lpString="*.ppt") returned 5 [0067.158] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB", pszSpec="*.pptx") returned 0 [0067.158] lstrlenA (lpString="*.pptx") returned 6 [0067.158] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB", pszSpec="*.txt") returned 0 [0067.158] lstrlenA (lpString="*.txt") returned 5 [0067.158] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB", pszSpec="*.pdf") returned 0 [0067.158] lstrlenA (lpString="*.pdf") returned 5 [0067.158] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB", pszSpec="*.djvu") returned 0 [0067.158] lstrlenA (lpString="*.djvu") returned 6 [0067.158] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB", pszSpec="*.htm") returned 0 [0067.158] lstrlenA (lpString="*.htm") returned 5 [0067.158] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB", pszSpec="*.html") returned 0 [0067.158] lstrlenA (lpString="*.html") returned 6 [0067.158] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB", pszSpec="*.mdb") returned 0 [0067.158] lstrlenA (lpString="*.mdb") returned 5 [0067.158] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB", pszSpec="*.cer") returned 0 [0067.158] lstrlenA (lpString="*.cer") returned 5 [0067.158] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB", pszSpec="*.p12") returned 0 [0067.158] lstrlenA (lpString="*.p12") returned 5 [0067.158] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB", pszSpec="*.pfx") returned 0 [0067.158] lstrlenA (lpString="*.pfx") returned 5 [0067.158] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB", pszSpec="*.kwm") returned 0 [0067.158] lstrlenA (lpString="*.kwm") returned 5 [0067.158] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB", pszSpec="*.pwm") returned 0 [0067.158] lstrlenA (lpString="*.pwm") returned 5 [0067.158] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB", pszSpec="*.1cd") returned 0 [0067.158] lstrlenA (lpString="*.1cd") returned 5 [0067.158] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB", pszSpec="*.md") returned 0 [0067.158] lstrlenA (lpString="*.md") returned 4 [0067.158] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB", pszSpec="*.mdf") returned 0 [0067.158] lstrlenA (lpString="*.mdf") returned 5 [0067.158] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB", pszSpec="*.dbf") returned 0 [0067.158] lstrlenA (lpString="*.dbf") returned 5 [0067.158] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB", pszSpec="*.odt") returned 0 [0067.159] lstrlenA (lpString="*.odt") returned 5 [0067.159] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB", pszSpec="*.vob") returned 0 [0067.159] lstrlenA (lpString="*.vob") returned 5 [0067.159] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB", pszSpec="*.ifo") returned 0 [0067.159] lstrlenA (lpString="*.ifo") returned 5 [0067.159] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB", pszSpec="*.lnk") returned 0 [0067.159] lstrlenA (lpString="*.lnk") returned 5 [0067.159] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB", pszSpec="*.torrent") returned 0 [0067.159] lstrlenA (lpString="*.torrent") returned 9 [0067.159] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB", pszSpec="*.mov") returned 0 [0067.159] lstrlenA (lpString="*.mov") returned 5 [0067.159] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB", pszSpec="*.m2v") returned 0 [0067.159] lstrlenA (lpString="*.m2v") returned 5 [0067.159] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB", pszSpec="*.3gp") returned 0 [0067.159] lstrlenA (lpString="*.3gp") returned 5 [0067.159] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB", pszSpec="*.mpeg") returned 0 [0067.159] lstrlenA (lpString="*.mpeg") returned 6 [0067.159] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB", pszSpec="*.mpg") returned 0 [0067.159] lstrlenA (lpString="*.mpg") returned 5 [0067.159] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB", pszSpec="*.flv") returned 0 [0067.159] lstrlenA (lpString="*.flv") returned 5 [0067.159] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB", pszSpec="*.avi") returned 0 [0067.159] lstrlenA (lpString="*.avi") returned 5 [0067.159] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB", pszSpec="*.mp4") returned 0 [0067.159] lstrlenA (lpString="*.mp4") returned 5 [0067.159] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB", pszSpec="*.wmv") returned 0 [0067.159] lstrlenA (lpString="*.wmv") returned 5 [0067.159] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB", pszSpec="*.divx") returned 0 [0067.159] lstrlenA (lpString="*.divx") returned 6 [0067.159] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB", pszSpec="*.mkv") returned 0 [0067.159] lstrlenA (lpString="*.mkv") returned 5 [0067.160] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB", pszSpec="*.mp3") returned 0 [0067.160] lstrlenA (lpString="*.mp3") returned 5 [0067.160] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB", pszSpec="*.wav") returned 0 [0067.160] lstrlenA (lpString="*.wav") returned 5 [0067.160] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB", pszSpec="*.flac") returned 0 [0067.160] lstrlenA (lpString="*.flac") returned 6 [0067.160] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB", pszSpec="*.ape") returned 0 [0067.160] lstrlenA (lpString="*.ape") returned 5 [0067.160] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB", pszSpec="*.wma") returned 0 [0067.160] lstrlenA (lpString="*.wma") returned 5 [0067.160] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB", pszSpec="*.ac3") returned 0 [0067.160] lstrlenA (lpString="*.ac3") returned 5 [0067.160] FindNextFileA (in: hFindFile=0x5b7c68, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0067.160] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0067.160] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="SmartTagInstall.exe") returned -1 [0067.160] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SmartTagInstall.exe") returned -1 [0067.160] lstrcmpiA (lpString1="", lpString2="SmartTagInstall.exe") returned -1 [0067.160] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB") returned="MSTAG.TLB" [0067.160] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\", lpString2="SmartTagInstall.exe" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe" [0067.160] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe", pszSpec="*.zip") returned 0 [0067.160] lstrlenA (lpString="*.zip") returned 5 [0067.160] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe", pszSpec="*.rar") returned 0 [0067.160] lstrlenA (lpString="*.rar") returned 5 [0067.160] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe", pszSpec="*.7z") returned 0 [0067.160] lstrlenA (lpString="*.7z") returned 4 [0067.160] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe", pszSpec="*.tar") returned 0 [0067.160] lstrlenA (lpString="*.tar") returned 5 [0067.160] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe", pszSpec="*.gzip") returned 0 [0067.160] lstrlenA (lpString="*.gzip") returned 6 [0067.160] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe", pszSpec="*.jpg") returned 0 [0067.160] lstrlenA (lpString="*.jpg") returned 5 [0067.160] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe", pszSpec="*.jpeg") returned 0 [0067.160] lstrlenA (lpString="*.jpeg") returned 6 [0067.160] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe", pszSpec="*.psd") returned 0 [0067.160] lstrlenA (lpString="*.psd") returned 5 [0067.160] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe", pszSpec="*.cdr") returned 0 [0067.161] lstrlenA (lpString="*.cdr") returned 5 [0067.161] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe", pszSpec="*.dwg") returned 0 [0067.161] lstrlenA (lpString="*.dwg") returned 5 [0067.161] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe", pszSpec="*.max") returned 0 [0067.161] lstrlenA (lpString="*.max") returned 5 [0067.161] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe", pszSpec="*.bmp") returned 0 [0067.161] lstrlenA (lpString="*.bmp") returned 5 [0067.161] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe", pszSpec="*.gif") returned 0 [0067.161] lstrlenA (lpString="*.gif") returned 5 [0067.161] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe", pszSpec="*.png") returned 0 [0067.161] lstrlenA (lpString="*.png") returned 5 [0067.161] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe", pszSpec="*.doc") returned 0 [0067.161] lstrlenA (lpString="*.doc") returned 5 [0067.161] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe", pszSpec="*.docx") returned 0 [0067.161] lstrlenA (lpString="*.docx") returned 6 [0067.161] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe", pszSpec="*.xls") returned 0 [0067.161] lstrlenA (lpString="*.xls") returned 5 [0067.161] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe", pszSpec="*.xlsx") returned 0 [0067.161] lstrlenA (lpString="*.xlsx") returned 6 [0067.161] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe", pszSpec="*.ppt") returned 0 [0067.161] lstrlenA (lpString="*.ppt") returned 5 [0067.161] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe", pszSpec="*.pptx") returned 0 [0067.161] lstrlenA (lpString="*.pptx") returned 6 [0067.161] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe", pszSpec="*.txt") returned 0 [0067.161] lstrlenA (lpString="*.txt") returned 5 [0067.161] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe", pszSpec="*.pdf") returned 0 [0067.161] lstrlenA (lpString="*.pdf") returned 5 [0067.161] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe", pszSpec="*.djvu") returned 0 [0067.161] lstrlenA (lpString="*.djvu") returned 6 [0067.161] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe", pszSpec="*.htm") returned 0 [0067.161] lstrlenA (lpString="*.htm") returned 5 [0067.161] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe", pszSpec="*.html") returned 0 [0067.161] lstrlenA (lpString="*.html") returned 6 [0067.161] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe", pszSpec="*.mdb") returned 0 [0067.161] lstrlenA (lpString="*.mdb") returned 5 [0067.161] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe", pszSpec="*.cer") returned 0 [0067.161] lstrlenA (lpString="*.cer") returned 5 [0067.162] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe", pszSpec="*.p12") returned 0 [0067.162] lstrlenA (lpString="*.p12") returned 5 [0067.162] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe", pszSpec="*.pfx") returned 0 [0067.162] lstrlenA (lpString="*.pfx") returned 5 [0067.162] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe", pszSpec="*.kwm") returned 0 [0067.162] lstrlenA (lpString="*.kwm") returned 5 [0067.162] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe", pszSpec="*.pwm") returned 0 [0067.162] lstrlenA (lpString="*.pwm") returned 5 [0067.162] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe", pszSpec="*.1cd") returned 0 [0067.162] lstrlenA (lpString="*.1cd") returned 5 [0067.162] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe", pszSpec="*.md") returned 0 [0067.162] lstrlenA (lpString="*.md") returned 4 [0067.162] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe", pszSpec="*.mdf") returned 0 [0067.162] lstrlenA (lpString="*.mdf") returned 5 [0067.162] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe", pszSpec="*.dbf") returned 0 [0067.162] lstrlenA (lpString="*.dbf") returned 5 [0067.162] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe", pszSpec="*.odt") returned 0 [0067.162] lstrlenA (lpString="*.odt") returned 5 [0067.162] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe", pszSpec="*.vob") returned 0 [0067.162] lstrlenA (lpString="*.vob") returned 5 [0067.162] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe", pszSpec="*.ifo") returned 0 [0067.162] lstrlenA (lpString="*.ifo") returned 5 [0067.162] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe", pszSpec="*.lnk") returned 0 [0067.162] lstrlenA (lpString="*.lnk") returned 5 [0067.162] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe", pszSpec="*.torrent") returned 0 [0067.162] lstrlenA (lpString="*.torrent") returned 9 [0067.162] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe", pszSpec="*.mov") returned 0 [0067.162] lstrlenA (lpString="*.mov") returned 5 [0067.162] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe", pszSpec="*.m2v") returned 0 [0067.162] lstrlenA (lpString="*.m2v") returned 5 [0067.162] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe", pszSpec="*.3gp") returned 0 [0067.162] lstrlenA (lpString="*.3gp") returned 5 [0067.162] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe", pszSpec="*.mpeg") returned 0 [0067.162] lstrlenA (lpString="*.mpeg") returned 6 [0067.162] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe", pszSpec="*.mpg") returned 0 [0067.162] lstrlenA (lpString="*.mpg") returned 5 [0067.162] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe", pszSpec="*.flv") returned 0 [0067.163] lstrlenA (lpString="*.flv") returned 5 [0067.163] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe", pszSpec="*.avi") returned 0 [0067.163] lstrlenA (lpString="*.avi") returned 5 [0067.163] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe", pszSpec="*.mp4") returned 0 [0067.163] lstrlenA (lpString="*.mp4") returned 5 [0067.163] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe", pszSpec="*.wmv") returned 0 [0067.163] lstrlenA (lpString="*.wmv") returned 5 [0067.163] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe", pszSpec="*.divx") returned 0 [0067.163] lstrlenA (lpString="*.divx") returned 6 [0067.163] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe", pszSpec="*.mkv") returned 0 [0067.163] lstrlenA (lpString="*.mkv") returned 5 [0067.163] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe", pszSpec="*.mp3") returned 0 [0067.163] lstrlenA (lpString="*.mp3") returned 5 [0067.163] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe", pszSpec="*.wav") returned 0 [0067.163] lstrlenA (lpString="*.wav") returned 5 [0067.163] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe", pszSpec="*.flac") returned 0 [0067.163] lstrlenA (lpString="*.flac") returned 6 [0067.163] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe", pszSpec="*.ape") returned 0 [0067.163] lstrlenA (lpString="*.ape") returned 5 [0067.163] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe", pszSpec="*.wma") returned 0 [0067.163] lstrlenA (lpString="*.wma") returned 5 [0067.163] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe", pszSpec="*.ac3") returned 0 [0067.163] lstrlenA (lpString="*.ac3") returned 5 [0067.163] FindNextFileA (in: hFindFile=0x5b7c68, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0 [0067.163] FindClose (in: hFindFile=0x5b7c68 | out: hFindFile=0x5b7c68) returned 1 [0067.163] FindNextFileA (in: hFindFile=0x5ba128, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0067.163] lstrcmpA (lpString1=".", lpString2="Source Engine") returned -1 [0067.163] lstrcmpA (lpString1="..", lpString2="Source Engine") returned -1 [0067.163] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\*.*") returned="*.*" [0067.163] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\", lpString2="Source Engine" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine" [0067.163] lstrlenA (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine") returned 60 [0067.163] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5b7c70 [0067.165] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0067.165] FindNextFileA (in: hFindFile=0x5b7c70, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0067.165] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0067.165] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0067.165] FindNextFileA (in: hFindFile=0x5b7c70, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0067.165] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0067.165] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="OSE.EXE") returned -1 [0067.165] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OSE.EXE") returned -1 [0067.165] lstrcmpiA (lpString1="", lpString2="OSE.EXE") returned -1 [0067.165] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\*.*") returned="*.*" [0067.165] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\", lpString2="OSE.EXE" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE" [0067.165] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE", pszSpec="*.zip") returned 0 [0067.165] lstrlenA (lpString="*.zip") returned 5 [0067.165] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE", pszSpec="*.rar") returned 0 [0067.165] lstrlenA (lpString="*.rar") returned 5 [0067.165] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE", pszSpec="*.7z") returned 0 [0067.165] lstrlenA (lpString="*.7z") returned 4 [0067.165] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE", pszSpec="*.tar") returned 0 [0067.165] lstrlenA (lpString="*.tar") returned 5 [0067.165] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE", pszSpec="*.gzip") returned 0 [0067.165] lstrlenA (lpString="*.gzip") returned 6 [0067.167] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE", pszSpec="*.jpg") returned 0 [0067.167] lstrlenA (lpString="*.jpg") returned 5 [0067.167] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE", pszSpec="*.jpeg") returned 0 [0067.167] lstrlenA (lpString="*.jpeg") returned 6 [0067.167] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE", pszSpec="*.psd") returned 0 [0067.167] lstrlenA (lpString="*.psd") returned 5 [0067.167] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE", pszSpec="*.cdr") returned 0 [0067.167] lstrlenA (lpString="*.cdr") returned 5 [0067.167] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE", pszSpec="*.dwg") returned 0 [0067.167] lstrlenA (lpString="*.dwg") returned 5 [0067.167] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE", pszSpec="*.max") returned 0 [0067.167] lstrlenA (lpString="*.max") returned 5 [0067.167] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE", pszSpec="*.bmp") returned 0 [0067.167] lstrlenA (lpString="*.bmp") returned 5 [0067.167] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE", pszSpec="*.gif") returned 0 [0067.167] lstrlenA (lpString="*.gif") returned 5 [0067.167] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE", pszSpec="*.png") returned 0 [0067.167] lstrlenA (lpString="*.png") returned 5 [0067.167] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE", pszSpec="*.doc") returned 0 [0067.167] lstrlenA (lpString="*.doc") returned 5 [0067.167] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE", pszSpec="*.docx") returned 0 [0067.167] lstrlenA (lpString="*.docx") returned 6 [0067.167] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE", pszSpec="*.xls") returned 0 [0067.167] lstrlenA (lpString="*.xls") returned 5 [0067.167] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE", pszSpec="*.xlsx") returned 0 [0067.167] lstrlenA (lpString="*.xlsx") returned 6 [0067.167] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE", pszSpec="*.ppt") returned 0 [0067.167] lstrlenA (lpString="*.ppt") returned 5 [0067.167] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE", pszSpec="*.pptx") returned 0 [0067.167] lstrlenA (lpString="*.pptx") returned 6 [0067.167] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE", pszSpec="*.txt") returned 0 [0067.167] lstrlenA (lpString="*.txt") returned 5 [0067.167] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE", pszSpec="*.pdf") returned 0 [0067.167] lstrlenA (lpString="*.pdf") returned 5 [0067.167] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE", pszSpec="*.djvu") returned 0 [0067.167] lstrlenA (lpString="*.djvu") returned 6 [0067.168] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE", pszSpec="*.htm") returned 0 [0067.168] lstrlenA (lpString="*.htm") returned 5 [0067.168] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE", pszSpec="*.html") returned 0 [0067.168] lstrlenA (lpString="*.html") returned 6 [0067.168] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE", pszSpec="*.mdb") returned 0 [0067.168] lstrlenA (lpString="*.mdb") returned 5 [0067.168] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE", pszSpec="*.cer") returned 0 [0067.168] lstrlenA (lpString="*.cer") returned 5 [0067.168] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE", pszSpec="*.p12") returned 0 [0067.168] lstrlenA (lpString="*.p12") returned 5 [0067.168] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE", pszSpec="*.pfx") returned 0 [0067.168] lstrlenA (lpString="*.pfx") returned 5 [0067.168] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE", pszSpec="*.kwm") returned 0 [0067.168] lstrlenA (lpString="*.kwm") returned 5 [0067.168] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE", pszSpec="*.pwm") returned 0 [0067.168] lstrlenA (lpString="*.pwm") returned 5 [0067.168] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE", pszSpec="*.1cd") returned 0 [0067.168] lstrlenA (lpString="*.1cd") returned 5 [0067.168] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE", pszSpec="*.md") returned 0 [0067.168] lstrlenA (lpString="*.md") returned 4 [0067.168] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE", pszSpec="*.mdf") returned 0 [0067.168] lstrlenA (lpString="*.mdf") returned 5 [0067.168] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE", pszSpec="*.dbf") returned 0 [0067.168] lstrlenA (lpString="*.dbf") returned 5 [0067.168] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE", pszSpec="*.odt") returned 0 [0067.168] lstrlenA (lpString="*.odt") returned 5 [0067.168] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE", pszSpec="*.vob") returned 0 [0067.168] lstrlenA (lpString="*.vob") returned 5 [0067.168] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE", pszSpec="*.ifo") returned 0 [0067.168] lstrlenA (lpString="*.ifo") returned 5 [0067.168] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE", pszSpec="*.lnk") returned 0 [0067.168] lstrlenA (lpString="*.lnk") returned 5 [0067.168] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE", pszSpec="*.torrent") returned 0 [0067.168] lstrlenA (lpString="*.torrent") returned 9 [0067.168] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE", pszSpec="*.mov") returned 0 [0067.168] lstrlenA (lpString="*.mov") returned 5 [0067.169] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE", pszSpec="*.m2v") returned 0 [0067.169] lstrlenA (lpString="*.m2v") returned 5 [0067.169] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE", pszSpec="*.3gp") returned 0 [0067.169] lstrlenA (lpString="*.3gp") returned 5 [0067.169] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE", pszSpec="*.mpeg") returned 0 [0067.169] lstrlenA (lpString="*.mpeg") returned 6 [0067.169] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE", pszSpec="*.mpg") returned 0 [0067.169] lstrlenA (lpString="*.mpg") returned 5 [0067.169] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE", pszSpec="*.flv") returned 0 [0067.169] lstrlenA (lpString="*.flv") returned 5 [0067.169] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE", pszSpec="*.avi") returned 0 [0067.169] lstrlenA (lpString="*.avi") returned 5 [0067.169] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE", pszSpec="*.mp4") returned 0 [0067.169] lstrlenA (lpString="*.mp4") returned 5 [0067.169] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE", pszSpec="*.wmv") returned 0 [0067.169] lstrlenA (lpString="*.wmv") returned 5 [0067.169] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE", pszSpec="*.divx") returned 0 [0067.169] lstrlenA (lpString="*.divx") returned 6 [0067.169] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE", pszSpec="*.mkv") returned 0 [0067.169] lstrlenA (lpString="*.mkv") returned 5 [0067.169] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE", pszSpec="*.mp3") returned 0 [0067.169] lstrlenA (lpString="*.mp3") returned 5 [0067.169] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE", pszSpec="*.wav") returned 0 [0067.169] lstrlenA (lpString="*.wav") returned 5 [0067.169] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE", pszSpec="*.flac") returned 0 [0067.169] lstrlenA (lpString="*.flac") returned 6 [0067.169] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE", pszSpec="*.ape") returned 0 [0067.169] lstrlenA (lpString="*.ape") returned 5 [0067.169] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE", pszSpec="*.wma") returned 0 [0067.169] lstrlenA (lpString="*.wma") returned 5 [0067.169] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE", pszSpec="*.ac3") returned 0 [0067.169] lstrlenA (lpString="*.ac3") returned 5 [0067.169] FindNextFileA (in: hFindFile=0x5b7c70, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0 [0067.169] FindClose (in: hFindFile=0x5b7c70 | out: hFindFile=0x5b7c70) returned 1 [0067.170] FindNextFileA (in: hFindFile=0x5ba128, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0067.170] lstrcmpA (lpString1=".", lpString2="Stationery") returned -1 [0067.170] lstrcmpA (lpString1="..", lpString2="Stationery") returned -1 [0067.170] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\*.*") returned="*.*" [0067.170] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\", lpString2="Stationery" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery" [0067.170] lstrlenA (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery") returned 57 [0067.170] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5b7c68 [0067.186] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0067.186] FindNextFileA (in: hFindFile=0x5b7c68, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0067.187] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0067.187] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0067.187] FindNextFileA (in: hFindFile=0x5b7c68, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0067.187] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0067.187] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Bears.htm") returned 1 [0067.187] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Bears.htm") returned 1 [0067.187] lstrcmpiA (lpString1="", lpString2="Bears.htm") returned -1 [0067.187] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\*.*") returned="*.*" [0067.187] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\", lpString2="Bears.htm" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm" [0067.187] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm", pszSpec="*.zip") returned 0 [0067.187] lstrlenA (lpString="*.zip") returned 5 [0067.187] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm", pszSpec="*.rar") returned 0 [0067.187] lstrlenA (lpString="*.rar") returned 5 [0067.187] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm", pszSpec="*.7z") returned 0 [0067.187] lstrlenA (lpString="*.7z") returned 4 [0067.187] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm", pszSpec="*.tar") returned 0 [0067.187] lstrlenA (lpString="*.tar") returned 5 [0067.187] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm", pszSpec="*.gzip") returned 0 [0067.187] lstrlenA (lpString="*.gzip") returned 6 [0067.187] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm", pszSpec="*.jpg") returned 0 [0067.187] lstrlenA (lpString="*.jpg") returned 5 [0067.187] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm", pszSpec="*.jpeg") returned 0 [0067.187] lstrlenA (lpString="*.jpeg") returned 6 [0067.187] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm", pszSpec="*.psd") returned 0 [0067.187] lstrlenA (lpString="*.psd") returned 5 [0067.187] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm", pszSpec="*.cdr") returned 0 [0067.187] lstrlenA (lpString="*.cdr") returned 5 [0067.187] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm", pszSpec="*.dwg") returned 0 [0067.187] lstrlenA (lpString="*.dwg") returned 5 [0067.187] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm", pszSpec="*.max") returned 0 [0067.187] lstrlenA (lpString="*.max") returned 5 [0067.187] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm", pszSpec="*.bmp") returned 0 [0067.188] lstrlenA (lpString="*.bmp") returned 5 [0067.188] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm", pszSpec="*.gif") returned 0 [0067.188] lstrlenA (lpString="*.gif") returned 5 [0067.188] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm", pszSpec="*.png") returned 0 [0067.188] lstrlenA (lpString="*.png") returned 5 [0067.188] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm", pszSpec="*.doc") returned 0 [0067.188] lstrlenA (lpString="*.doc") returned 5 [0067.188] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm", pszSpec="*.docx") returned 0 [0067.188] lstrlenA (lpString="*.docx") returned 6 [0067.188] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm", pszSpec="*.xls") returned 0 [0067.188] lstrlenA (lpString="*.xls") returned 5 [0067.188] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm", pszSpec="*.xlsx") returned 0 [0067.188] lstrlenA (lpString="*.xlsx") returned 6 [0067.188] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm", pszSpec="*.ppt") returned 0 [0067.188] lstrlenA (lpString="*.ppt") returned 5 [0067.188] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm", pszSpec="*.pptx") returned 0 [0067.188] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm", pszSpec="*.txt") returned 0 [0067.188] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm" [0067.188] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm" [0067.188] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm.") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm." [0067.188] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm. ") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm. " [0067.188] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0067.196] FindNextFileA (in: hFindFile=0x5b7c68, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0067.196] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0067.196] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Bears.jpg") returned 1 [0067.196] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Bears.jpg") returned 1 [0067.196] lstrcmpiA (lpString1="", lpString2="Bears.jpg") returned -1 [0067.196] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned="Bears.htm" [0067.196] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\", lpString2="Bears.jpg" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg" [0067.196] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg" [0067.196] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg" [0067.196] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg.") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg." [0067.196] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg. ") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg. " [0067.196] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0067.196] FindNextFileA (in: hFindFile=0x5b7c68, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0067.196] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0067.196] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Blue_Gradient.jpg") returned 1 [0067.196] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Blue_Gradient.jpg") returned 1 [0067.196] lstrcmpiA (lpString1="", lpString2="Blue_Gradient.jpg") returned -1 [0067.196] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned="Bears.jpg" [0067.196] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\", lpString2="Blue_Gradient.jpg" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg" [0067.196] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg" [0067.196] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg" [0067.196] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg.") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg." [0067.196] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg. ") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg. " [0067.197] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\blue_gradient.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0067.197] FindNextFileA (in: hFindFile=0x5b7c68, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0067.197] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0067.197] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Cave_Drawings.gif") returned 1 [0067.197] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Cave_Drawings.gif") returned 1 [0067.197] lstrcmpiA (lpString1="", lpString2="Cave_Drawings.gif") returned -1 [0067.197] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned="Blue_Gradient.jpg" [0067.197] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\", lpString2="Cave_Drawings.gif" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif" [0067.197] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif" [0067.197] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif" [0067.197] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif.") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif." [0067.197] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif. ") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif. " [0067.197] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\cave_drawings.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0067.198] FindNextFileA (in: hFindFile=0x5b7c68, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0067.198] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0067.198] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Connectivity.gif") returned 1 [0067.198] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Connectivity.gif") returned 1 [0067.198] lstrcmpiA (lpString1="", lpString2="Connectivity.gif") returned -1 [0067.198] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned="Cave_Drawings.gif" [0067.198] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\", lpString2="Connectivity.gif" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif" [0067.198] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif" [0067.198] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif" [0067.198] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif.") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif." [0067.198] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif. ") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif. " [0067.198] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\connectivity.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0067.198] FindNextFileA (in: hFindFile=0x5b7c68, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0067.198] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0067.198] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Desktop.ini") returned 1 [0067.198] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Desktop.ini") returned 1 [0067.198] lstrcmpiA (lpString1="", lpString2="Desktop.ini") returned -1 [0067.198] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned="Connectivity.gif" [0067.198] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\", lpString2="Desktop.ini" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini" [0067.198] FindNextFileA (in: hFindFile=0x5b7c68, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0067.198] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0067.198] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Dotted_Lines.emf") returned 1 [0067.198] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Dotted_Lines.emf") returned 1 [0067.198] lstrcmpiA (lpString1="", lpString2="Dotted_Lines.emf") returned -1 [0067.198] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned="Desktop.ini" [0067.198] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\", lpString2="Dotted_Lines.emf" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf" [0067.198] FindNextFileA (in: hFindFile=0x5b7c68, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0067.198] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0067.198] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Garden.htm") returned -1 [0067.198] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Garden.htm") returned 1 [0067.198] lstrcmpiA (lpString1="", lpString2="Garden.htm") returned -1 [0067.198] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned="Dotted_Lines.emf" [0067.198] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\", lpString2="Garden.htm" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm" [0067.199] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm" [0067.199] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm" [0067.199] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm.") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm." [0067.199] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm. ") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm. " [0067.199] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0067.199] FindNextFileA (in: hFindFile=0x5b7c68, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0067.199] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0067.199] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Garden.jpg") returned -1 [0067.199] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Garden.jpg") returned 1 [0067.199] lstrcmpiA (lpString1="", lpString2="Garden.jpg") returned -1 [0067.199] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned="Garden.htm" [0067.199] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\", lpString2="Garden.jpg" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg" [0067.199] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg" [0067.199] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg" [0067.199] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg.") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg." [0067.199] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg. ") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg. " [0067.199] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0067.199] FindNextFileA (in: hFindFile=0x5b7c68, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0067.199] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0067.199] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Genko_1.emf") returned -1 [0067.199] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Genko_1.emf") returned 1 [0067.199] lstrcmpiA (lpString1="", lpString2="Genko_1.emf") returned -1 [0067.199] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned="Garden.jpg" [0067.199] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\", lpString2="Genko_1.emf" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf" [0067.199] FindNextFileA (in: hFindFile=0x5b7c68, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0067.199] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0067.199] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Genko_2.emf") returned -1 [0067.200] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Genko_2.emf") returned 1 [0067.200] lstrcmpiA (lpString1="", lpString2="Genko_2.emf") returned -1 [0067.200] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned="Genko_1.emf" [0067.200] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\", lpString2="Genko_2.emf" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf" [0067.200] FindNextFileA (in: hFindFile=0x5b7c68, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0067.200] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0067.200] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Graph.emf") returned -1 [0067.200] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Graph.emf") returned 1 [0067.200] lstrcmpiA (lpString1="", lpString2="Graph.emf") returned -1 [0067.200] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned="Genko_2.emf" [0067.200] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\", lpString2="Graph.emf" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf" [0067.200] FindNextFileA (in: hFindFile=0x5b7c68, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0067.200] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0067.200] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Green Bubbles.htm") returned -1 [0067.200] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Green Bubbles.htm") returned 1 [0067.200] lstrcmpiA (lpString1="", lpString2="Green Bubbles.htm") returned -1 [0067.200] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf") returned="Graph.emf" [0067.200] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\", lpString2="Green Bubbles.htm" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm" [0067.200] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm" [0067.200] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm" [0067.200] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm.") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm." [0067.200] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm. ") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm. " [0067.200] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\green bubbles.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0067.201] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0067.201] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="GreenBubbles.jpg") returned -1 [0067.201] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="GreenBubbles.jpg") returned 1 [0067.201] lstrcmpiA (lpString1="", lpString2="GreenBubbles.jpg") returned -1 [0067.201] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm") returned="Green Bubbles.htm" [0067.201] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\", lpString2="GreenBubbles.jpg" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg" [0067.201] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg" [0067.201] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg" [0067.201] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg.") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg." [0067.201] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg. ") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg. " [0067.201] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\greenbubbles.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0067.201] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0067.201] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="grid_(cm).wmf") returned -1 [0067.201] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="grid_(cm).wmf") returned 1 [0067.201] lstrcmpiA (lpString1="", lpString2="grid_(cm).wmf") returned -1 [0067.201] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg") returned="GreenBubbles.jpg" [0067.201] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\", lpString2="grid_(cm).wmf" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf" [0067.201] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0067.201] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="grid_(inch).wmf") returned -1 [0067.201] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="grid_(inch).wmf") returned 1 [0067.202] lstrcmpiA (lpString1="", lpString2="grid_(inch).wmf") returned -1 [0067.202] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf") returned="grid_(cm).wmf" [0067.202] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\", lpString2="grid_(inch).wmf" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf" [0067.202] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0067.202] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Hand Prints.htm") returned -1 [0067.202] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Hand Prints.htm") returned 1 [0067.202] lstrcmpiA (lpString1="", lpString2="Hand Prints.htm") returned -1 [0067.202] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf") returned="grid_(inch).wmf" [0067.202] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\", lpString2="Hand Prints.htm" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm" [0067.202] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm" [0067.202] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm" [0067.202] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm.") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm." [0067.202] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm. ") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm. " [0067.202] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\hand prints.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0067.213] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0067.213] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="HandPrints.jpg") returned -1 [0067.213] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="HandPrints.jpg") returned 1 [0067.213] lstrcmpiA (lpString1="", lpString2="HandPrints.jpg") returned -1 [0067.213] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm") returned="Hand Prints.htm" [0067.213] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\", lpString2="HandPrints.jpg" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HandPrints.jpg") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HandPrints.jpg" [0067.213] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HandPrints.jpg" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HandPrints.jpg") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HandPrints.jpg" [0067.213] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HandPrints.jpg" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HandPrints.jpg") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HandPrints.jpg" [0067.213] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HandPrints.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HandPrints.jpg.") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HandPrints.jpg." [0067.213] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HandPrints.jpg.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HandPrints.jpg. ") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HandPrints.jpg. " [0067.213] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HandPrints.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\handprints.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0067.213] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0067.213] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Memo.emf") returned -1 [0067.213] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Memo.emf") returned -1 [0067.213] lstrcmpiA (lpString1="", lpString2="Memo.emf") returned -1 [0067.213] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HandPrints.jpg") returned="HandPrints.jpg" [0067.213] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\", lpString2="Memo.emf" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Memo.emf") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Memo.emf" [0067.213] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0067.213] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Monet.jpg") returned -1 [0067.213] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Monet.jpg") returned -1 [0067.213] lstrcmpiA (lpString1="", lpString2="Monet.jpg") returned -1 [0067.213] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Memo.emf") returned="Memo.emf" [0067.213] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\", lpString2="Monet.jpg" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Monet.jpg") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Monet.jpg" [0067.213] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Monet.jpg" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Monet.jpg") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Monet.jpg" [0067.213] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Monet.jpg" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Monet.jpg") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Monet.jpg" [0067.213] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Monet.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Monet.jpg.") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Monet.jpg." [0067.213] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Monet.jpg.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Monet.jpg. ") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Monet.jpg. " [0067.213] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Monet.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\monet.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0067.214] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0067.214] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Month_Calendar.emf") returned -1 [0067.214] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Month_Calendar.emf") returned -1 [0067.214] lstrcmpiA (lpString1="", lpString2="Month_Calendar.emf") returned -1 [0067.214] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Monet.jpg") returned="Monet.jpg" [0067.214] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\", lpString2="Month_Calendar.emf" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Month_Calendar.emf") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Month_Calendar.emf" [0067.214] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0067.214] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Music.emf") returned -1 [0067.214] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Music.emf") returned -1 [0067.214] lstrcmpiA (lpString1="", lpString2="Music.emf") returned -1 [0067.214] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Month_Calendar.emf") returned="Month_Calendar.emf" [0067.214] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\", lpString2="Music.emf" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Music.emf") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Music.emf" [0067.214] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0067.214] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Notebook.jpg") returned -1 [0067.214] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Notebook.jpg") returned -1 [0067.214] lstrcmpiA (lpString1="", lpString2="Notebook.jpg") returned -1 [0067.215] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Music.emf") returned="Music.emf" [0067.215] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\", lpString2="Notebook.jpg" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Notebook.jpg") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Notebook.jpg" [0067.215] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Notebook.jpg" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Notebook.jpg") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Notebook.jpg" [0067.215] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Notebook.jpg" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Notebook.jpg") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Notebook.jpg" [0067.215] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Notebook.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Notebook.jpg.") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Notebook.jpg." [0067.215] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Notebook.jpg.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Notebook.jpg. ") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Notebook.jpg. " [0067.215] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Notebook.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\notebook.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0067.215] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0067.215] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Orange Circles.htm") returned -1 [0067.215] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Orange Circles.htm") returned -1 [0067.215] lstrcmpiA (lpString1="", lpString2="Orange Circles.htm") returned -1 [0067.215] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Notebook.jpg") returned="Notebook.jpg" [0067.215] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\", lpString2="Orange Circles.htm" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Orange Circles.htm") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Orange Circles.htm" [0067.215] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Orange Circles.htm" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Orange Circles.htm") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Orange Circles.htm" [0067.215] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Orange Circles.htm" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Orange Circles.htm") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Orange Circles.htm" [0067.216] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Orange Circles.htm", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Orange Circles.htm.") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Orange Circles.htm." [0067.216] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Orange Circles.htm.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Orange Circles.htm. ") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Orange Circles.htm. " [0067.216] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Orange Circles.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\orange circles.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0067.216] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0067.216] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="OrangeCircles.jpg") returned -1 [0067.216] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OrangeCircles.jpg") returned -1 [0067.216] lstrcmpiA (lpString1="", lpString2="OrangeCircles.jpg") returned -1 [0067.216] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Orange Circles.htm") returned="Orange Circles.htm" [0067.216] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\", lpString2="OrangeCircles.jpg" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\OrangeCircles.jpg") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\OrangeCircles.jpg" [0067.216] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\OrangeCircles.jpg" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\OrangeCircles.jpg") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\OrangeCircles.jpg" [0067.216] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\OrangeCircles.jpg" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\OrangeCircles.jpg") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\OrangeCircles.jpg" [0067.216] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\OrangeCircles.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\OrangeCircles.jpg.") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\OrangeCircles.jpg." [0067.216] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\OrangeCircles.jpg.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\OrangeCircles.jpg. ") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\OrangeCircles.jpg. " [0067.216] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\OrangeCircles.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\orangecircles.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0067.216] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0067.216] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Peacock.htm") returned -1 [0067.216] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Peacock.htm") returned -1 [0067.216] lstrcmpiA (lpString1="", lpString2="Peacock.htm") returned -1 [0067.216] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\OrangeCircles.jpg") returned="OrangeCircles.jpg" [0067.216] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\", lpString2="Peacock.htm" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.htm") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.htm" [0067.216] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.htm" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.htm") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.htm" [0067.216] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.htm" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.htm") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.htm" [0067.216] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.htm", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.htm.") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.htm." [0067.216] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.htm.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.htm. ") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.htm. " [0067.216] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0067.217] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0067.217] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Peacock.jpg") returned -1 [0067.217] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Peacock.jpg") returned -1 [0067.217] lstrcmpiA (lpString1="", lpString2="Peacock.jpg") returned -1 [0067.217] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.htm") returned="Peacock.htm" [0067.217] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\", lpString2="Peacock.jpg" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.jpg") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.jpg" [0067.217] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.jpg" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.jpg") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.jpg" [0067.217] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.jpg" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.jpg") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.jpg" [0067.217] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.jpg.") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.jpg." [0067.217] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.jpg.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.jpg. ") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.jpg. " [0067.217] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0067.218] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0067.218] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Pine_Lumber.jpg") returned -1 [0067.218] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Pine_Lumber.jpg") returned -1 [0067.218] lstrcmpiA (lpString1="", lpString2="Pine_Lumber.jpg") returned -1 [0067.218] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.jpg") returned="Peacock.jpg" [0067.218] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\", lpString2="Pine_Lumber.jpg" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pine_Lumber.jpg") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pine_Lumber.jpg" [0067.218] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pine_Lumber.jpg" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pine_Lumber.jpg") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pine_Lumber.jpg" [0067.218] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pine_Lumber.jpg" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pine_Lumber.jpg") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pine_Lumber.jpg" [0067.218] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pine_Lumber.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pine_Lumber.jpg.") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pine_Lumber.jpg." [0067.218] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pine_Lumber.jpg.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pine_Lumber.jpg. ") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pine_Lumber.jpg. " [0067.218] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pine_Lumber.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\pine_lumber.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0067.218] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0067.218] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Pretty_Peacock.jpg") returned -1 [0067.218] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Pretty_Peacock.jpg") returned -1 [0067.218] lstrcmpiA (lpString1="", lpString2="Pretty_Peacock.jpg") returned -1 [0067.219] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pine_Lumber.jpg") returned="Pine_Lumber.jpg" [0067.219] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\", lpString2="Pretty_Peacock.jpg" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pretty_Peacock.jpg") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pretty_Peacock.jpg" [0067.219] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pretty_Peacock.jpg" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pretty_Peacock.jpg") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pretty_Peacock.jpg" [0067.219] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pretty_Peacock.jpg" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pretty_Peacock.jpg") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pretty_Peacock.jpg" [0067.219] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pretty_Peacock.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pretty_Peacock.jpg.") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pretty_Peacock.jpg." [0067.219] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pretty_Peacock.jpg.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pretty_Peacock.jpg. ") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pretty_Peacock.jpg. " [0067.219] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pretty_Peacock.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\pretty_peacock.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0067.219] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0067.219] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Psychedelic.jpg") returned -1 [0067.219] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Psychedelic.jpg") returned -1 [0067.219] lstrcmpiA (lpString1="", lpString2="Psychedelic.jpg") returned -1 [0067.219] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pretty_Peacock.jpg") returned="Pretty_Peacock.jpg" [0067.219] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\", lpString2="Psychedelic.jpg" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Psychedelic.jpg") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Psychedelic.jpg" [0067.219] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Psychedelic.jpg" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Psychedelic.jpg") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Psychedelic.jpg" [0067.219] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Psychedelic.jpg" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Psychedelic.jpg") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Psychedelic.jpg" [0067.219] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Psychedelic.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Psychedelic.jpg.") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Psychedelic.jpg." [0067.219] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Psychedelic.jpg.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Psychedelic.jpg. ") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Psychedelic.jpg. " [0067.219] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Psychedelic.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\psychedelic.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0067.220] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0067.220] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Roses.htm") returned -1 [0067.220] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Roses.htm") returned -1 [0067.220] lstrcmpiA (lpString1="", lpString2="Roses.htm") returned -1 [0067.220] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Psychedelic.jpg") returned="Psychedelic.jpg" [0067.220] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\", lpString2="Roses.htm" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.htm") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.htm" [0067.220] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.htm" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.htm") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.htm" [0067.220] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.htm" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.htm") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.htm" [0067.220] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.htm", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.htm.") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.htm." [0067.220] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.htm.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.htm. ") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.htm. " [0067.220] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\roses.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0067.220] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0067.221] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Roses.jpg") returned -1 [0067.221] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Roses.jpg") returned -1 [0067.221] lstrcmpiA (lpString1="", lpString2="Roses.jpg") returned -1 [0067.221] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.htm") returned="Roses.htm" [0067.221] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\", lpString2="Roses.jpg" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.jpg") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.jpg" [0067.221] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.jpg" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.jpg") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.jpg" [0067.221] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.jpg" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.jpg") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.jpg" [0067.221] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.jpg.") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.jpg." [0067.221] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.jpg.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.jpg. ") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.jpg. " [0067.221] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\roses.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0067.221] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0067.222] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Sand_Paper.jpg") returned -1 [0067.222] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Sand_Paper.jpg") returned -1 [0067.222] lstrcmpiA (lpString1="", lpString2="Sand_Paper.jpg") returned -1 [0067.222] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.jpg") returned="Roses.jpg" [0067.222] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\", lpString2="Sand_Paper.jpg" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Sand_Paper.jpg") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Sand_Paper.jpg" [0067.222] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Sand_Paper.jpg" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Sand_Paper.jpg") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Sand_Paper.jpg" [0067.222] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Sand_Paper.jpg" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Sand_Paper.jpg") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Sand_Paper.jpg" [0067.222] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Sand_Paper.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Sand_Paper.jpg.") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Sand_Paper.jpg." [0067.222] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Sand_Paper.jpg.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Sand_Paper.jpg. ") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Sand_Paper.jpg. " [0067.222] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Sand_Paper.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\sand_paper.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0067.222] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0067.222] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Seyes.emf") returned -1 [0067.222] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Seyes.emf") returned -1 [0067.222] lstrcmpiA (lpString1="", lpString2="Seyes.emf") returned -1 [0067.222] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Sand_Paper.jpg") returned="Sand_Paper.jpg" [0067.222] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\", lpString2="Seyes.emf" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Seyes.emf") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Seyes.emf" [0067.222] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0067.222] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Shades of Blue.htm") returned -1 [0067.222] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Shades of Blue.htm") returned -1 [0067.222] lstrcmpiA (lpString1="", lpString2="Shades of Blue.htm") returned -1 [0067.222] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Seyes.emf") returned="Seyes.emf" [0067.222] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\", lpString2="Shades of Blue.htm" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shades of Blue.htm") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shades of Blue.htm" [0067.222] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shades of Blue.htm" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shades of Blue.htm") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shades of Blue.htm" [0067.222] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shades of Blue.htm" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shades of Blue.htm") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shades of Blue.htm" [0067.222] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shades of Blue.htm", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shades of Blue.htm.") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shades of Blue.htm." [0067.222] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shades of Blue.htm.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shades of Blue.htm. ") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shades of Blue.htm. " [0067.222] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shades of Blue.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shades of blue.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0067.222] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0067.223] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="ShadesOfBlue.jpg") returned -1 [0067.223] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ShadesOfBlue.jpg") returned -1 [0067.223] lstrcmpiA (lpString1="", lpString2="ShadesOfBlue.jpg") returned -1 [0067.223] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shades of Blue.htm") returned="Shades of Blue.htm" [0067.223] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\", lpString2="ShadesOfBlue.jpg" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\ShadesOfBlue.jpg") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\ShadesOfBlue.jpg" [0067.223] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\ShadesOfBlue.jpg" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\ShadesOfBlue.jpg") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\ShadesOfBlue.jpg" [0067.223] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\ShadesOfBlue.jpg" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\ShadesOfBlue.jpg") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\ShadesOfBlue.jpg" [0067.223] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\ShadesOfBlue.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\ShadesOfBlue.jpg.") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\ShadesOfBlue.jpg." [0067.223] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\ShadesOfBlue.jpg.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\ShadesOfBlue.jpg. ") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\ShadesOfBlue.jpg. " [0067.223] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\ShadesOfBlue.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shadesofblue.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0067.226] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0067.226] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Shorthand.emf") returned -1 [0067.226] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Shorthand.emf") returned -1 [0067.226] lstrcmpiA (lpString1="", lpString2="Shorthand.emf") returned -1 [0067.226] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\ShadesOfBlue.jpg") returned="ShadesOfBlue.jpg" [0067.226] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\", lpString2="Shorthand.emf" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shorthand.emf") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shorthand.emf" [0067.226] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0067.226] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Small_News.jpg") returned -1 [0067.226] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Small_News.jpg") returned -1 [0067.226] lstrcmpiA (lpString1="", lpString2="Small_News.jpg") returned -1 [0067.226] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shorthand.emf") returned="Shorthand.emf" [0067.226] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\", lpString2="Small_News.jpg" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Small_News.jpg") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Small_News.jpg" [0067.226] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Small_News.jpg" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Small_News.jpg") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Small_News.jpg" [0067.226] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Small_News.jpg" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Small_News.jpg") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Small_News.jpg" [0067.226] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Small_News.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Small_News.jpg.") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Small_News.jpg." [0067.226] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Small_News.jpg.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Small_News.jpg. ") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Small_News.jpg. " [0067.226] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Small_News.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\small_news.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0067.249] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0067.249] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Soft Blue.htm") returned -1 [0067.249] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Soft Blue.htm") returned -1 [0067.249] lstrcmpiA (lpString1="", lpString2="Soft Blue.htm") returned -1 [0067.249] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Small_News.jpg") returned="Small_News.jpg" [0067.249] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\", lpString2="Soft Blue.htm" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Soft Blue.htm") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Soft Blue.htm" [0067.250] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Soft Blue.htm" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Soft Blue.htm") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Soft Blue.htm" [0067.250] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Soft Blue.htm" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Soft Blue.htm") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Soft Blue.htm" [0067.250] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Soft Blue.htm", lpString2="." | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Soft Blue.htm.") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Soft Blue.htm." [0067.250] lstrcatA (in: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Soft Blue.htm.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Soft Blue.htm. ") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Soft Blue.htm. " [0067.250] CreateFileA (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Soft Blue.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\soft blue.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0067.251] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0067.251] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="SoftBlue.jpg") returned -1 [0067.251] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SoftBlue.jpg") returned -1 [0067.251] lstrcmpiA (lpString1="", lpString2="SoftBlue.jpg") returned -1 [0067.251] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Soft Blue.htm") returned="Soft Blue.htm" [0067.253] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0067.253] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Stars.htm") returned -1 [0067.253] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Stars.htm") returned -1 [0067.253] lstrcmpiA (lpString1="", lpString2="Stars.htm") returned -1 [0067.253] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\SoftBlue.jpg") returned="SoftBlue.jpg" [0067.253] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0067.253] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Stars.jpg") returned -1 [0067.253] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Stars.jpg") returned -1 [0067.253] lstrcmpiA (lpString1="", lpString2="Stars.jpg") returned -1 [0067.253] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.htm") returned="Stars.htm" [0067.256] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0067.256] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Stucco.gif") returned -1 [0067.256] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Stucco.gif") returned -1 [0067.256] lstrcmpiA (lpString1="", lpString2="Stucco.gif") returned -1 [0067.256] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.jpg") returned="Stars.jpg" [0067.256] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0067.256] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Tanspecks.jpg") returned -1 [0067.256] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Tanspecks.jpg") returned -1 [0067.256] lstrcmpiA (lpString1="", lpString2="Tanspecks.jpg") returned -1 [0067.256] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stucco.gif") returned="Stucco.gif" [0067.257] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0067.257] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Tiki.gif") returned -1 [0067.257] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Tiki.gif") returned -1 [0067.257] lstrcmpiA (lpString1="", lpString2="Tiki.gif") returned -1 [0067.257] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tanspecks.jpg") returned="Tanspecks.jpg" [0067.257] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0067.257] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="To_Do_List.emf") returned -1 [0067.257] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="To_Do_List.emf") returned -1 [0067.257] lstrcmpiA (lpString1="", lpString2="To_Do_List.emf") returned -1 [0067.257] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tiki.gif") returned="Tiki.gif" [0067.257] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0067.257] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="White_Chocolate.jpg") returned -1 [0067.257] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="White_Chocolate.jpg") returned -1 [0067.257] lstrcmpiA (lpString1="", lpString2="White_Chocolate.jpg") returned -1 [0067.257] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\To_Do_List.emf") returned="To_Do_List.emf" [0067.258] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0067.258] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Wrinkled_Paper.gif") returned -1 [0067.258] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Wrinkled_Paper.gif") returned -1 [0067.258] lstrcmpiA (lpString1="", lpString2="Wrinkled_Paper.gif") returned -1 [0067.258] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\White_Chocolate.jpg") returned="White_Chocolate.jpg" [0067.259] lstrcmpA (lpString1=".", lpString2="TextConv") returned -1 [0067.259] lstrcmpA (lpString1="..", lpString2="TextConv") returned -1 [0067.259] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\*.*") returned="*.*" [0067.259] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5b7be0 [0067.260] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0067.260] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0067.260] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0067.260] lstrcmpA (lpString1=".", lpString2="en-US") returned -1 [0067.260] lstrcmpA (lpString1="..", lpString2="en-US") returned -1 [0067.260] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\*.*") returned="*.*" [0067.260] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\en-US\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5b8c28 [0067.260] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0067.260] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0067.260] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0067.260] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0067.260] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="MSCONV97.DLL") returned -1 [0067.260] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSCONV97.DLL") returned -1 [0067.260] lstrcmpiA (lpString1="", lpString2="MSCONV97.DLL") returned -1 [0067.260] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\*.*") returned="*.*" [0067.261] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0067.261] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="RECOVR32.CNV") returned -1 [0067.261] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="RECOVR32.CNV") returned -1 [0067.261] lstrcmpiA (lpString1="", lpString2="RECOVR32.CNV") returned -1 [0067.261] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\MSCONV97.DLL") returned="MSCONV97.DLL" [0067.261] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0067.261] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Wks9Pxy.cnv") returned -1 [0067.261] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Wks9Pxy.cnv") returned -1 [0067.261] lstrcmpiA (lpString1="", lpString2="Wks9Pxy.cnv") returned -1 [0067.261] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\RECOVR32.CNV") returned="RECOVR32.CNV" [0067.261] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0067.261] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="WPFT532.CNV") returned -1 [0067.261] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WPFT532.CNV") returned -1 [0067.261] lstrcmpiA (lpString1="", lpString2="WPFT532.CNV") returned -1 [0067.261] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\Wks9Pxy.cnv") returned="Wks9Pxy.cnv" [0067.261] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0067.261] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="WPFT632.CNV") returned -1 [0067.261] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WPFT632.CNV") returned -1 [0067.261] lstrcmpiA (lpString1="", lpString2="WPFT632.CNV") returned -1 [0067.261] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT532.CNV") returned="WPFT532.CNV" [0067.261] lstrcmpA (lpString1=".", lpString2="THEMES14") returned -1 [0067.261] lstrcmpA (lpString1="..", lpString2="THEMES14") returned -1 [0067.261] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\*.*") returned="*.*" [0067.262] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5b7be0 [0067.279] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0067.280] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0067.280] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0067.280] lstrcmpA (lpString1=".", lpString2="AFTRNOON") returned -1 [0067.280] lstrcmpA (lpString1="..", lpString2="AFTRNOON") returned -1 [0067.280] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\*.*") returned="*.*" [0067.280] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5b8c28 [0067.280] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0067.280] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0067.280] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0067.280] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0067.280] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="AFTRNOON.ELM") returned 1 [0067.280] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AFTRNOON.ELM") returned 1 [0067.280] lstrcmpiA (lpString1="", lpString2="AFTRNOON.ELM") returned -1 [0067.280] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\*.*") returned="*.*" [0067.281] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0067.281] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="AFTRNOON.INF") returned 1 [0067.281] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AFTRNOON.INF") returned 1 [0067.281] lstrcmpiA (lpString1="", lpString2="AFTRNOON.INF") returned -1 [0067.281] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.ELM") returned="AFTRNOON.ELM" [0067.281] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0067.281] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="PREVIEW.GIF") returned -1 [0067.281] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PREVIEW.GIF") returned -1 [0067.281] lstrcmpiA (lpString1="", lpString2="PREVIEW.GIF") returned -1 [0067.281] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.INF") returned="AFTRNOON.INF" [0067.291] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF") returned="PREVIEW.GIF" [0067.292] SetFilePointer (in: hFile=0x90, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0067.292] WriteFile (in: hFile=0x90, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x5c7, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x5c7, lpOverlapped=0x0) returned 1 [0067.292] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0067.292] CloseHandle (hObject=0x90) returned 1 [0067.292] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF. " (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\preview.gif. ")) returned 1 [0067.293] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0067.293] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="THMBNAIL.PNG") returned -1 [0067.293] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="THMBNAIL.PNG") returned -1 [0067.293] lstrcmpiA (lpString1="", lpString2="THMBNAIL.PNG") returned -1 [0067.293] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF") returned="PREVIEW.GIF" [0067.304] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG") returned="THMBNAIL.PNG" [0067.304] SetFilePointer (in: hFile=0x90, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0067.304] WriteFile (in: hFile=0x90, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x6238, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x6238, lpOverlapped=0x0) returned 1 [0067.304] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0067.304] CloseHandle (hObject=0x90) returned 1 [0067.304] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG. " (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\thmbnail.png. ")) returned 1 [0067.305] lstrcmpA (lpString1=".", lpString2="ARCTIC") returned -1 [0067.305] lstrcmpA (lpString1="..", lpString2="ARCTIC") returned -1 [0067.305] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\*.*") returned="*.*" [0067.305] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5b8c28 [0067.306] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0067.306] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0067.306] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0067.306] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0067.306] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="ARCTIC.ELM") returned 1 [0067.306] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ARCTIC.ELM") returned 1 [0067.306] lstrcmpiA (lpString1="", lpString2="ARCTIC.ELM") returned -1 [0067.306] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\*.*") returned="*.*" [0067.306] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0067.306] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="ARCTIC.INF") returned 1 [0067.306] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ARCTIC.INF") returned 1 [0067.306] lstrcmpiA (lpString1="", lpString2="ARCTIC.INF") returned -1 [0067.306] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM") returned="ARCTIC.ELM" [0067.306] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0067.306] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="PREVIEW.GIF") returned -1 [0067.306] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PREVIEW.GIF") returned -1 [0067.306] lstrcmpiA (lpString1="", lpString2="PREVIEW.GIF") returned -1 [0067.306] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.INF") returned="ARCTIC.INF" [0067.314] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned="PREVIEW.GIF" [0067.314] SetFilePointer (in: hFile=0x90, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0067.314] WriteFile (in: hFile=0x90, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0xb4f, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0xb4f, lpOverlapped=0x0) returned 1 [0067.314] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0067.314] CloseHandle (hObject=0x90) returned 1 [0067.314] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF. " (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\preview.gif. ")) returned 1 [0067.315] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0067.315] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="THMBNAIL.PNG") returned -1 [0067.315] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="THMBNAIL.PNG") returned -1 [0067.315] lstrcmpiA (lpString1="", lpString2="THMBNAIL.PNG") returned -1 [0067.315] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned="PREVIEW.GIF" [0067.320] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG") returned="THMBNAIL.PNG" [0067.320] SetFilePointer (in: hFile=0x90, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0067.320] WriteFile (in: hFile=0x90, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x4cea, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x4cea, lpOverlapped=0x0) returned 1 [0067.320] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0067.321] CloseHandle (hObject=0x90) returned 1 [0067.321] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG. " (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\thmbnail.png. ")) returned 1 [0067.321] lstrcmpA (lpString1=".", lpString2="AXIS") returned -1 [0067.321] lstrcmpA (lpString1="..", lpString2="AXIS") returned -1 [0067.321] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\*.*") returned="*.*" [0067.321] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5b8c28 [0067.322] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0067.322] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0067.322] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0067.322] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0067.322] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="AXIS.ELM") returned 1 [0067.322] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AXIS.ELM") returned 1 [0067.322] lstrcmpiA (lpString1="", lpString2="AXIS.ELM") returned -1 [0067.322] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\*.*") returned="*.*" [0067.322] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0067.322] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="AXIS.INF") returned 1 [0067.322] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AXIS.INF") returned 1 [0067.322] lstrcmpiA (lpString1="", lpString2="AXIS.INF") returned -1 [0067.322] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM") returned="AXIS.ELM" [0067.323] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0067.323] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.INF") returned="AXIS.INF" [0067.331] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned="PREVIEW.GIF" [0067.331] SetFilePointer (in: hFile=0x90, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0067.332] WriteFile (in: hFile=0x90, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0xac6, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0xac6, lpOverlapped=0x0) returned 1 [0067.332] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0067.332] CloseHandle (hObject=0x90) returned 1 [0067.332] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF. " (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\preview.gif. ")) returned 1 [0067.332] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0067.332] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned="PREVIEW.GIF" [0067.334] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG") returned="THMBNAIL.PNG" [0067.334] SetFilePointer (in: hFile=0x90, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0067.334] WriteFile (in: hFile=0x90, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x880a, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x880a, lpOverlapped=0x0) returned 1 [0067.334] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0067.334] CloseHandle (hObject=0x90) returned 1 [0067.334] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG. " (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\thmbnail.png. ")) returned 1 [0067.335] lstrcmpA (lpString1=".", lpString2="BLENDS") returned -1 [0067.335] lstrcmpA (lpString1="..", lpString2="BLENDS") returned -1 [0067.335] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\*.*") returned="*.*" [0067.335] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5b8c28 [0067.336] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0067.336] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0067.336] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0067.336] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0067.336] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\*.*") returned="*.*" [0067.336] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0067.336] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM") returned="BLENDS.ELM" [0067.336] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0067.336] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF") returned="BLENDS.INF" [0067.380] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned="PREVIEW.GIF" [0067.380] SetFilePointer (in: hFile=0x90, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0067.380] WriteFile (in: hFile=0x90, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x82b, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x82b, lpOverlapped=0x0) returned 1 [0067.380] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0067.380] CloseHandle (hObject=0x90) returned 1 [0067.380] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF. " (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\preview.gif. ")) returned 1 [0067.381] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0067.381] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned="PREVIEW.GIF" [0067.390] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG") returned="THMBNAIL.PNG" [0067.390] SetFilePointer (in: hFile=0x90, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0067.390] WriteFile (in: hFile=0x90, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x5039, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x5039, lpOverlapped=0x0) returned 1 [0067.390] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0067.390] CloseHandle (hObject=0x90) returned 1 [0067.390] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG. " (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\thmbnail.png. ")) returned 1 [0067.391] lstrcmpA (lpString1=".", lpString2="BLUECALM") returned -1 [0067.391] lstrcmpA (lpString1="..", lpString2="BLUECALM") returned -1 [0067.391] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\*.*") returned="*.*" [0067.391] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5b8c28 [0067.392] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0067.392] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0067.392] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0067.392] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0067.392] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\*.*") returned="*.*" [0067.392] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0067.392] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM") returned="BLUECALM.ELM" [0067.392] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0067.392] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF") returned="BLUECALM.INF" [0067.411] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned="PREVIEW.GIF" [0067.411] SetFilePointer (in: hFile=0x90, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0067.411] WriteFile (in: hFile=0x90, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x5be, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x5be, lpOverlapped=0x0) returned 1 [0067.412] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0067.412] CloseHandle (hObject=0x90) returned 1 [0067.412] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF. " (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\preview.gif. ")) returned 1 [0067.412] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0067.412] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned="PREVIEW.GIF" [0067.423] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG") returned="THMBNAIL.PNG" [0067.423] SetFilePointer (in: hFile=0x90, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0067.423] WriteFile (in: hFile=0x90, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x8097, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x8097, lpOverlapped=0x0) returned 1 [0067.424] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0067.424] CloseHandle (hObject=0x90) returned 1 [0067.424] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG. " (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\thmbnail.png. ")) returned 1 [0067.424] lstrcmpA (lpString1=".", lpString2="BLUEPRNT") returned -1 [0067.424] lstrcmpA (lpString1="..", lpString2="BLUEPRNT") returned -1 [0067.424] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\*.*") returned="*.*" [0067.424] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5b8c28 [0067.426] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0067.426] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0067.426] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0067.426] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0067.426] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\*.*") returned="*.*" [0067.426] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0067.426] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM") returned="BLUEPRNT.ELM" [0067.426] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0067.426] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF") returned="BLUEPRNT.INF" [0067.450] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned="PREVIEW.GIF" [0067.450] SetFilePointer (in: hFile=0x90, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0067.450] WriteFile (in: hFile=0x90, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x72b, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x72b, lpOverlapped=0x0) returned 1 [0067.450] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0067.450] CloseHandle (hObject=0x90) returned 1 [0067.450] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF. " (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\preview.gif. ")) returned 1 [0067.451] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0067.451] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned="PREVIEW.GIF" [0067.453] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG") returned="THMBNAIL.PNG" [0067.453] SetFilePointer (in: hFile=0x90, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0067.453] WriteFile (in: hFile=0x90, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x6ab5, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x6ab5, lpOverlapped=0x0) returned 1 [0067.453] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0067.453] CloseHandle (hObject=0x90) returned 1 [0067.453] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG. " (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\thmbnail.png. ")) returned 1 [0067.454] lstrcmpA (lpString1=".", lpString2="BOLDSTRI") returned -1 [0067.454] lstrcmpA (lpString1="..", lpString2="BOLDSTRI") returned -1 [0067.454] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\*.*") returned="*.*" [0067.454] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5b8c28 [0067.455] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0067.455] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0067.455] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0067.455] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0067.455] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\*.*") returned="*.*" [0067.455] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0067.455] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM") returned="BOLDSTRI.ELM" [0067.455] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0067.455] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF") returned="BOLDSTRI.INF" [0067.458] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned="PREVIEW.GIF" [0067.458] SetFilePointer (in: hFile=0x90, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0067.458] WriteFile (in: hFile=0x90, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0xd3d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0xd3d, lpOverlapped=0x0) returned 1 [0067.458] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0067.458] CloseHandle (hObject=0x90) returned 1 [0067.458] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF. " (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\preview.gif. ")) returned 1 [0067.459] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0067.459] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned="PREVIEW.GIF" [0067.474] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG") returned="THMBNAIL.PNG" [0067.474] SetFilePointer (in: hFile=0x90, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0067.474] WriteFile (in: hFile=0x90, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x7c03, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x7c03, lpOverlapped=0x0) returned 1 [0067.474] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0067.474] CloseHandle (hObject=0x90) returned 1 [0067.474] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG. " (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\thmbnail.png. ")) returned 1 [0067.475] lstrcmpA (lpString1=".", lpString2="BREEZE") returned -1 [0067.475] lstrcmpA (lpString1="..", lpString2="BREEZE") returned -1 [0067.475] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\*.*") returned="*.*" [0067.475] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5b8c28 [0067.476] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0067.476] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0067.477] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0067.477] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0067.477] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\*.*") returned="*.*" [0067.477] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0067.477] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM") returned="BREEZE.ELM" [0067.477] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0067.477] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF") returned="BREEZE.INF" [0067.495] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned="PREVIEW.GIF" [0067.495] SetFilePointer (in: hFile=0x90, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0067.495] WriteFile (in: hFile=0x90, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0xa48, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0xa48, lpOverlapped=0x0) returned 1 [0067.496] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0067.496] CloseHandle (hObject=0x90) returned 1 [0067.496] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF. " (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\preview.gif. ")) returned 1 [0067.496] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0067.496] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned="PREVIEW.GIF" [0067.514] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG") returned="THMBNAIL.PNG" [0067.514] SetFilePointer (in: hFile=0x90, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0067.514] WriteFile (in: hFile=0x90, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0xa8b2, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0xa8b2, lpOverlapped=0x0) returned 1 [0067.514] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0067.514] CloseHandle (hObject=0x90) returned 1 [0067.514] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG. " (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\thmbnail.png. ")) returned 1 [0067.515] lstrcmpA (lpString1=".", lpString2="CANYON") returned -1 [0067.515] lstrcmpA (lpString1="..", lpString2="CANYON") returned -1 [0067.516] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\*.*") returned="*.*" [0067.516] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5b8c28 [0067.526] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0067.526] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0067.526] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0067.526] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0067.526] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\*.*") returned="*.*" [0067.526] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0067.526] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM") returned="CANYON.ELM" [0067.526] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0067.526] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF") returned="CANYON.INF" [0067.542] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned="PREVIEW.GIF" [0067.542] SetFilePointer (in: hFile=0x90, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0067.543] WriteFile (in: hFile=0x90, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x357, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x357, lpOverlapped=0x0) returned 1 [0067.543] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0067.543] CloseHandle (hObject=0x90) returned 1 [0067.543] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF. " (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\preview.gif. ")) returned 1 [0067.543] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0067.543] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned="PREVIEW.GIF" [0067.567] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned="THMBNAIL.PNG" [0067.567] SetFilePointer (in: hFile=0x90, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0067.568] WriteFile (in: hFile=0x90, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x7f05, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x7f05, lpOverlapped=0x0) returned 1 [0067.568] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0067.568] CloseHandle (hObject=0x90) returned 1 [0067.568] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG. " (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\thmbnail.png. ")) returned 1 [0067.569] lstrcmpA (lpString1=".", lpString2="CAPSULES") returned -1 [0067.569] lstrcmpA (lpString1="..", lpString2="CAPSULES") returned -1 [0067.569] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\*.*") returned="*.*" [0067.569] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5b8c28 [0067.570] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0067.570] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0067.570] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0067.570] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0067.570] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\*.*") returned="*.*" [0067.570] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0067.570] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM") returned="CAPSULES.ELM" [0067.570] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0067.570] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.INF") returned="CAPSULES.INF" [0067.579] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned="PREVIEW.GIF" [0067.579] SetFilePointer (in: hFile=0x90, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0067.579] WriteFile (in: hFile=0x90, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x7a2, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x7a2, lpOverlapped=0x0) returned 1 [0067.579] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0067.579] CloseHandle (hObject=0x90) returned 1 [0067.579] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF. " (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\preview.gif. ")) returned 1 [0067.580] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0067.580] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned="PREVIEW.GIF" [0067.581] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned="THMBNAIL.PNG" [0067.581] SetFilePointer (in: hFile=0x90, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0067.582] WriteFile (in: hFile=0x90, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x748b, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x748b, lpOverlapped=0x0) returned 1 [0067.582] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0067.582] CloseHandle (hObject=0x90) returned 1 [0067.582] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG. " (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\thmbnail.png. ")) returned 1 [0067.582] lstrcmpA (lpString1=".", lpString2="CASCADE") returned -1 [0067.582] lstrcmpA (lpString1="..", lpString2="CASCADE") returned -1 [0067.582] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\*.*") returned="*.*" [0067.582] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5b8c28 [0067.585] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0067.585] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0067.585] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0067.585] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0067.585] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\*.*") returned="*.*" [0067.585] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0067.585] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.ELM") returned="CASCADE.ELM" [0067.586] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0067.586] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.INF") returned="CASCADE.INF" [0067.587] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned="PREVIEW.GIF" [0067.587] SetFilePointer (in: hFile=0x90, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0067.587] WriteFile (in: hFile=0x90, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x4f9, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x4f9, lpOverlapped=0x0) returned 1 [0067.587] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0067.587] CloseHandle (hObject=0x90) returned 1 [0067.588] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF. " (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\preview.gif. ")) returned 1 [0067.588] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0067.588] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned="PREVIEW.GIF" [0067.596] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG") returned="THMBNAIL.PNG" [0067.596] SetFilePointer (in: hFile=0x90, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0067.596] WriteFile (in: hFile=0x90, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x4f39, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x4f39, lpOverlapped=0x0) returned 1 [0067.597] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0067.597] CloseHandle (hObject=0x90) returned 1 [0067.597] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG. " (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\thmbnail.png. ")) returned 1 [0067.597] lstrcmpA (lpString1=".", lpString2="COMPASS") returned -1 [0067.597] lstrcmpA (lpString1="..", lpString2="COMPASS") returned -1 [0067.597] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\*.*") returned="*.*" [0067.598] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5b8c28 [0067.598] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0067.599] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0067.599] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0067.599] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0067.599] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\*.*") returned="*.*" [0067.599] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0067.599] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.ELM") returned="COMPASS.ELM" [0067.599] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0067.599] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF") returned="COMPASS.INF" [0067.610] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF") returned="PREVIEW.GIF" [0067.610] SetFilePointer (in: hFile=0x90, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0067.610] WriteFile (in: hFile=0x90, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x4b3, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x4b3, lpOverlapped=0x0) returned 1 [0067.610] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0067.610] CloseHandle (hObject=0x90) returned 1 [0067.610] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF. " (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\preview.gif. ")) returned 1 [0067.611] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0067.611] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF") returned="PREVIEW.GIF" [0067.612] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG") returned="THMBNAIL.PNG" [0067.612] SetFilePointer (in: hFile=0x90, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0067.612] WriteFile (in: hFile=0x90, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x5005, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x5005, lpOverlapped=0x0) returned 1 [0067.613] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0067.613] CloseHandle (hObject=0x90) returned 1 [0067.613] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG. " (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\thmbnail.png. ")) returned 1 [0067.614] lstrcmpA (lpString1=".", lpString2="CONCRETE") returned -1 [0067.614] lstrcmpA (lpString1="..", lpString2="CONCRETE") returned -1 [0067.614] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\*.*") returned="*.*" [0067.614] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5b8c28 [0067.614] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0067.614] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0067.614] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0067.614] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0067.615] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\*.*") returned="*.*" [0067.615] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0067.615] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM") returned="CONCRETE.ELM" [0067.615] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0067.615] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.INF") returned="CONCRETE.INF" [0067.619] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF") returned="PREVIEW.GIF" [0067.619] SetFilePointer (in: hFile=0x90, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0067.619] WriteFile (in: hFile=0x90, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x4ad, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x4ad, lpOverlapped=0x0) returned 1 [0067.619] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0067.619] CloseHandle (hObject=0x90) returned 1 [0067.619] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF. " (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\preview.gif. ")) returned 1 [0067.620] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0067.620] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF") returned="PREVIEW.GIF" [0067.622] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG") returned="THMBNAIL.PNG" [0067.622] SetFilePointer (in: hFile=0x90, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0067.622] WriteFile (in: hFile=0x90, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x6f59, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x6f59, lpOverlapped=0x0) returned 1 [0067.622] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0067.622] CloseHandle (hObject=0x90) returned 1 [0067.622] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG. " (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\thmbnail.png. ")) returned 1 [0067.623] lstrcmpA (lpString1=".", lpString2="DEEPBLUE") returned -1 [0067.623] lstrcmpA (lpString1="..", lpString2="DEEPBLUE") returned -1 [0067.623] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\*.*") returned="*.*" [0067.623] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5b8c28 [0067.623] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0067.623] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0067.623] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0067.623] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0067.623] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\*.*") returned="*.*" [0067.623] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0067.624] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM") returned="DEEPBLUE.ELM" [0067.624] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0067.624] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.INF") returned="DEEPBLUE.INF" [0067.625] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF") returned="PREVIEW.GIF" [0067.625] SetFilePointer (in: hFile=0x90, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0067.625] WriteFile (in: hFile=0x90, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0xf1b, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0xf1b, lpOverlapped=0x0) returned 1 [0067.625] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0067.625] CloseHandle (hObject=0x90) returned 1 [0067.626] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF. " (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\preview.gif. ")) returned 1 [0067.626] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0067.626] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF") returned="PREVIEW.GIF" [0067.628] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG") returned="THMBNAIL.PNG" [0067.629] SetFilePointer (in: hFile=0x90, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0067.629] WriteFile (in: hFile=0x90, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x81a3, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x81a3, lpOverlapped=0x0) returned 1 [0067.629] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0067.629] CloseHandle (hObject=0x90) returned 1 [0067.629] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG. " (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\thmbnail.png. ")) returned 1 [0067.630] lstrcmpA (lpString1=".", lpString2="ECHO") returned -1 [0067.630] lstrcmpA (lpString1="..", lpString2="ECHO") returned -1 [0067.630] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\*.*") returned="*.*" [0067.630] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5b8c28 [0067.631] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0067.631] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0067.631] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0067.631] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0067.631] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\*.*") returned="*.*" [0067.631] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0067.631] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM") returned="ECHO.ELM" [0067.631] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0067.631] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.INF") returned="ECHO.INF" [0067.633] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF") returned="PREVIEW.GIF" [0067.633] SetFilePointer (in: hFile=0x90, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0067.633] WriteFile (in: hFile=0x90, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x553, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x553, lpOverlapped=0x0) returned 1 [0067.633] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0067.633] CloseHandle (hObject=0x90) returned 1 [0067.633] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF. " (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\preview.gif. ")) returned 1 [0067.634] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0067.634] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF") returned="PREVIEW.GIF" [0067.635] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG") returned="THMBNAIL.PNG" [0067.635] SetFilePointer (in: hFile=0x90, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0067.635] WriteFile (in: hFile=0x90, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x61b8, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x61b8, lpOverlapped=0x0) returned 1 [0067.636] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0067.636] CloseHandle (hObject=0x90) returned 1 [0067.636] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG. " (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\thmbnail.png. ")) returned 1 [0067.636] lstrcmpA (lpString1=".", lpString2="ECLIPSE") returned -1 [0067.637] lstrcmpA (lpString1="..", lpString2="ECLIPSE") returned -1 [0067.637] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\*.*") returned="*.*" [0067.637] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5b8c28 [0067.650] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0067.650] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0067.650] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0067.650] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0067.650] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\*.*") returned="*.*" [0067.650] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0067.650] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.ELM") returned="ECLIPSE.ELM" [0067.650] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0067.650] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.INF") returned="ECLIPSE.INF" [0067.666] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned="PREVIEW.GIF" [0067.666] SetFilePointer (in: hFile=0x90, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0067.666] WriteFile (in: hFile=0x90, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x4e9, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x4e9, lpOverlapped=0x0) returned 1 [0067.666] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0067.666] CloseHandle (hObject=0x90) returned 1 [0067.666] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF. " (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\preview.gif. ")) returned 1 [0067.667] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0067.667] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned="PREVIEW.GIF" [0067.668] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG") returned="THMBNAIL.PNG" [0067.668] SetFilePointer (in: hFile=0x90, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0067.668] WriteFile (in: hFile=0x90, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x7e39, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x7e39, lpOverlapped=0x0) returned 1 [0067.669] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0067.669] CloseHandle (hObject=0x90) returned 1 [0067.669] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG. " (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\thmbnail.png. ")) returned 1 [0067.671] lstrcmpA (lpString1=".", lpString2="EDGE") returned -1 [0067.671] lstrcmpA (lpString1="..", lpString2="EDGE") returned -1 [0067.671] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\*.*") returned="*.*" [0067.671] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5b8c28 [0067.683] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0067.683] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0067.683] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0067.684] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0067.684] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\*.*") returned="*.*" [0067.684] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0067.684] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.ELM") returned="EDGE.ELM" [0067.684] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0067.684] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.INF") returned="EDGE.INF" [0067.695] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned="PREVIEW.GIF" [0067.695] SetFilePointer (in: hFile=0x90, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0067.695] WriteFile (in: hFile=0x90, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x4e9, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x4e9, lpOverlapped=0x0) returned 1 [0067.695] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0067.695] CloseHandle (hObject=0x90) returned 1 [0067.695] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF. " (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\preview.gif. ")) returned 1 [0067.696] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0067.696] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned="PREVIEW.GIF" [0067.706] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG") returned="THMBNAIL.PNG" [0067.706] SetFilePointer (in: hFile=0x90, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0067.706] WriteFile (in: hFile=0x90, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x66c8, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x66c8, lpOverlapped=0x0) returned 1 [0067.706] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0067.706] CloseHandle (hObject=0x90) returned 1 [0067.706] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG. " (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\thmbnail.png. ")) returned 1 [0067.707] lstrcmpA (lpString1=".", lpString2="EVRGREEN") returned -1 [0067.707] lstrcmpA (lpString1="..", lpString2="EVRGREEN") returned -1 [0067.707] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\*.*") returned="*.*" [0067.707] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5b8c28 [0067.708] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0067.708] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0067.708] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0067.708] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0067.708] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\*.*") returned="*.*" [0067.708] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0067.708] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.ELM") returned="EVRGREEN.ELM" [0067.708] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0067.708] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.INF") returned="EVRGREEN.INF" [0067.727] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF") returned="PREVIEW.GIF" [0067.727] SetFilePointer (in: hFile=0x90, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0067.727] WriteFile (in: hFile=0x90, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x4f0, lpOverlapped=0x0) returned 1 [0067.727] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0067.728] CloseHandle (hObject=0x90) returned 1 [0067.728] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF. " (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\preview.gif. ")) returned 1 [0067.728] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0067.728] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF") returned="PREVIEW.GIF" [0067.730] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG") returned="THMBNAIL.PNG" [0067.730] SetFilePointer (in: hFile=0x90, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0067.730] WriteFile (in: hFile=0x90, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x7e57, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x7e57, lpOverlapped=0x0) returned 1 [0067.730] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0067.730] CloseHandle (hObject=0x90) returned 1 [0067.730] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG. " (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\thmbnail.png. ")) returned 1 [0067.731] lstrcmpA (lpString1=".", lpString2="EXPEDITN") returned -1 [0067.731] lstrcmpA (lpString1="..", lpString2="EXPEDITN") returned -1 [0067.731] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\*.*") returned="*.*" [0067.731] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5b8c28 [0067.731] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0067.731] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0067.731] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0067.731] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0067.731] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\*.*") returned="*.*" [0067.731] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0067.731] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.ELM") returned="EXPEDITN.ELM" [0067.731] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0067.731] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.INF") returned="EXPEDITN.INF" [0067.741] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF") returned="PREVIEW.GIF" [0067.741] SetFilePointer (in: hFile=0x90, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0067.742] WriteFile (in: hFile=0x90, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x13a6, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x13a6, lpOverlapped=0x0) returned 1 [0067.742] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0067.742] CloseHandle (hObject=0x90) returned 1 [0067.742] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF. " (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\preview.gif. ")) returned 1 [0067.743] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0067.743] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF") returned="PREVIEW.GIF" [0067.746] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG") returned="THMBNAIL.PNG" [0067.746] SetFilePointer (in: hFile=0x90, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0067.746] WriteFile (in: hFile=0x90, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0xecda, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0xecda, lpOverlapped=0x0) returned 1 [0067.746] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0067.746] CloseHandle (hObject=0x90) returned 1 [0067.746] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG. " (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\thmbnail.png. ")) returned 1 [0067.747] lstrcmpA (lpString1=".", lpString2="ICE") returned -1 [0067.747] lstrcmpA (lpString1="..", lpString2="ICE") returned -1 [0067.747] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\*.*") returned="*.*" [0067.747] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5b8c28 [0067.749] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0067.749] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0067.749] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0067.749] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0067.749] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\*.*") returned="*.*" [0067.749] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0067.749] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.ELM") returned="ICE.ELM" [0067.749] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0067.749] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF") returned="ICE.INF" [0067.777] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned="PREVIEW.GIF" [0067.777] SetFilePointer (in: hFile=0x90, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0067.777] WriteFile (in: hFile=0x90, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x99e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x99e, lpOverlapped=0x0) returned 1 [0067.777] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0067.777] CloseHandle (hObject=0x90) returned 1 [0067.777] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF. " (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\preview.gif. ")) returned 1 [0067.779] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0067.779] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned="PREVIEW.GIF" [0067.781] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG") returned="THMBNAIL.PNG" [0067.781] SetFilePointer (in: hFile=0x90, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0067.781] WriteFile (in: hFile=0x90, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x4927, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x4927, lpOverlapped=0x0) returned 1 [0067.781] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0067.781] CloseHandle (hObject=0x90) returned 1 [0067.781] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG. " (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\thmbnail.png. ")) returned 1 [0067.782] lstrcmpA (lpString1=".", lpString2="INDUST") returned -1 [0067.782] lstrcmpA (lpString1="..", lpString2="INDUST") returned -1 [0067.782] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\*.*") returned="*.*" [0067.782] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5b8c28 [0067.793] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0067.793] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0067.793] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0067.793] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0067.793] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\*.*") returned="*.*" [0067.793] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0067.794] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.ELM") returned="INDUST.ELM" [0067.794] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0067.794] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.INF") returned="INDUST.INF" [0067.802] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF") returned="PREVIEW.GIF" [0067.802] SetFilePointer (in: hFile=0x90, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0067.803] WriteFile (in: hFile=0x90, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x13e1, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x13e1, lpOverlapped=0x0) returned 1 [0067.803] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0067.803] CloseHandle (hObject=0x90) returned 1 [0067.803] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF. " (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\preview.gif. ")) returned 1 [0067.803] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0067.803] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF") returned="PREVIEW.GIF" [0067.810] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG") returned="THMBNAIL.PNG" [0067.810] SetFilePointer (in: hFile=0x90, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0067.810] WriteFile (in: hFile=0x90, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x82bd, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x82bd, lpOverlapped=0x0) returned 1 [0067.811] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0067.811] CloseHandle (hObject=0x90) returned 1 [0067.811] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG. " (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\thmbnail.png. ")) returned 1 [0067.811] lstrcmpA (lpString1=".", lpString2="IRIS") returned -1 [0067.811] lstrcmpA (lpString1="..", lpString2="IRIS") returned -1 [0067.811] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\*.*") returned="*.*" [0067.812] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5b8c28 [0067.812] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0067.812] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0067.812] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0067.812] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0067.812] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\*.*") returned="*.*" [0067.812] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0067.812] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM") returned="IRIS.ELM" [0067.812] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0067.812] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.INF") returned="IRIS.INF" [0067.819] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF") returned="PREVIEW.GIF" [0067.819] SetFilePointer (in: hFile=0x90, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0067.819] WriteFile (in: hFile=0x90, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x952, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x952, lpOverlapped=0x0) returned 1 [0067.820] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0067.820] CloseHandle (hObject=0x90) returned 1 [0067.820] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF. " (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\preview.gif. ")) returned 1 [0067.820] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0067.820] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF") returned="PREVIEW.GIF" [0067.823] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG") returned="THMBNAIL.PNG" [0067.823] SetFilePointer (in: hFile=0x90, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0067.823] WriteFile (in: hFile=0x90, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x4bc3, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x4bc3, lpOverlapped=0x0) returned 1 [0067.823] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0067.823] CloseHandle (hObject=0x90) returned 1 [0067.823] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG. " (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\thmbnail.png. ")) returned 1 [0067.824] lstrcmpA (lpString1=".", lpString2="JOURNAL") returned -1 [0067.824] lstrcmpA (lpString1="..", lpString2="JOURNAL") returned -1 [0067.824] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\*.*") returned="*.*" [0067.824] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5b8c28 [0067.825] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0067.825] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0067.825] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0067.825] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0067.825] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\*.*") returned="*.*" [0067.825] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0067.825] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM") returned="JOURNAL.ELM" [0067.825] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0067.825] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.INF") returned="JOURNAL.INF" [0067.827] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned="PREVIEW.GIF" [0067.827] SetFilePointer (in: hFile=0x90, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0067.827] WriteFile (in: hFile=0x90, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x476, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x476, lpOverlapped=0x0) returned 1 [0067.827] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0067.827] CloseHandle (hObject=0x90) returned 1 [0067.827] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF. " (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\preview.gif. ")) returned 1 [0067.828] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0067.828] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned="PREVIEW.GIF" [0067.838] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG") returned="THMBNAIL.PNG" [0067.838] SetFilePointer (in: hFile=0x90, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0067.838] WriteFile (in: hFile=0x90, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x4793, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x4793, lpOverlapped=0x0) returned 1 [0067.839] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0067.839] CloseHandle (hObject=0x90) returned 1 [0067.839] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG. " (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\thmbnail.png. ")) returned 1 [0067.839] lstrcmpA (lpString1=".", lpString2="LAYERS") returned -1 [0067.839] lstrcmpA (lpString1="..", lpString2="LAYERS") returned -1 [0067.839] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\*.*") returned="*.*" [0067.840] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5b8c28 [0067.840] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0067.840] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0067.840] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0067.841] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0067.841] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\*.*") returned="*.*" [0067.841] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0067.841] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.ELM") returned="LAYERS.ELM" [0067.841] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0067.841] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.INF") returned="LAYERS.INF" [0067.843] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF") returned="PREVIEW.GIF" [0067.843] SetFilePointer (in: hFile=0x90, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0067.843] WriteFile (in: hFile=0x90, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x621, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x621, lpOverlapped=0x0) returned 1 [0067.843] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0067.843] CloseHandle (hObject=0x90) returned 1 [0067.844] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF. " (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\preview.gif. ")) returned 1 [0067.844] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0067.844] PathFindFileNameA (pszPath="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF") returned="PREVIEW.GIF" [0067.869] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0067.869] CloseHandle (hObject=0x90) returned 1 [0067.869] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG. " (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\thmbnail.png. ")) returned 1 [0067.869] lstrcmpA (lpString1=".", lpString2="LEVEL") returned -1 [0067.869] lstrcmpA (lpString1="..", lpString2="LEVEL") returned -1 [0067.869] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5b8c28 [0067.870] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0067.870] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0067.870] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0067.870] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0067.870] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0067.870] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0067.872] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0067.872] CloseHandle (hObject=0x90) returned 1 [0067.872] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF. " (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\preview.gif. ")) returned 1 [0067.872] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0067.874] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0067.874] CloseHandle (hObject=0x90) returned 1 [0067.874] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG. " (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\thmbnail.png. ")) returned 1 [0067.874] lstrcmpA (lpString1=".", lpString2="NETWORK") returned -1 [0067.874] lstrcmpA (lpString1="..", lpString2="NETWORK") returned -1 [0067.874] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5b8c28 [0067.875] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0067.875] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0067.875] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0067.875] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0067.875] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0067.875] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0067.876] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0067.877] CloseHandle (hObject=0x90) returned 1 [0067.877] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF. " (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\preview.gif. ")) returned 1 [0067.877] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0067.893] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0067.893] CloseHandle (hObject=0x90) returned 1 [0067.893] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG. " (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\thmbnail.png. ")) returned 1 [0067.893] lstrcmpA (lpString1=".", lpString2="PAPYRUS") returned -1 [0067.893] lstrcmpA (lpString1="..", lpString2="PAPYRUS") returned -1 [0067.893] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5b8c28 [0067.906] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0067.906] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0067.906] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0067.906] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0067.906] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0067.906] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0067.908] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0067.908] CloseHandle (hObject=0x90) returned 1 [0067.908] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF. " (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\preview.gif. ")) returned 1 [0067.908] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0067.913] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0067.913] CloseHandle (hObject=0x90) returned 1 [0067.913] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG. " (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\thmbnail.png. ")) returned 1 [0067.914] lstrcmpA (lpString1=".", lpString2="PIXEL") returned -1 [0067.914] lstrcmpA (lpString1="..", lpString2="PIXEL") returned -1 [0067.914] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5b8c28 [0067.914] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0067.914] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0067.914] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0067.914] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0067.914] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0067.914] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0067.923] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0067.924] CloseHandle (hObject=0x90) returned 1 [0067.924] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF. " (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\preview.gif. ")) returned 1 [0067.924] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0067.926] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0067.926] CloseHandle (hObject=0x90) returned 1 [0067.926] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG. " (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\thmbnail.png. ")) returned 1 [0067.927] lstrcmpA (lpString1=".", lpString2="PROFILE") returned -1 [0067.927] lstrcmpA (lpString1="..", lpString2="PROFILE") returned -1 [0067.927] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5b8c28 [0067.927] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0067.927] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0067.927] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0067.927] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0067.971] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0067.971] CloseHandle (hObject=0x90) returned 1 [0067.972] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF. " (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\preview.gif. ")) returned 1 [0067.972] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0067.972] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0067.972] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0067.973] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0067.973] CloseHandle (hObject=0x90) returned 1 [0067.974] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG. " (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\thmbnail.png. ")) returned 1 [0067.974] lstrcmpA (lpString1=".", lpString2="QUAD") returned -1 [0067.974] lstrcmpA (lpString1="..", lpString2="QUAD") returned -1 [0067.974] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5b8c28 [0067.974] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0067.974] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0067.974] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0067.974] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0067.984] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0067.984] CloseHandle (hObject=0x90) returned 1 [0067.984] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF. " (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\preview.gif. ")) returned 1 [0067.984] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0067.985] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0067.985] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0067.996] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0067.996] CloseHandle (hObject=0x90) returned 1 [0067.996] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG. " (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\thmbnail.png. ")) returned 1 [0067.996] lstrcmpA (lpString1=".", lpString2="RADIAL") returned -1 [0067.996] lstrcmpA (lpString1="..", lpString2="RADIAL") returned -1 [0067.997] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5b8c28 [0068.008] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0068.008] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0068.008] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0068.008] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0068.018] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0068.018] CloseHandle (hObject=0x90) returned 1 [0068.018] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF. " (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\preview.gif. ")) returned 1 [0068.019] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0068.019] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0068.019] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0068.020] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0068.020] CloseHandle (hObject=0x90) returned 1 [0068.020] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG. " (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\thmbnail.png. ")) returned 1 [0068.021] lstrcmpA (lpString1=".", lpString2="REFINED") returned -1 [0068.021] lstrcmpA (lpString1="..", lpString2="REFINED") returned -1 [0068.021] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5b8c28 [0068.021] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0068.021] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0068.021] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0068.021] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0068.028] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0068.028] CloseHandle (hObject=0x90) returned 1 [0068.028] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF. " (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\preview.gif. ")) returned 1 [0068.029] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0068.029] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0068.029] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0068.034] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0068.034] CloseHandle (hObject=0x90) returned 1 [0068.034] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG. " (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\thmbnail.png. ")) returned 1 [0068.034] lstrcmpA (lpString1=".", lpString2="RICEPAPR") returned -1 [0068.034] lstrcmpA (lpString1="..", lpString2="RICEPAPR") returned -1 [0068.034] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5b8c28 [0068.041] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0068.041] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0068.042] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0068.042] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0068.043] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0068.043] CloseHandle (hObject=0x90) returned 1 [0068.043] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF. " (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\preview.gif. ")) returned 1 [0068.043] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0068.044] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0068.044] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0068.061] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0068.061] CloseHandle (hObject=0x90) returned 1 [0068.062] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG. " (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\thmbnail.png. ")) returned 1 [0068.062] lstrcmpA (lpString1=".", lpString2="RIPPLE") returned -1 [0068.062] lstrcmpA (lpString1="..", lpString2="RIPPLE") returned -1 [0068.062] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5b8c28 [0068.062] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0068.062] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0068.062] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0068.062] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0068.064] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0068.064] CloseHandle (hObject=0x90) returned 1 [0068.064] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF. " (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\preview.gif. ")) returned 1 [0068.065] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0068.065] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0068.065] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0068.073] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0068.073] CloseHandle (hObject=0x90) returned 1 [0068.073] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG. " (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\thmbnail.png. ")) returned 1 [0068.074] lstrcmpA (lpString1=".", lpString2="RMNSQUE") returned -1 [0068.074] lstrcmpA (lpString1="..", lpString2="RMNSQUE") returned -1 [0068.074] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5b8c28 [0068.074] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0068.074] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0068.074] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0068.074] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0068.088] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0068.088] CloseHandle (hObject=0x90) returned 1 [0068.088] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF. " (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\preview.gif. ")) returned 1 [0068.089] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0068.089] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0068.089] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0068.095] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0068.095] CloseHandle (hObject=0x90) returned 1 [0068.095] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG. " (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\thmbnail.png. ")) returned 1 [0068.096] lstrcmpA (lpString1=".", lpString2="SATIN") returned -1 [0068.096] lstrcmpA (lpString1="..", lpString2="SATIN") returned -1 [0068.096] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5b8c28 [0068.096] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0068.096] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0068.096] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0068.096] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0068.112] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0068.112] CloseHandle (hObject=0x90) returned 1 [0068.112] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF. " (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\preview.gif. ")) returned 1 [0068.112] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0068.112] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0068.112] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0068.135] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0068.136] CloseHandle (hObject=0x90) returned 1 [0068.136] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG. " (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\thmbnail.png. ")) returned 1 [0068.138] lstrcmpA (lpString1=".", lpString2="SKY") returned -1 [0068.138] lstrcmpA (lpString1="..", lpString2="SKY") returned -1 [0068.138] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5b8c28 [0068.200] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0068.200] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0068.200] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0068.200] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0068.209] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0068.209] CloseHandle (hObject=0x90) returned 1 [0068.209] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF. " (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\preview.gif. ")) returned 1 [0068.209] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0068.209] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0068.209] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0068.221] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0068.221] CloseHandle (hObject=0x90) returned 1 [0068.221] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG. " (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\thmbnail.png. ")) returned 1 [0068.221] lstrcmpA (lpString1=".", lpString2="SLATE") returned -1 [0068.221] lstrcmpA (lpString1="..", lpString2="SLATE") returned -1 [0068.221] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5b8c28 [0068.233] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0068.233] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0068.233] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0068.233] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0068.244] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0068.244] CloseHandle (hObject=0x90) returned 1 [0068.244] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF. " (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\preview.gif. ")) returned 1 [0068.245] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0068.245] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0068.245] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0068.254] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0068.254] CloseHandle (hObject=0x90) returned 1 [0068.255] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG. " (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\thmbnail.png. ")) returned 1 [0068.255] lstrcmpA (lpString1=".", lpString2="SONORA") returned -1 [0068.255] lstrcmpA (lpString1="..", lpString2="SONORA") returned -1 [0068.255] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5b8c28 [0068.256] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0068.256] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0068.256] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0068.256] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0068.266] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0068.266] CloseHandle (hObject=0x90) returned 1 [0068.266] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF. " (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\preview.gif. ")) returned 1 [0068.266] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0068.266] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0068.267] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0068.276] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0068.276] CloseHandle (hObject=0x90) returned 1 [0068.276] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG. " (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\thmbnail.png. ")) returned 1 [0068.276] lstrcmpA (lpString1=".", lpString2="SPRING") returned -1 [0068.276] lstrcmpA (lpString1="..", lpString2="SPRING") returned -1 [0068.276] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5b8c28 [0068.277] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0068.277] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0068.277] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0068.277] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0068.292] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0068.292] CloseHandle (hObject=0x90) returned 1 [0068.293] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF. " (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\preview.gif. ")) returned 1 [0068.293] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0068.293] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0068.293] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0068.320] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0068.320] CloseHandle (hObject=0x90) returned 1 [0068.320] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG. " (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\thmbnail.png. ")) returned 1 [0068.321] lstrcmpA (lpString1=".", lpString2="STRTEDGE") returned -1 [0068.321] lstrcmpA (lpString1="..", lpString2="STRTEDGE") returned -1 [0068.321] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5b8c28 [0068.345] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0068.345] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0068.345] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0068.345] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0068.363] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0068.363] CloseHandle (hObject=0x90) returned 1 [0068.363] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF. " (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\preview.gif. ")) returned 1 [0068.364] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0068.364] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0068.364] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0068.375] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0068.375] CloseHandle (hObject=0x90) returned 1 [0068.375] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG. " (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\thmbnail.png. ")) returned 1 [0068.375] lstrcmpA (lpString1=".", lpString2="STUDIO") returned -1 [0068.376] lstrcmpA (lpString1="..", lpString2="STUDIO") returned -1 [0068.376] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5b8c28 [0068.376] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0068.376] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0068.376] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0068.376] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0068.392] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0068.392] CloseHandle (hObject=0x90) returned 1 [0068.393] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF. " (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\preview.gif. ")) returned 1 [0068.393] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0068.393] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0068.393] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0068.411] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0068.411] CloseHandle (hObject=0x90) returned 1 [0068.411] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG. " (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\thmbnail.png. ")) returned 1 [0068.412] lstrcmpA (lpString1=".", lpString2="SUMIPNTG") returned -1 [0068.412] lstrcmpA (lpString1="..", lpString2="SUMIPNTG") returned -1 [0068.412] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5b8c28 [0068.412] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0068.412] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0068.412] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0068.412] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0068.433] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0068.433] CloseHandle (hObject=0x90) returned 1 [0068.433] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF. " (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\preview.gif. ")) returned 1 [0068.434] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0068.434] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0068.434] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0068.436] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0068.436] CloseHandle (hObject=0x90) returned 1 [0068.436] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG. " (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\thmbnail.png. ")) returned 1 [0068.436] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0068.436] lstrcmpA (lpString1=".", lpString2="WATER") returned -1 [0068.436] lstrcmpA (lpString1="..", lpString2="WATER") returned -1 [0068.436] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5b8c28 [0068.437] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0068.437] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0068.437] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0068.437] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0068.447] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0068.447] CloseHandle (hObject=0x90) returned 1 [0068.447] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF. " (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\preview.gif. ")) returned 1 [0068.448] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0068.471] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0068.471] CloseHandle (hObject=0x90) returned 1 [0068.471] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG. " (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\thmbnail.png. ")) returned 1 [0068.471] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0068.471] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0068.471] lstrcmpA (lpString1=".", lpString2="WATERMAR") returned -1 [0068.471] lstrcmpA (lpString1="..", lpString2="WATERMAR") returned -1 [0068.471] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5b8c28 [0068.472] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0068.472] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0068.472] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0068.472] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0068.475] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0068.475] CloseHandle (hObject=0x90) returned 1 [0068.475] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF. " (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\preview.gif. ")) returned 1 [0068.475] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0068.484] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0068.484] CloseHandle (hObject=0x90) returned 1 [0068.484] MoveFileA (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG. " (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\thmbnail.png. ")) returned 1 [0068.485] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0068.485] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0068.485] lstrcmpA (lpString1=".", lpString2="TRANSLAT") returned -1 [0068.485] lstrcmpA (lpString1="..", lpString2="TRANSLAT") returned -1 [0068.485] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5b7be0 [0068.515] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0068.515] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0068.515] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0068.515] lstrcmpA (lpString1=".", lpString2="ARFR") returned -1 [0068.515] lstrcmpA (lpString1="..", lpString2="ARFR") returned -1 [0068.515] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5b8c28 [0068.516] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0068.516] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0068.516] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0068.517] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0068.517] lstrcmpA (lpString1=".", lpString2="ENES") returned -1 [0068.517] lstrcmpA (lpString1="..", lpString2="ENES") returned -1 [0068.517] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5b8c28 [0068.517] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0068.518] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0068.518] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0068.518] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0068.518] lstrcmpA (lpString1=".", lpString2="ENFR") returned -1 [0068.518] lstrcmpA (lpString1="..", lpString2="ENFR") returned -1 [0068.518] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5b8c28 [0068.518] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0068.518] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0068.518] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0068.518] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0068.518] lstrcmpA (lpString1=".", lpString2="ESEN") returned -1 [0068.518] lstrcmpA (lpString1="..", lpString2="ESEN") returned -1 [0068.518] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5b8c28 [0068.518] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0068.518] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0068.519] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0068.519] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0068.519] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0068.519] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0068.519] lstrcmpA (lpString1=".", lpString2="FRAR") returned -1 [0068.519] lstrcmpA (lpString1="..", lpString2="FRAR") returned -1 [0068.519] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5b8c28 [0068.520] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0068.520] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0068.520] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0068.520] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0068.520] lstrcmpA (lpString1=".", lpString2="FREN") returned -1 [0068.520] lstrcmpA (lpString1="..", lpString2="FREN") returned -1 [0068.520] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5b8c28 [0068.521] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0068.521] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0068.521] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0068.521] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0068.521] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0068.521] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0068.521] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0068.522] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0068.522] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0068.522] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0068.522] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0068.522] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0068.522] FindClose (in: hFindFile=0x5b7be0 | out: hFindFile=0x5b7be0) returned 1 [0068.522] lstrcmpA (lpString1=".", lpString2="Triedit") returned -1 [0068.522] lstrcmpA (lpString1="..", lpString2="Triedit") returned -1 [0068.522] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Triedit\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5b7be0 [0068.522] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0068.523] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0068.523] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0068.523] lstrcmpA (lpString1=".", lpString2="en-US") returned -1 [0068.523] lstrcmpA (lpString1="..", lpString2="en-US") returned -1 [0068.523] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Triedit\\en-US\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5b8c28 [0068.524] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0068.524] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0068.524] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0068.524] FindClose (in: hFindFile=0x5b8c28 | out: hFindFile=0x5b8c28) returned 1 [0068.524] FindClose (in: hFindFile=0x5b7be0 | out: hFindFile=0x5b7be0) returned 1 [0068.524] lstrcmpA (lpString1=".", lpString2="VBA") returned -1 [0068.524] lstrcmpA (lpString1="..", lpString2="VBA") returned -1 [0068.524] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5b7c58 [0068.525] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0068.525] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0068.525] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0068.525] lstrcmpA (lpString1=".", lpString2="VBA7") returned -1 [0068.525] lstrcmpA (lpString1="..", lpString2="VBA7") returned -1 [0068.525] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5b7be0 [0068.525] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0068.525] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0068.525] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0068.525] lstrcmpA (lpString1=".", lpString2="1033") returned -1 [0068.525] lstrcmpA (lpString1="..", lpString2="1033") returned -1 [0068.525] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5bb250 [0068.536] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0068.536] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0068.536] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0068.536] PeekMessageA (in: lpMsg=0xaef84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaef84) returned 0 [0068.536] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM", pszSpec="*.zip") returned 0 [0068.536] lstrlenA (lpString="*.zip") returned 5 [0068.536] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM", pszSpec="*.rar") returned 0 [0068.536] lstrlenA (lpString="*.rar") returned 5 [0068.536] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM", pszSpec="*.7z") returned 0 [0068.536] lstrlenA (lpString="*.7z") returned 4 [0068.536] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM", pszSpec="*.tar") returned 0 [0068.536] lstrlenA (lpString="*.tar") returned 5 [0068.536] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM", pszSpec="*.gzip") returned 0 [0068.536] lstrlenA (lpString="*.gzip") returned 6 [0068.536] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM", pszSpec="*.jpg") returned 0 [0068.536] lstrlenA (lpString="*.jpg") returned 5 [0068.536] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM", pszSpec="*.jpeg") returned 0 [0068.536] lstrlenA (lpString="*.jpeg") returned 6 [0068.536] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM", pszSpec="*.psd") returned 0 [0068.536] lstrlenA (lpString="*.psd") returned 5 [0068.536] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM", pszSpec="*.cdr") returned 0 [0068.536] lstrlenA (lpString="*.cdr") returned 5 [0068.536] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM", pszSpec="*.dwg") returned 0 [0068.536] lstrlenA (lpString="*.dwg") returned 5 [0068.536] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM", pszSpec="*.max") returned 0 [0068.536] lstrlenA (lpString="*.max") returned 5 [0068.536] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM", pszSpec="*.bmp") returned 0 [0068.536] lstrlenA (lpString="*.bmp") returned 5 [0068.536] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM", pszSpec="*.gif") returned 0 [0068.536] lstrlenA (lpString="*.gif") returned 5 [0068.536] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM", pszSpec="*.png") returned 0 [0068.536] lstrlenA (lpString="*.png") returned 5 [0068.536] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM", pszSpec="*.doc") returned 0 [0068.536] lstrlenA (lpString="*.doc") returned 5 [0068.536] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM", pszSpec="*.docx") returned 0 [0068.536] lstrlenA (lpString="*.docx") returned 6 [0068.536] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM", pszSpec="*.xls") returned 0 [0068.537] lstrlenA (lpString="*.xls") returned 5 [0068.537] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM", pszSpec="*.xlsx") returned 0 [0068.537] lstrlenA (lpString="*.xlsx") returned 6 [0068.537] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM", pszSpec="*.ppt") returned 0 [0068.537] lstrlenA (lpString="*.ppt") returned 5 [0068.537] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM", pszSpec="*.pptx") returned 0 [0068.537] lstrlenA (lpString="*.pptx") returned 6 [0068.537] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM", pszSpec="*.txt") returned 0 [0068.537] lstrlenA (lpString="*.txt") returned 5 [0068.537] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM", pszSpec="*.pdf") returned 0 [0068.537] lstrlenA (lpString="*.pdf") returned 5 [0068.537] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM", pszSpec="*.djvu") returned 0 [0068.537] lstrlenA (lpString="*.djvu") returned 6 [0068.537] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM", pszSpec="*.htm") returned 0 [0068.537] lstrlenA (lpString="*.htm") returned 5 [0068.537] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM", pszSpec="*.html") returned 0 [0068.537] lstrlenA (lpString="*.html") returned 6 [0068.537] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM", pszSpec="*.mdb") returned 0 [0068.537] lstrlenA (lpString="*.mdb") returned 5 [0068.537] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM", pszSpec="*.cer") returned 0 [0068.537] lstrlenA (lpString="*.cer") returned 5 [0068.537] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM", pszSpec="*.p12") returned 0 [0068.537] lstrlenA (lpString="*.p12") returned 5 [0068.537] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM", pszSpec="*.pfx") returned 0 [0068.537] lstrlenA (lpString="*.pfx") returned 5 [0068.537] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM", pszSpec="*.kwm") returned 0 [0068.537] lstrlenA (lpString="*.kwm") returned 5 [0068.537] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM", pszSpec="*.pwm") returned 0 [0068.537] lstrlenA (lpString="*.pwm") returned 5 [0068.537] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM", pszSpec="*.1cd") returned 0 [0068.537] lstrlenA (lpString="*.1cd") returned 5 [0068.537] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM", pszSpec="*.md") returned 0 [0068.537] lstrlenA (lpString="*.md") returned 4 [0068.537] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM", pszSpec="*.mdf") returned 0 [0068.537] lstrlenA (lpString="*.mdf") returned 5 [0068.537] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM", pszSpec="*.dbf") returned 0 [0068.537] lstrlenA (lpString="*.dbf") returned 5 [0068.537] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM", pszSpec="*.odt") returned 0 [0068.537] lstrlenA (lpString="*.odt") returned 5 [0068.537] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM", pszSpec="*.vob") returned 0 [0068.537] lstrlenA (lpString="*.vob") returned 5 [0068.537] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM", pszSpec="*.ifo") returned 0 [0068.537] lstrlenA (lpString="*.ifo") returned 5 [0068.537] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM", pszSpec="*.lnk") returned 0 [0068.537] lstrlenA (lpString="*.lnk") returned 5 [0068.537] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM", pszSpec="*.torrent") returned 0 [0068.537] lstrlenA (lpString="*.torrent") returned 9 [0068.537] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM", pszSpec="*.mov") returned 0 [0068.537] lstrlenA (lpString="*.mov") returned 5 [0068.538] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM", pszSpec="*.m2v") returned 0 [0068.538] lstrlenA (lpString="*.m2v") returned 5 [0068.538] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM", pszSpec="*.3gp") returned 0 [0068.538] lstrlenA (lpString="*.3gp") returned 5 [0068.538] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM", pszSpec="*.mpeg") returned 0 [0068.538] lstrlenA (lpString="*.mpeg") returned 6 [0068.538] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM", pszSpec="*.mpg") returned 0 [0068.538] lstrlenA (lpString="*.mpg") returned 5 [0068.538] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM", pszSpec="*.flv") returned 0 [0068.538] lstrlenA (lpString="*.flv") returned 5 [0068.538] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM", pszSpec="*.avi") returned 0 [0068.538] lstrlenA (lpString="*.avi") returned 5 [0068.538] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM", pszSpec="*.mp4") returned 0 [0068.538] lstrlenA (lpString="*.mp4") returned 5 [0068.538] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM", pszSpec="*.wmv") returned 0 [0068.538] lstrlenA (lpString="*.wmv") returned 5 [0068.538] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM", pszSpec="*.divx") returned 0 [0068.538] lstrlenA (lpString="*.divx") returned 6 [0068.538] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM", pszSpec="*.mkv") returned 0 [0068.538] lstrlenA (lpString="*.mkv") returned 5 [0068.538] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM", pszSpec="*.mp3") returned 0 [0068.538] lstrlenA (lpString="*.mp3") returned 5 [0068.538] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM", pszSpec="*.wav") returned 0 [0068.538] lstrlenA (lpString="*.wav") returned 5 [0068.538] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM", pszSpec="*.flac") returned 0 [0068.538] lstrlenA (lpString="*.flac") returned 6 [0068.538] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM", pszSpec="*.ape") returned 0 [0068.538] lstrlenA (lpString="*.ape") returned 5 [0068.538] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM", pszSpec="*.wma") returned 0 [0068.538] lstrlenA (lpString="*.wma") returned 5 [0068.538] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM", pszSpec="*.ac3") returned 0 [0068.538] lstrlenA (lpString="*.ac3") returned 5 [0068.538] FindNextFileA (in: hFindFile=0x5bb250, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0068.538] PeekMessageA (in: lpMsg=0xaef84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaef84) returned 0 [0068.538] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM", pszSpec="*.zip") returned 0 [0068.538] lstrlenA (lpString="*.zip") returned 5 [0068.538] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM", pszSpec="*.rar") returned 0 [0068.538] lstrlenA (lpString="*.rar") returned 5 [0068.538] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM", pszSpec="*.7z") returned 0 [0068.538] lstrlenA (lpString="*.7z") returned 4 [0068.538] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM", pszSpec="*.tar") returned 0 [0068.538] lstrlenA (lpString="*.tar") returned 5 [0068.538] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM", pszSpec="*.gzip") returned 0 [0068.538] lstrlenA (lpString="*.gzip") returned 6 [0068.538] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM", pszSpec="*.jpg") returned 0 [0068.538] lstrlenA (lpString="*.jpg") returned 5 [0068.538] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM", pszSpec="*.jpeg") returned 0 [0068.538] lstrlenA (lpString="*.jpeg") returned 6 [0068.538] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM", pszSpec="*.psd") returned 0 [0068.539] lstrlenA (lpString="*.psd") returned 5 [0068.539] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM", pszSpec="*.cdr") returned 0 [0068.539] lstrlenA (lpString="*.cdr") returned 5 [0068.539] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM", pszSpec="*.dwg") returned 0 [0068.539] lstrlenA (lpString="*.dwg") returned 5 [0068.539] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM", pszSpec="*.max") returned 0 [0068.539] lstrlenA (lpString="*.max") returned 5 [0068.539] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM", pszSpec="*.bmp") returned 0 [0068.539] lstrlenA (lpString="*.bmp") returned 5 [0068.539] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM", pszSpec="*.gif") returned 0 [0068.539] lstrlenA (lpString="*.gif") returned 5 [0068.539] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM", pszSpec="*.png") returned 0 [0068.539] lstrlenA (lpString="*.png") returned 5 [0068.539] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM", pszSpec="*.doc") returned 0 [0068.539] lstrlenA (lpString="*.doc") returned 5 [0068.539] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM", pszSpec="*.docx") returned 0 [0068.539] lstrlenA (lpString="*.docx") returned 6 [0068.539] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM", pszSpec="*.xls") returned 0 [0068.539] lstrlenA (lpString="*.xls") returned 5 [0068.539] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM", pszSpec="*.xlsx") returned 0 [0068.539] lstrlenA (lpString="*.xlsx") returned 6 [0068.539] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM", pszSpec="*.ppt") returned 0 [0068.539] lstrlenA (lpString="*.ppt") returned 5 [0068.539] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM", pszSpec="*.pptx") returned 0 [0068.539] lstrlenA (lpString="*.pptx") returned 6 [0068.539] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM", pszSpec="*.txt") returned 0 [0068.539] lstrlenA (lpString="*.txt") returned 5 [0068.539] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM", pszSpec="*.pdf") returned 0 [0068.539] lstrlenA (lpString="*.pdf") returned 5 [0068.539] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM", pszSpec="*.djvu") returned 0 [0068.539] lstrlenA (lpString="*.djvu") returned 6 [0068.539] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM", pszSpec="*.htm") returned 0 [0068.539] lstrlenA (lpString="*.htm") returned 5 [0068.539] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM", pszSpec="*.html") returned 0 [0068.539] lstrlenA (lpString="*.html") returned 6 [0068.539] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM", pszSpec="*.mdb") returned 0 [0068.539] lstrlenA (lpString="*.mdb") returned 5 [0068.539] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM", pszSpec="*.cer") returned 0 [0068.539] lstrlenA (lpString="*.cer") returned 5 [0068.539] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM", pszSpec="*.p12") returned 0 [0068.539] lstrlenA (lpString="*.p12") returned 5 [0068.539] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM", pszSpec="*.pfx") returned 0 [0068.539] lstrlenA (lpString="*.pfx") returned 5 [0068.539] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM", pszSpec="*.kwm") returned 0 [0068.539] lstrlenA (lpString="*.kwm") returned 5 [0068.539] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM", pszSpec="*.pwm") returned 0 [0068.539] lstrlenA (lpString="*.pwm") returned 5 [0068.539] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM", pszSpec="*.1cd") returned 0 [0068.539] lstrlenA (lpString="*.1cd") returned 5 [0068.539] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM", pszSpec="*.md") returned 0 [0068.539] lstrlenA (lpString="*.md") returned 4 [0068.540] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM", pszSpec="*.mdf") returned 0 [0068.540] lstrlenA (lpString="*.mdf") returned 5 [0068.540] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM", pszSpec="*.dbf") returned 0 [0068.540] lstrlenA (lpString="*.dbf") returned 5 [0068.540] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM", pszSpec="*.odt") returned 0 [0068.540] lstrlenA (lpString="*.odt") returned 5 [0068.540] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM", pszSpec="*.vob") returned 0 [0068.540] lstrlenA (lpString="*.vob") returned 5 [0068.540] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM", pszSpec="*.ifo") returned 0 [0068.540] lstrlenA (lpString="*.ifo") returned 5 [0068.540] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM", pszSpec="*.lnk") returned 0 [0068.540] lstrlenA (lpString="*.lnk") returned 5 [0068.540] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM", pszSpec="*.torrent") returned 0 [0068.540] lstrlenA (lpString="*.torrent") returned 9 [0068.540] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM", pszSpec="*.mov") returned 0 [0068.540] lstrlenA (lpString="*.mov") returned 5 [0068.540] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM", pszSpec="*.m2v") returned 0 [0068.540] lstrlenA (lpString="*.m2v") returned 5 [0068.540] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM", pszSpec="*.3gp") returned 0 [0068.540] lstrlenA (lpString="*.3gp") returned 5 [0068.540] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM", pszSpec="*.mpeg") returned 0 [0068.540] lstrlenA (lpString="*.mpeg") returned 6 [0068.540] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM", pszSpec="*.mpg") returned 0 [0068.540] lstrlenA (lpString="*.mpg") returned 5 [0068.540] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM", pszSpec="*.flv") returned 0 [0068.540] lstrlenA (lpString="*.flv") returned 5 [0068.540] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM", pszSpec="*.avi") returned 0 [0068.540] lstrlenA (lpString="*.avi") returned 5 [0068.540] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM", pszSpec="*.mp4") returned 0 [0068.540] lstrlenA (lpString="*.mp4") returned 5 [0068.540] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM", pszSpec="*.wmv") returned 0 [0068.540] lstrlenA (lpString="*.wmv") returned 5 [0068.540] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM", pszSpec="*.divx") returned 0 [0068.540] lstrlenA (lpString="*.divx") returned 6 [0068.540] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM", pszSpec="*.mkv") returned 0 [0068.540] lstrlenA (lpString="*.mkv") returned 5 [0068.540] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM", pszSpec="*.mp3") returned 0 [0068.540] lstrlenA (lpString="*.mp3") returned 5 [0068.540] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM", pszSpec="*.wav") returned 0 [0068.540] lstrlenA (lpString="*.wav") returned 5 [0068.540] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM", pszSpec="*.flac") returned 0 [0068.540] lstrlenA (lpString="*.flac") returned 6 [0068.540] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM", pszSpec="*.ape") returned 0 [0068.540] lstrlenA (lpString="*.ape") returned 5 [0068.540] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM", pszSpec="*.wma") returned 0 [0068.540] lstrlenA (lpString="*.wma") returned 5 [0068.540] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM", pszSpec="*.ac3") returned 0 [0068.540] lstrlenA (lpString="*.ac3") returned 5 [0068.540] FindNextFileA (in: hFindFile=0x5bb250, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0068.540] PeekMessageA (in: lpMsg=0xaef84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaef84) returned 0 [0068.541] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBE7INTL.DLL", pszSpec="*.zip") returned 0 [0068.541] lstrlenA (lpString="*.zip") returned 5 [0068.541] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBE7INTL.DLL", pszSpec="*.rar") returned 0 [0068.541] lstrlenA (lpString="*.rar") returned 5 [0068.541] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBE7INTL.DLL", pszSpec="*.7z") returned 0 [0068.541] lstrlenA (lpString="*.7z") returned 4 [0068.541] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBE7INTL.DLL", pszSpec="*.tar") returned 0 [0068.541] lstrlenA (lpString="*.tar") returned 5 [0068.541] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBE7INTL.DLL", pszSpec="*.gzip") returned 0 [0068.541] lstrlenA (lpString="*.gzip") returned 6 [0068.541] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBE7INTL.DLL", pszSpec="*.jpg") returned 0 [0068.541] lstrlenA (lpString="*.jpg") returned 5 [0068.541] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBE7INTL.DLL", pszSpec="*.jpeg") returned 0 [0068.541] lstrlenA (lpString="*.jpeg") returned 6 [0068.541] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBE7INTL.DLL", pszSpec="*.psd") returned 0 [0068.541] lstrlenA (lpString="*.psd") returned 5 [0068.541] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBE7INTL.DLL", pszSpec="*.cdr") returned 0 [0068.541] lstrlenA (lpString="*.cdr") returned 5 [0068.541] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBE7INTL.DLL", pszSpec="*.dwg") returned 0 [0068.541] lstrlenA (lpString="*.dwg") returned 5 [0068.541] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBE7INTL.DLL", pszSpec="*.max") returned 0 [0068.541] lstrlenA (lpString="*.max") returned 5 [0068.541] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBE7INTL.DLL", pszSpec="*.bmp") returned 0 [0068.541] lstrlenA (lpString="*.bmp") returned 5 [0068.541] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBE7INTL.DLL", pszSpec="*.gif") returned 0 [0068.541] lstrlenA (lpString="*.gif") returned 5 [0068.541] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBE7INTL.DLL", pszSpec="*.png") returned 0 [0068.541] lstrlenA (lpString="*.png") returned 5 [0068.541] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBE7INTL.DLL", pszSpec="*.doc") returned 0 [0068.541] lstrlenA (lpString="*.doc") returned 5 [0068.541] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBE7INTL.DLL", pszSpec="*.docx") returned 0 [0068.541] lstrlenA (lpString="*.docx") returned 6 [0068.541] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBE7INTL.DLL", pszSpec="*.xls") returned 0 [0068.541] lstrlenA (lpString="*.xls") returned 5 [0068.541] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBE7INTL.DLL", pszSpec="*.xlsx") returned 0 [0068.541] lstrlenA (lpString="*.xlsx") returned 6 [0068.541] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBE7INTL.DLL", pszSpec="*.ppt") returned 0 [0068.541] lstrlenA (lpString="*.ppt") returned 5 [0068.541] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBE7INTL.DLL", pszSpec="*.pptx") returned 0 [0068.541] lstrlenA (lpString="*.pptx") returned 6 [0068.541] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBE7INTL.DLL", pszSpec="*.txt") returned 0 [0068.541] lstrlenA (lpString="*.txt") returned 5 [0068.541] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBE7INTL.DLL", pszSpec="*.pdf") returned 0 [0068.541] lstrlenA (lpString="*.pdf") returned 5 [0068.541] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBE7INTL.DLL", pszSpec="*.djvu") returned 0 [0068.541] lstrlenA (lpString="*.djvu") returned 6 [0068.541] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBE7INTL.DLL", pszSpec="*.htm") returned 0 [0068.541] lstrlenA (lpString="*.htm") returned 5 [0068.542] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBE7INTL.DLL", pszSpec="*.html") returned 0 [0068.542] lstrlenA (lpString="*.html") returned 6 [0068.542] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBE7INTL.DLL", pszSpec="*.mdb") returned 0 [0068.542] lstrlenA (lpString="*.mdb") returned 5 [0068.542] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBE7INTL.DLL", pszSpec="*.cer") returned 0 [0068.542] lstrlenA (lpString="*.cer") returned 5 [0068.542] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBE7INTL.DLL", pszSpec="*.p12") returned 0 [0068.542] lstrlenA (lpString="*.p12") returned 5 [0068.542] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBE7INTL.DLL", pszSpec="*.pfx") returned 0 [0068.542] lstrlenA (lpString="*.pfx") returned 5 [0068.542] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBE7INTL.DLL", pszSpec="*.kwm") returned 0 [0068.542] lstrlenA (lpString="*.kwm") returned 5 [0068.542] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBE7INTL.DLL", pszSpec="*.pwm") returned 0 [0068.542] lstrlenA (lpString="*.pwm") returned 5 [0068.542] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBE7INTL.DLL", pszSpec="*.1cd") returned 0 [0068.542] lstrlenA (lpString="*.1cd") returned 5 [0068.542] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBE7INTL.DLL", pszSpec="*.md") returned 0 [0068.542] lstrlenA (lpString="*.md") returned 4 [0068.542] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBE7INTL.DLL", pszSpec="*.mdf") returned 0 [0068.542] lstrlenA (lpString="*.mdf") returned 5 [0068.542] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBE7INTL.DLL", pszSpec="*.dbf") returned 0 [0068.542] lstrlenA (lpString="*.dbf") returned 5 [0068.542] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBE7INTL.DLL", pszSpec="*.odt") returned 0 [0068.542] lstrlenA (lpString="*.odt") returned 5 [0068.542] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBE7INTL.DLL", pszSpec="*.vob") returned 0 [0068.542] lstrlenA (lpString="*.vob") returned 5 [0068.542] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBE7INTL.DLL", pszSpec="*.ifo") returned 0 [0068.542] lstrlenA (lpString="*.ifo") returned 5 [0068.542] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBE7INTL.DLL", pszSpec="*.lnk") returned 0 [0068.542] lstrlenA (lpString="*.lnk") returned 5 [0068.542] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBE7INTL.DLL", pszSpec="*.torrent") returned 0 [0068.542] lstrlenA (lpString="*.torrent") returned 9 [0068.542] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBE7INTL.DLL", pszSpec="*.mov") returned 0 [0068.542] lstrlenA (lpString="*.mov") returned 5 [0068.542] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBE7INTL.DLL", pszSpec="*.m2v") returned 0 [0068.542] lstrlenA (lpString="*.m2v") returned 5 [0068.542] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBE7INTL.DLL", pszSpec="*.3gp") returned 0 [0068.542] lstrlenA (lpString="*.3gp") returned 5 [0068.542] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBE7INTL.DLL", pszSpec="*.mpeg") returned 0 [0068.542] lstrlenA (lpString="*.mpeg") returned 6 [0068.542] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBE7INTL.DLL", pszSpec="*.mpg") returned 0 [0068.542] lstrlenA (lpString="*.mpg") returned 5 [0068.542] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBE7INTL.DLL", pszSpec="*.flv") returned 0 [0068.542] lstrlenA (lpString="*.flv") returned 5 [0068.542] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBE7INTL.DLL", pszSpec="*.avi") returned 0 [0068.542] lstrlenA (lpString="*.avi") returned 5 [0068.542] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBE7INTL.DLL", pszSpec="*.mp4") returned 0 [0068.542] lstrlenA (lpString="*.mp4") returned 5 [0068.542] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBE7INTL.DLL", pszSpec="*.wmv") returned 0 [0068.542] lstrlenA (lpString="*.wmv") returned 5 [0068.543] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBE7INTL.DLL", pszSpec="*.divx") returned 0 [0068.543] lstrlenA (lpString="*.divx") returned 6 [0068.543] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBE7INTL.DLL", pszSpec="*.mkv") returned 0 [0068.543] lstrlenA (lpString="*.mkv") returned 5 [0068.543] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBE7INTL.DLL", pszSpec="*.mp3") returned 0 [0068.543] lstrlenA (lpString="*.mp3") returned 5 [0068.543] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBE7INTL.DLL", pszSpec="*.wav") returned 0 [0068.543] lstrlenA (lpString="*.wav") returned 5 [0068.543] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBE7INTL.DLL", pszSpec="*.flac") returned 0 [0068.543] lstrlenA (lpString="*.flac") returned 6 [0068.543] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBE7INTL.DLL", pszSpec="*.ape") returned 0 [0068.543] lstrlenA (lpString="*.ape") returned 5 [0068.543] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBE7INTL.DLL", pszSpec="*.wma") returned 0 [0068.543] lstrlenA (lpString="*.wma") returned 5 [0068.543] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBE7INTL.DLL", pszSpec="*.ac3") returned 0 [0068.543] lstrlenA (lpString="*.ac3") returned 5 [0068.543] FindNextFileA (in: hFindFile=0x5bb250, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0068.543] PeekMessageA (in: lpMsg=0xaef84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaef84) returned 0 [0068.543] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM", pszSpec="*.zip") returned 0 [0068.543] lstrlenA (lpString="*.zip") returned 5 [0068.543] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM", pszSpec="*.rar") returned 0 [0068.543] lstrlenA (lpString="*.rar") returned 5 [0068.543] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM", pszSpec="*.7z") returned 0 [0068.543] lstrlenA (lpString="*.7z") returned 4 [0068.543] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM", pszSpec="*.tar") returned 0 [0068.543] lstrlenA (lpString="*.tar") returned 5 [0068.543] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM", pszSpec="*.gzip") returned 0 [0068.543] lstrlenA (lpString="*.gzip") returned 6 [0068.543] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM", pszSpec="*.jpg") returned 0 [0068.543] lstrlenA (lpString="*.jpg") returned 5 [0068.543] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM", pszSpec="*.jpeg") returned 0 [0068.543] lstrlenA (lpString="*.jpeg") returned 6 [0068.543] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM", pszSpec="*.psd") returned 0 [0068.543] lstrlenA (lpString="*.psd") returned 5 [0068.543] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM", pszSpec="*.cdr") returned 0 [0068.543] lstrlenA (lpString="*.cdr") returned 5 [0068.543] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM", pszSpec="*.dwg") returned 0 [0068.543] lstrlenA (lpString="*.dwg") returned 5 [0068.543] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM", pszSpec="*.max") returned 0 [0068.543] lstrlenA (lpString="*.max") returned 5 [0068.543] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM", pszSpec="*.bmp") returned 0 [0068.543] lstrlenA (lpString="*.bmp") returned 5 [0068.543] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM", pszSpec="*.gif") returned 0 [0068.543] lstrlenA (lpString="*.gif") returned 5 [0068.543] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM", pszSpec="*.png") returned 0 [0068.543] lstrlenA (lpString="*.png") returned 5 [0068.543] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM", pszSpec="*.doc") returned 0 [0068.543] lstrlenA (lpString="*.doc") returned 5 [0068.543] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM", pszSpec="*.docx") returned 0 [0068.544] lstrlenA (lpString="*.docx") returned 6 [0068.544] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM", pszSpec="*.xls") returned 0 [0068.544] lstrlenA (lpString="*.xls") returned 5 [0068.544] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM", pszSpec="*.xlsx") returned 0 [0068.544] lstrlenA (lpString="*.xlsx") returned 6 [0068.544] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM", pszSpec="*.ppt") returned 0 [0068.544] lstrlenA (lpString="*.ppt") returned 5 [0068.544] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM", pszSpec="*.pptx") returned 0 [0068.544] lstrlenA (lpString="*.pptx") returned 6 [0068.544] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM", pszSpec="*.txt") returned 0 [0068.544] lstrlenA (lpString="*.txt") returned 5 [0068.544] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM", pszSpec="*.pdf") returned 0 [0068.544] lstrlenA (lpString="*.pdf") returned 5 [0068.544] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM", pszSpec="*.djvu") returned 0 [0068.544] lstrlenA (lpString="*.djvu") returned 6 [0068.544] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM", pszSpec="*.htm") returned 0 [0068.544] lstrlenA (lpString="*.htm") returned 5 [0068.544] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM", pszSpec="*.html") returned 0 [0068.544] lstrlenA (lpString="*.html") returned 6 [0068.544] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM", pszSpec="*.mdb") returned 0 [0068.544] lstrlenA (lpString="*.mdb") returned 5 [0068.544] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM", pszSpec="*.cer") returned 0 [0068.544] lstrlenA (lpString="*.cer") returned 5 [0068.544] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM", pszSpec="*.p12") returned 0 [0068.544] lstrlenA (lpString="*.p12") returned 5 [0068.544] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM", pszSpec="*.pfx") returned 0 [0068.544] lstrlenA (lpString="*.pfx") returned 5 [0068.544] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM", pszSpec="*.kwm") returned 0 [0068.544] lstrlenA (lpString="*.kwm") returned 5 [0068.544] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM", pszSpec="*.pwm") returned 0 [0068.544] lstrlenA (lpString="*.pwm") returned 5 [0068.544] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM", pszSpec="*.1cd") returned 0 [0068.544] lstrlenA (lpString="*.1cd") returned 5 [0068.544] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM", pszSpec="*.md") returned 0 [0068.544] lstrlenA (lpString="*.md") returned 4 [0068.544] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM", pszSpec="*.mdf") returned 0 [0068.544] lstrlenA (lpString="*.mdf") returned 5 [0068.544] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM", pszSpec="*.dbf") returned 0 [0068.544] lstrlenA (lpString="*.dbf") returned 5 [0068.544] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM", pszSpec="*.odt") returned 0 [0068.544] lstrlenA (lpString="*.odt") returned 5 [0068.544] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM", pszSpec="*.vob") returned 0 [0068.544] lstrlenA (lpString="*.vob") returned 5 [0068.544] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM", pszSpec="*.ifo") returned 0 [0068.544] lstrlenA (lpString="*.ifo") returned 5 [0068.544] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM", pszSpec="*.lnk") returned 0 [0068.544] lstrlenA (lpString="*.lnk") returned 5 [0068.544] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM", pszSpec="*.torrent") returned 0 [0068.544] lstrlenA (lpString="*.torrent") returned 9 [0068.544] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM", pszSpec="*.mov") returned 0 [0068.544] lstrlenA (lpString="*.mov") returned 5 [0068.545] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM", pszSpec="*.m2v") returned 0 [0068.545] lstrlenA (lpString="*.m2v") returned 5 [0068.545] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM", pszSpec="*.3gp") returned 0 [0068.545] lstrlenA (lpString="*.3gp") returned 5 [0068.545] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM", pszSpec="*.mpeg") returned 0 [0068.545] lstrlenA (lpString="*.mpeg") returned 6 [0068.545] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM", pszSpec="*.mpg") returned 0 [0068.545] lstrlenA (lpString="*.mpg") returned 5 [0068.545] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM", pszSpec="*.flv") returned 0 [0068.545] lstrlenA (lpString="*.flv") returned 5 [0068.545] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM", pszSpec="*.avi") returned 0 [0068.545] lstrlenA (lpString="*.avi") returned 5 [0068.545] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM", pszSpec="*.mp4") returned 0 [0068.545] lstrlenA (lpString="*.mp4") returned 5 [0068.545] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM", pszSpec="*.wmv") returned 0 [0068.545] lstrlenA (lpString="*.wmv") returned 5 [0068.545] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM", pszSpec="*.divx") returned 0 [0068.545] lstrlenA (lpString="*.divx") returned 6 [0068.545] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM", pszSpec="*.mkv") returned 0 [0068.545] lstrlenA (lpString="*.mkv") returned 5 [0068.545] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM", pszSpec="*.mp3") returned 0 [0068.545] lstrlenA (lpString="*.mp3") returned 5 [0068.545] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM", pszSpec="*.wav") returned 0 [0068.545] lstrlenA (lpString="*.wav") returned 5 [0068.545] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM", pszSpec="*.flac") returned 0 [0068.545] lstrlenA (lpString="*.flac") returned 6 [0068.545] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM", pszSpec="*.ape") returned 0 [0068.545] lstrlenA (lpString="*.ape") returned 5 [0068.545] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM", pszSpec="*.wma") returned 0 [0068.545] lstrlenA (lpString="*.wma") returned 5 [0068.545] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM", pszSpec="*.ac3") returned 0 [0068.545] lstrlenA (lpString="*.ac3") returned 5 [0068.545] FindNextFileA (in: hFindFile=0x5bb250, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0068.545] PeekMessageA (in: lpMsg=0xaef84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaef84) returned 0 [0068.545] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM", pszSpec="*.zip") returned 0 [0068.545] lstrlenA (lpString="*.zip") returned 5 [0068.545] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM", pszSpec="*.rar") returned 0 [0068.546] lstrlenA (lpString="*.rar") returned 5 [0068.546] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM", pszSpec="*.7z") returned 0 [0068.546] lstrlenA (lpString="*.7z") returned 4 [0068.546] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM", pszSpec="*.tar") returned 0 [0068.546] lstrlenA (lpString="*.tar") returned 5 [0068.546] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM", pszSpec="*.gzip") returned 0 [0068.546] lstrlenA (lpString="*.gzip") returned 6 [0068.546] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM", pszSpec="*.jpg") returned 0 [0068.546] lstrlenA (lpString="*.jpg") returned 5 [0068.546] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM", pszSpec="*.jpeg") returned 0 [0068.546] lstrlenA (lpString="*.jpeg") returned 6 [0068.546] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM", pszSpec="*.psd") returned 0 [0068.546] lstrlenA (lpString="*.psd") returned 5 [0068.546] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM", pszSpec="*.cdr") returned 0 [0068.546] lstrlenA (lpString="*.cdr") returned 5 [0068.546] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM", pszSpec="*.dwg") returned 0 [0068.546] lstrlenA (lpString="*.dwg") returned 5 [0068.546] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM", pszSpec="*.max") returned 0 [0068.546] lstrlenA (lpString="*.max") returned 5 [0068.546] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM", pszSpec="*.bmp") returned 0 [0068.546] lstrlenA (lpString="*.bmp") returned 5 [0068.546] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM", pszSpec="*.gif") returned 0 [0068.546] lstrlenA (lpString="*.gif") returned 5 [0068.546] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM", pszSpec="*.png") returned 0 [0068.546] lstrlenA (lpString="*.png") returned 5 [0068.546] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM", pszSpec="*.doc") returned 0 [0068.546] lstrlenA (lpString="*.doc") returned 5 [0068.546] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM", pszSpec="*.docx") returned 0 [0068.546] lstrlenA (lpString="*.docx") returned 6 [0068.546] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM", pszSpec="*.xls") returned 0 [0068.546] lstrlenA (lpString="*.xls") returned 5 [0068.546] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM", pszSpec="*.xlsx") returned 0 [0068.546] lstrlenA (lpString="*.xlsx") returned 6 [0068.546] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM", pszSpec="*.ppt") returned 0 [0068.546] lstrlenA (lpString="*.ppt") returned 5 [0068.546] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM", pszSpec="*.pptx") returned 0 [0068.546] lstrlenA (lpString="*.pptx") returned 6 [0068.546] PathMatchSpecA (pszFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM", pszSpec="*.txt") returned 0 [0068.546] lstrlenA (lpString="*.txt") returned 5 [0068.546] FindNextFileA (in: hFindFile=0x5bb250, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0068.546] PeekMessageA (in: lpMsg=0xaef84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaef84) returned 0 [0068.546] FindNextFileA (in: hFindFile=0x5bb250, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0068.546] PeekMessageA (in: lpMsg=0xaef84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaef84) returned 0 [0068.547] FindNextFileA (in: hFindFile=0x5bb250, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0068.547] PeekMessageA (in: lpMsg=0xaef84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaef84) returned 0 [0068.547] FindNextFileA (in: hFindFile=0x5bb250, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0 [0068.547] FindClose (in: hFindFile=0x5bb250 | out: hFindFile=0x5bb250) returned 1 [0068.550] FindNextFileA (in: hFindFile=0x5b7be0, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0068.550] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0068.550] FindNextFileA (in: hFindFile=0x5b7be0, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0 [0068.550] FindClose (in: hFindFile=0x5b7be0 | out: hFindFile=0x5b7be0) returned 1 [0068.550] FindNextFileA (in: hFindFile=0x5b7c58, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0 [0068.550] FindClose (in: hFindFile=0x5b7c58 | out: hFindFile=0x5b7c58) returned 1 [0068.550] FindNextFileA (in: hFindFile=0x5ba128, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0068.550] lstrcmpA (lpString1=".", lpString2="VC") returned -1 [0068.550] lstrcmpA (lpString1="..", lpString2="VC") returned -1 [0068.551] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5b7c58 [0068.575] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0068.575] FindNextFileA (in: hFindFile=0x5b7c58, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0068.575] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0068.575] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0068.575] FindNextFileA (in: hFindFile=0x5b7c58, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0068.575] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0068.576] FindNextFileA (in: hFindFile=0x5b7c58, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0068.576] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0068.576] FindNextFileA (in: hFindFile=0x5b7c58, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0 [0068.576] FindClose (in: hFindFile=0x5b7c58 | out: hFindFile=0x5b7c58) returned 1 [0068.576] FindNextFileA (in: hFindFile=0x5ba128, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0068.576] lstrcmpA (lpString1=".", lpString2="VGX") returned -1 [0068.576] lstrcmpA (lpString1="..", lpString2="VGX") returned -1 [0068.576] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VGX\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5b7c58 [0068.576] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0068.576] FindNextFileA (in: hFindFile=0x5b7c58, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0068.576] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0068.576] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0068.576] FindNextFileA (in: hFindFile=0x5b7c58, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0068.576] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0068.576] FindNextFileA (in: hFindFile=0x5b7c58, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0 [0068.576] FindClose (in: hFindFile=0x5b7c58 | out: hFindFile=0x5b7c58) returned 1 [0068.576] FindNextFileA (in: hFindFile=0x5ba128, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0068.576] lstrcmpA (lpString1=".", lpString2="Visio Shared") returned -1 [0068.576] lstrcmpA (lpString1="..", lpString2="Visio Shared") returned -1 [0068.576] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5b7c68 [0068.577] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0068.577] FindNextFileA (in: hFindFile=0x5b7c68, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0068.577] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0068.577] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0068.577] FindNextFileA (in: hFindFile=0x5b7c68, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0068.577] lstrcmpA (lpString1=".", lpString2="Fonts") returned -1 [0068.577] lstrcmpA (lpString1="..", lpString2="Fonts") returned -1 [0068.577] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5b7be0 [0068.615] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0068.616] FindNextFileA (in: hFindFile=0x5b7be0, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0068.616] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0068.616] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0068.616] FindNextFileA (in: hFindFile=0x5b7be0, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0068.616] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0068.616] FindNextFileA (in: hFindFile=0x5b7be0, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0068.616] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0068.616] FindNextFileA (in: hFindFile=0x5b7be0, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0068.616] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0068.616] FindNextFileA (in: hFindFile=0x5b7be0, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0068.616] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0068.616] FindNextFileA (in: hFindFile=0x5b7be0, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0068.616] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0068.616] FindNextFileA (in: hFindFile=0x5b7be0, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0068.616] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0068.616] FindNextFileA (in: hFindFile=0x5b7be0, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0068.616] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0068.616] FindNextFileA (in: hFindFile=0x5b7be0, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0068.616] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0068.616] FindNextFileA (in: hFindFile=0x5b7be0, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0068.616] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0068.616] FindNextFileA (in: hFindFile=0x5b7be0, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0068.616] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0068.617] FindNextFileA (in: hFindFile=0x5b7be0, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0 [0068.617] FindClose (in: hFindFile=0x5b7be0 | out: hFindFile=0x5b7be0) returned 1 [0068.617] FindNextFileA (in: hFindFile=0x5b7c68, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0 [0068.617] FindClose (in: hFindFile=0x5b7c68 | out: hFindFile=0x5b7c68) returned 1 [0068.617] FindNextFileA (in: hFindFile=0x5ba128, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0068.617] lstrcmpA (lpString1=".", lpString2="VSTO") returned -1 [0068.617] lstrcmpA (lpString1="..", lpString2="VSTO") returned -1 [0068.617] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5b7c58 [0068.618] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0068.618] FindNextFileA (in: hFindFile=0x5b7c58, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0068.618] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0068.618] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0068.618] FindNextFileA (in: hFindFile=0x5b7c58, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0068.618] lstrcmpA (lpString1=".", lpString2="10.0") returned -1 [0068.618] lstrcmpA (lpString1="..", lpString2="10.0") returned -1 [0068.618] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5b7be0 [0068.673] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0068.673] FindNextFileA (in: hFindFile=0x5b7be0, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0068.673] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0068.673] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0068.673] FindNextFileA (in: hFindFile=0x5b7be0, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0068.673] lstrcmpA (lpString1=".", lpString2="1033") returned -1 [0068.673] lstrcmpA (lpString1="..", lpString2="1033") returned -1 [0068.673] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5bb250 [0068.677] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0068.677] FindNextFileA (in: hFindFile=0x5bb250, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0068.677] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0068.677] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0068.677] FindNextFileA (in: hFindFile=0x5bb250, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0068.677] PeekMessageA (in: lpMsg=0xaef84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaef84) returned 0 [0068.677] FindNextFileA (in: hFindFile=0x5bb250, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0068.677] PeekMessageA (in: lpMsg=0xaef84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaef84) returned 0 [0068.678] FindNextFileA (in: hFindFile=0x5bb250, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0 [0068.678] FindClose (in: hFindFile=0x5bb250 | out: hFindFile=0x5bb250) returned 1 [0068.678] FindNextFileA (in: hFindFile=0x5b7be0, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0068.678] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0068.678] FindNextFileA (in: hFindFile=0x5b7be0, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0068.678] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0068.678] FindNextFileA (in: hFindFile=0x5b7be0, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0068.678] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0068.678] FindNextFileA (in: hFindFile=0x5b7be0, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0068.678] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0068.678] FindNextFileA (in: hFindFile=0x5b7be0, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0 [0068.678] FindClose (in: hFindFile=0x5b7be0 | out: hFindFile=0x5b7be0) returned 1 [0068.678] FindNextFileA (in: hFindFile=0x5b7c58, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0068.678] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0068.678] FindNextFileA (in: hFindFile=0x5b7c58, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0068.678] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0068.678] FindNextFileA (in: hFindFile=0x5b7c58, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0068.678] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0068.678] FindNextFileA (in: hFindFile=0x5b7c58, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0 [0068.678] FindClose (in: hFindFile=0x5b7c58 | out: hFindFile=0x5b7c58) returned 1 [0068.678] FindNextFileA (in: hFindFile=0x5ba128, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0068.679] lstrcmpA (lpString1=".", lpString2="Web Folders") returned -1 [0068.679] lstrcmpA (lpString1="..", lpString2="Web Folders") returned -1 [0068.679] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5b7c68 [0068.679] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0068.679] FindNextFileA (in: hFindFile=0x5b7c68, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0068.679] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0068.679] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0068.679] FindNextFileA (in: hFindFile=0x5b7c68, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0068.680] lstrcmpA (lpString1=".", lpString2="1033") returned -1 [0068.680] lstrcmpA (lpString1="..", lpString2="1033") returned -1 [0068.680] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5b7be0 [0068.680] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0068.680] FindNextFileA (in: hFindFile=0x5b7be0, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0068.680] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0068.680] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0068.680] FindNextFileA (in: hFindFile=0x5b7be0, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0068.680] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0068.680] FindNextFileA (in: hFindFile=0x5b7be0, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0 [0068.680] FindClose (in: hFindFile=0x5b7be0 | out: hFindFile=0x5b7be0) returned 1 [0068.680] FindNextFileA (in: hFindFile=0x5b7c68, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0068.680] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0068.680] FindNextFileA (in: hFindFile=0x5b7c68, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0 [0068.680] FindClose (in: hFindFile=0x5b7c68 | out: hFindFile=0x5b7c68) returned 1 [0068.680] FindNextFileA (in: hFindFile=0x5ba128, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0068.680] lstrcmpA (lpString1=".", lpString2="Web Server Extensions") returned -1 [0068.680] lstrcmpA (lpString1="..", lpString2="Web Server Extensions") returned -1 [0068.680] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5b7c80 [0068.681] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0068.681] FindNextFileA (in: hFindFile=0x5b7c80, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0068.681] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0068.681] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0068.681] FindNextFileA (in: hFindFile=0x5b7c80, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0068.681] lstrcmpA (lpString1=".", lpString2="14") returned -1 [0068.681] lstrcmpA (lpString1="..", lpString2="14") returned -1 [0068.681] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5b7cc0 [0068.681] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0068.681] FindNextFileA (in: hFindFile=0x5b7cc0, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0068.681] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0068.681] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0068.681] FindNextFileA (in: hFindFile=0x5b7cc0, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0068.681] lstrcmpA (lpString1=".", lpString2="BIN") returned -1 [0068.681] lstrcmpA (lpString1="..", lpString2="BIN") returned -1 [0068.681] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5b7be0 [0068.682] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0068.682] FindNextFileA (in: hFindFile=0x5b7be0, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0068.682] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0068.682] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0068.682] FindNextFileA (in: hFindFile=0x5b7be0, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0068.682] lstrcmpA (lpString1=".", lpString2="1033") returned -1 [0068.682] lstrcmpA (lpString1="..", lpString2="1033") returned -1 [0068.682] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\*.*", lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 0x5b7c20 [0068.682] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0068.682] FindNextFileA (in: hFindFile=0x5b7c20, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0068.682] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0068.682] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0068.682] FindNextFileA (in: hFindFile=0x5b7c20, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0068.682] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0068.683] FindNextFileA (in: hFindFile=0x5b7c20, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 0 [0068.683] FindClose (in: hFindFile=0x5b7c20 | out: hFindFile=0x5b7c20) returned 1 [0068.683] FindNextFileA (in: hFindFile=0x5b7be0, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0068.683] PeekMessageA (in: lpMsg=0xaef84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaef84) returned 0 [0068.683] FindNextFileA (in: hFindFile=0x5b7be0, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0068.683] PeekMessageA (in: lpMsg=0xaef84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaef84) returned 0 [0068.683] FindNextFileA (in: hFindFile=0x5b7be0, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0 [0068.683] FindClose (in: hFindFile=0x5b7be0 | out: hFindFile=0x5b7be0) returned 1 [0068.683] FindNextFileA (in: hFindFile=0x5b7cc0, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0 [0068.683] FindClose (in: hFindFile=0x5b7cc0 | out: hFindFile=0x5b7cc0) returned 1 [0068.683] FindNextFileA (in: hFindFile=0x5b7c80, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0 [0068.683] FindClose (in: hFindFile=0x5b7c80 | out: hFindFile=0x5b7c80) returned 1 [0068.683] FindNextFileA (in: hFindFile=0x5ba128, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 0 [0068.683] FindClose (in: hFindFile=0x5ba128 | out: hFindFile=0x5ba128) returned 1 [0068.683] FindNextFileA (in: hFindFile=0x5ba178, lpFindFileData=0xaf4e8 | out: lpFindFileData=0xaf4e8) returned 1 [0068.683] PeekMessageA (in: lpMsg=0xaf4c4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf4c4) returned 0 [0068.683] FindNextFileA (in: hFindFile=0x5ba178, lpFindFileData=0xaf4e8 | out: lpFindFileData=0xaf4e8) returned 1 [0068.683] lstrcmpA (lpString1=".", lpString2="Services") returned -1 [0068.683] lstrcmpA (lpString1="..", lpString2="Services") returned -1 [0068.683] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\Services\\*.*", lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 0x5ba128 [0068.684] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0068.684] FindNextFileA (in: hFindFile=0x5ba128, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0068.684] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0068.684] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0068.684] FindNextFileA (in: hFindFile=0x5ba128, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0068.684] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0068.684] FindNextFileA (in: hFindFile=0x5ba128, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 0 [0068.684] FindClose (in: hFindFile=0x5ba128 | out: hFindFile=0x5ba128) returned 1 [0068.684] FindNextFileA (in: hFindFile=0x5ba178, lpFindFileData=0xaf4e8 | out: lpFindFileData=0xaf4e8) returned 1 [0068.684] lstrcmpA (lpString1=".", lpString2="SpeechEngines") returned -1 [0068.685] lstrcmpA (lpString1="..", lpString2="SpeechEngines") returned -1 [0068.685] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\*.*", lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 0x5ba128 [0068.685] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0068.685] FindNextFileA (in: hFindFile=0x5ba128, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0068.685] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0068.685] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0068.685] FindNextFileA (in: hFindFile=0x5ba128, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0068.685] lstrcmpA (lpString1=".", lpString2="Microsoft") returned -1 [0068.685] lstrcmpA (lpString1="..", lpString2="Microsoft") returned -1 [0068.685] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5b7be0 [0068.686] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0068.686] FindNextFileA (in: hFindFile=0x5b7be0, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0068.686] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0068.686] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0068.686] FindNextFileA (in: hFindFile=0x5b7be0, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0068.686] lstrcmpA (lpString1=".", lpString2="TTS20") returned -1 [0068.686] lstrcmpA (lpString1="..", lpString2="TTS20") returned -1 [0068.686] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5b8c28 [0068.686] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0068.686] FindNextFileA (in: hFindFile=0x5b8c28, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0068.686] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0068.686] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0068.686] FindNextFileA (in: hFindFile=0x5b8c28, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0068.686] lstrcmpA (lpString1=".", lpString2="en-US") returned -1 [0068.686] lstrcmpA (lpString1="..", lpString2="en-US") returned -1 [0068.686] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5b8c68 [0068.686] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0068.686] FindNextFileA (in: hFindFile=0x5b8c68, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0068.686] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0068.686] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0068.686] FindNextFileA (in: hFindFile=0x5b8c68, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0068.686] lstrcmpA (lpString1=".", lpString2="enu-dsk") returned -1 [0068.686] lstrcmpA (lpString1="..", lpString2="enu-dsk") returned -1 [0068.686] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\*.*", lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 0x5bc270 [0068.687] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0068.687] FindNextFileA (in: hFindFile=0x5bc270, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0068.687] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0068.687] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0068.687] FindNextFileA (in: hFindFile=0x5bc270, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 0 [0068.687] FindClose (in: hFindFile=0x5bc270 | out: hFindFile=0x5bc270) returned 1 [0068.687] FindNextFileA (in: hFindFile=0x5b8c68, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0068.687] PeekMessageA (in: lpMsg=0xaef84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaef84) returned 0 [0068.687] FindNextFileA (in: hFindFile=0x5b8c68, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0068.687] PeekMessageA (in: lpMsg=0xaef84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaef84) returned 0 [0068.687] FindNextFileA (in: hFindFile=0x5b8c68, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0 [0068.687] FindClose (in: hFindFile=0x5b8c68 | out: hFindFile=0x5b8c68) returned 1 [0068.687] FindNextFileA (in: hFindFile=0x5b8c28, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0068.687] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0068.687] FindNextFileA (in: hFindFile=0x5b8c28, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0068.687] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0068.687] FindNextFileA (in: hFindFile=0x5b8c28, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0068.687] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0068.687] FindNextFileA (in: hFindFile=0x5b8c28, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0 [0068.687] FindClose (in: hFindFile=0x5b8c28 | out: hFindFile=0x5b8c28) returned 1 [0068.688] FindNextFileA (in: hFindFile=0x5b7be0, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0 [0068.688] FindClose (in: hFindFile=0x5b7be0 | out: hFindFile=0x5b7be0) returned 1 [0068.688] FindNextFileA (in: hFindFile=0x5ba128, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 0 [0068.688] FindClose (in: hFindFile=0x5ba128 | out: hFindFile=0x5ba128) returned 1 [0068.688] FindNextFileA (in: hFindFile=0x5ba178, lpFindFileData=0xaf4e8 | out: lpFindFileData=0xaf4e8) returned 1 [0068.688] lstrcmpA (lpString1=".", lpString2="System") returned -1 [0068.688] lstrcmpA (lpString1="..", lpString2="System") returned -1 [0068.688] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\System\\*.*", lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 0x5ba128 [0068.691] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0068.691] FindNextFileA (in: hFindFile=0x5ba128, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0068.691] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0068.691] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0068.691] FindNextFileA (in: hFindFile=0x5ba128, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0068.691] lstrcmpA (lpString1=".", lpString2="ado") returned -1 [0068.691] lstrcmpA (lpString1="..", lpString2="ado") returned -1 [0068.691] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\System\\ado\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5b7c48 [0068.692] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0068.692] FindNextFileA (in: hFindFile=0x5b7c48, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0068.692] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0068.692] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0068.692] FindNextFileA (in: hFindFile=0x5b7c48, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0068.692] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0068.692] FindNextFileA (in: hFindFile=0x5b7c48, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0068.692] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0068.692] FindNextFileA (in: hFindFile=0x5b7c48, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0068.692] lstrcmpA (lpString1=".", lpString2="en-US") returned -1 [0068.692] lstrcmpA (lpString1="..", lpString2="en-US") returned -1 [0068.692] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\System\\ado\\en-US\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5b7be0 [0068.693] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0068.693] FindNextFileA (in: hFindFile=0x5b7be0, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0068.693] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0068.693] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0068.693] FindNextFileA (in: hFindFile=0x5b7be0, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0068.693] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0068.703] FindNextFileA (in: hFindFile=0x5b7be0, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0 [0068.703] FindClose (in: hFindFile=0x5b7be0 | out: hFindFile=0x5b7be0) returned 1 [0068.704] FindNextFileA (in: hFindFile=0x5b7c48, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0068.704] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0068.704] FindNextFileA (in: hFindFile=0x5b7c48, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0068.704] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0068.704] FindNextFileA (in: hFindFile=0x5b7c48, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0068.704] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0068.704] FindNextFileA (in: hFindFile=0x5b7c48, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0068.704] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0068.704] FindNextFileA (in: hFindFile=0x5b7c48, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0068.704] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0068.704] FindNextFileA (in: hFindFile=0x5b7c48, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0068.704] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0068.704] FindNextFileA (in: hFindFile=0x5b7c48, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0068.704] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0068.704] FindNextFileA (in: hFindFile=0x5b7c48, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0068.704] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0068.704] FindNextFileA (in: hFindFile=0x5b7c48, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0068.704] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0068.704] FindNextFileA (in: hFindFile=0x5b7c48, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0068.704] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0068.704] FindNextFileA (in: hFindFile=0x5b7c48, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0068.704] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0068.704] FindNextFileA (in: hFindFile=0x5b7c48, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0068.704] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0068.704] FindNextFileA (in: hFindFile=0x5b7c48, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0068.704] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0068.704] FindNextFileA (in: hFindFile=0x5b7c48, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0068.705] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0068.705] FindNextFileA (in: hFindFile=0x5b7c48, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0 [0068.705] FindClose (in: hFindFile=0x5b7c48 | out: hFindFile=0x5b7c48) returned 1 [0068.705] FindNextFileA (in: hFindFile=0x5ba128, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0068.705] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0068.705] FindNextFileA (in: hFindFile=0x5ba128, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0068.705] lstrcmpA (lpString1=".", lpString2="en-US") returned -1 [0068.705] lstrcmpA (lpString1="..", lpString2="en-US") returned -1 [0068.705] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\System\\en-US\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5b7c48 [0068.705] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0068.705] FindNextFileA (in: hFindFile=0x5b7c48, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0068.705] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0068.705] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0068.705] FindNextFileA (in: hFindFile=0x5b7c48, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0068.705] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0068.705] FindNextFileA (in: hFindFile=0x5b7c48, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0 [0068.705] FindClose (in: hFindFile=0x5b7c48 | out: hFindFile=0x5b7c48) returned 1 [0068.705] FindNextFileA (in: hFindFile=0x5ba128, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0068.705] lstrcmpA (lpString1=".", lpString2="msadc") returned -1 [0068.705] lstrcmpA (lpString1="..", lpString2="msadc") returned -1 [0068.706] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5b7c48 [0068.709] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0068.709] FindNextFileA (in: hFindFile=0x5b7c48, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0068.709] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0068.709] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0068.709] FindNextFileA (in: hFindFile=0x5b7c48, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0068.709] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0068.710] FindNextFileA (in: hFindFile=0x5b7c48, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0068.710] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0068.710] FindNextFileA (in: hFindFile=0x5b7c48, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0068.710] lstrcmpA (lpString1=".", lpString2="en-US") returned -1 [0068.710] lstrcmpA (lpString1="..", lpString2="en-US") returned -1 [0068.710] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5b7be0 [0068.725] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0068.725] FindNextFileA (in: hFindFile=0x5b7be0, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0068.725] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0068.725] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0068.725] FindNextFileA (in: hFindFile=0x5b7be0, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0068.725] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0068.725] FindNextFileA (in: hFindFile=0x5b7be0, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0068.725] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0068.725] FindNextFileA (in: hFindFile=0x5b7be0, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0068.725] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0068.725] FindNextFileA (in: hFindFile=0x5b7be0, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0068.725] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0068.725] FindNextFileA (in: hFindFile=0x5b7be0, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0068.725] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0068.725] FindNextFileA (in: hFindFile=0x5b7be0, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0068.725] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0068.725] FindNextFileA (in: hFindFile=0x5b7be0, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0 [0068.725] FindClose (in: hFindFile=0x5b7be0 | out: hFindFile=0x5b7be0) returned 1 [0068.726] FindNextFileA (in: hFindFile=0x5b7c48, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0068.726] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0068.726] FindNextFileA (in: hFindFile=0x5b7c48, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0068.726] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0068.726] FindNextFileA (in: hFindFile=0x5b7c48, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0068.726] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0068.726] FindNextFileA (in: hFindFile=0x5b7c48, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0068.726] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0068.726] FindNextFileA (in: hFindFile=0x5b7c48, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0068.726] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0068.726] FindNextFileA (in: hFindFile=0x5b7c48, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0068.726] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0068.726] FindNextFileA (in: hFindFile=0x5b7c48, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0068.727] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0068.727] FindNextFileA (in: hFindFile=0x5b7c48, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0068.727] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0068.727] FindNextFileA (in: hFindFile=0x5b7c48, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0068.727] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0068.727] FindNextFileA (in: hFindFile=0x5b7c48, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0068.727] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0068.727] FindNextFileA (in: hFindFile=0x5b7c48, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0068.727] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0068.727] FindNextFileA (in: hFindFile=0x5b7c48, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0068.727] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0068.727] FindNextFileA (in: hFindFile=0x5b7c48, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0068.727] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0068.727] FindNextFileA (in: hFindFile=0x5b7c48, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0068.727] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0068.727] FindNextFileA (in: hFindFile=0x5b7c48, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0068.727] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0068.727] FindNextFileA (in: hFindFile=0x5b7c48, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0068.727] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0068.727] FindNextFileA (in: hFindFile=0x5b7c48, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0 [0068.727] FindClose (in: hFindFile=0x5b7c48 | out: hFindFile=0x5b7c48) returned 1 [0068.727] FindNextFileA (in: hFindFile=0x5ba128, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0068.727] lstrcmpA (lpString1=".", lpString2="MSMAPI") returned -1 [0068.727] lstrcmpA (lpString1="..", lpString2="MSMAPI") returned -1 [0068.727] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\System\\MSMAPI\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5b7c48 [0068.728] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0068.728] FindNextFileA (in: hFindFile=0x5b7c48, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0068.728] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0068.728] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0068.728] FindNextFileA (in: hFindFile=0x5b7c48, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0068.728] lstrcmpA (lpString1=".", lpString2="1033") returned -1 [0068.728] lstrcmpA (lpString1="..", lpString2="1033") returned -1 [0068.728] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\System\\MSMAPI\\1033\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5b7be0 [0068.729] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0068.729] FindNextFileA (in: hFindFile=0x5b7be0, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0068.729] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0068.729] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0068.729] FindNextFileA (in: hFindFile=0x5b7be0, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0068.729] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0068.729] FindNextFileA (in: hFindFile=0x5b7be0, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0 [0068.729] FindClose (in: hFindFile=0x5b7be0 | out: hFindFile=0x5b7be0) returned 1 [0068.729] FindNextFileA (in: hFindFile=0x5b7c48, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0 [0068.729] FindClose (in: hFindFile=0x5b7c48 | out: hFindFile=0x5b7c48) returned 1 [0068.729] FindNextFileA (in: hFindFile=0x5ba128, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0068.729] lstrcmpA (lpString1=".", lpString2="Ole DB") returned -1 [0068.729] lstrcmpA (lpString1="..", lpString2="Ole DB") returned -1 [0068.729] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5b7c48 [0068.730] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0068.730] FindNextFileA (in: hFindFile=0x5b7c48, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0068.730] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0068.730] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0068.730] FindNextFileA (in: hFindFile=0x5b7c48, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0068.730] lstrcmpA (lpString1=".", lpString2="en-US") returned -1 [0068.730] lstrcmpA (lpString1="..", lpString2="en-US") returned -1 [0068.730] FindFirstFileA (in: lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5b7be0 [0068.730] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0068.730] FindNextFileA (in: hFindFile=0x5b7be0, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0068.730] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0068.730] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0068.730] FindNextFileA (in: hFindFile=0x5b7be0, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0068.731] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0068.731] FindNextFileA (in: hFindFile=0x5b7be0, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0068.731] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0068.731] FindNextFileA (in: hFindFile=0x5b7be0, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0068.731] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0068.731] FindNextFileA (in: hFindFile=0x5b7be0, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0068.731] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0068.731] FindNextFileA (in: hFindFile=0x5b7be0, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0 [0068.731] FindClose (in: hFindFile=0x5b7be0 | out: hFindFile=0x5b7be0) returned 1 [0068.731] FindNextFileA (in: hFindFile=0x5b7c48, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0068.731] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0068.731] FindNextFileA (in: hFindFile=0x5b7c48, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0068.731] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0068.731] FindNextFileA (in: hFindFile=0x5b7c48, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0068.731] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0068.731] FindNextFileA (in: hFindFile=0x5b7c48, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0068.731] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0068.731] FindNextFileA (in: hFindFile=0x5b7c48, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0068.731] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0068.731] FindNextFileA (in: hFindFile=0x5b7c48, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0068.731] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0068.731] FindNextFileA (in: hFindFile=0x5b7c48, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0068.731] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0068.731] FindNextFileA (in: hFindFile=0x5b7c48, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0068.731] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0068.731] FindNextFileA (in: hFindFile=0x5b7c48, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0068.731] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0068.732] FindNextFileA (in: hFindFile=0x5b7c48, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0068.732] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0068.732] FindNextFileA (in: hFindFile=0x5b7c48, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0068.732] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0068.732] FindNextFileA (in: hFindFile=0x5b7c48, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0068.732] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0068.732] FindNextFileA (in: hFindFile=0x5b7c48, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0068.732] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0068.732] FindNextFileA (in: hFindFile=0x5b7c48, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0068.732] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0068.732] FindNextFileA (in: hFindFile=0x5b7c48, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0068.732] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0068.732] FindNextFileA (in: hFindFile=0x5b7c48, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0068.732] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0068.732] FindNextFileA (in: hFindFile=0x5b7c48, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0 [0068.732] FindClose (in: hFindFile=0x5b7c48 | out: hFindFile=0x5b7c48) returned 1 [0068.732] FindNextFileA (in: hFindFile=0x5ba128, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0068.732] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0068.732] FindNextFileA (in: hFindFile=0x5ba128, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0068.732] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0068.732] FindNextFileA (in: hFindFile=0x5ba128, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 0 [0068.732] FindClose (in: hFindFile=0x5ba128 | out: hFindFile=0x5ba128) returned 1 [0068.732] FindNextFileA (in: hFindFile=0x5ba178, lpFindFileData=0xaf4e8 | out: lpFindFileData=0xaf4e8) returned 0 [0068.732] FindClose (in: hFindFile=0x5ba178 | out: hFindFile=0x5ba178) returned 1 [0068.732] FindNextFileA (in: hFindFile=0x5b90e0, lpFindFileData=0xaf638 | out: lpFindFileData=0xaf638) returned 1 [0068.732] PeekMessageA (in: lpMsg=0xaf614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf614) returned 0 [0068.732] FindNextFileA (in: hFindFile=0x5b90e0, lpFindFileData=0xaf638 | out: lpFindFileData=0xaf638) returned 1 [0068.732] lstrcmpA (lpString1=".", lpString2="DVD Maker") returned -1 [0068.733] FindFirstFileA (in: lpFileName="C:\\Program Files\\DVD Maker\\*.*", lpFindFileData=0xaf4e8 | out: lpFindFileData=0xaf4e8) returned 0x5b5c18 [0068.733] FindNextFileA (in: hFindFile=0x5b5c18, lpFindFileData=0xaf4e8 | out: lpFindFileData=0xaf4e8) returned 1 [0068.733] FindNextFileA (in: hFindFile=0x5b5c18, lpFindFileData=0xaf4e8 | out: lpFindFileData=0xaf4e8) returned 1 [0068.733] PeekMessageA (in: lpMsg=0xaf4c4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf4c4) returned 0 [0068.733] FindNextFileA (in: hFindFile=0x5b5c18, lpFindFileData=0xaf4e8 | out: lpFindFileData=0xaf4e8) returned 1 [0068.733] PeekMessageA (in: lpMsg=0xaf4c4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf4c4) returned 0 [0068.733] FindNextFileA (in: hFindFile=0x5b5c18, lpFindFileData=0xaf4e8 | out: lpFindFileData=0xaf4e8) returned 1 [0068.733] PeekMessageA (in: lpMsg=0xaf4c4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf4c4) returned 0 [0068.733] FindNextFileA (in: hFindFile=0x5b5c18, lpFindFileData=0xaf4e8 | out: lpFindFileData=0xaf4e8) returned 1 [0068.733] PeekMessageA (in: lpMsg=0xaf4c4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf4c4) returned 0 [0068.733] FindNextFileA (in: hFindFile=0x5b5c18, lpFindFileData=0xaf4e8 | out: lpFindFileData=0xaf4e8) returned 1 [0068.733] FindFirstFileA (in: lpFileName="C:\\Program Files\\DVD Maker\\en-US\\*.*", lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 0x5b5bd0 [0068.734] FindNextFileA (in: hFindFile=0x5b5bd0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0068.734] FindNextFileA (in: hFindFile=0x5b5bd0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0068.734] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0068.734] FindNextFileA (in: hFindFile=0x5b5bd0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0068.734] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0068.734] FindNextFileA (in: hFindFile=0x5b5bd0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0068.734] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0068.734] FindNextFileA (in: hFindFile=0x5b5bd0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 0 [0068.734] FindClose (in: hFindFile=0x5b5bd0 | out: hFindFile=0x5b5bd0) returned 1 [0068.735] FindNextFileA (in: hFindFile=0x5b5c18, lpFindFileData=0xaf4e8 | out: lpFindFileData=0xaf4e8) returned 1 [0068.735] PeekMessageA (in: lpMsg=0xaf4c4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf4c4) returned 0 [0068.735] FindNextFileA (in: hFindFile=0x5b5c18, lpFindFileData=0xaf4e8 | out: lpFindFileData=0xaf4e8) returned 1 [0068.735] PeekMessageA (in: lpMsg=0xaf4c4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf4c4) returned 0 [0068.735] FindNextFileA (in: hFindFile=0x5b5c18, lpFindFileData=0xaf4e8 | out: lpFindFileData=0xaf4e8) returned 1 [0068.735] PeekMessageA (in: lpMsg=0xaf4c4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf4c4) returned 0 [0068.735] FindNextFileA (in: hFindFile=0x5b5c18, lpFindFileData=0xaf4e8 | out: lpFindFileData=0xaf4e8) returned 1 [0068.735] PeekMessageA (in: lpMsg=0xaf4c4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf4c4) returned 0 [0068.735] FindNextFileA (in: hFindFile=0x5b5c18, lpFindFileData=0xaf4e8 | out: lpFindFileData=0xaf4e8) returned 1 [0068.735] PeekMessageA (in: lpMsg=0xaf4c4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf4c4) returned 0 [0068.735] FindNextFileA (in: hFindFile=0x5b5c18, lpFindFileData=0xaf4e8 | out: lpFindFileData=0xaf4e8) returned 1 [0068.735] PeekMessageA (in: lpMsg=0xaf4c4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf4c4) returned 0 [0068.735] FindNextFileA (in: hFindFile=0x5b5c18, lpFindFileData=0xaf4e8 | out: lpFindFileData=0xaf4e8) returned 1 [0068.735] PeekMessageA (in: lpMsg=0xaf4c4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf4c4) returned 0 [0068.735] FindNextFileA (in: hFindFile=0x5b5c18, lpFindFileData=0xaf4e8 | out: lpFindFileData=0xaf4e8) returned 1 [0068.735] PeekMessageA (in: lpMsg=0xaf4c4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf4c4) returned 0 [0068.735] FindNextFileA (in: hFindFile=0x5b5c18, lpFindFileData=0xaf4e8 | out: lpFindFileData=0xaf4e8) returned 1 [0068.735] PeekMessageA (in: lpMsg=0xaf4c4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf4c4) returned 0 [0068.735] FindNextFileA (in: hFindFile=0x5b5c18, lpFindFileData=0xaf4e8 | out: lpFindFileData=0xaf4e8) returned 1 [0068.736] PeekMessageA (in: lpMsg=0xaf4c4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf4c4) returned 0 [0068.736] FindNextFileA (in: hFindFile=0x5b5c18, lpFindFileData=0xaf4e8 | out: lpFindFileData=0xaf4e8) returned 1 [0068.736] FindFirstFileA (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\*.*", lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 0x5b5bd0 [0068.737] FindNextFileA (in: hFindFile=0x5b5bd0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0068.737] FindNextFileA (in: hFindFile=0x5b5bd0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0068.737] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0068.737] FindNextFileA (in: hFindFile=0x5b5bd0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0068.737] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0068.747] FindNextFileA (in: hFindFile=0x5b5bd0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0068.747] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0068.747] FindNextFileA (in: hFindFile=0x5b5bd0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0068.747] FindFirstFileA (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5b7cd0 [0068.749] FindNextFileA (in: hFindFile=0x5b7cd0, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0068.750] FindNextFileA (in: hFindFile=0x5b7cd0, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0068.750] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0068.759] FindNextFileA (in: hFindFile=0x5b7cd0, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0068.759] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0068.759] FindNextFileA (in: hFindFile=0x5b7cd0, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0068.759] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0068.759] FindNextFileA (in: hFindFile=0x5b7cd0, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0068.759] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0068.760] FindNextFileA (in: hFindFile=0x5b7cd0, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0068.760] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0068.760] FindNextFileA (in: hFindFile=0x5b7cd0, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0068.760] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0068.760] FindNextFileA (in: hFindFile=0x5b7cd0, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0068.760] FindFirstFileA (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5b7c68 [0068.784] FindNextFileA (in: hFindFile=0x5b7c68, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0068.784] FindNextFileA (in: hFindFile=0x5b7c68, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0068.784] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0068.785] FindNextFileA (in: hFindFile=0x5b7c68, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0068.785] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0068.785] FindNextFileA (in: hFindFile=0x5b7c68, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0068.785] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0068.785] FindNextFileA (in: hFindFile=0x5b7c68, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0068.785] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0068.786] FindNextFileA (in: hFindFile=0x5b7c68, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0068.786] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0068.786] FindNextFileA (in: hFindFile=0x5b7c68, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0068.786] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0068.786] FindNextFileA (in: hFindFile=0x5b7c68, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0068.786] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0068.786] FindNextFileA (in: hFindFile=0x5b7c68, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0068.786] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0068.786] FindNextFileA (in: hFindFile=0x5b7c68, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0068.786] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0068.786] FindNextFileA (in: hFindFile=0x5b7c68, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0068.786] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0068.787] FindNextFileA (in: hFindFile=0x5b7c68, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0068.787] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0068.787] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0068.788] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0068.788] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0068.789] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0068.789] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0068.789] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0068.795] FindFirstFileA (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5b7c68 [0068.809] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0068.809] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0068.810] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0068.810] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0068.810] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0068.810] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0068.811] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0068.811] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0068.811] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0068.811] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0068.811] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0068.811] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0068.811] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0068.812] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0068.812] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0068.812] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0068.812] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0068.812] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0068.813] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0068.813] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0068.813] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0068.813] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0068.814] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0068.814] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0068.814] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0068.814] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0068.814] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0068.817] FindFirstFileA (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5b7c68 [0068.834] FindFirstFileA (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5b7c68 [0068.843] FindFirstFileA (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5b7c68 [0068.853] FindFirstFileA (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5b7c68 [0068.865] FindFirstFileA (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5b7c68 [0068.871] FindFirstFileA (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5b7c68 [0068.874] FindFirstFileA (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5b7c68 [0068.879] FindFirstFileA (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5b7c68 [0068.885] FindFirstFileA (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5b7c68 [0068.888] FindFirstFileA (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5b7c68 [0068.892] FindFirstFileA (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5b7c68 [0068.918] FindFirstFileA (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5b7c68 [0068.922] FindFirstFileA (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5b7c68 [0068.942] FindFirstFileA (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5b7c68 [0068.982] FindFirstFileA (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5b7c68 [0068.999] FindFirstFileA (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5b7c68 [0069.004] FindFirstFileA (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5b7c68 [0069.005] FindFirstFileA (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5b7c68 [0069.056] FindFirstFileA (in: lpFileName="C:\\Program Files\\Internet Explorer\\*.*", lpFindFileData=0xaf4e8 | out: lpFindFileData=0xaf4e8) returned 0x5b5c28 [0069.056] FindFirstFileA (in: lpFileName="C:\\Program Files\\Internet Explorer\\en-US\\*.*", lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 0x5b5bd0 [0069.058] FindFirstFileA (in: lpFileName="C:\\Program Files\\Internet Explorer\\SIGNUP\\*.*", lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 0x5b5bd0 [0069.058] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\*.*", lpFindFileData=0xaf4e8 | out: lpFindFileData=0xaf4e8) returned 0x5b5c40 [0069.058] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\*.*", lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 0x5b5bd0 [0069.058] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5b7d18 [0069.068] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5b7c90 [0069.089] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5b7c90 [0069.089] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5b7cd0 [0069.090] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\*.*", lpFindFileData=0xaf4e8 | out: lpFindFileData=0xaf4e8) returned 0x5b5c28 [0069.090] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\*.*", lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 0x5b5bd0 [0069.091] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5b7cf0 [0069.160] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00004_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00004_.gif. ")) returned 1 [0069.193] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00011_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00011_.gif. ")) returned 1 [0069.205] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00021_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00021_.gif. ")) returned 1 [0069.217] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00037_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00037_.gif. ")) returned 1 [0069.243] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00038_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00038_.gif. ")) returned 1 [0069.264] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00040_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00040_.gif. ")) returned 1 [0069.275] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00052_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00052_.gif. ")) returned 1 [0069.280] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00057_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00057_.gif. ")) returned 1 [0069.282] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00090_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00090_.gif. ")) returned 1 [0069.283] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00092_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00092_.gif. ")) returned 1 [0069.311] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00103_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00103_.gif. ")) returned 1 [0069.319] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00120_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00120_.gif. ")) returned 1 [0069.328] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00126_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00126_.gif. ")) returned 1 [0069.337] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00129_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00129_.gif. ")) returned 1 [0069.357] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00130_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00130_.gif. ")) returned 1 [0069.386] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00135_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00135_.gif. ")) returned 1 [0069.394] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00139_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00139_.gif. ")) returned 1 [0069.410] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00142_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00142_.gif. ")) returned 1 [0069.425] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00154_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00154_.gif. ")) returned 1 [0069.458] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00157_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00157_.gif. ")) returned 1 [0069.488] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00158_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00158_.gif. ")) returned 1 [0069.491] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00160_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00160_.gif. ")) returned 1 [0069.496] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00161_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00161_.gif. ")) returned 1 [0069.558] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00163_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00163_.gif. ")) returned 1 [0069.580] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00164_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00164_.gif. ")) returned 1 [0069.598] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00165_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00165_.gif. ")) returned 1 [0069.610] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00167_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00167_.gif. ")) returned 1 [0069.621] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00169_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00169_.gif. ")) returned 1 [0069.626] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00170_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00170_.gif. ")) returned 1 [0069.648] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00171_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00171_.gif. ")) returned 1 [0069.712] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00172_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00172_.gif. ")) returned 1 [0069.730] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00174_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00174_.gif. ")) returned 1 [0069.750] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00175_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00175_.gif. ")) returned 1 [0069.754] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00176_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00176_.gif. ")) returned 1 [0069.853] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10890_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10890_.gif. ")) returned 1 [0069.860] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10972_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10972_.gif. ")) returned 1 [0069.862] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19563_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19563_.gif. ")) returned 1 [0069.870] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19582_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19582_.gif. ")) returned 1 [0069.904] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0075478.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0075478.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0075478.GIF. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0075478.gif. ")) returned 1 [0069.944] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099145.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099145.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099145.JPG. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099145.jpg. ")) returned 1 [0069.968] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099147.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099147.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099147.JPG. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099147.jpg. ")) returned 1 [0070.037] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099148.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099148.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099148.JPG. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099148.jpg. ")) returned 1 [0070.077] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099150.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099150.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099150.JPG. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099150.jpg. ")) returned 1 [0070.141] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099152.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099152.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099152.JPG. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099152.jpg. ")) returned 1 [0070.219] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099154.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099154.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099154.JPG. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099154.jpg. ")) returned 1 [0070.262] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099155.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099155.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099155.JPG. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099155.jpg. ")) returned 1 [0070.299] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099156.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099156.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099156.JPG. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099156.jpg. ")) returned 1 [0070.339] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099157.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099157.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099157.JPG. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099157.jpg. ")) returned 1 [0070.382] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099160.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099160.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099160.JPG. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099160.jpg. ")) returned 1 [0070.448] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099161.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099161.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099161.JPG. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099161.jpg. ")) returned 1 [0070.455] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099162.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099162.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099162.JPG. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099162.jpg. ")) returned 1 [0070.468] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099165.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099165.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099165.JPG. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099165.jpg. ")) returned 1 [0070.480] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099166.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099166.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099166.JPG. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099166.jpg. ")) returned 1 [0070.485] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099167.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099167.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099167.JPG. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099167.jpg. ")) returned 1 [0070.503] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099168.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099168.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099168.JPG. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099168.jpg. ")) returned 1 [0070.509] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099185.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099185.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099185.JPG. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099185.jpg. ")) returned 1 [0070.521] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099186.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099186.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099186.JPG. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099186.jpg. ")) returned 1 [0070.523] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099187.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099187.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099187.JPG. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099187.jpg. ")) returned 1 [0070.532] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099188.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099188.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099188.JPG. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099188.jpg. ")) returned 1 [0070.538] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099189.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099189.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099189.JPG. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099189.jpg. ")) returned 1 [0070.548] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099190.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099190.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099190.JPG. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099190.jpg. ")) returned 1 [0070.558] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099191.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099191.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099191.JPG. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099191.jpg. ")) returned 1 [0070.577] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099192.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099192.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099192.GIF. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099192.gif. ")) returned 1 [0070.586] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099193.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099193.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099193.GIF. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099193.gif. ")) returned 1 [0070.620] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099194.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099194.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099194.GIF. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099194.gif. ")) returned 1 [0070.629] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099195.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099195.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099195.GIF. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099195.gif. ")) returned 1 [0070.639] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099196.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099196.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099196.GIF. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099196.gif. ")) returned 1 [0070.640] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099197.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099197.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099197.GIF. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099197.gif. ")) returned 1 [0070.647] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099198.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099198.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099198.GIF. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099198.gif. ")) returned 1 [0070.691] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099199.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099199.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099199.GIF. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099199.gif. ")) returned 1 [0070.726] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099200.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099200.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099200.GIF. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099200.gif. ")) returned 1 [0070.728] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099201.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099201.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099201.GIF. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099201.gif. ")) returned 1 [0070.757] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099202.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099202.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099202.GIF. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099202.gif. ")) returned 1 [0070.762] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099203.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099203.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099203.GIF. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099203.gif. ")) returned 1 [0070.766] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101856.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101856.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101856.BMP. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101856.bmp. ")) returned 1 [0070.769] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101857.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101857.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101857.BMP. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101857.bmp. ")) returned 1 [0070.772] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101858.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101858.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101858.BMP. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101858.bmp. ")) returned 1 [0070.775] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101859.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101859.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101859.BMP. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101859.bmp. ")) returned 1 [0070.786] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101860.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101860.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101860.BMP. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101860.bmp. ")) returned 1 [0070.798] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101861.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101861.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101861.BMP. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101861.bmp. ")) returned 1 [0070.815] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101862.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101862.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101862.BMP. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101862.bmp. ")) returned 1 [0070.825] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101863.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101863.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101863.BMP. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101863.bmp. ")) returned 1 [0070.831] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101864.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101864.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101864.BMP. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101864.bmp. ")) returned 1 [0070.837] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101865.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101865.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101865.BMP. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101865.bmp. ")) returned 1 [0070.842] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101866.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101866.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101866.BMP. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101866.bmp. ")) returned 1 [0070.852] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101867.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101867.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101867.BMP. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101867.bmp. ")) returned 1 [0070.889] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0144773.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0144773.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0144773.JPG. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0144773.jpg. ")) returned 1 [0070.900] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145168.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145168.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145168.JPG. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145168.jpg. ")) returned 1 [0070.908] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145212.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145212.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145212.JPG. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145212.jpg. ")) returned 1 [0070.943] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145272.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145272.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145272.JPG. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145272.jpg. ")) returned 1 [0070.954] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145361.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145361.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145361.JPG. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145361.jpg. ")) returned 1 [0070.963] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145373.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145373.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145373.JPG. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145373.jpg. ")) returned 1 [0070.971] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145669.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145669.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145669.JPG. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145669.jpg. ")) returned 1 [0071.003] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145707.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145707.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145707.JPG. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145707.jpg. ")) returned 1 [0071.025] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145810.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145810.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145810.JPG. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145810.jpg. ")) returned 1 [0071.047] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145879.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145879.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145879.JPG. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145879.jpg. ")) returned 1 [0071.058] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145895.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145895.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145895.JPG. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145895.jpg. ")) returned 1 [0071.067] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145904.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145904.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145904.JPG. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145904.jpg. ")) returned 1 [0071.077] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0146142.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0146142.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0146142.JPG. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0146142.jpg. ")) returned 1 [0071.083] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148309.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0148309.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148309.JPG. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0148309.jpg. ")) returned 1 [0071.091] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148757.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0148757.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148757.JPG. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0148757.jpg. ")) returned 1 [0071.101] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148798.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0148798.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148798.JPG. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0148798.jpg. ")) returned 1 [0071.147] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149018.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0149018.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149018.JPG. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0149018.jpg. ")) returned 1 [0071.176] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149118.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0149118.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149118.JPG. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0149118.jpg. ")) returned 1 [0071.205] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0164153.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0164153.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0164153.JPG. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0164153.jpg. ")) returned 1 [0071.217] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174952.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174952.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174952.JPG. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174952.jpg. ")) returned 1 [0071.231] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175361.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0175361.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175361.JPG. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0175361.jpg. ")) returned 1 [0071.246] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175428.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0175428.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175428.JPG. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0175428.jpg. ")) returned 1 [0071.262] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177257.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0177257.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177257.JPG. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0177257.jpg. ")) returned 1 [0071.276] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177806.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0177806.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177806.JPG. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0177806.jpg. ")) returned 1 [0071.302] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178348.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178348.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178348.JPG. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178348.jpg. ")) returned 1 [0071.311] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178459.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178459.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178459.JPG. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178459.jpg. ")) returned 1 [0071.324] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178460.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178460.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178460.JPG. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178460.jpg. ")) returned 1 [0071.330] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178523.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178523.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178523.JPG. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178523.jpg. ")) returned 1 [0071.335] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178632.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178632.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178632.JPG. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178632.jpg. ")) returned 1 [0071.346] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178639.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178639.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178639.JPG. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178639.jpg. ")) returned 1 [0071.349] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178932.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178932.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178932.JPG. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178932.jpg. ")) returned 1 [0071.356] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0179963.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0179963.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0179963.JPG. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0179963.jpg. ")) returned 1 [0071.370] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182689.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182689.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182689.JPG. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182689.jpg. ")) returned 1 [0071.384] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0202045.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0202045.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0202045.JPG. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0202045.jpg. ")) returned 1 [0071.396] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216112.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216112.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216112.JPG. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216112.jpg. ")) returned 1 [0071.408] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216153.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216153.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216153.JPG. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216153.jpg. ")) returned 1 [0071.425] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0227419.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0227419.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0227419.JPG. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0227419.jpg. ")) returned 1 [0071.445] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0227558.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0227558.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0227558.JPG. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0227558.jpg. ")) returned 1 [0071.464] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287641.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287641.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287641.JPG. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287641.jpg. ")) returned 1 [0071.466] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287642.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287642.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287642.JPG. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287642.jpg. ")) returned 1 [0071.478] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287643.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287643.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287643.JPG. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287643.jpg. ")) returned 1 [0071.481] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287644.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287644.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287644.JPG. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287644.jpg. ")) returned 1 [0071.490] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287645.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287645.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287645.JPG. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287645.jpg. ")) returned 1 [0071.496] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0289430.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0289430.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0289430.JPG. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0289430.jpg. ")) returned 1 [0071.504] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309480.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309480.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309480.JPG. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309480.jpg. ")) returned 1 [0071.507] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309567.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309567.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309567.JPG. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309567.jpg. ")) returned 1 [0071.517] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309585.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309585.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309585.JPG. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309585.jpg. ")) returned 1 [0071.529] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309598.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309598.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309598.JPG. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309598.jpg. ")) returned 1 [0071.541] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309664.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309664.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309664.JPG. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309664.jpg. ")) returned 1 [0071.557] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309705.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309705.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309705.JPG. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309705.jpg. ")) returned 1 [0071.568] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313896.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0313896.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313896.JPG. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0313896.jpg. ")) returned 1 [0071.572] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313965.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0313965.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313965.JPG. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0313965.jpg. ")) returned 1 [0071.585] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313970.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0313970.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313970.JPG. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0313970.jpg. ")) returned 1 [0071.593] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313974.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0313974.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313974.JPG. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0313974.jpg. ")) returned 1 [0071.602] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0314068.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0314068.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0314068.JPG. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0314068.jpg. ")) returned 1 [0071.614] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0315580.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0315580.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0315580.JPG. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0315580.jpg. ")) returned 1 [0071.625] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0315612.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0315612.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0315612.JPG. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0315612.jpg. ")) returned 1 [0071.634] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0321179.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0321179.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0321179.JPG. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0321179.jpg. ")) returned 1 [0071.640] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0337280.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0337280.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0337280.JPG. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0337280.jpg. ")) returned 1 [0071.643] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341328.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341328.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341328.JPG. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341328.jpg. ")) returned 1 [0071.657] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341344.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341344.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341344.JPG. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341344.jpg. ")) returned 1 [0071.666] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341439.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341439.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341439.JPG. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341439.jpg. ")) returned 1 [0071.679] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341447.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341447.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341447.JPG. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341447.jpg. ")) returned 1 [0071.684] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341448.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341448.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341448.JPG. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341448.jpg. ")) returned 1 [0071.694] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341455.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341455.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341455.JPG. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341455.jpg. ")) returned 1 [0071.713] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341475.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341475.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341475.JPG. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341475.jpg. ")) returned 1 [0071.722] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341499.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341499.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341499.JPG. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341499.jpg. ")) returned 1 [0071.731] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341534.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341534.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341534.JPG. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341534.jpg. ")) returned 1 [0071.740] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341551.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341551.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341551.JPG. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341551.jpg. ")) returned 1 [0071.746] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341554.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341554.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341554.JPG. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341554.jpg. ")) returned 1 [0071.759] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341557.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341557.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341557.JPG. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341557.jpg. ")) returned 1 [0071.762] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341559.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341559.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341559.JPG. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341559.jpg. ")) returned 1 [0071.765] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341561.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341561.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341561.JPG. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341561.jpg. ")) returned 1 [0071.768] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341634.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341634.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341634.JPG. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341634.jpg. ")) returned 1 [0071.781] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341636.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341636.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341636.JPG. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341636.jpg. ")) returned 1 [0071.784] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341645.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341645.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341645.JPG. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341645.jpg. ")) returned 1 [0071.793] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341653.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341653.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341653.JPG. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341653.jpg. ")) returned 1 [0071.801] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341654.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341654.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341654.JPG. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341654.jpg. ")) returned 1 [0071.814] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341738.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341738.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341738.JPG. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341738.jpg. ")) returned 1 [0071.818] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341742.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341742.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341742.JPG. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341742.jpg. ")) returned 1 [0071.831] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382836.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382836.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382836.JPG. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382836.jpg. ")) returned 1 [0071.848] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382925.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382925.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382925.JPG. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382925.jpg. ")) returned 1 [0071.870] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382926.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382926.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382926.JPG. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382926.jpg. ")) returned 1 [0071.900] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382927.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382927.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382927.JPG. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382927.jpg. ")) returned 1 [0071.903] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382930.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382930.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382930.JPG. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382930.jpg. ")) returned 1 [0071.906] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382931.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382931.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382931.JPG. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382931.jpg. ")) returned 1 [0071.918] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382938.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382938.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382938.JPG. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382938.jpg. ")) returned 1 [0071.934] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382939.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382939.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382939.JPG. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382939.jpg. ")) returned 1 [0071.937] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382942.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382942.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382942.JPG. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382942.jpg. ")) returned 1 [0071.950] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382944.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382944.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382944.JPG. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382944.jpg. ")) returned 1 [0071.964] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382947.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382947.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382947.JPG. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382947.jpg. ")) returned 1 [0072.022] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382948.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382948.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382948.JPG. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382948.jpg. ")) returned 1 [0072.362] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382950.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382950.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382950.JPG. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382950.jpg. ")) returned 1 [0072.374] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382952.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382952.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382952.JPG. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382952.jpg. ")) returned 1 [0072.479] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382954.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382954.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382954.JPG. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382954.jpg. ")) returned 1 [0072.491] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382955.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382955.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382955.JPG. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382955.jpg. ")) returned 1 [0072.517] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382957.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382957.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382957.JPG. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382957.jpg. ")) returned 1 [0072.530] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382958.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382958.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382958.JPG. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382958.jpg. ")) returned 1 [0072.533] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382959.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382959.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382959.JPG. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382959.jpg. ")) returned 1 [0072.539] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382960.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382960.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382960.JPG. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382960.jpg. ")) returned 1 [0072.545] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382961.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382961.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382961.JPG. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382961.jpg. ")) returned 1 [0072.557] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382962.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382962.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382962.JPG. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382962.jpg. ")) returned 1 [0072.559] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382963.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382963.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382963.JPG. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382963.jpg. ")) returned 1 [0072.573] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382965.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382965.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382965.JPG. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382965.jpg. ")) returned 1 [0072.576] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382966.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382966.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382966.JPG. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382966.jpg. ")) returned 1 [0072.593] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382967.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382967.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382967.JPG. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382967.jpg. ")) returned 1 [0072.611] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382968.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382968.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382968.JPG. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382968.jpg. ")) returned 1 [0072.615] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382969.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382969.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382969.JPG. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382969.jpg. ")) returned 1 [0072.627] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382970.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382970.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382970.JPG. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382970.jpg. ")) returned 1 [0072.653] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384862.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384862.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384862.JPG. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384862.jpg. ")) returned 1 [0072.671] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384885.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384885.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384885.JPG. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384885.jpg. ")) returned 1 [0072.684] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384888.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384888.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384888.JPG. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384888.jpg. ")) returned 1 [0072.686] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384895.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384895.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384895.JPG. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384895.jpg. ")) returned 1 [0072.714] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384900.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384900.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384900.JPG. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384900.jpg. ")) returned 1 [0072.720] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386120.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386120.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386120.JPG. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386120.jpg. ")) returned 1 [0072.736] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386267.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386267.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386267.JPG. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386267.jpg. ")) returned 1 [0072.751] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386270.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386270.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386270.JPG. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386270.jpg. ")) returned 1 [0072.754] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386485.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386485.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386485.JPG. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386485.jpg. ")) returned 1 [0072.764] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386764.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386764.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386764.JPG. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386764.jpg. ")) returned 1 [0072.766] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387337.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387337.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387337.JPG. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387337.jpg. ")) returned 1 [0072.778] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387578.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387578.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387578.JPG. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387578.jpg. ")) returned 1 [0072.782] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387591.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387591.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387591.JPG. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387591.jpg. ")) returned 1 [0072.785] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387604.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387604.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387604.JPG. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387604.jpg. ")) returned 1 [0072.788] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387882.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387882.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387882.JPG. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387882.jpg. ")) returned 1 [0072.791] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387895.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387895.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387895.JPG. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387895.jpg. ")) returned 1 [0072.796] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0390072.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0390072.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0390072.JPG. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0390072.jpg. ")) returned 1 [0072.814] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400001.PNG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0400001.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400001.PNG. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0400001.png. ")) returned 1 [0072.819] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400002.PNG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0400002.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400002.PNG. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0400002.png. ")) returned 1 [0072.824] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400003.PNG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0400003.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400003.PNG. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0400003.png. ")) returned 1 [0072.828] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400004.PNG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0400004.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400004.PNG. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0400004.png. ")) returned 1 [0072.832] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400005.PNG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0400005.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400005.PNG. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0400005.png. ")) returned 1 [0072.852] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH00601G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph00601g.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH00601G.GIF. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph00601g.gif. ")) returned 1 [0072.861] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH00780U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph00780u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH00780U.BMP. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph00780u.bmp. ")) returned 1 [0072.867] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01035U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01035u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01035U.BMP. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01035u.bmp. ")) returned 1 [0072.887] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01046J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01046j.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01046J.JPG. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01046j.jpg. ")) returned 1 [0072.891] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01179J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01179j.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01179J.JPG. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01179j.jpg. ")) returned 1 [0072.899] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01213K.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01213k.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01213K.JPG. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01213k.jpg. ")) returned 1 [0072.911] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01221K.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01221k.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01221K.JPG. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01221k.jpg. ")) returned 1 [0072.914] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01235U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01235u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01235U.BMP. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01235u.bmp. ")) returned 1 [0072.916] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01236U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01236u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01236U.BMP. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01236u.bmp. ")) returned 1 [0072.923] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01239K.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01239k.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01239K.JPG. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01239k.jpg. ")) returned 1 [0072.926] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01247U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01247u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01247U.BMP. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01247u.bmp. ")) returned 1 [0072.936] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01255G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01255g.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01255G.GIF. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01255g.gif. ")) returned 1 [0072.940] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01265U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01265u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01265U.BMP. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01265u.bmp. ")) returned 1 [0072.943] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01332U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01332u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01332U.BMP. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01332u.bmp. ")) returned 1 [0072.945] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01478U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01478u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01478U.BMP. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01478u.bmp. ")) returned 1 [0072.949] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01562U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01562u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01562U.BMP. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01562u.bmp. ")) returned 1 [0072.961] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01607U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01607u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01607U.BMP. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01607u.bmp. ")) returned 1 [0072.978] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01931J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01931j.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01931J.JPG. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01931j.jpg. ")) returned 1 [0072.982] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02028K.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02028k.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02028K.JPG. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02028k.jpg. ")) returned 1 [0072.989] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02039U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02039u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02039U.BMP. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02039u.bmp. ")) returned 1 [0072.991] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02040U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02040u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02040U.BMP. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02040u.bmp. ")) returned 1 [0073.006] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02053J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02053j.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02053J.JPG. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02053j.jpg. ")) returned 1 [0073.009] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02058U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02058u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02058U.BMP. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02058u.bmp. ")) returned 1 [0073.021] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02062U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02062u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02062U.BMP. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02062u.bmp. ")) returned 1 [0073.026] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02069J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02069j.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02069J.JPG. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02069j.jpg. ")) returned 1 [0073.034] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02071U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02071u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02071U.BMP. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02071u.bmp. ")) returned 1 [0073.037] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02074U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02074u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02074U.BMP. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02074u.bmp. ")) returned 1 [0073.040] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02208U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02208u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02208U.BMP. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02208u.bmp. ")) returned 1 [0073.046] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02223U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02223u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02223U.BMP. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02223u.bmp. ")) returned 1 [0073.050] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02291U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02291u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02291U.BMP. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02291u.bmp. ")) returned 1 [0073.053] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02398U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02398u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02398U.BMP. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02398u.bmp. ")) returned 1 [0073.062] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02412K.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02412k.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02412K.JPG. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02412k.jpg. ")) returned 1 [0073.065] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02417U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02417u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02417U.BMP. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02417u.bmp. ")) returned 1 [0073.084] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02466U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02466u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02466U.BMP. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02466u.bmp. ")) returned 1 [0073.087] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02470U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02470u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02470U.BMP. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02470u.bmp. ")) returned 1 [0073.096] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02503U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02503u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02503U.BMP. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02503u.bmp. ")) returned 1 [0073.103] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02567J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02567j.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02567J.JPG. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02567j.jpg. ")) returned 1 [0073.108] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02736G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02736g.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02736G.GIF. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02736g.gif. ")) returned 1 [0073.116] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02736U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02736u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02736U.BMP. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02736u.bmp. ")) returned 1 [0073.119] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02738U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02738u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02738U.BMP. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02738u.bmp. ")) returned 1 [0073.131] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02740G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02740g.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02740G.GIF. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02740g.gif. ")) returned 1 [0073.134] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02740U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02740u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02740U.BMP. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02740u.bmp. ")) returned 1 [0073.148] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02742G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02742g.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02742G.GIF. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02742g.gif. ")) returned 1 [0073.185] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02742U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02742u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02742U.BMP. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02742u.bmp. ")) returned 1 [0073.187] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02743G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02743g.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02743G.GIF. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02743g.gif. ")) returned 1 [0073.193] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02746G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02746g.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02746G.GIF. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02746g.gif. ")) returned 1 [0073.205] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02746U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02746u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02746U.BMP. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02746u.bmp. ")) returned 1 [0073.208] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02748G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02748g.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02748G.GIF. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02748g.gif. ")) returned 1 [0073.211] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02748U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02748u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02748U.BMP. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02748u.bmp. ")) returned 1 [0073.213] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02749G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02749g.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02749G.GIF. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02749g.gif. ")) returned 1 [0073.215] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02749U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02749u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02749U.BMP. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02749u.bmp. ")) returned 1 [0073.217] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02750G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02750g.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02750G.GIF. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02750g.gif. ")) returned 1 [0073.220] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02750U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02750u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02750U.BMP. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02750u.bmp. ")) returned 1 [0073.223] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02752G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02752g.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02752G.GIF. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02752g.gif. ")) returned 1 [0073.229] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02752U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02752u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02752U.BMP. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02752u.bmp. ")) returned 1 [0073.235] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02753U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02753u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02753U.BMP. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02753u.bmp. ")) returned 1 [0073.239] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02754U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02754u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02754U.BMP. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02754u.bmp. ")) returned 1 [0073.252] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02755U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02755u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02755U.BMP. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02755u.bmp. ")) returned 1 [0073.263] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02756U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02756u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02756U.BMP. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02756u.bmp. ")) returned 1 [0073.273] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02757U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02757u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02757U.BMP. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02757u.bmp. ")) returned 1 [0073.288] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02758U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02758u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02758U.BMP. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02758u.bmp. ")) returned 1 [0073.292] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02759J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02759j.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02759J.JPG. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02759j.jpg. ")) returned 1 [0073.295] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02810J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02810j.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02810J.JPG. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02810j.jpg. ")) returned 1 [0073.298] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02829J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02829j.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02829J.JPG. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02829j.jpg. ")) returned 1 [0073.322] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02845G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02845g.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02845G.GIF. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02845g.gif. ")) returned 1 [0073.333] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02897J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02897j.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02897J.JPG. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02897j.jpg. ")) returned 1 [0073.340] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03011U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03011u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03011U.BMP. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03011u.bmp. ")) returned 1 [0073.352] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03012U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03012u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03012U.BMP. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03012u.bmp. ")) returned 1 [0073.359] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03014_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03014_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03014_.GIF. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03014_.gif. ")) returned 1 [0073.386] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03041I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03041i.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03041I.JPG. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03041i.jpg. ")) returned 1 [0073.393] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03143I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03143i.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03143I.JPG. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03143i.jpg. ")) returned 1 [0073.400] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03205I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03205i.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03205I.JPG. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03205i.jpg. ")) returned 1 [0073.403] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03224I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03224i.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03224I.JPG. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03224i.jpg. ")) returned 1 [0073.428] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03379I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03379i.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03379I.JPG. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03379i.jpg. ")) returned 1 [0073.431] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03380I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03380i.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03380I.JPG. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03380i.jpg. ")) returned 1 [0073.433] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03425I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03425i.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03425I.JPG. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03425i.jpg. ")) returned 1 [0073.493] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01219_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01219_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01219_.GIF. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01219_.gif. ")) returned 1 [0073.494] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01237_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01237_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01237_.GIF. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01237_.gif. ")) returned 1 [0073.496] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01238_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01238_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01238_.GIF. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01238_.gif. ")) returned 1 [0073.497] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01239_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01239_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01239_.GIF. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01239_.gif. ")) returned 1 [0073.498] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01240_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01240_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01240_.GIF. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01240_.gif. ")) returned 1 [0073.499] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01241_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01241_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01241_.GIF. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01241_.gif. ")) returned 1 [0073.501] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01242_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01242_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01242_.GIF. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01242_.gif. ")) returned 1 [0073.503] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01243_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01243_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01243_.GIF. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01243_.gif. ")) returned 1 [0073.504] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01244_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01244_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01244_.GIF. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01244_.gif. ")) returned 1 [0073.507] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01245_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01245_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01245_.GIF. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01245_.gif. ")) returned 1 [0073.508] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01246_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01246_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01246_.GIF. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01246_.gif. ")) returned 1 [0073.525] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01253_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01253_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01253_.GIF. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01253_.gif. ")) returned 1 [0073.527] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01268_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01268_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01268_.GIF. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01268_.gif. ")) returned 1 [0073.529] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01292_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01292_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01292_.GIF. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01292_.gif. ")) returned 1 [0073.531] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01293_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01293_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01293_.GIF. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01293_.gif. ")) returned 1 [0073.534] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01294_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01294_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01294_.GIF. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01294_.gif. ")) returned 1 [0073.537] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01295_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01295_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01295_.GIF. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01295_.gif. ")) returned 1 [0073.539] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01296_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01296_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01296_.GIF. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01296_.gif. ")) returned 1 [0073.551] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01297_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01297_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01297_.GIF. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01297_.gif. ")) returned 1 [0073.554] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01298_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01298_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01298_.GIF. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01298_.gif. ")) returned 1 [0073.557] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01299_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01299_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01299_.GIF. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01299_.gif. ")) returned 1 [0073.559] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01300_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01300_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01300_.GIF. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01300_.gif. ")) returned 1 [0073.560] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01301_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01301_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01301_.GIF. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01301_.gif. ")) returned 1 [0073.632] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01304G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01304g.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01304G.GIF. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01304g.gif. ")) returned 1 [0073.634] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01330_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01330_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01330_.GIF. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01330_.gif. ")) returned 1 [0073.639] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01734_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01734_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01734_.GIF. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01734_.gif. ")) returned 1 [0073.641] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01740_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01740_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01740_.GIF. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01740_.gif. ")) returned 1 [0073.643] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01742_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01742_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01742_.GIF. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01742_.gif. ")) returned 1 [0073.647] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01743_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01743_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01743_.GIF. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01743_.gif. ")) returned 1 [0073.657] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01744_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01744_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01744_.GIF. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01744_.gif. ")) returned 1 [0073.659] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01745_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01745_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01745_.GIF. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01745_.gif. ")) returned 1 [0073.663] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01746_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01746_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01746_.GIF. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01746_.gif. ")) returned 1 [0073.665] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01747_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01747_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01747_.GIF. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01747_.gif. ")) returned 1 [0073.672] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01748_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01748_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01748_.GIF. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01748_.gif. ")) returned 1 [0073.675] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01749_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01749_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01749_.GIF. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01749_.gif. ")) returned 1 [0073.677] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01750_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01750_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01750_.GIF. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01750_.gif. ")) returned 1 [0073.686] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01751_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01751_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01751_.GIF. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01751_.gif. ")) returned 1 [0073.689] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01770_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01770_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01770_.GIF. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01770_.gif. ")) returned 1 [0073.690] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01838_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01838_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01838_.GIF. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01838_.gif. ")) returned 1 [0073.693] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01839_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01839_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01839_.GIF. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01839_.gif. ")) returned 1 [0073.695] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01840_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01840_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01840_.GIF. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01840_.gif. ")) returned 1 [0073.697] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01842_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01842_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01842_.GIF. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01842_.gif. ")) returned 1 [0073.706] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01843_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01843_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01843_.GIF. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01843_.gif. ")) returned 1 [0073.719] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB02229_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb02229_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB02229_.GIF. " (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb02229_.gif. ")) returned 1 [0073.720] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5b7cf0 [0073.727] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5b7c78 [0073.740] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143743.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143743.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143743.GIF. " (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143743.gif. ")) returned 1 [0073.741] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143744.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143744.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143744.GIF. " (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143744.gif. ")) returned 1 [0073.751] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143745.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143745.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143745.GIF. " (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143745.gif. ")) returned 1 [0073.768] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143746.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143746.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143746.GIF. " (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143746.gif. ")) returned 1 [0073.778] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143748.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143748.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143748.GIF. " (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143748.gif. ")) returned 1 [0073.782] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143749.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143749.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143749.GIF. " (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143749.gif. ")) returned 1 [0073.789] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143750.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143750.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143750.GIF. " (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143750.gif. ")) returned 1 [0073.797] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143752.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143752.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143752.GIF. " (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143752.gif. ")) returned 1 [0073.804] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143753.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143753.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143753.GIF. " (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143753.gif. ")) returned 1 [0073.814] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143754.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143754.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143754.GIF. " (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143754.gif. ")) returned 1 [0073.817] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143758.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143758.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143758.GIF. " (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143758.gif. ")) returned 1 [0073.824] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00516L.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00516l.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00516L.GIF. " (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00516l.gif. ")) returned 1 [0073.838] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00531L.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00531l.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00531L.GIF. " (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00531l.gif. ")) returned 1 [0073.849] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00673L.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00673l.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00673L.GIF. " (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00673l.gif. ")) returned 1 [0073.858] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00703L.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00703l.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00703L.GIF. " (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00703l.gif. ")) returned 1 [0073.871] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00760L.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00760l.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00760L.GIF. " (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00760l.gif. ")) returned 1 [0073.882] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00780L.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00780l.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00780L.GIF. " (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00780l.gif. ")) returned 1 [0073.884] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB01741L.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb01741l.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB01741L.GIF. " (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb01741l.gif. ")) returned 1 [0073.889] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02039_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02039_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02039_.GIF. " (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02039_.gif. ")) returned 1 [0073.892] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02055_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02055_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02055_.GIF. " (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02055_.gif. ")) returned 1 [0073.895] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02073_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02073_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02073_.GIF. " (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02073_.gif. ")) returned 1 [0073.899] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02074_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02074_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02074_.GIF. " (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02074_.gif. ")) returned 1 [0073.907] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02077_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02077_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02077_.GIF. " (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02077_.gif. ")) returned 1 [0073.915] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02082_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02082_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02082_.GIF. " (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02082_.gif. ")) returned 1 [0073.918] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02085_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02085_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02085_.GIF. " (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02085_.gif. ")) returned 1 [0073.920] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02097_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02097_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02097_.GIF. " (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02097_.gif. ")) returned 1 [0073.925] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02106_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02106_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02106_.GIF. " (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02106_.gif. ")) returned 1 [0073.928] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02116_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02116_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02116_.GIF. " (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02116_.gif. ")) returned 1 [0073.931] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02134_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02134_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02134_.GIF. " (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02134_.gif. ")) returned 1 [0073.942] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02187_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02187_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02187_.GIF. " (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02187_.gif. ")) returned 1 [0073.954] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02198_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02198_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02198_.GIF. " (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02198_.gif. ")) returned 1 [0073.960] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02201_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02201_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02201_.GIF. " (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02201_.gif. ")) returned 1 [0073.963] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02214_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02214_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02214_.GIF. " (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02214_.gif. ")) returned 1 [0073.966] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02218_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02218_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02218_.GIF. " (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02218_.gif. ")) returned 1 [0073.978] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\*.*", lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 0x5b5bd0 [0074.135] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5b7d10 [0074.170] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5b7d10 [0074.174] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5b7d10 [0074.324] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\*.*", lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 0x5b5bd0 [0074.325] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5b7cf0 [0074.330] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5b7c78 [0074.353] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\ELPHRG01.WAV" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\elphrg01.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\ELPHRG01.WAV. " (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\elphrg01.wav. ")) returned 1 [0074.379] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0214098.WAV" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0214098.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0214098.WAV. " (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0214098.wav. ")) returned 1 [0074.398] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0234687.GIF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0234687.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0234687.GIF. " (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0234687.gif. ")) returned 1 [0074.407] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0283209.GIF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0283209.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0283209.GIF. " (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0283209.gif. ")) returned 1 [0074.412] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0284916.JPG" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0284916.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0284916.JPG. " (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0284916.jpg. ")) returned 1 [0074.426] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0295241.GIF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0295241.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0295241.GIF. " (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0295241.gif. ")) returned 1 [0074.436] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0300520.GIF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0300520.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0300520.GIF. " (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0300520.gif. ")) returned 1 [0074.444] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0302827.JPG" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0302827.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0302827.JPG. " (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0302827.jpg. ")) returned 1 [0074.455] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0302953.JPG" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0302953.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0302953.JPG. " (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0302953.jpg. ")) returned 1 [0074.466] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0315447.JPG" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0315447.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0315447.JPG. " (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0315447.jpg. ")) returned 1 [0074.468] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5b7cf0 [0074.468] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5b7c78 [0074.469] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5b7c78 [0074.494] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5b7c78 [0074.516] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10253_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10253_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10253_.GIF. " (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10253_.gif. ")) returned 1 [0074.519] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10254_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10254_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10254_.GIF. " (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10254_.gif. ")) returned 1 [0074.521] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10255_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10255_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10255_.GIF. " (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10255_.gif. ")) returned 1 [0074.523] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10263_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10263_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10263_.GIF. " (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10263_.gif. ")) returned 1 [0074.718] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10264_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10264_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10264_.GIF. " (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10264_.gif. ")) returned 1 [0074.720] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10265_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10265_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10265_.GIF. " (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10265_.gif. ")) returned 1 [0074.721] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10266_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10266_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10266_.GIF. " (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10266_.gif. ")) returned 1 [0074.741] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10267_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10267_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10267_.GIF. " (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10267_.gif. ")) returned 1 [0074.743] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10268_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10268_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10268_.GIF. " (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10268_.gif. ")) returned 1 [0074.758] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10297_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10297_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10297_.GIF. " (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10297_.gif. ")) returned 1 [0074.826] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10298_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10298_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10298_.GIF. " (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10298_.gif. ")) returned 1 [0074.828] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10299_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10299_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10299_.GIF. " (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10299_.gif. ")) returned 1 [0074.829] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10300_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10300_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10300_.GIF. " (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10300_.gif. ")) returned 1 [0074.830] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10301_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10301_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10301_.GIF. " (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10301_.gif. ")) returned 1 [0074.831] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10302_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10302_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10302_.GIF. " (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10302_.gif. ")) returned 1 [0074.833] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10335_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10335_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10335_.GIF. " (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10335_.gif. ")) returned 1 [0074.835] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10336_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10336_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10336_.GIF. " (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10336_.gif. ")) returned 1 [0074.837] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10337_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10337_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10337_.GIF. " (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10337_.gif. ")) returned 1 [0074.840] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14513_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14513_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14513_.GIF. " (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14513_.gif. ")) returned 1 [0074.841] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14514_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14514_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14514_.GIF. " (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14514_.gif. ")) returned 1 [0074.844] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14515_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14515_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14515_.GIF. " (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14515_.gif. ")) returned 1 [0074.845] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14528_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14528_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14528_.GIF. " (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14528_.gif. ")) returned 1 [0074.847] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14529_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14529_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14529_.GIF. " (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14529_.gif. ")) returned 1 [0074.849] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14530_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14530_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14530_.GIF. " (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14530_.gif. ")) returned 1 [0074.850] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14531_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14531_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14531_.GIF. " (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14531_.gif. ")) returned 1 [0074.852] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14532_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14532_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14532_.GIF. " (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14532_.gif. ")) returned 1 [0074.855] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14533_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14533_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14533_.GIF. " (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14533_.gif. ")) returned 1 [0074.858] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14565_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14565_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14565_.GIF. " (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14565_.gif. ")) returned 1 [0074.860] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14578_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14578_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14578_.GIF. " (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14578_.gif. ")) returned 1 [0074.862] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14579_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14579_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14579_.GIF. " (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14579_.gif. ")) returned 1 [0074.864] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14580_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14580_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14580_.GIF. " (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14580_.gif. ")) returned 1 [0074.866] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14581_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14581_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14581_.GIF. " (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14581_.gif. ")) returned 1 [0074.868] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14582_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14582_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14582_.GIF. " (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14582_.gif. ")) returned 1 [0074.871] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14583_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14583_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14583_.GIF. " (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14583_.gif. ")) returned 1 [0074.873] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14654_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14654_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14654_.GIF. " (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14654_.gif. ")) returned 1 [0074.875] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14655_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14655_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14655_.GIF. " (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14655_.gif. ")) returned 1 [0074.876] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14656_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14656_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14656_.GIF. " (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14656_.gif. ")) returned 1 [0074.877] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14691_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14691_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14691_.GIF. " (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14691_.gif. ")) returned 1 [0074.879] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14692_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14692_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14692_.GIF. " (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14692_.gif. ")) returned 1 [0074.880] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14693_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14693_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14693_.GIF. " (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14693_.gif. ")) returned 1 [0074.885] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14752_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14752_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14752_.GIF. " (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14752_.gif. ")) returned 1 [0074.933] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14753_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14753_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14753_.GIF. " (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14753_.gif. ")) returned 1 [0074.935] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14754_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14754_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14754_.GIF. " (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14754_.gif. ")) returned 1 [0074.935] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14755_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14755_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14755_.GIF. " (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14755_.gif. ")) returned 1 [0074.938] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14756_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14756_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14756_.GIF. " (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14756_.gif. ")) returned 1 [0074.939] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14757_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14757_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14757_.GIF. " (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14757_.gif. ")) returned 1 [0074.942] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14790_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14790_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14790_.GIF. " (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14790_.gif. ")) returned 1 [0074.998] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14791_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14791_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14791_.GIF. " (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14791_.gif. ")) returned 1 [0075.000] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14792_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14792_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14792_.GIF. " (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14792_.gif. ")) returned 1 [0075.002] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14793_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14793_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14793_.GIF. " (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14793_.gif. ")) returned 1 [0075.004] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14794_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14794_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14794_.GIF. " (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14794_.gif. ")) returned 1 [0075.005] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14795_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14795_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14795_.GIF. " (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14795_.gif. ")) returned 1 [0075.007] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14828_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14828_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14828_.GIF. " (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14828_.gif. ")) returned 1 [0075.009] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14829_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14829_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14829_.GIF. " (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14829_.gif. ")) returned 1 [0075.010] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14830_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14830_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14830_.GIF. " (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14830_.gif. ")) returned 1 [0075.013] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14831_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14831_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14831_.GIF. " (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14831_.gif. ")) returned 1 [0075.015] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14832_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14832_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14832_.GIF. " (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14832_.gif. ")) returned 1 [0075.016] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14833_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14833_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14833_.GIF. " (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14833_.gif. ")) returned 1 [0075.018] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14866_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14866_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14866_.GIF. " (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14866_.gif. ")) returned 1 [0075.020] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14867_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14867_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14867_.GIF. " (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14867_.gif. ")) returned 1 [0075.021] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14868_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14868_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14868_.GIF. " (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14868_.gif. ")) returned 1 [0075.023] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14869_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14869_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14869_.GIF. " (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14869_.gif. ")) returned 1 [0075.025] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14870_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14870_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14870_.GIF. " (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14870_.gif. ")) returned 1 [0075.027] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14871_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14871_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14871_.GIF. " (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14871_.gif. ")) returned 1 [0075.029] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14980_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14980_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14980_.GIF. " (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14980_.gif. ")) returned 1 [0075.031] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14981_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14981_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14981_.GIF. " (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14981_.gif. ")) returned 1 [0075.032] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14982_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14982_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14982_.GIF. " (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14982_.gif. ")) returned 1 [0075.036] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14983_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14983_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14983_.GIF. " (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14983_.gif. ")) returned 1 [0075.038] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14984_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14984_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14984_.GIF. " (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14984_.gif. ")) returned 1 [0075.039] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14985_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14985_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14985_.GIF. " (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14985_.gif. ")) returned 1 [0075.111] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15018_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15018_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15018_.GIF. " (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15018_.gif. ")) returned 1 [0075.113] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15019_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15019_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15019_.GIF. " (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15019_.gif. ")) returned 1 [0075.115] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15020_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15020_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15020_.GIF. " (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15020_.gif. ")) returned 1 [0075.115] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15021_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15021_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15021_.GIF. " (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15021_.gif. ")) returned 1 [0075.117] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15022_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15022_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15022_.GIF. " (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15022_.gif. ")) returned 1 [0075.119] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15023_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15023_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15023_.GIF. " (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15023_.gif. ")) returned 1 [0075.121] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15056_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15056_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15056_.GIF. " (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15056_.gif. ")) returned 1 [0075.123] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15057_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15057_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15057_.GIF. " (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15057_.gif. ")) returned 1 [0075.124] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15058_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15058_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15058_.GIF. " (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15058_.gif. ")) returned 1 [0075.126] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15059_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15059_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15059_.GIF. " (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15059_.gif. ")) returned 1 [0075.128] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15060_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15060_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15060_.GIF. " (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15060_.gif. ")) returned 1 [0075.129] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15061_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15061_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15061_.GIF. " (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15061_.gif. ")) returned 1 [0075.132] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15132_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15132_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15132_.GIF. " (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15132_.gif. ")) returned 1 [0075.133] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15133_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15133_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15133_.GIF. " (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15133_.gif. ")) returned 1 [0075.135] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15134_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15134_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15134_.GIF. " (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15134_.gif. ")) returned 1 [0075.138] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15135_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15135_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15135_.GIF. " (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15135_.gif. ")) returned 1 [0075.140] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15136_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15136_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15136_.GIF. " (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15136_.gif. ")) returned 1 [0075.142] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15168_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15168_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15168_.GIF. " (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15168_.gif. ")) returned 1 [0075.154] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15169_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15169_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15169_.GIF. " (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15169_.gif. ")) returned 1 [0075.156] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15170_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15170_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15170_.GIF. " (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15170_.gif. ")) returned 1 [0075.157] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15171_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15171_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15171_.GIF. " (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15171_.gif. ")) returned 1 [0075.159] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15172_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15172_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15172_.GIF. " (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15172_.gif. ")) returned 1 [0075.161] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15173_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15173_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15173_.GIF. " (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15173_.gif. ")) returned 1 [0075.163] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15272_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15272_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15272_.GIF. " (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15272_.gif. ")) returned 1 [0075.165] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15273_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15273_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15273_.GIF. " (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15273_.gif. ")) returned 1 [0075.166] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15274_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15274_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15274_.GIF. " (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15274_.gif. ")) returned 1 [0075.167] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15275_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15275_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15275_.GIF. " (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15275_.gif. ")) returned 1 [0075.169] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15276_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15276_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15276_.GIF. " (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15276_.gif. ")) returned 1 [0075.170] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15277_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15277_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15277_.GIF. " (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15277_.gif. ")) returned 1 [0075.172] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21294_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21294_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21294_.GIF. " (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21294_.gif. ")) returned 1 [0075.174] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21295_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21295_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21295_.GIF. " (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21295_.gif. ")) returned 1 [0075.175] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21296_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21296_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21296_.GIF. " (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21296_.gif. ")) returned 1 [0075.228] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21297_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21297_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21297_.GIF. " (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21297_.gif. ")) returned 1 [0075.230] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21298_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21298_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21298_.GIF. " (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21298_.gif. ")) returned 1 [0075.231] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21299_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21299_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21299_.GIF. " (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21299_.gif. ")) returned 1 [0075.232] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21300_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21300_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21300_.GIF. " (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21300_.gif. ")) returned 1 [0075.233] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21301_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21301_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21301_.GIF. " (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21301_.gif. ")) returned 1 [0075.235] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21302_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21302_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21302_.GIF. " (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21302_.gif. ")) returned 1 [0075.237] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21304_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21304_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21304_.GIF. " (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21304_.gif. ")) returned 1 [0075.240] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21306_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21306_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21306_.GIF. " (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21306_.gif. ")) returned 1 [0075.262] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21308_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21308_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21308_.GIF. " (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21308_.gif. ")) returned 1 [0075.340] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21310_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21310_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21310_.GIF. " (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21310_.gif. ")) returned 1 [0075.342] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21312_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21312_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21312_.GIF. " (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21312_.gif. ")) returned 1 [0075.344] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21314_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21314_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21314_.GIF. " (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21314_.gif. ")) returned 1 [0075.346] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21316_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21316_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21316_.GIF. " (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21316_.gif. ")) returned 1 [0075.348] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21327_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21327_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21327_.GIF. " (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21327_.gif. ")) returned 1 [0075.351] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21329_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21329_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21329_.GIF. " (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21329_.gif. ")) returned 1 [0075.389] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21331_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21331_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21331_.GIF. " (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21331_.gif. ")) returned 1 [0075.391] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21333_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21333_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21333_.GIF. " (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21333_.gif. ")) returned 1 [0075.528] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21335_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21335_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21335_.GIF. " (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21335_.gif. ")) returned 1 [0075.532] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21337_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21337_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21337_.GIF. " (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21337_.gif. ")) returned 1 [0075.556] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21339_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21339_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21339_.GIF. " (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21339_.gif. ")) returned 1 [0075.561] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21342_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21342_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21342_.GIF. " (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21342_.gif. ")) returned 1 [0075.564] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21343_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21343_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21343_.GIF. " (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21343_.gif. ")) returned 1 [0075.568] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21344_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21344_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21344_.GIF. " (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21344_.gif. ")) returned 1 [0075.571] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21364_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21364_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21364_.GIF. " (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21364_.gif. ")) returned 1 [0075.573] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21365_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21365_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21365_.GIF. " (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21365_.gif. ")) returned 1 [0075.576] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21366_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21366_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21366_.GIF. " (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21366_.gif. ")) returned 1 [0075.578] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21375_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21375_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21375_.GIF. " (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21375_.gif. ")) returned 1 [0075.579] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21376_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21376_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21376_.GIF. " (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21376_.gif. ")) returned 1 [0075.582] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21377_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21377_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21377_.GIF. " (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21377_.gif. ")) returned 1 [0075.583] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21398_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21398_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21398_.GIF. " (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21398_.gif. ")) returned 1 [0075.585] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21399_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21399_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21399_.GIF. " (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21399_.gif. ")) returned 1 [0075.587] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21400_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21400_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21400_.GIF. " (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21400_.gif. ")) returned 1 [0075.588] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21421_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21421_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21421_.GIF. " (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21421_.gif. ")) returned 1 [0075.589] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21422_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21422_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21422_.GIF. " (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21422_.gif. ")) returned 1 [0075.592] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21423_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21423_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21423_.GIF. " (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21423_.gif. ")) returned 1 [0075.593] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21433_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21433_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21433_.GIF. " (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21433_.gif. ")) returned 1 [0075.594] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21434_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21434_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21434_.GIF. " (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21434_.gif. ")) returned 1 [0075.596] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21435_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21435_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21435_.GIF. " (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21435_.gif. ")) returned 1 [0075.597] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21480_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21480_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21480_.GIF. " (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21480_.gif. ")) returned 1 [0075.598] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21481_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21481_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21481_.GIF. " (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21481_.gif. ")) returned 1 [0075.600] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21482_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21482_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21482_.GIF. " (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21482_.gif. ")) returned 1 [0075.601] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21503_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21503_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21503_.GIF. " (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21503_.gif. ")) returned 1 [0075.602] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21504_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21504_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21504_.GIF. " (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21504_.gif. ")) returned 1 [0075.604] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21505_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21505_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21505_.GIF. " (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21505_.gif. ")) returned 1 [0075.605] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21518_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21518_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21518_.GIF. " (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21518_.gif. ")) returned 1 [0075.607] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21519_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21519_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21519_.GIF. " (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21519_.gif. ")) returned 1 [0075.608] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21520_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21520_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21520_.GIF. " (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21520_.gif. ")) returned 1 [0075.611] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21533_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21533_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21533_.GIF. " (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21533_.gif. ")) returned 1 [0075.612] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21534_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21534_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21534_.GIF. " (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21534_.gif. ")) returned 1 [0075.614] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21535_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21535_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21535_.GIF. " (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21535_.gif. ")) returned 1 [0075.616] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115834.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\j0115834.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115834.GIF. " (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\j0115834.gif. ")) returned 1 [0075.618] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115835.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\j0115835.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115835.GIF. " (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\j0115835.gif. ")) returned 1 [0075.619] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115836.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\j0115836.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115836.GIF. " (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\j0115836.gif. ")) returned 1 [0075.620] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115839.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\j0115839.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115839.GIF. " (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\j0115839.gif. ")) returned 1 [0075.827] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115840.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\j0115840.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115840.GIF. " (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\j0115840.gif. ")) returned 1 [0075.829] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115841.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\j0115841.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115841.GIF. " (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\j0115841.gif. ")) returned 1 [0075.831] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115842.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\j0115842.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115842.GIF. " (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\j0115842.gif. ")) returned 1 [0075.833] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115843.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\j0115843.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115843.GIF. " (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\j0115843.gif. ")) returned 1 [0075.834] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115844.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\j0115844.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115844.GIF. " (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\j0115844.gif. ")) returned 1 [0075.870] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115863.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\j0115863.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115863.GIF. " (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\j0115863.gif. ")) returned 1 [0075.871] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115864.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\j0115864.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115864.GIF. " (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\j0115864.gif. ")) returned 1 [0075.873] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115865.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\j0115865.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115865.GIF. " (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\j0115865.gif. ")) returned 1 [0075.875] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115866.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\j0115866.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115866.GIF. " (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\j0115866.gif. ")) returned 1 [0075.876] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115867.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\j0115867.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115867.GIF. " (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\j0115867.gif. ")) returned 1 [0075.877] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115868.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\j0115868.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115868.GIF. " (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\j0115868.gif. ")) returned 1 [0075.878] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5b7c78 [0075.980] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10219_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd10219_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10219_.GIF. " (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd10219_.gif. ")) returned 1 [0075.993] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10256_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd10256_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10256_.GIF. " (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd10256_.gif. ")) returned 1 [0075.995] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10289_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd10289_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10289_.GIF. " (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd10289_.gif. ")) returned 1 [0075.996] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10290_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd10290_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10290_.GIF. " (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd10290_.gif. ")) returned 1 [0076.009] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10307_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd10307_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10307_.GIF. " (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd10307_.gif. ")) returned 1 [0076.010] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10308_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd10308_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10308_.GIF. " (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd10308_.gif. ")) returned 1 [0076.040] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10358_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd10358_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10358_.GIF. " (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd10358_.gif. ")) returned 1 [0076.045] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14516_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14516_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14516_.GIF. " (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14516_.gif. ")) returned 1 [0076.097] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14538_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14538_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14538_.GIF. " (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14538_.gif. ")) returned 1 [0076.127] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14539_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14539_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14539_.GIF. " (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14539_.gif. ")) returned 1 [0076.134] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14594_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14594_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14594_.GIF. " (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14594_.gif. ")) returned 1 [0076.135] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14595_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14595_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14595_.GIF. " (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14595_.gif. ")) returned 1 [0076.136] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14677_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14677_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14677_.GIF. " (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14677_.gif. ")) returned 1 [0076.150] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14710_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14710_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14710_.GIF. " (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14710_.gif. ")) returned 1 [0076.173] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14711_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14711_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14711_.GIF. " (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14711_.gif. ")) returned 1 [0076.174] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14768_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14768_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14768_.GIF. " (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14768_.gif. ")) returned 1 [0076.175] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14769_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14769_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14769_.GIF. " (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14769_.gif. ")) returned 1 [0076.177] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14800_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14800_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14800_.GIF. " (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14800_.gif. ")) returned 1 [0076.182] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14801_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14801_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14801_.GIF. " (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14801_.gif. ")) returned 1 [0076.183] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14844_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14844_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14844_.GIF. " (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14844_.gif. ")) returned 1 [0076.185] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14845_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14845_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14845_.GIF. " (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14845_.gif. ")) returned 1 [0076.187] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14882_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14882_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14882_.GIF. " (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14882_.gif. ")) returned 1 [0076.190] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14883_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14883_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14883_.GIF. " (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14883_.gif. ")) returned 1 [0076.199] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14996_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14996_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14996_.GIF. " (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14996_.gif. ")) returned 1 [0076.200] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14997_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14997_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14997_.GIF. " (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14997_.gif. ")) returned 1 [0076.230] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15034_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd15034_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15034_.GIF. " (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd15034_.gif. ")) returned 1 [0076.232] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15035_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd15035_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15035_.GIF. " (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd15035_.gif. ")) returned 1 [0076.234] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15072_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd15072_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15072_.GIF. " (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd15072_.gif. ")) returned 1 [0076.235] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15073_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd15073_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15073_.GIF. " (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd15073_.gif. ")) returned 1 [0076.237] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15155_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd15155_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15155_.GIF. " (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd15155_.gif. ")) returned 1 [0076.238] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15156_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd15156_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15156_.GIF. " (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd15156_.gif. ")) returned 1 [0076.243] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15184_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd15184_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15184_.GIF. " (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd15184_.gif. ")) returned 1 [0076.251] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15185_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd15185_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15185_.GIF. " (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd15185_.gif. ")) returned 1 [0076.270] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15301_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd15301_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15301_.GIF. " (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd15301_.gif. ")) returned 1 [0076.273] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15302_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd15302_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15302_.GIF. " (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd15302_.gif. ")) returned 1 [0076.337] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21303_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21303_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21303_.GIF. " (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21303_.gif. ")) returned 1 [0076.339] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21305_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21305_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21305_.GIF. " (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21305_.gif. ")) returned 1 [0076.341] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21307_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21307_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21307_.GIF. " (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21307_.gif. ")) returned 1 [0076.372] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21309_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21309_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21309_.GIF. " (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21309_.gif. ")) returned 1 [0076.375] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21311_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21311_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21311_.GIF. " (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21311_.gif. ")) returned 1 [0076.382] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21313_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21313_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21313_.GIF. " (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21313_.gif. ")) returned 1 [0076.383] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21315_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21315_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21315_.GIF. " (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21315_.gif. ")) returned 1 [0076.384] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21318_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21318_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21318_.GIF. " (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21318_.gif. ")) returned 1 [0076.386] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21319_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21319_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21319_.GIF. " (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21319_.gif. ")) returned 1 [0076.388] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21320_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21320_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21320_.GIF. " (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21320_.gif. ")) returned 1 [0076.390] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21321_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21321_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21321_.GIF. " (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21321_.gif. ")) returned 1 [0076.392] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21322_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21322_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21322_.GIF. " (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21322_.gif. ")) returned 1 [0076.403] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21323_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21323_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21323_.GIF. " (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21323_.gif. ")) returned 1 [0076.428] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21324_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21324_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21324_.GIF. " (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21324_.gif. ")) returned 1 [0076.431] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21325_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21325_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21325_.GIF. " (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21325_.gif. ")) returned 1 [0076.433] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21326_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21326_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21326_.GIF. " (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21326_.gif. ")) returned 1 [0076.434] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21328_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21328_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21328_.GIF. " (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21328_.gif. ")) returned 1 [0076.436] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21330_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21330_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21330_.GIF. " (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21330_.gif. ")) returned 1 [0076.457] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21332_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21332_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21332_.GIF. " (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21332_.gif. ")) returned 1 [0076.459] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21334_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21334_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21334_.GIF. " (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21334_.gif. ")) returned 1 [0076.494] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21336_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21336_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21336_.GIF. " (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21336_.gif. ")) returned 1 [0076.500] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21338_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21338_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21338_.GIF. " (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21338_.gif. ")) returned 1 [0076.502] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21340_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21340_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21340_.GIF. " (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21340_.gif. ")) returned 1 [0076.504] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21348_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21348_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21348_.GIF. " (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21348_.gif. ")) returned 1 [0076.506] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21370_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21370_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21370_.GIF. " (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21370_.gif. ")) returned 1 [0076.508] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21390_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21390_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21390_.GIF. " (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21390_.gif. ")) returned 1 [0076.514] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21413_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21413_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21413_.GIF. " (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21413_.gif. ")) returned 1 [0076.527] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21427_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21427_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21427_.GIF. " (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21427_.gif. ")) returned 1 [0076.529] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21448_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21448_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21448_.GIF. " (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21448_.gif. ")) returned 1 [0076.530] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21495_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21495_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21495_.GIF. " (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21495_.gif. ")) returned 1 [0076.542] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21512_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21512_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21512_.GIF. " (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21512_.gif. ")) returned 1 [0076.544] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21527_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21527_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21527_.GIF. " (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21527_.gif. ")) returned 1 [0076.554] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21548_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21548_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21548_.GIF. " (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21548_.gif. ")) returned 1 [0076.555] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\J0115855.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\j0115855.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\J0115855.GIF. " (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\j0115855.gif. ")) returned 1 [0076.557] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\J0115856.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\j0115856.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\J0115856.GIF. " (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\j0115856.gif. ")) returned 1 [0076.558] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\J0115875.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\j0115875.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\J0115875.GIF. " (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\j0115875.gif. ")) returned 1 [0076.560] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\J0115876.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\j0115876.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\J0115876.GIF. " (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\j0115876.gif. ")) returned 1 [0076.561] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\*.*", lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 0x5b5bd0 [0076.596] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5b7ce8 [0076.604] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BASIC.HTM" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\basic.htm"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BASIC.HTM. " (normalized: "c:\\program files\\microsoft office\\office14\\1033\\basic.htm. ")) returned 1 [0076.605] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Bibliography\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5b7c78 [0076.606] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5b7c78 [0076.645] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBSAMPLE.MDB" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dbsample.mdb"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBSAMPLE.MDB. " (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dbsample.mdb. ")) returned 1 [0076.649] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5b7c78 [0076.689] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\BG_ADOBE.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_adobe.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\BG_ADOBE.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_adobe.gif. ")) returned 1 [0076.700] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Casual.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_casual.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Casual.gif. " (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_casual.gif. ")) returned 1 [0076.707] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Country.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_country.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Country.gif. " (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_country.gif. ")) returned 1 [0076.709] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Earthy.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_earthy.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Earthy.gif. " (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_earthy.gif. ")) returned 1 [0076.719] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_GreenTea.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_greentea.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_GreenTea.gif. " (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_greentea.gif. ")) returned 1 [0076.721] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Groove.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_groove.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Groove.gif. " (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_groove.gif. ")) returned 1 [0076.756] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_LightSpirit.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_lightspirit.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_LightSpirit.gif. " (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_lightspirit.gif. ")) returned 1 [0076.769] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_OliveGreen.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_olivegreen.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_OliveGreen.gif. " (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_olivegreen.gif. ")) returned 1 [0076.772] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Premium.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_premium.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Premium.gif. " (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_premium.gif. ")) returned 1 [0076.812] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_SlateBlue.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_slateblue.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_SlateBlue.gif. " (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_slateblue.gif. ")) returned 1 [0076.814] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_TexturedBlue.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_texturedblue.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_TexturedBlue.gif. " (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_texturedblue.gif. ")) returned 1 [0076.820] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_VelvetRose.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_velvetrose.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_VelvetRose.gif. " (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_velvetrose.gif. ")) returned 1 [0076.821] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5b7dd0 [0076.833] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Americana\\*.*", lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 0x5b7d28 [0076.835] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Americana\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\americana\\tab_off.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Americana\\TAB_OFF.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\americana\\tab_off.gif. ")) returned 1 [0076.838] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Americana\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\americana\\tab_on.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Americana\\TAB_ON.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\americana\\tab_on.gif. ")) returned 1 [0076.839] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\*.*", lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 0x5b7d28 [0076.840] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\BUTTON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\babyblue\\button.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\BUTTON.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\babyblue\\button.gif. ")) returned 1 [0076.841] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\HEADER.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\babyblue\\header.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\HEADER.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\babyblue\\header.gif. ")) returned 1 [0076.843] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\babyblue\\tab_off.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\TAB_OFF.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\babyblue\\tab_off.gif. ")) returned 1 [0076.846] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\babyblue\\tab_on.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\TAB_ON.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\babyblue\\tab_on.gif. ")) returned 1 [0076.846] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Biscay\\*.*", lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 0x5b7d28 [0076.847] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Biscay\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\biscay\\tab_off.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Biscay\\TAB_OFF.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\biscay\\tab_off.gif. ")) returned 1 [0076.848] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Biscay\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\biscay\\tab_on.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Biscay\\TAB_ON.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\biscay\\tab_on.gif. ")) returned 1 [0076.849] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\*.*", lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 0x5b7d28 [0076.850] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\background.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\brightorange\\background.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\background.gif. " (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\brightorange\\background.gif. ")) returned 1 [0076.852] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\BUTTON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\brightorange\\button.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\BUTTON.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\brightorange\\button.gif. ")) returned 1 [0076.940] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\brightorange\\tab_off.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\TAB_OFF.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\brightorange\\tab_off.gif. ")) returned 1 [0076.944] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\brightorange\\tab_on.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\TAB_ON.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\brightorange\\tab_on.gif. ")) returned 1 [0076.945] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightYellow\\*.*", lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 0x5b7d28 [0076.947] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightYellow\\HEADER.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\brightyellow\\header.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightYellow\\HEADER.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\brightyellow\\header.gif. ")) returned 1 [0076.951] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightYellow\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\brightyellow\\tab_off.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightYellow\\TAB_OFF.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\brightyellow\\tab_off.gif. ")) returned 1 [0076.955] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightYellow\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\brightyellow\\tab_on.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightYellow\\TAB_ON.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\brightyellow\\tab_on.gif. ")) returned 1 [0076.958] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert\\*.*", lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 0x5b7d28 [0076.960] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert\\HEADER.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\desert\\header.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert\\HEADER.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\desert\\header.gif. ")) returned 1 [0076.963] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\desert\\tab_off.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert\\TAB_OFF.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\desert\\tab_off.gif. ")) returned 1 [0076.984] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\desert\\tab_on.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert\\TAB_ON.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\desert\\tab_on.gif. ")) returned 1 [0076.985] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck\\*.*", lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 0x5b7d28 [0076.986] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck\\HEADER.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\graycheck\\header.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck\\HEADER.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\graycheck\\header.gif. ")) returned 1 [0076.988] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\graycheck\\tab_off.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck\\TAB_OFF.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\graycheck\\tab_off.gif. ")) returned 1 [0076.990] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\graycheck\\tab_on.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck\\TAB_ON.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\graycheck\\tab_on.gif. ")) returned 1 [0077.023] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Lime\\*.*", lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 0x5b7d28 [0077.024] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Lime\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\lime\\tab_off.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Lime\\TAB_OFF.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\lime\\tab_off.gif. ")) returned 1 [0077.026] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Lime\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\lime\\tab_on.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Lime\\TAB_ON.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\lime\\tab_on.gif. ")) returned 1 [0077.026] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis\\*.*", lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 0x5b7d28 [0077.035] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis\\HEADER.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\oasis\\header.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis\\HEADER.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\oasis\\header.gif. ")) returned 1 [0077.037] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\oasis\\tab_off.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis\\TAB_OFF.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\oasis\\tab_off.gif. ")) returned 1 [0077.044] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\oasis\\tab_on.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis\\TAB_ON.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\oasis\\tab_on.gif. ")) returned 1 [0077.068] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\RTF_BOLD.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\rtf_bold.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\RTF_BOLD.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\rtf_bold.gif. ")) returned 1 [0077.071] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\rtf_choosefont.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\rtf_choosefont.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\rtf_choosefont.gif. " (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\rtf_choosefont.gif. ")) returned 1 [0077.094] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\rtf_italic.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\rtf_italic.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\rtf_italic.gif. " (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\rtf_italic.gif. ")) returned 1 [0077.096] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\rtf_spellcheck.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\rtf_spellcheck.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\rtf_spellcheck.gif. " (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\rtf_spellcheck.gif. ")) returned 1 [0077.100] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\rtf_underline.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\rtf_underline.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\rtf_underline.gif. " (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\rtf_underline.gif. ")) returned 1 [0077.101] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Slate\\*.*", lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 0x5b7d28 [0077.104] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Slate\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\slate\\tab_off.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Slate\\TAB_OFF.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\slate\\tab_off.gif. ")) returned 1 [0077.106] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Slate\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\slate\\tab_on.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Slate\\TAB_ON.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\slate\\tab_on.gif. ")) returned 1 [0077.107] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue\\*.*", lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 0x5b7d28 [0077.131] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue\\background.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\softblue\\background.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue\\background.gif. " (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\softblue\\background.gif. ")) returned 1 [0077.132] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\softblue\\tab_off.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue\\TAB_OFF.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\softblue\\tab_off.gif. ")) returned 1 [0077.134] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\softblue\\tab_on.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue\\TAB_ON.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\softblue\\tab_on.gif. ")) returned 1 [0077.134] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\*.*", lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 0x5b7d28 [0077.138] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\arrow.png" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\solutions\\arrow.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\arrow.png. " (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\solutions\\arrow.png. ")) returned 1 [0077.157] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Document.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\solutions\\document.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Document.gif. " (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\solutions\\document.gif. ")) returned 1 [0077.159] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Generic.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\solutions\\generic.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Generic.gif. " (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\solutions\\generic.gif. ")) returned 1 [0077.163] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\gradient.png" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\solutions\\gradient.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\gradient.png. " (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\solutions\\gradient.png. ")) returned 1 [0077.164] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Main.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\solutions\\main.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Main.gif. " (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\solutions\\main.gif. ")) returned 1 [0077.166] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Person.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\solutions\\person.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Person.gif. " (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\solutions\\person.gif. ")) returned 1 [0077.182] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Response.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\solutions\\response.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Response.gif. " (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\solutions\\response.gif. ")) returned 1 [0077.183] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SpringGreen\\*.*", lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 0x5b7d28 [0077.185] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SpringGreen\\BUTTON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\springgreen\\button.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SpringGreen\\BUTTON.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\springgreen\\button.gif. ")) returned 1 [0077.187] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SpringGreen\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\springgreen\\tab_off.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SpringGreen\\TAB_OFF.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\springgreen\\tab_off.gif. ")) returned 1 [0077.188] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SpringGreen\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\springgreen\\tab_on.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SpringGreen\\TAB_ON.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\springgreen\\tab_on.gif. ")) returned 1 [0077.195] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\*.*", lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 0x5b7d28 [0077.197] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\background.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\sts2\\background.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\background.gif. " (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\sts2\\background.gif. ")) returned 1 [0077.214] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\HEADER.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\sts2\\header.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\HEADER.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\sts2\\header.gif. ")) returned 1 [0077.216] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\sts2\\tab_off.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\TAB_OFF.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\sts2\\tab_off.gif. ")) returned 1 [0077.219] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\sts2\\tab_on.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\TAB_ON.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\sts2\\tab_on.gif. ")) returned 1 [0077.220] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl\\*.*", lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 0x5b7d28 [0077.224] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl\\background.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\swirl\\background.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl\\background.gif. " (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\swirl\\background.gif. ")) returned 1 [0077.248] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl\\HEADER.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\swirl\\header.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl\\HEADER.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\swirl\\header.gif. ")) returned 1 [0077.250] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\swirl\\tab_off.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl\\TAB_OFF.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\swirl\\tab_off.gif. ")) returned 1 [0077.254] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\swirl\\tab_on.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl\\TAB_ON.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\swirl\\tab_on.gif. ")) returned 1 [0077.387] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLN.DOC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\prottpln.doc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLN.DOC. " (normalized: "c:\\program files\\microsoft office\\office14\\1033\\prottpln.doc. ")) returned 1 [0077.405] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLN.PPT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\prottpln.ppt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLN.PPT. " (normalized: "c:\\program files\\microsoft office\\office14\\1033\\prottpln.ppt. ")) returned 1 [0077.410] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLN.XLS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\prottpln.xls"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLN.XLS. " (normalized: "c:\\program files\\microsoft office\\office14\\1033\\prottpln.xls. ")) returned 1 [0077.415] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLV.DOC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\prottplv.doc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLV.DOC. " (normalized: "c:\\program files\\microsoft office\\office14\\1033\\prottplv.doc. ")) returned 1 [0077.458] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLV.PPT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\prottplv.ppt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLV.PPT. " (normalized: "c:\\program files\\microsoft office\\office14\\1033\\prottplv.ppt. ")) returned 1 [0077.462] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLV.XLS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\prottplv.xls"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLV.XLS. " (normalized: "c:\\program files\\microsoft office\\office14\\1033\\prottplv.xls. ")) returned 1 [0077.464] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5b7c78 [0077.698] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5b7c78 [0077.791] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR10F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir10f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR10F.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir10f.gif. ")) returned 1 [0077.807] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR11F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir11f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR11F.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir11f.gif. ")) returned 1 [0077.853] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR12F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir12f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR12F.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir12f.gif. ")) returned 1 [0077.892] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR13F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir13f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR13F.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir13f.gif. ")) returned 1 [0077.954] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR14F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir14f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR14F.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir14f.gif. ")) returned 1 [0078.082] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR15F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir15f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR15F.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir15f.gif. ")) returned 1 [0078.093] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR16F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir16f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR16F.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir16f.gif. ")) returned 1 [0078.116] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR17F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir17f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR17F.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir17f.gif. ")) returned 1 [0078.172] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR18F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir18f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR18F.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir18f.gif. ")) returned 1 [0078.185] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR19F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir19f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR19F.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir19f.gif. ")) returned 1 [0078.236] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR1B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir1b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR1B.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir1b.gif. ")) returned 1 [0078.317] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR1F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir1f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR1F.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir1f.gif. ")) returned 1 [0078.397] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR20F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir20f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR20F.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir20f.gif. ")) returned 1 [0078.442] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR21F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir21f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR21F.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir21f.gif. ")) returned 1 [0078.563] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR22F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir22f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR22F.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir22f.gif. ")) returned 1 [0078.652] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR23F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir23f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR23F.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir23f.gif. ")) returned 1 [0078.750] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR24F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir24f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR24F.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir24f.gif. ")) returned 1 [0078.805] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR25F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir25f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR25F.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir25f.gif. ")) returned 1 [0078.825] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR26F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir26f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR26F.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir26f.gif. ")) returned 1 [0078.975] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR27F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir27f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR27F.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir27f.gif. ")) returned 1 [0079.089] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR28B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir28b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR28B.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir28b.gif. ")) returned 1 [0079.141] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR28F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir28f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR28F.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir28f.gif. ")) returned 1 [0079.241] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR29B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir29b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR29B.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir29b.gif. ")) returned 1 [0079.245] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR29F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir29f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR29F.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir29f.gif. ")) returned 1 [0079.352] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR2B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir2b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR2B.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir2b.gif. ")) returned 1 [0079.365] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR2F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir2f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR2F.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir2f.gif. ")) returned 1 [0079.430] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR30B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir30b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR30B.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir30b.gif. ")) returned 1 [0079.657] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR30F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir30f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR30F.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir30f.gif. ")) returned 1 [0079.670] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR31B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir31b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR31B.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir31b.gif. ")) returned 1 [0079.705] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR31F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir31f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR31F.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir31f.gif. ")) returned 1 [0079.712] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR32B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir32b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR32B.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir32b.gif. ")) returned 1 [0079.727] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR32F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir32f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR32F.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir32f.gif. ")) returned 1 [0079.771] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR33B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir33b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR33B.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir33b.gif. ")) returned 1 [0079.858] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR33F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir33f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR33F.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir33f.gif. ")) returned 1 [0079.878] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR34B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir34b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR34B.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir34b.gif. ")) returned 1 [0079.888] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR34F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir34f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR34F.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir34f.gif. ")) returned 1 [0079.921] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR35B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir35b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR35B.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir35b.gif. ")) returned 1 [0079.977] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR35F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir35f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR35F.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir35f.gif. ")) returned 1 [0079.989] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR36B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir36b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR36B.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir36b.gif. ")) returned 1 [0079.996] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR36F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir36f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR36F.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir36f.gif. ")) returned 1 [0080.084] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR37F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir37f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR37F.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir37f.gif. ")) returned 1 [0080.092] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR38F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir38f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR38F.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir38f.gif. ")) returned 1 [0080.136] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR39F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir39f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR39F.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir39f.gif. ")) returned 1 [0080.160] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR3B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir3b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR3B.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir3b.gif. ")) returned 1 [0080.189] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR3F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir3f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR3F.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir3f.gif. ")) returned 1 [0080.208] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR40F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir40f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR40F.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir40f.gif. ")) returned 1 [0080.218] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR41F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir41f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR41F.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir41f.gif. ")) returned 1 [0080.228] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR42F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir42f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR42F.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir42f.gif. ")) returned 1 [0080.235] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR43B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir43b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR43B.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir43b.gif. ")) returned 1 [0080.239] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR43F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir43f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR43F.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir43f.gif. ")) returned 1 [0080.248] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR44B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir44b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR44B.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir44b.gif. ")) returned 1 [0080.251] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR44F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir44f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR44F.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir44f.gif. ")) returned 1 [0080.255] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR45B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir45b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR45B.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir45b.gif. ")) returned 1 [0080.260] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR45F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir45f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR45F.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir45f.gif. ")) returned 1 [0080.265] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR46B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir46b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR46B.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir46b.gif. ")) returned 1 [0080.270] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR46F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir46f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR46F.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir46f.gif. ")) returned 1 [0080.282] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR47B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir47b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR47B.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir47b.gif. ")) returned 1 [0080.287] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR47F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir47f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR47F.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir47f.gif. ")) returned 1 [0080.294] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR48B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir48b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR48B.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir48b.gif. ")) returned 1 [0080.334] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR48F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir48f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR48F.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir48f.gif. ")) returned 1 [0080.347] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR49B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir49b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR49B.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir49b.gif. ")) returned 1 [0080.351] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR49F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir49f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR49F.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir49f.gif. ")) returned 1 [0080.394] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR4B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir4b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR4B.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir4b.gif. ")) returned 1 [0080.427] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR4F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir4f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR4F.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir4f.gif. ")) returned 1 [0080.429] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR50B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir50b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR50B.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir50b.gif. ")) returned 1 [0080.439] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR50F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir50f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR50F.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir50f.gif. ")) returned 1 [0080.452] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR51B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir51b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR51B.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir51b.gif. ")) returned 1 [0080.469] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR51F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir51f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR51F.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir51f.gif. ")) returned 1 [0080.506] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR5B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir5b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR5B.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir5b.gif. ")) returned 1 [0080.549] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR5F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir5f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR5F.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir5f.gif. ")) returned 1 [0080.565] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR6B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir6b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR6B.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir6b.gif. ")) returned 1 [0080.573] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR6F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir6f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR6F.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir6f.gif. ")) returned 1 [0080.606] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR7B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir7b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR7B.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir7b.gif. ")) returned 1 [0080.675] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR7F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir7f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR7F.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir7f.gif. ")) returned 1 [0080.752] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR8B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir8b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR8B.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir8b.gif. ")) returned 1 [0080.762] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR8F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir8f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR8F.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir8f.gif. ")) returned 1 [0080.772] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR9B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir9b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR9B.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir9b.gif. ")) returned 1 [0080.867] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR9F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir9f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR9F.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir9f.gif. ")) returned 1 [0080.869] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR00.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir00.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR00.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir00.gif. ")) returned 1 [0080.872] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR10F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir10f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR10F.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir10f.gif. ")) returned 1 [0080.931] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR11F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir11f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR11F.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir11f.gif. ")) returned 1 [0080.974] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR12F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir12f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR12F.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir12f.gif. ")) returned 1 [0081.083] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR13F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir13f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR13F.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir13f.gif. ")) returned 1 [0081.187] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR14F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir14f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR14F.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir14f.gif. ")) returned 1 [0081.190] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR15F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir15f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR15F.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir15f.gif. ")) returned 1 [0081.262] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR16F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir16f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR16F.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir16f.gif. ")) returned 1 [0081.264] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR17F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir17f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR17F.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir17f.gif. ")) returned 1 [0081.299] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR18F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir18f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR18F.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir18f.gif. ")) returned 1 [0081.370] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR19F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir19f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR19F.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir19f.gif. ")) returned 1 [0081.377] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR1B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir1b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR1B.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir1b.gif. ")) returned 1 [0081.402] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR1F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir1f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR1F.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir1f.gif. ")) returned 1 [0081.413] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR20F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir20f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR20F.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir20f.gif. ")) returned 1 [0081.416] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR21F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir21f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR21F.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir21f.gif. ")) returned 1 [0081.502] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR22F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir22f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR22F.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir22f.gif. ")) returned 1 [0081.595] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR23F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir23f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR23F.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir23f.gif. ")) returned 1 [0081.598] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR24F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir24f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR24F.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir24f.gif. ")) returned 1 [0081.610] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR25F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir25f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR25F.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir25f.gif. ")) returned 1 [0081.620] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR26F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir26f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR26F.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir26f.gif. ")) returned 1 [0081.627] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR27F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir27f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR27F.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir27f.gif. ")) returned 1 [0081.630] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR28F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir28f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR28F.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir28f.gif. ")) returned 1 [0081.634] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR29F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir29f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR29F.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir29f.gif. ")) returned 1 [0081.638] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR2B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir2b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR2B.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir2b.gif. ")) returned 1 [0081.676] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR2F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir2f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR2F.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir2f.gif. ")) returned 1 [0081.679] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR30F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir30f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR30F.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir30f.gif. ")) returned 1 [0081.775] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR31F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir31f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR31F.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir31f.gif. ")) returned 1 [0081.789] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR32F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir32f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR32F.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir32f.gif. ")) returned 1 [0081.803] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR33F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir33f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR33F.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir33f.gif. ")) returned 1 [0081.858] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR34F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir34f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR34F.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir34f.gif. ")) returned 1 [0081.874] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR35F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir35f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR35F.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir35f.gif. ")) returned 1 [0081.927] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR36F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir36f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR36F.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir36f.gif. ")) returned 1 [0081.942] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR37F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir37f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR37F.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir37f.gif. ")) returned 1 [0081.945] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR38F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir38f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR38F.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir38f.gif. ")) returned 1 [0081.980] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR39F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir39f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR39F.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir39f.gif. ")) returned 1 [0081.984] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR3B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir3b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR3B.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir3b.gif. ")) returned 1 [0081.996] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR3F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir3f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR3F.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir3f.gif. ")) returned 1 [0082.140] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR40F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir40f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR40F.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir40f.gif. ")) returned 1 [0082.169] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR41F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir41f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR41F.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir41f.gif. ")) returned 1 [0082.250] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR42F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir42f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR42F.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir42f.gif. ")) returned 1 [0082.253] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR43B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir43b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR43B.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir43b.gif. ")) returned 1 [0082.255] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR43F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir43f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR43F.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir43f.gif. ")) returned 1 [0082.292] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR44B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir44b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR44B.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir44b.gif. ")) returned 1 [0082.297] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR44F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir44f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR44F.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir44f.gif. ")) returned 1 [0082.344] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR45B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir45b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR45B.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir45b.gif. ")) returned 1 [0082.494] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR45F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir45f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR45F.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir45f.gif. ")) returned 1 [0082.504] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR46B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir46b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR46B.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir46b.gif. ")) returned 1 [0082.508] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR46F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir46f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR46F.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir46f.gif. ")) returned 1 [0082.537] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR47B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir47b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR47B.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir47b.gif. ")) returned 1 [0082.557] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR47F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir47f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR47F.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir47f.gif. ")) returned 1 [0082.574] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR48B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir48b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR48B.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir48b.gif. ")) returned 1 [0082.578] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR48F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir48f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR48F.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir48f.gif. ")) returned 1 [0082.625] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR49B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir49b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR49B.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir49b.gif. ")) returned 1 [0082.628] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR49F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir49f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR49F.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir49f.gif. ")) returned 1 [0082.635] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR4B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir4b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR4B.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir4b.gif. ")) returned 1 [0082.674] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR4F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir4f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR4F.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir4f.gif. ")) returned 1 [0082.681] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR50B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir50b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR50B.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir50b.gif. ")) returned 1 [0082.686] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR50F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir50f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR50F.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir50f.gif. ")) returned 1 [0082.691] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR51B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir51b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR51B.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir51b.gif. ")) returned 1 [0082.694] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR51F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir51f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR51F.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir51f.gif. ")) returned 1 [0082.706] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR5B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir5b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR5B.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir5b.gif. ")) returned 1 [0082.709] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR5F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir5f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR5F.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir5f.gif. ")) returned 1 [0082.732] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR6B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir6b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR6B.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir6b.gif. ")) returned 1 [0082.737] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR6F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir6f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR6F.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir6f.gif. ")) returned 1 [0082.740] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR7B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir7b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR7B.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir7b.gif. ")) returned 1 [0082.743] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR7F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir7f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR7F.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir7f.gif. ")) returned 1 [0082.746] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR8B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir8b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR8B.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir8b.gif. ")) returned 1 [0082.752] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR8F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir8f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR8F.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir8f.gif. ")) returned 1 [0082.755] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR9B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir9b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR9B.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir9b.gif. ")) returned 1 [0082.766] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR9F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir9f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR9F.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir9f.gif. ")) returned 1 [0082.768] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5b7c78 [0082.791] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Vsdir\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5b7c78 [0082.796] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1036\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5b7ce8 [0082.797] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\3082\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5b7ce8 [0082.799] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5b7c78 [0082.851] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\CLNTWRAP.HTM" (normalized: "c:\\program files\\microsoft office\\office14\\accessweb\\clntwrap.htm"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\CLNTWRAP.HTM. " (normalized: "c:\\program files\\microsoft office\\office14\\accessweb\\clntwrap.htm. ")) returned 1 [0082.855] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5b7cf0 [0082.871] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5b7cf0 [0082.882] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5b7c78 [0082.954] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5b7d48 [0082.954] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5b7d48 [0082.959] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5b7cf0 [0083.006] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5b7cf0 [0083.051] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5b7c78 [0083.088] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Document Parts\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5b7d00 [0083.089] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Document Parts\\1033\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5b7c78 [0083.090] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Document Parts\\1033\\14\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5b7cb8 [0083.090] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5b7cf0 [0083.091] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5b7c78 [0083.192] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5b7cf0 [0083.210] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5b7c78 [0083.211] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5b7dd8 [0083.212] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Components\\*.*", lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 0x5b7d30 [0083.229] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Components\\SignedComponents.cer" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\certificates\\groove.net\\components\\signedcomponents.cer"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Components\\SignedComponents.cer. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\certificates\\groove.net\\components\\signedcomponents.cer. ")) returned 1 [0083.230] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\ManagedObjects\\*.*", lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 0x5b7d30 [0083.260] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\ManagedObjects\\SignedManagedObjects.cer" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\certificates\\groove.net\\managedobjects\\signedmanagedobjects.cer"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\ManagedObjects\\SignedManagedObjects.cer. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\certificates\\groove.net\\managedobjects\\signedmanagedobjects.cer. ")) returned 1 [0083.261] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers\\*.*", lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 0x5b7d30 [0083.263] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers\\Management.cer" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\certificates\\groove.net\\servers\\management.cer"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers\\Management.cer. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\certificates\\groove.net\\servers\\management.cer. ")) returned 1 [0083.277] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers\\RELAY.CER" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\certificates\\groove.net\\servers\\relay.cer"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers\\RELAY.CER. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\certificates\\groove.net\\servers\\relay.cer. ")) returned 1 [0083.278] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5b7dd0 [0083.286] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\*.*", lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 0x5b7d30 [0083.468] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VeriSign_Class_3_Code_Signing_2001-4_CA.cer" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\certificates\\verisign\\components\\verisign_class_3_code_signing_2001-4_ca.cer"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VeriSign_Class_3_Code_Signing_2001-4_CA.cer. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\certificates\\verisign\\components\\verisign_class_3_code_signing_2001-4_ca.cer. ")) returned 1 [0083.571] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VeriSign_Class_3_Public_Primary_CA.cer" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\certificates\\verisign\\components\\verisign_class_3_public_primary_ca.cer"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VeriSign_Class_3_Public_Primary_CA.cer. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\certificates\\verisign\\components\\verisign_class_3_public_primary_ca.cer. ")) returned 1 [0083.600] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VS_ComponentSigningIntermediate.cer" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\certificates\\verisign\\components\\vs_componentsigningintermediate.cer"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VS_ComponentSigningIntermediate.cer. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\certificates\\verisign\\components\\vs_componentsigningintermediate.cer. ")) returned 1 [0083.601] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5b7c78 [0083.732] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5b7dc0 [0083.774] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\COUGH.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\people\\cough.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\COUGH.WAV. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\people\\cough.wav. ")) returned 1 [0083.800] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\GIGGLE.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\people\\giggle.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\GIGGLE.WAV. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\people\\giggle.wav. ")) returned 1 [0083.954] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\HICCUP.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\people\\hiccup.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\HICCUP.WAV. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\people\\hiccup.wav. ")) returned 1 [0084.222] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\MMHMM.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\people\\mmhmm.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\MMHMM.WAV. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\people\\mmhmm.wav. ")) returned 1 [0084.247] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\SNEEZE.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\people\\sneeze.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\SNEEZE.WAV. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\people\\sneeze.wav. ")) returned 1 [0084.286] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\THROAT.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\people\\throat.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\THROAT.WAV. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\people\\throat.wav. ")) returned 1 [0084.408] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\Whistling.wav" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\people\\whistling.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\Whistling.wav. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\people\\whistling.wav. ")) returned 1 [0084.409] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5b7dc0 [0084.472] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\ALARM.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\places\\alarm.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\ALARM.WAV. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\places\\alarm.wav. ")) returned 1 [0084.512] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\BUZZ.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\places\\buzz.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\BUZZ.WAV. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\places\\buzz.wav. ")) returned 1 [0084.526] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\LASER.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\places\\laser.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\LASER.WAV. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\places\\laser.wav. ")) returned 1 [0084.559] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\RADAR.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\places\\radar.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\RADAR.WAV. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\places\\radar.wav. ")) returned 1 [0084.567] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\TOOT.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\places\\toot.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\TOOT.WAV. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\places\\toot.wav. ")) returned 1 [0084.602] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\VIBE.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\places\\vibe.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\VIBE.WAV. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\places\\vibe.wav. ")) returned 1 [0084.635] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\WARN.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\places\\warn.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\WARN.WAV. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\places\\warn.wav. ")) returned 1 [0084.636] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5b7dc0 [0084.765] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\CAN.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\things\\can.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\CAN.WAV. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\things\\can.wav. ")) returned 1 [0084.777] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\COUPLER.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\things\\coupler.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\COUPLER.WAV. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\things\\coupler.wav. ")) returned 1 [0084.788] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\HORN.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\things\\horn.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\HORN.WAV. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\things\\horn.wav. ")) returned 1 [0084.818] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOT.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\things\\shot.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOT.WAV. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\things\\shot.wav. ")) returned 1 [0084.821] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOVEL.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\things\\shovel.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOVEL.WAV. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\things\\shovel.wav. ")) returned 1 [0084.855] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SPLASH.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\things\\splash.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SPLASH.WAV. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\things\\splash.wav. ")) returned 1 [0084.869] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\WHOOSH.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\things\\whoosh.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\WHOOSH.WAV. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\things\\whoosh.wav. ")) returned 1 [0084.870] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5b7c78 [0084.887] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\calendartooliconimages.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImages.jpg. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\calendartooliconimages.jpg. ")) returned 1 [0084.908] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\calendartooliconimagesmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImagesMask.bmp. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\calendartooliconimagesmask.bmp. ")) returned 1 [0084.948] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImages.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\chessiconimages.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImages.bmp. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\chessiconimages.bmp. ")) returned 1 [0084.964] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\chessiconimagesmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImagesMask.bmp. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\chessiconimagesmask.bmp. ")) returned 1 [0084.977] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImage.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\createspaceimage.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImage.jpg. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\createspaceimage.jpg. ")) returned 1 [0084.987] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImageMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\createspaceimagemask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImageMask.bmp. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\createspaceimagemask.bmp. ")) returned 1 [0085.016] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\datalisticonimages.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImages.jpg. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\datalisticonimages.jpg. ")) returned 1 [0085.019] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="DataListIconImagesMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImagesMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImagesMask.bmp" [0085.019] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImagesMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImagesMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImagesMask.bmp" [0085.019] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImagesMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImagesMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImagesMask.bmp" [0085.019] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImagesMask.bmp", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImagesMask.bmp.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImagesMask.bmp." [0085.019] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImagesMask.bmp.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImagesMask.bmp. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImagesMask.bmp. " [0085.020] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\datalisticonimagesmask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0085.020] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x708 [0085.020] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x71c4f100, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x606ee510, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x71c4f100, dwHighDateTime=0x1c747ea)) returned 1 [0085.020] SetFilePointer (in: hFile=0x90, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0085.021] ReadFile (in: hFile=0x90, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x6ae, lpOverlapped=0x0) returned 1 [0085.029] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImagesMask.bmp") returned="DataListIconImagesMask.bmp" [0085.029] SetFilePointer (in: hFile=0x90, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0085.029] WriteFile (in: hFile=0x90, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x6ae, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x6ae, lpOverlapped=0x0) returned 1 [0085.029] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0085.029] CloseHandle (hObject=0x90) returned 1 [0085.030] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\datalisticonimagesmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImagesMask.bmp. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\datalisticonimagesmask.bmp. ")) returned 1 [0085.031] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="DataViewIconImages.jpg") returned 1 [0085.031] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DataViewIconImages.jpg") returned 1 [0085.031] lstrcmpiA (lpString1="", lpString2="DataViewIconImages.jpg") returned -1 [0085.031] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImagesMask.bmp") returned="DataListIconImagesMask.bmp" [0085.031] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="DataViewIconImages.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImages.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImages.jpg" [0085.031] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImages.jpg", pszSpec="*.zip") returned 0 [0085.031] lstrlenA (lpString="*.zip") returned 5 [0085.031] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImages.jpg", pszSpec="*.rar") returned 0 [0085.031] lstrlenA (lpString="*.rar") returned 5 [0085.031] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImages.jpg", pszSpec="*.7z") returned 0 [0085.031] lstrlenA (lpString="*.7z") returned 4 [0085.031] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImages.jpg", pszSpec="*.tar") returned 0 [0085.031] lstrlenA (lpString="*.tar") returned 5 [0085.032] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImages.jpg", pszSpec="*.gzip") returned 0 [0085.032] lstrlenA (lpString="*.gzip") returned 6 [0085.032] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImages.jpg", pszSpec="*.jpg") returned 1 [0085.032] lstrlenA (lpString="*.jpg") returned 5 [0085.032] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImages.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImages.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImages.jpg" [0085.032] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImages.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImages.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImages.jpg" [0085.032] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImages.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImages.jpg.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImages.jpg." [0085.032] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImages.jpg.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImages.jpg. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImages.jpg. " [0085.032] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\dataviewiconimages.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0085.036] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x16c7 [0085.036] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x72f61e00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x606ee510, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x72f61e00, dwHighDateTime=0x1c747ea)) returned 1 [0085.036] SetFilePointer (in: hFile=0x90, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0085.036] ReadFile (in: hFile=0x90, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x166d, lpOverlapped=0x0) returned 1 [0085.059] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImages.jpg") returned="DataViewIconImages.jpg" [0085.059] SetFilePointer (in: hFile=0x90, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0085.059] WriteFile (in: hFile=0x90, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x166d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x166d, lpOverlapped=0x0) returned 1 [0085.059] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0085.059] CloseHandle (hObject=0x90) returned 1 [0085.060] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\dataviewiconimages.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImages.jpg. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\dataviewiconimages.jpg. ")) returned 1 [0085.060] FindNextFileA (in: hFindFile=0x5b7c78, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0085.060] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0085.060] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="DataViewIconImagesMask.bmp") returned 1 [0085.060] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DataViewIconImagesMask.bmp") returned 1 [0085.060] lstrcmpiA (lpString1="", lpString2="DataViewIconImagesMask.bmp") returned -1 [0085.060] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImages.jpg") returned="DataViewIconImages.jpg" [0085.060] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="DataViewIconImagesMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImagesMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImagesMask.bmp" [0085.060] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImagesMask.bmp", pszSpec="*.zip") returned 0 [0085.060] lstrlenA (lpString="*.zip") returned 5 [0085.060] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImagesMask.bmp", pszSpec="*.rar") returned 0 [0085.060] lstrlenA (lpString="*.rar") returned 5 [0085.060] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImagesMask.bmp", pszSpec="*.7z") returned 0 [0085.060] lstrlenA (lpString="*.7z") returned 4 [0085.061] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImagesMask.bmp", pszSpec="*.tar") returned 0 [0085.061] lstrlenA (lpString="*.tar") returned 5 [0085.061] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImagesMask.bmp", pszSpec="*.gzip") returned 0 [0085.061] lstrlenA (lpString="*.gzip") returned 6 [0085.061] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImagesMask.bmp", pszSpec="*.jpg") returned 0 [0085.061] lstrlenA (lpString="*.jpg") returned 5 [0085.061] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImagesMask.bmp", pszSpec="*.jpeg") returned 0 [0085.061] lstrlenA (lpString="*.jpeg") returned 6 [0085.061] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImagesMask.bmp", pszSpec="*.psd") returned 0 [0085.061] lstrlenA (lpString="*.psd") returned 5 [0085.061] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImagesMask.bmp", pszSpec="*.cdr") returned 0 [0085.061] lstrlenA (lpString="*.cdr") returned 5 [0085.061] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImagesMask.bmp", pszSpec="*.dwg") returned 0 [0085.061] lstrlenA (lpString="*.dwg") returned 5 [0085.061] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImagesMask.bmp", pszSpec="*.max") returned 0 [0085.061] lstrlenA (lpString="*.max") returned 5 [0085.061] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImagesMask.bmp", pszSpec="*.bmp") returned 1 [0085.061] lstrlenA (lpString="*.bmp") returned 5 [0085.061] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImagesMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImagesMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImagesMask.bmp" [0085.061] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImagesMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImagesMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImagesMask.bmp" [0085.061] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImagesMask.bmp", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImagesMask.bmp.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImagesMask.bmp." [0085.061] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImagesMask.bmp.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImagesMask.bmp. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImagesMask.bmp. " [0085.061] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\dataviewiconimagesmask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0085.062] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x708 [0085.062] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x72f61e00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x51d354f0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x72f61e00, dwHighDateTime=0x1c747ea)) returned 1 [0085.062] SetFilePointer (in: hFile=0x90, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0085.062] ReadFile (in: hFile=0x90, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x6ae, lpOverlapped=0x0) returned 1 [0085.075] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImagesMask.bmp") returned="DataViewIconImagesMask.bmp" [0085.075] SetFilePointer (in: hFile=0x90, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0085.075] WriteFile (in: hFile=0x90, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x6ae, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x6ae, lpOverlapped=0x0) returned 1 [0085.075] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0085.075] CloseHandle (hObject=0x90) returned 1 [0085.076] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\dataviewiconimagesmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImagesMask.bmp. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\dataviewiconimagesmask.bmp. ")) returned 1 [0085.077] FindNextFileA (in: hFindFile=0x5b7c78, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0085.077] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0085.077] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="DiscussionToolIconImages.jpg") returned 1 [0085.077] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DiscussionToolIconImages.jpg") returned 1 [0085.077] lstrcmpiA (lpString1="", lpString2="DiscussionToolIconImages.jpg") returned -1 [0085.077] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImagesMask.bmp") returned="DataViewIconImagesMask.bmp" [0085.077] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="DiscussionToolIconImages.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImages.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImages.jpg" [0085.077] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImages.jpg", pszSpec="*.zip") returned 0 [0085.077] lstrlenA (lpString="*.zip") returned 5 [0085.077] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImages.jpg", pszSpec="*.rar") returned 0 [0085.077] lstrlenA (lpString="*.rar") returned 5 [0085.077] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImages.jpg", pszSpec="*.7z") returned 0 [0085.077] lstrlenA (lpString="*.7z") returned 4 [0085.077] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImages.jpg", pszSpec="*.tar") returned 0 [0085.077] lstrlenA (lpString="*.tar") returned 5 [0085.077] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImages.jpg", pszSpec="*.gzip") returned 0 [0085.077] lstrlenA (lpString="*.gzip") returned 6 [0085.077] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImages.jpg", pszSpec="*.jpg") returned 1 [0085.077] lstrlenA (lpString="*.jpg") returned 5 [0085.077] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImages.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImages.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImages.jpg" [0085.078] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImages.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImages.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImages.jpg" [0085.078] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImages.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImages.jpg.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImages.jpg." [0085.078] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImages.jpg.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImages.jpg. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImages.jpg. " [0085.078] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\discussiontooliconimages.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0085.078] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2eaf [0085.078] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x72f61e00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x607d2d50, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x72f61e00, dwHighDateTime=0x1c747ea)) returned 1 [0085.078] SetFilePointer (in: hFile=0x90, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0085.078] ReadFile (in: hFile=0x90, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x2e55, lpOverlapped=0x0) returned 1 [0085.101] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImages.jpg") returned="DiscussionToolIconImages.jpg" [0085.101] SetFilePointer (in: hFile=0x90, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0085.101] WriteFile (in: hFile=0x90, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x2e55, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x2e55, lpOverlapped=0x0) returned 1 [0085.101] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0085.101] CloseHandle (hObject=0x90) returned 1 [0085.102] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\discussiontooliconimages.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImages.jpg. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\discussiontooliconimages.jpg. ")) returned 1 [0085.102] FindNextFileA (in: hFindFile=0x5b7c78, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0085.102] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0085.103] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="DiscussionToolIconImagesMask.bmp") returned 1 [0085.103] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DiscussionToolIconImagesMask.bmp") returned 1 [0085.103] lstrcmpiA (lpString1="", lpString2="DiscussionToolIconImagesMask.bmp") returned -1 [0085.103] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImages.jpg") returned="DiscussionToolIconImages.jpg" [0085.103] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="DiscussionToolIconImagesMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImagesMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImagesMask.bmp" [0085.103] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImagesMask.bmp", pszSpec="*.zip") returned 0 [0085.103] lstrlenA (lpString="*.zip") returned 5 [0085.103] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImagesMask.bmp", pszSpec="*.rar") returned 0 [0085.103] lstrlenA (lpString="*.rar") returned 5 [0085.103] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImagesMask.bmp", pszSpec="*.7z") returned 0 [0085.103] lstrlenA (lpString="*.7z") returned 4 [0085.103] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImagesMask.bmp", pszSpec="*.tar") returned 0 [0085.103] lstrlenA (lpString="*.tar") returned 5 [0085.103] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImagesMask.bmp", pszSpec="*.gzip") returned 0 [0085.103] lstrlenA (lpString="*.gzip") returned 6 [0085.103] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImagesMask.bmp", pszSpec="*.jpg") returned 0 [0085.103] lstrlenA (lpString="*.jpg") returned 5 [0085.103] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImagesMask.bmp", pszSpec="*.jpeg") returned 0 [0085.103] lstrlenA (lpString="*.jpeg") returned 6 [0085.103] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImagesMask.bmp", pszSpec="*.psd") returned 0 [0085.103] lstrlenA (lpString="*.psd") returned 5 [0085.103] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImagesMask.bmp", pszSpec="*.cdr") returned 0 [0085.103] lstrlenA (lpString="*.cdr") returned 5 [0085.103] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImagesMask.bmp", pszSpec="*.dwg") returned 0 [0085.103] lstrlenA (lpString="*.dwg") returned 5 [0085.103] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImagesMask.bmp", pszSpec="*.max") returned 0 [0085.103] lstrlenA (lpString="*.max") returned 5 [0085.103] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImagesMask.bmp", pszSpec="*.bmp") returned 1 [0085.103] lstrlenA (lpString="*.bmp") returned 5 [0085.103] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImagesMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImagesMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImagesMask.bmp" [0085.103] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImagesMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImagesMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImagesMask.bmp" [0085.103] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImagesMask.bmp", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImagesMask.bmp.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImagesMask.bmp." [0085.103] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImagesMask.bmp.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImagesMask.bmp. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImagesMask.bmp. " [0085.103] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\discussiontooliconimagesmask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0085.104] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x638 [0085.104] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x72f61e00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x51e19d30, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x72f61e00, dwHighDateTime=0x1c747ea)) returned 1 [0085.104] SetFilePointer (in: hFile=0x90, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0085.104] ReadFile (in: hFile=0x90, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x5de, lpOverlapped=0x0) returned 1 [0085.105] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImagesMask.bmp") returned="DiscussionToolIconImagesMask.bmp" [0085.105] SetFilePointer (in: hFile=0x90, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0085.105] WriteFile (in: hFile=0x90, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x5de, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x5de, lpOverlapped=0x0) returned 1 [0085.105] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0085.106] CloseHandle (hObject=0x90) returned 1 [0085.106] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\discussiontooliconimagesmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImagesMask.bmp. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\discussiontooliconimagesmask.bmp. ")) returned 1 [0085.107] FindNextFileA (in: hFindFile=0x5b7c78, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0085.107] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0085.107] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Form_StatusImage.jpg") returned -1 [0085.107] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Form_StatusImage.jpg") returned 1 [0085.107] lstrcmpiA (lpString1="", lpString2="Form_StatusImage.jpg") returned -1 [0085.107] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImagesMask.bmp") returned="DiscussionToolIconImagesMask.bmp" [0085.107] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="Form_StatusImage.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImage.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImage.jpg" [0085.107] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImage.jpg", pszSpec="*.zip") returned 0 [0085.107] lstrlenA (lpString="*.zip") returned 5 [0085.107] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImage.jpg", pszSpec="*.rar") returned 0 [0085.107] lstrlenA (lpString="*.rar") returned 5 [0085.107] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImage.jpg", pszSpec="*.7z") returned 0 [0085.107] lstrlenA (lpString="*.7z") returned 4 [0085.107] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImage.jpg", pszSpec="*.tar") returned 0 [0085.107] lstrlenA (lpString="*.tar") returned 5 [0085.107] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImage.jpg", pszSpec="*.gzip") returned 0 [0085.107] lstrlenA (lpString="*.gzip") returned 6 [0085.107] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImage.jpg", pszSpec="*.jpg") returned 1 [0085.107] lstrlenA (lpString="*.jpg") returned 5 [0085.107] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImage.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImage.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImage.jpg" [0085.107] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImage.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImage.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImage.jpg" [0085.107] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImage.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImage.jpg.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImage.jpg." [0085.107] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImage.jpg.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImage.jpg. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImage.jpg. " [0085.107] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImage.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\form_statusimage.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0085.108] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2a0f [0085.108] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x72f61e00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x528d0030, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x72f61e00, dwHighDateTime=0x1c747ea)) returned 1 [0085.108] SetFilePointer (in: hFile=0x90, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0085.109] ReadFile (in: hFile=0x90, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x29b5, lpOverlapped=0x0) returned 1 [0085.134] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImage.jpg") returned="Form_StatusImage.jpg" [0085.134] SetFilePointer (in: hFile=0x90, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0085.134] WriteFile (in: hFile=0x90, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x29b5, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x29b5, lpOverlapped=0x0) returned 1 [0085.134] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0085.134] CloseHandle (hObject=0x90) returned 1 [0085.135] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImage.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\form_statusimage.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImage.jpg. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\form_statusimage.jpg. ")) returned 1 [0085.136] FindNextFileA (in: hFindFile=0x5b7c78, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0085.136] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0085.136] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Form_StatusImageMask.bmp") returned -1 [0085.136] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Form_StatusImageMask.bmp") returned 1 [0085.136] lstrcmpiA (lpString1="", lpString2="Form_StatusImageMask.bmp") returned -1 [0085.136] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImage.jpg") returned="Form_StatusImage.jpg" [0085.136] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="Form_StatusImageMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImageMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImageMask.bmp" [0085.136] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImageMask.bmp", pszSpec="*.zip") returned 0 [0085.136] lstrlenA (lpString="*.zip") returned 5 [0085.136] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImageMask.bmp", pszSpec="*.rar") returned 0 [0085.136] lstrlenA (lpString="*.rar") returned 5 [0085.136] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImageMask.bmp", pszSpec="*.7z") returned 0 [0085.136] lstrlenA (lpString="*.7z") returned 4 [0085.136] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImageMask.bmp", pszSpec="*.tar") returned 0 [0085.136] lstrlenA (lpString="*.tar") returned 5 [0085.136] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImageMask.bmp", pszSpec="*.gzip") returned 0 [0085.136] lstrlenA (lpString="*.gzip") returned 6 [0085.136] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImageMask.bmp", pszSpec="*.jpg") returned 0 [0085.136] lstrlenA (lpString="*.jpg") returned 5 [0085.136] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImageMask.bmp", pszSpec="*.jpeg") returned 0 [0085.136] lstrlenA (lpString="*.jpeg") returned 6 [0085.136] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImageMask.bmp", pszSpec="*.psd") returned 0 [0085.136] lstrlenA (lpString="*.psd") returned 5 [0085.136] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImageMask.bmp", pszSpec="*.cdr") returned 0 [0085.136] lstrlenA (lpString="*.cdr") returned 5 [0085.136] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImageMask.bmp", pszSpec="*.dwg") returned 0 [0085.137] lstrlenA (lpString="*.dwg") returned 5 [0085.137] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImageMask.bmp", pszSpec="*.max") returned 0 [0085.137] lstrlenA (lpString="*.max") returned 5 [0085.137] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImageMask.bmp", pszSpec="*.bmp") returned 1 [0085.137] lstrlenA (lpString="*.bmp") returned 5 [0085.137] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImageMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImageMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImageMask.bmp" [0085.137] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImageMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImageMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImageMask.bmp" [0085.137] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImageMask.bmp", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImageMask.bmp.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImageMask.bmp." [0085.137] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImageMask.bmp.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImageMask.bmp. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImageMask.bmp. " [0085.137] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImageMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\form_statusimagemask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0085.137] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3618 [0085.137] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x74274b00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x528d0030, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x74274b00, dwHighDateTime=0x1c747ea)) returned 1 [0085.137] SetFilePointer (in: hFile=0x90, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0085.137] ReadFile (in: hFile=0x90, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x35be, lpOverlapped=0x0) returned 1 [0085.174] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImageMask.bmp") returned="Form_StatusImageMask.bmp" [0085.174] SetFilePointer (in: hFile=0x90, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0085.174] WriteFile (in: hFile=0x90, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x35be, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x35be, lpOverlapped=0x0) returned 1 [0085.175] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0085.175] CloseHandle (hObject=0x90) returned 1 [0085.176] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImageMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\form_statusimagemask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImageMask.bmp. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\form_statusimagemask.bmp. ")) returned 1 [0085.176] FindNextFileA (in: hFindFile=0x5b7c78, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0085.176] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0085.176] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="GRIP.JPG") returned -1 [0085.176] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="GRIP.JPG") returned 1 [0085.176] lstrcmpiA (lpString1="", lpString2="GRIP.JPG") returned -1 [0085.176] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImageMask.bmp") returned="Form_StatusImageMask.bmp" [0085.176] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="GRIP.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIP.JPG") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIP.JPG" [0085.177] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIP.JPG", pszSpec="*.zip") returned 0 [0085.177] lstrlenA (lpString="*.zip") returned 5 [0085.177] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIP.JPG", pszSpec="*.rar") returned 0 [0085.177] lstrlenA (lpString="*.rar") returned 5 [0085.177] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIP.JPG", pszSpec="*.7z") returned 0 [0085.177] lstrlenA (lpString="*.7z") returned 4 [0085.177] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIP.JPG", pszSpec="*.tar") returned 0 [0085.177] lstrlenA (lpString="*.tar") returned 5 [0085.177] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIP.JPG", pszSpec="*.gzip") returned 0 [0085.177] lstrlenA (lpString="*.gzip") returned 6 [0085.177] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIP.JPG", pszSpec="*.jpg") returned 1 [0085.177] lstrlenA (lpString="*.jpg") returned 5 [0085.177] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIP.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIP.JPG") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIP.JPG" [0085.177] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIP.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIP.JPG") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIP.JPG" [0085.177] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIP.JPG", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIP.JPG.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIP.JPG." [0085.177] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIP.JPG.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIP.JPG. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIP.JPG. " [0085.177] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIP.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\grip.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0085.180] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1d29 [0085.180] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x74274b00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x61c0e850, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x74274b00, dwHighDateTime=0x1c747ea)) returned 1 [0085.180] SetFilePointer (in: hFile=0x90, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0085.180] ReadFile (in: hFile=0x90, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x1ccf, lpOverlapped=0x0) returned 1 [0085.224] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIP.JPG") returned="GRIP.JPG" [0085.224] SetFilePointer (in: hFile=0x90, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0085.224] WriteFile (in: hFile=0x90, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x1ccf, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x1ccf, lpOverlapped=0x0) returned 1 [0085.225] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0085.225] CloseHandle (hObject=0x90) returned 1 [0085.225] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIP.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\grip.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIP.JPG. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\grip.jpg. ")) returned 1 [0085.226] FindNextFileA (in: hFindFile=0x5b7c78, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0085.226] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0085.226] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="GRIPMASK.BMP") returned -1 [0085.226] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="GRIPMASK.BMP") returned 1 [0085.226] lstrcmpiA (lpString1="", lpString2="GRIPMASK.BMP") returned -1 [0085.226] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIP.JPG") returned="GRIP.JPG" [0085.226] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="GRIPMASK.BMP" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIPMASK.BMP") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIPMASK.BMP" [0085.226] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIPMASK.BMP", pszSpec="*.zip") returned 0 [0085.226] lstrlenA (lpString="*.zip") returned 5 [0085.226] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIPMASK.BMP", pszSpec="*.rar") returned 0 [0085.226] lstrlenA (lpString="*.rar") returned 5 [0085.226] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIPMASK.BMP", pszSpec="*.7z") returned 0 [0085.226] lstrlenA (lpString="*.7z") returned 4 [0085.226] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIPMASK.BMP", pszSpec="*.tar") returned 0 [0085.226] lstrlenA (lpString="*.tar") returned 5 [0085.226] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIPMASK.BMP", pszSpec="*.gzip") returned 0 [0085.227] lstrlenA (lpString="*.gzip") returned 6 [0085.227] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIPMASK.BMP", pszSpec="*.jpg") returned 0 [0085.227] lstrlenA (lpString="*.jpg") returned 5 [0085.227] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIPMASK.BMP", pszSpec="*.jpeg") returned 0 [0085.227] lstrlenA (lpString="*.jpeg") returned 6 [0085.227] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIPMASK.BMP", pszSpec="*.psd") returned 0 [0085.227] lstrlenA (lpString="*.psd") returned 5 [0085.227] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIPMASK.BMP", pszSpec="*.cdr") returned 0 [0085.227] lstrlenA (lpString="*.cdr") returned 5 [0085.227] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIPMASK.BMP", pszSpec="*.dwg") returned 0 [0085.227] lstrlenA (lpString="*.dwg") returned 5 [0085.227] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIPMASK.BMP", pszSpec="*.max") returned 0 [0085.227] lstrlenA (lpString="*.max") returned 5 [0085.227] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIPMASK.BMP", pszSpec="*.bmp") returned 1 [0085.227] lstrlenA (lpString="*.bmp") returned 5 [0085.227] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIPMASK.BMP" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIPMASK.BMP") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIPMASK.BMP" [0085.227] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIPMASK.BMP" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIPMASK.BMP") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIPMASK.BMP" [0085.227] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIPMASK.BMP", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIPMASK.BMP.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIPMASK.BMP." [0085.227] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIPMASK.BMP.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIPMASK.BMP. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIPMASK.BMP. " [0085.227] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIPMASK.BMP" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\gripmask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0085.227] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xc38 [0085.227] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x74274b00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x61c0e850, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x74274b00, dwHighDateTime=0x1c747ea)) returned 1 [0085.227] SetFilePointer (in: hFile=0x90, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0085.227] ReadFile (in: hFile=0x90, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0xbde, lpOverlapped=0x0) returned 1 [0085.230] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIPMASK.BMP") returned="GRIPMASK.BMP" [0085.230] SetFilePointer (in: hFile=0x90, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0085.230] WriteFile (in: hFile=0x90, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0xbde, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0xbde, lpOverlapped=0x0) returned 1 [0085.230] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0085.230] CloseHandle (hObject=0x90) returned 1 [0085.231] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIPMASK.BMP" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\gripmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIPMASK.BMP. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\gripmask.bmp. ")) returned 1 [0085.231] FindNextFileA (in: hFindFile=0x5b7c78, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0085.231] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0085.231] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="InformationIcon.jpg") returned -1 [0085.231] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="InformationIcon.jpg") returned -1 [0085.231] lstrcmpiA (lpString1="", lpString2="InformationIcon.jpg") returned -1 [0085.232] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIPMASK.BMP") returned="GRIPMASK.BMP" [0085.232] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="InformationIcon.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIcon.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIcon.jpg" [0085.232] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIcon.jpg", pszSpec="*.zip") returned 0 [0085.232] lstrlenA (lpString="*.zip") returned 5 [0085.232] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIcon.jpg", pszSpec="*.rar") returned 0 [0085.232] lstrlenA (lpString="*.rar") returned 5 [0085.232] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIcon.jpg", pszSpec="*.7z") returned 0 [0085.232] lstrlenA (lpString="*.7z") returned 4 [0085.232] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIcon.jpg", pszSpec="*.tar") returned 0 [0085.232] lstrlenA (lpString="*.tar") returned 5 [0085.232] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIcon.jpg", pszSpec="*.gzip") returned 0 [0085.232] lstrlenA (lpString="*.gzip") returned 6 [0085.232] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIcon.jpg", pszSpec="*.jpg") returned 1 [0085.232] lstrlenA (lpString="*.jpg") returned 5 [0085.232] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIcon.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIcon.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIcon.jpg" [0085.232] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIcon.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIcon.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIcon.jpg" [0085.232] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIcon.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIcon.jpg.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIcon.jpg." [0085.232] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIcon.jpg.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIcon.jpg. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIcon.jpg. " [0085.232] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIcon.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\informationicon.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0085.233] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xbe5 [0085.233] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x74274b00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x61cf3090, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x74274b00, dwHighDateTime=0x1c747ea)) returned 1 [0085.233] SetFilePointer (in: hFile=0x90, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0085.233] ReadFile (in: hFile=0x90, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0xb8b, lpOverlapped=0x0) returned 1 [0085.290] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIcon.jpg") returned="InformationIcon.jpg" [0085.290] SetFilePointer (in: hFile=0x90, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0085.291] WriteFile (in: hFile=0x90, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0xb8b, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0xb8b, lpOverlapped=0x0) returned 1 [0085.291] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0085.291] CloseHandle (hObject=0x90) returned 1 [0085.292] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIcon.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\informationicon.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIcon.jpg. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\informationicon.jpg. ")) returned 1 [0085.294] FindNextFileA (in: hFindFile=0x5b7c78, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0085.294] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0085.294] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="InformationIconMask.bmp") returned -1 [0085.294] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="InformationIconMask.bmp") returned -1 [0085.294] lstrcmpiA (lpString1="", lpString2="InformationIconMask.bmp") returned -1 [0085.294] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIcon.jpg") returned="InformationIcon.jpg" [0085.295] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="InformationIconMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIconMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIconMask.bmp" [0085.295] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIconMask.bmp", pszSpec="*.zip") returned 0 [0085.295] lstrlenA (lpString="*.zip") returned 5 [0085.295] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIconMask.bmp", pszSpec="*.rar") returned 0 [0085.295] lstrlenA (lpString="*.rar") returned 5 [0085.295] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIconMask.bmp", pszSpec="*.7z") returned 0 [0085.295] lstrlenA (lpString="*.7z") returned 4 [0085.295] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIconMask.bmp", pszSpec="*.tar") returned 0 [0085.295] lstrlenA (lpString="*.tar") returned 5 [0085.295] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIconMask.bmp", pszSpec="*.gzip") returned 0 [0085.295] lstrlenA (lpString="*.gzip") returned 6 [0085.295] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIconMask.bmp", pszSpec="*.jpg") returned 0 [0085.295] lstrlenA (lpString="*.jpg") returned 5 [0085.295] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIconMask.bmp", pszSpec="*.jpeg") returned 0 [0085.295] lstrlenA (lpString="*.jpeg") returned 6 [0085.295] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIconMask.bmp", pszSpec="*.psd") returned 0 [0085.296] lstrlenA (lpString="*.psd") returned 5 [0085.296] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIconMask.bmp", pszSpec="*.cdr") returned 0 [0085.296] lstrlenA (lpString="*.cdr") returned 5 [0085.296] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIconMask.bmp", pszSpec="*.dwg") returned 0 [0085.296] lstrlenA (lpString="*.dwg") returned 5 [0085.296] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIconMask.bmp", pszSpec="*.max") returned 0 [0085.296] lstrlenA (lpString="*.max") returned 5 [0085.296] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIconMask.bmp", pszSpec="*.bmp") returned 1 [0085.296] lstrlenA (lpString="*.bmp") returned 5 [0085.296] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIconMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIconMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIconMask.bmp" [0085.296] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIconMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIconMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIconMask.bmp" [0085.296] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIconMask.bmp", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIconMask.bmp.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIconMask.bmp." [0085.296] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIconMask.bmp.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIconMask.bmp. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIconMask.bmp. " [0085.296] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIconMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\informationiconmask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0085.297] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x838 [0085.297] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x74274b00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x61cf3090, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x74274b00, dwHighDateTime=0x1c747ea)) returned 1 [0085.297] SetFilePointer (in: hFile=0x90, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0085.297] ReadFile (in: hFile=0x90, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x7de, lpOverlapped=0x0) returned 1 [0085.300] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIconMask.bmp") returned="InformationIconMask.bmp" [0085.300] SetFilePointer (in: hFile=0x90, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0085.300] WriteFile (in: hFile=0x90, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x7de, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x7de, lpOverlapped=0x0) returned 1 [0085.301] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0085.301] CloseHandle (hObject=0x90) returned 1 [0085.302] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIconMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\informationiconmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIconMask.bmp. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\informationiconmask.bmp. ")) returned 1 [0085.304] FindNextFileA (in: hFindFile=0x5b7c78, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0085.304] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0085.304] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="LoginDialogBackground.jpg") returned -1 [0085.304] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="LoginDialogBackground.jpg") returned -1 [0085.304] lstrcmpiA (lpString1="", lpString2="LoginDialogBackground.jpg") returned -1 [0085.304] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIconMask.bmp") returned="InformationIconMask.bmp" [0085.304] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="LoginDialogBackground.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginDialogBackground.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginDialogBackground.jpg" [0085.304] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginDialogBackground.jpg", pszSpec="*.zip") returned 0 [0085.304] lstrlenA (lpString="*.zip") returned 5 [0085.304] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginDialogBackground.jpg", pszSpec="*.rar") returned 0 [0085.304] lstrlenA (lpString="*.rar") returned 5 [0085.304] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginDialogBackground.jpg", pszSpec="*.7z") returned 0 [0085.304] lstrlenA (lpString="*.7z") returned 4 [0085.304] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginDialogBackground.jpg", pszSpec="*.tar") returned 0 [0085.304] lstrlenA (lpString="*.tar") returned 5 [0085.304] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginDialogBackground.jpg", pszSpec="*.gzip") returned 0 [0085.304] lstrlenA (lpString="*.gzip") returned 6 [0085.304] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginDialogBackground.jpg", pszSpec="*.jpg") returned 1 [0085.305] lstrlenA (lpString="*.jpg") returned 5 [0085.305] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginDialogBackground.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginDialogBackground.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginDialogBackground.jpg" [0085.305] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginDialogBackground.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginDialogBackground.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginDialogBackground.jpg" [0085.305] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginDialogBackground.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginDialogBackground.jpg.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginDialogBackground.jpg." [0085.305] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginDialogBackground.jpg.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginDialogBackground.jpg. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginDialogBackground.jpg. " [0085.305] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginDialogBackground.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\logindialogbackground.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0085.306] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xceed [0085.306] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x675aa300, dwHighDateTime=0x1c9f921), lpLastAccessTime=0x407536*(dwLowDateTime=0x581a1510, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x675aa300, dwHighDateTime=0x1c9f921)) returned 1 [0085.306] SetFilePointer (in: hFile=0x90, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0085.306] ReadFile (in: hFile=0x90, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0xce93, lpOverlapped=0x0) returned 1 [0085.330] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginDialogBackground.jpg") returned="LoginDialogBackground.jpg" [0085.330] SetFilePointer (in: hFile=0x90, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0085.330] WriteFile (in: hFile=0x90, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0xce93, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0xce93, lpOverlapped=0x0) returned 1 [0085.330] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0085.331] CloseHandle (hObject=0x90) returned 1 [0085.331] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginDialogBackground.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\logindialogbackground.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginDialogBackground.jpg. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\logindialogbackground.jpg. ")) returned 1 [0085.332] FindNextFileA (in: hFindFile=0x5b7c78, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0085.332] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0085.332] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="LoginTool24x24Images.jpg") returned -1 [0085.332] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="LoginTool24x24Images.jpg") returned -1 [0085.332] lstrcmpiA (lpString1="", lpString2="LoginTool24x24Images.jpg") returned -1 [0085.332] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginDialogBackground.jpg") returned="LoginDialogBackground.jpg" [0085.332] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="LoginTool24x24Images.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24Images.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24Images.jpg" [0085.332] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24Images.jpg", pszSpec="*.zip") returned 0 [0085.332] lstrlenA (lpString="*.zip") returned 5 [0085.332] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24Images.jpg", pszSpec="*.rar") returned 0 [0085.332] lstrlenA (lpString="*.rar") returned 5 [0085.332] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24Images.jpg", pszSpec="*.7z") returned 0 [0085.332] lstrlenA (lpString="*.7z") returned 4 [0085.332] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24Images.jpg", pszSpec="*.tar") returned 0 [0085.332] lstrlenA (lpString="*.tar") returned 5 [0085.332] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24Images.jpg", pszSpec="*.gzip") returned 0 [0085.333] lstrlenA (lpString="*.gzip") returned 6 [0085.333] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24Images.jpg", pszSpec="*.jpg") returned 1 [0085.333] lstrlenA (lpString="*.jpg") returned 5 [0085.333] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24Images.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24Images.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24Images.jpg" [0085.333] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24Images.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24Images.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24Images.jpg" [0085.333] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24Images.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24Images.jpg.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24Images.jpg." [0085.333] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24Images.jpg.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24Images.jpg. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24Images.jpg. " [0085.333] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24Images.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\logintool24x24images.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0085.333] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1e93 [0085.333] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x75587800, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x695e6e70, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x75587800, dwHighDateTime=0x1c747ea)) returned 1 [0085.334] SetFilePointer (in: hFile=0x90, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0085.334] ReadFile (in: hFile=0x90, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x1e39, lpOverlapped=0x0) returned 1 [0085.345] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24Images.jpg") returned="LoginTool24x24Images.jpg" [0085.345] SetFilePointer (in: hFile=0x90, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0085.345] WriteFile (in: hFile=0x90, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x1e39, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x1e39, lpOverlapped=0x0) returned 1 [0085.346] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0085.346] CloseHandle (hObject=0x90) returned 1 [0085.346] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24Images.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\logintool24x24images.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24Images.jpg. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\logintool24x24images.jpg. ")) returned 1 [0085.347] FindNextFileA (in: hFindFile=0x5b7c78, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0085.347] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0085.347] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="LoginTool24x24ImagesMask.bmp") returned -1 [0085.347] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="LoginTool24x24ImagesMask.bmp") returned -1 [0085.347] lstrcmpiA (lpString1="", lpString2="LoginTool24x24ImagesMask.bmp") returned -1 [0085.347] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24Images.jpg") returned="LoginTool24x24Images.jpg" [0085.347] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="LoginTool24x24ImagesMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24ImagesMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24ImagesMask.bmp" [0085.347] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24ImagesMask.bmp", pszSpec="*.zip") returned 0 [0085.347] lstrlenA (lpString="*.zip") returned 5 [0085.347] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24ImagesMask.bmp", pszSpec="*.rar") returned 0 [0085.347] lstrlenA (lpString="*.rar") returned 5 [0085.347] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24ImagesMask.bmp", pszSpec="*.7z") returned 0 [0085.347] lstrlenA (lpString="*.7z") returned 4 [0085.347] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24ImagesMask.bmp", pszSpec="*.tar") returned 0 [0085.347] lstrlenA (lpString="*.tar") returned 5 [0085.347] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24ImagesMask.bmp", pszSpec="*.gzip") returned 0 [0085.347] lstrlenA (lpString="*.gzip") returned 6 [0085.347] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24ImagesMask.bmp", pszSpec="*.jpg") returned 0 [0085.347] lstrlenA (lpString="*.jpg") returned 5 [0085.347] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24ImagesMask.bmp", pszSpec="*.jpeg") returned 0 [0085.348] lstrlenA (lpString="*.jpeg") returned 6 [0085.348] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24ImagesMask.bmp", pszSpec="*.psd") returned 0 [0085.348] lstrlenA (lpString="*.psd") returned 5 [0085.348] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24ImagesMask.bmp", pszSpec="*.cdr") returned 0 [0085.348] lstrlenA (lpString="*.cdr") returned 5 [0085.348] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24ImagesMask.bmp", pszSpec="*.dwg") returned 0 [0085.348] lstrlenA (lpString="*.dwg") returned 5 [0085.348] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24ImagesMask.bmp", pszSpec="*.max") returned 0 [0085.348] lstrlenA (lpString="*.max") returned 5 [0085.348] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24ImagesMask.bmp", pszSpec="*.bmp") returned 1 [0085.348] lstrlenA (lpString="*.bmp") returned 5 [0085.348] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24ImagesMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24ImagesMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24ImagesMask.bmp" [0085.348] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24ImagesMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24ImagesMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24ImagesMask.bmp" [0085.348] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24ImagesMask.bmp", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24ImagesMask.bmp.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24ImagesMask.bmp." [0085.348] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24ImagesMask.bmp.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24ImagesMask.bmp. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24ImagesMask.bmp. " [0085.348] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24ImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\logintool24x24imagesmask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0085.348] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xaf8 [0085.348] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x75587800, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x695e6e70, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x75587800, dwHighDateTime=0x1c747ea)) returned 1 [0085.348] SetFilePointer (in: hFile=0x90, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0085.348] ReadFile (in: hFile=0x90, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0xa9e, lpOverlapped=0x0) returned 1 [0085.349] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24ImagesMask.bmp") returned="LoginTool24x24ImagesMask.bmp" [0085.349] SetFilePointer (in: hFile=0x90, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0085.349] WriteFile (in: hFile=0x90, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0xa9e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0xa9e, lpOverlapped=0x0) returned 1 [0085.350] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0085.350] CloseHandle (hObject=0x90) returned 1 [0085.350] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24ImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\logintool24x24imagesmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24ImagesMask.bmp. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\logintool24x24imagesmask.bmp. ")) returned 1 [0085.351] FindNextFileA (in: hFindFile=0x5b7c78, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0085.351] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0085.351] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="MessageAttachmentIconImages.jpg") returned -1 [0085.351] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MessageAttachmentIconImages.jpg") returned -1 [0085.351] lstrcmpiA (lpString1="", lpString2="MessageAttachmentIconImages.jpg") returned -1 [0085.351] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24ImagesMask.bmp") returned="LoginTool24x24ImagesMask.bmp" [0085.351] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="MessageAttachmentIconImages.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImages.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImages.jpg" [0085.351] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImages.jpg", pszSpec="*.zip") returned 0 [0085.351] lstrlenA (lpString="*.zip") returned 5 [0085.351] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImages.jpg", pszSpec="*.rar") returned 0 [0085.351] lstrlenA (lpString="*.rar") returned 5 [0085.351] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImages.jpg", pszSpec="*.7z") returned 0 [0085.351] lstrlenA (lpString="*.7z") returned 4 [0085.351] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImages.jpg", pszSpec="*.tar") returned 0 [0085.351] lstrlenA (lpString="*.tar") returned 5 [0085.351] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImages.jpg", pszSpec="*.gzip") returned 0 [0085.351] lstrlenA (lpString="*.gzip") returned 6 [0085.351] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImages.jpg", pszSpec="*.jpg") returned 1 [0085.351] lstrlenA (lpString="*.jpg") returned 5 [0085.351] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImages.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImages.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImages.jpg" [0085.351] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImages.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImages.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImages.jpg" [0085.351] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImages.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImages.jpg.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImages.jpg." [0085.351] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImages.jpg.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImages.jpg. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImages.jpg. " [0085.351] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\messageattachmenticonimages.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0085.352] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x25e5 [0085.352] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x75587800, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x69a5d7b0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x75587800, dwHighDateTime=0x1c747ea)) returned 1 [0085.352] SetFilePointer (in: hFile=0x90, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0085.352] ReadFile (in: hFile=0x90, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x258b, lpOverlapped=0x0) returned 1 [0085.363] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImages.jpg") returned="MessageAttachmentIconImages.jpg" [0085.363] SetFilePointer (in: hFile=0x90, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0085.363] WriteFile (in: hFile=0x90, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x258b, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x258b, lpOverlapped=0x0) returned 1 [0085.363] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0085.363] CloseHandle (hObject=0x90) returned 1 [0085.363] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\messageattachmenticonimages.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImages.jpg. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\messageattachmenticonimages.jpg. ")) returned 1 [0085.364] FindNextFileA (in: hFindFile=0x5b7c78, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0085.364] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0085.364] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="MessageAttachmentIconImagesMask.bmp") returned -1 [0085.364] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MessageAttachmentIconImagesMask.bmp") returned -1 [0085.364] lstrcmpiA (lpString1="", lpString2="MessageAttachmentIconImagesMask.bmp") returned -1 [0085.364] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImages.jpg") returned="MessageAttachmentIconImages.jpg" [0085.364] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="MessageAttachmentIconImagesMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImagesMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImagesMask.bmp" [0085.364] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImagesMask.bmp", pszSpec="*.zip") returned 0 [0085.364] lstrlenA (lpString="*.zip") returned 5 [0085.364] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImagesMask.bmp", pszSpec="*.rar") returned 0 [0085.364] lstrlenA (lpString="*.rar") returned 5 [0085.364] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImagesMask.bmp", pszSpec="*.7z") returned 0 [0085.364] lstrlenA (lpString="*.7z") returned 4 [0085.364] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImagesMask.bmp", pszSpec="*.tar") returned 0 [0085.364] lstrlenA (lpString="*.tar") returned 5 [0085.364] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImagesMask.bmp", pszSpec="*.gzip") returned 0 [0085.364] lstrlenA (lpString="*.gzip") returned 6 [0085.364] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImagesMask.bmp", pszSpec="*.jpg") returned 0 [0085.364] lstrlenA (lpString="*.jpg") returned 5 [0085.365] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImagesMask.bmp", pszSpec="*.jpeg") returned 0 [0085.365] lstrlenA (lpString="*.jpeg") returned 6 [0085.365] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImagesMask.bmp", pszSpec="*.psd") returned 0 [0085.365] lstrlenA (lpString="*.psd") returned 5 [0085.365] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImagesMask.bmp", pszSpec="*.cdr") returned 0 [0085.365] lstrlenA (lpString="*.cdr") returned 5 [0085.365] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImagesMask.bmp", pszSpec="*.dwg") returned 0 [0085.365] lstrlenA (lpString="*.dwg") returned 5 [0085.365] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImagesMask.bmp", pszSpec="*.max") returned 0 [0085.365] lstrlenA (lpString="*.max") returned 5 [0085.365] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImagesMask.bmp", pszSpec="*.bmp") returned 1 [0085.365] lstrlenA (lpString="*.bmp") returned 5 [0085.365] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImagesMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImagesMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImagesMask.bmp" [0085.365] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImagesMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImagesMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImagesMask.bmp" [0085.365] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImagesMask.bmp", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImagesMask.bmp.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImagesMask.bmp." [0085.365] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImagesMask.bmp.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImagesMask.bmp. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImagesMask.bmp. " [0085.365] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\messageattachmenticonimagesmask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0085.366] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x838 [0085.366] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x75587800, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x583906f0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x75587800, dwHighDateTime=0x1c747ea)) returned 1 [0085.366] SetFilePointer (in: hFile=0x90, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0085.366] ReadFile (in: hFile=0x90, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x7de, lpOverlapped=0x0) returned 1 [0085.367] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImagesMask.bmp") returned="MessageAttachmentIconImagesMask.bmp" [0085.367] SetFilePointer (in: hFile=0x90, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0085.367] WriteFile (in: hFile=0x90, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x7de, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x7de, lpOverlapped=0x0) returned 1 [0085.367] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0085.367] CloseHandle (hObject=0x90) returned 1 [0085.368] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\messageattachmenticonimagesmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImagesMask.bmp. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\messageattachmenticonimagesmask.bmp. ")) returned 1 [0085.368] FindNextFileA (in: hFindFile=0x5b7c78, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0085.368] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0085.368] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="MessageHistoryIconImages.jpg") returned -1 [0085.368] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MessageHistoryIconImages.jpg") returned -1 [0085.368] lstrcmpiA (lpString1="", lpString2="MessageHistoryIconImages.jpg") returned -1 [0085.368] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImagesMask.bmp") returned="MessageAttachmentIconImagesMask.bmp" [0085.369] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="MessageHistoryIconImages.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImages.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImages.jpg" [0085.369] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImages.jpg", pszSpec="*.zip") returned 0 [0085.369] lstrlenA (lpString="*.zip") returned 5 [0085.369] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImages.jpg", pszSpec="*.rar") returned 0 [0085.369] lstrlenA (lpString="*.rar") returned 5 [0085.369] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImages.jpg", pszSpec="*.7z") returned 0 [0085.369] lstrlenA (lpString="*.7z") returned 4 [0085.369] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImages.jpg", pszSpec="*.tar") returned 0 [0085.369] lstrlenA (lpString="*.tar") returned 5 [0085.369] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImages.jpg", pszSpec="*.gzip") returned 0 [0085.369] lstrlenA (lpString="*.gzip") returned 6 [0085.369] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImages.jpg", pszSpec="*.jpg") returned 1 [0085.369] lstrlenA (lpString="*.jpg") returned 5 [0085.369] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImages.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImages.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImages.jpg" [0085.369] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImages.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImages.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImages.jpg" [0085.369] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImages.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImages.jpg.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImages.jpg." [0085.369] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImages.jpg.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImages.jpg. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImages.jpg. " [0085.369] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\messagehistoryiconimages.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0085.370] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x22f6 [0085.370] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x75587800, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x583906f0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x75587800, dwHighDateTime=0x1c747ea)) returned 1 [0085.370] SetFilePointer (in: hFile=0x90, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0085.370] ReadFile (in: hFile=0x90, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x229c, lpOverlapped=0x0) returned 1 [0085.371] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImages.jpg") returned="MessageHistoryIconImages.jpg" [0085.371] SetFilePointer (in: hFile=0x90, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0085.371] WriteFile (in: hFile=0x90, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x229c, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x229c, lpOverlapped=0x0) returned 1 [0085.371] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0085.371] CloseHandle (hObject=0x90) returned 1 [0085.372] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\messagehistoryiconimages.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImages.jpg. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\messagehistoryiconimages.jpg. ")) returned 1 [0085.373] FindNextFileA (in: hFindFile=0x5b7c78, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0085.373] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0085.373] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="MessageHistoryIconImagesMask.bmp") returned -1 [0085.373] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MessageHistoryIconImagesMask.bmp") returned -1 [0085.373] lstrcmpiA (lpString1="", lpString2="MessageHistoryIconImagesMask.bmp") returned -1 [0085.373] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImages.jpg") returned="MessageHistoryIconImages.jpg" [0085.373] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="MessageHistoryIconImagesMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImagesMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImagesMask.bmp" [0085.373] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImagesMask.bmp", pszSpec="*.zip") returned 0 [0085.373] lstrlenA (lpString="*.zip") returned 5 [0085.373] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImagesMask.bmp", pszSpec="*.rar") returned 0 [0085.373] lstrlenA (lpString="*.rar") returned 5 [0085.373] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImagesMask.bmp", pszSpec="*.7z") returned 0 [0085.373] lstrlenA (lpString="*.7z") returned 4 [0085.373] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImagesMask.bmp", pszSpec="*.tar") returned 0 [0085.373] lstrlenA (lpString="*.tar") returned 5 [0085.373] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImagesMask.bmp", pszSpec="*.gzip") returned 0 [0085.373] lstrlenA (lpString="*.gzip") returned 6 [0085.373] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImagesMask.bmp", pszSpec="*.jpg") returned 0 [0085.373] lstrlenA (lpString="*.jpg") returned 5 [0085.373] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImagesMask.bmp", pszSpec="*.jpeg") returned 0 [0085.373] lstrlenA (lpString="*.jpeg") returned 6 [0085.373] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImagesMask.bmp", pszSpec="*.psd") returned 0 [0085.373] lstrlenA (lpString="*.psd") returned 5 [0085.373] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImagesMask.bmp", pszSpec="*.cdr") returned 0 [0085.373] lstrlenA (lpString="*.cdr") returned 5 [0085.373] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImagesMask.bmp", pszSpec="*.dwg") returned 0 [0085.373] lstrlenA (lpString="*.dwg") returned 5 [0085.373] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImagesMask.bmp", pszSpec="*.max") returned 0 [0085.373] lstrlenA (lpString="*.max") returned 5 [0085.373] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImagesMask.bmp", pszSpec="*.bmp") returned 1 [0085.373] lstrlenA (lpString="*.bmp") returned 5 [0085.373] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImagesMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImagesMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImagesMask.bmp" [0085.373] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImagesMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImagesMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImagesMask.bmp" [0085.373] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImagesMask.bmp", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImagesMask.bmp.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImagesMask.bmp." [0085.373] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImagesMask.bmp.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImagesMask.bmp. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImagesMask.bmp. " [0085.373] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\messagehistoryiconimagesmask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0085.374] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x140 [0085.374] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x75587800, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x583906f0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x75587800, dwHighDateTime=0x1c747ea)) returned 1 [0085.374] SetFilePointer (in: hFile=0x90, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0085.374] ReadFile (in: hFile=0x90, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0xe6, lpOverlapped=0x0) returned 1 [0085.375] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImagesMask.bmp") returned="MessageHistoryIconImagesMask.bmp" [0085.375] SetFilePointer (in: hFile=0x90, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0085.375] WriteFile (in: hFile=0x90, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0xe6, lpOverlapped=0x0) returned 1 [0085.375] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0085.375] CloseHandle (hObject=0x90) returned 1 [0085.375] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\messagehistoryiconimagesmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImagesMask.bmp. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\messagehistoryiconimagesmask.bmp. ")) returned 1 [0085.376] FindNextFileA (in: hFindFile=0x5b7c78, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0085.376] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0085.376] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="NotifierBackground.jpg") returned -1 [0085.376] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="NotifierBackground.jpg") returned -1 [0085.376] lstrcmpiA (lpString1="", lpString2="NotifierBackground.jpg") returned -1 [0085.376] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImagesMask.bmp") returned="MessageHistoryIconImagesMask.bmp" [0085.376] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="NotifierBackground.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackground.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackground.jpg" [0085.376] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackground.jpg", pszSpec="*.zip") returned 0 [0085.376] lstrlenA (lpString="*.zip") returned 5 [0085.376] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackground.jpg", pszSpec="*.rar") returned 0 [0085.376] lstrlenA (lpString="*.rar") returned 5 [0085.376] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackground.jpg", pszSpec="*.7z") returned 0 [0085.376] lstrlenA (lpString="*.7z") returned 4 [0085.376] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackground.jpg", pszSpec="*.tar") returned 0 [0085.376] lstrlenA (lpString="*.tar") returned 5 [0085.376] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackground.jpg", pszSpec="*.gzip") returned 0 [0085.376] lstrlenA (lpString="*.gzip") returned 6 [0085.376] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackground.jpg", pszSpec="*.jpg") returned 1 [0085.376] lstrlenA (lpString="*.jpg") returned 5 [0085.376] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackground.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackground.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackground.jpg" [0085.377] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackground.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackground.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackground.jpg" [0085.377] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackground.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackground.jpg.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackground.jpg." [0085.377] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackground.jpg.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackground.jpg. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackground.jpg. " [0085.377] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackground.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifierbackground.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0085.389] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3efd [0085.389] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x46b7a400, dwHighDateTime=0x1c9e8b3), lpLastAccessTime=0x407536*(dwLowDateTime=0x59590d50, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x46b7a400, dwHighDateTime=0x1c9e8b3)) returned 1 [0085.389] SetFilePointer (in: hFile=0x90, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0085.389] ReadFile (in: hFile=0x90, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x3ea3, lpOverlapped=0x0) returned 1 [0085.429] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackground.jpg") returned="NotifierBackground.jpg" [0085.429] SetFilePointer (in: hFile=0x90, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0085.429] WriteFile (in: hFile=0x90, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x3ea3, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x3ea3, lpOverlapped=0x0) returned 1 [0085.430] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0085.430] CloseHandle (hObject=0x90) returned 1 [0085.431] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackground.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifierbackground.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackground.jpg. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifierbackground.jpg. ")) returned 1 [0085.432] FindNextFileA (in: hFindFile=0x5b7c78, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0085.432] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0085.432] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="NotifierBackgroundRTL.jpg") returned -1 [0085.432] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="NotifierBackgroundRTL.jpg") returned -1 [0085.432] lstrcmpiA (lpString1="", lpString2="NotifierBackgroundRTL.jpg") returned -1 [0085.432] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackground.jpg") returned="NotifierBackground.jpg" [0085.432] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="NotifierBackgroundRTL.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackgroundRTL.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackgroundRTL.jpg" [0085.432] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackgroundRTL.jpg", pszSpec="*.zip") returned 0 [0085.432] lstrlenA (lpString="*.zip") returned 5 [0085.432] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackgroundRTL.jpg", pszSpec="*.rar") returned 0 [0085.432] lstrlenA (lpString="*.rar") returned 5 [0085.432] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackgroundRTL.jpg", pszSpec="*.7z") returned 0 [0085.432] lstrlenA (lpString="*.7z") returned 4 [0085.432] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackgroundRTL.jpg", pszSpec="*.tar") returned 0 [0085.432] lstrlenA (lpString="*.tar") returned 5 [0085.432] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackgroundRTL.jpg", pszSpec="*.gzip") returned 0 [0085.432] lstrlenA (lpString="*.gzip") returned 6 [0085.433] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackgroundRTL.jpg", pszSpec="*.jpg") returned 1 [0085.433] lstrlenA (lpString="*.jpg") returned 5 [0085.433] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackgroundRTL.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackgroundRTL.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackgroundRTL.jpg" [0085.433] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackgroundRTL.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackgroundRTL.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackgroundRTL.jpg" [0085.433] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackgroundRTL.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackgroundRTL.jpg.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackgroundRTL.jpg." [0085.433] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackgroundRTL.jpg.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackgroundRTL.jpg. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackgroundRTL.jpg. " [0085.433] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackgroundRTL.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifierbackgroundrtl.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0085.433] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x40aa [0085.433] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x50410c00, dwHighDateTime=0x1c9e8b3), lpLastAccessTime=0x407536*(dwLowDateTime=0x59590d50, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x50410c00, dwHighDateTime=0x1c9e8b3)) returned 1 [0085.433] SetFilePointer (in: hFile=0x90, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0085.433] ReadFile (in: hFile=0x90, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x4050, lpOverlapped=0x0) returned 1 [0085.434] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackgroundRTL.jpg") returned="NotifierBackgroundRTL.jpg" [0085.434] SetFilePointer (in: hFile=0x90, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0085.434] WriteFile (in: hFile=0x90, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x4050, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x4050, lpOverlapped=0x0) returned 1 [0085.434] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0085.435] CloseHandle (hObject=0x90) returned 1 [0085.435] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackgroundRTL.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifierbackgroundrtl.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackgroundRTL.jpg. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifierbackgroundrtl.jpg. ")) returned 1 [0085.436] FindNextFileA (in: hFindFile=0x5b7c78, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0085.437] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0085.437] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="NotifierCloseButton.jpg") returned -1 [0085.437] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="NotifierCloseButton.jpg") returned -1 [0085.437] lstrcmpiA (lpString1="", lpString2="NotifierCloseButton.jpg") returned -1 [0085.437] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackgroundRTL.jpg") returned="NotifierBackgroundRTL.jpg" [0085.437] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="NotifierCloseButton.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierCloseButton.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierCloseButton.jpg" [0085.437] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierCloseButton.jpg", pszSpec="*.zip") returned 0 [0085.437] lstrlenA (lpString="*.zip") returned 5 [0085.437] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierCloseButton.jpg", pszSpec="*.rar") returned 0 [0085.437] lstrlenA (lpString="*.rar") returned 5 [0085.437] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierCloseButton.jpg", pszSpec="*.7z") returned 0 [0085.437] lstrlenA (lpString="*.7z") returned 4 [0085.437] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierCloseButton.jpg", pszSpec="*.tar") returned 0 [0085.437] lstrlenA (lpString="*.tar") returned 5 [0085.437] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierCloseButton.jpg", pszSpec="*.gzip") returned 0 [0085.437] lstrlenA (lpString="*.gzip") returned 6 [0085.437] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierCloseButton.jpg", pszSpec="*.jpg") returned 1 [0085.437] lstrlenA (lpString="*.jpg") returned 5 [0085.437] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierCloseButton.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierCloseButton.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierCloseButton.jpg" [0085.437] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierCloseButton.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierCloseButton.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierCloseButton.jpg" [0085.437] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierCloseButton.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierCloseButton.jpg.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierCloseButton.jpg." [0085.437] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierCloseButton.jpg.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierCloseButton.jpg. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierCloseButton.jpg. " [0085.437] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierCloseButton.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifierclosebutton.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0085.438] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2f2 [0085.438] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x79304700, dwHighDateTime=0x1c91151), lpLastAccessTime=0x407536*(dwLowDateTime=0x6a513ab0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x79304700, dwHighDateTime=0x1c91151)) returned 1 [0085.438] SetFilePointer (in: hFile=0x90, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0085.438] ReadFile (in: hFile=0x90, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x298, lpOverlapped=0x0) returned 1 [0085.449] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierCloseButton.jpg") returned="NotifierCloseButton.jpg" [0085.449] SetFilePointer (in: hFile=0x90, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0085.449] WriteFile (in: hFile=0x90, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x298, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x298, lpOverlapped=0x0) returned 1 [0085.449] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0085.449] CloseHandle (hObject=0x90) returned 1 [0085.450] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierCloseButton.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifierclosebutton.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierCloseButton.jpg. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifierclosebutton.jpg. ")) returned 1 [0085.451] FindNextFileA (in: hFindFile=0x5b7c78, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0085.451] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0085.451] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="NotifierDisableDownArrow.jpg") returned -1 [0085.451] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="NotifierDisableDownArrow.jpg") returned -1 [0085.451] lstrcmpiA (lpString1="", lpString2="NotifierDisableDownArrow.jpg") returned -1 [0085.451] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierCloseButton.jpg") returned="NotifierCloseButton.jpg" [0085.451] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="NotifierDisableDownArrow.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableDownArrow.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableDownArrow.jpg" [0085.451] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableDownArrow.jpg", pszSpec="*.zip") returned 0 [0085.451] lstrlenA (lpString="*.zip") returned 5 [0085.451] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableDownArrow.jpg", pszSpec="*.rar") returned 0 [0085.451] lstrlenA (lpString="*.rar") returned 5 [0085.451] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableDownArrow.jpg", pszSpec="*.7z") returned 0 [0085.451] lstrlenA (lpString="*.7z") returned 4 [0085.451] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableDownArrow.jpg", pszSpec="*.tar") returned 0 [0085.451] lstrlenA (lpString="*.tar") returned 5 [0085.452] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableDownArrow.jpg", pszSpec="*.gzip") returned 0 [0085.452] lstrlenA (lpString="*.gzip") returned 6 [0085.452] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableDownArrow.jpg", pszSpec="*.jpg") returned 1 [0085.452] lstrlenA (lpString="*.jpg") returned 5 [0085.452] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableDownArrow.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableDownArrow.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableDownArrow.jpg" [0085.452] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableDownArrow.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableDownArrow.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableDownArrow.jpg" [0085.452] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableDownArrow.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableDownArrow.jpg.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableDownArrow.jpg." [0085.452] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableDownArrow.jpg.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableDownArrow.jpg. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableDownArrow.jpg. " [0085.452] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableDownArrow.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifierdisabledownarrow.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0085.452] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2cc [0085.452] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x7f262800, dwHighDateTime=0x1c91151), lpLastAccessTime=0x407536*(dwLowDateTime=0x6a539c10, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x7f262800, dwHighDateTime=0x1c91151)) returned 1 [0085.452] SetFilePointer (in: hFile=0x90, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0085.452] ReadFile (in: hFile=0x90, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x272, lpOverlapped=0x0) returned 1 [0085.465] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableDownArrow.jpg") returned="NotifierDisableDownArrow.jpg" [0085.465] SetFilePointer (in: hFile=0x90, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0085.465] WriteFile (in: hFile=0x90, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x272, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x272, lpOverlapped=0x0) returned 1 [0085.465] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0085.465] CloseHandle (hObject=0x90) returned 1 [0085.466] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableDownArrow.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifierdisabledownarrow.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableDownArrow.jpg. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifierdisabledownarrow.jpg. ")) returned 1 [0085.467] FindNextFileA (in: hFindFile=0x5b7c78, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0085.467] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0085.467] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="NotifierDisableUpArrow.jpg") returned -1 [0085.467] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="NotifierDisableUpArrow.jpg") returned -1 [0085.467] lstrcmpiA (lpString1="", lpString2="NotifierDisableUpArrow.jpg") returned -1 [0085.467] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableDownArrow.jpg") returned="NotifierDisableDownArrow.jpg" [0085.467] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="NotifierDisableUpArrow.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableUpArrow.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableUpArrow.jpg" [0085.467] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableUpArrow.jpg", pszSpec="*.zip") returned 0 [0085.467] lstrlenA (lpString="*.zip") returned 5 [0085.467] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableUpArrow.jpg", pszSpec="*.rar") returned 0 [0085.467] lstrlenA (lpString="*.rar") returned 5 [0085.467] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableUpArrow.jpg", pszSpec="*.7z") returned 0 [0085.467] lstrlenA (lpString="*.7z") returned 4 [0085.467] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableUpArrow.jpg", pszSpec="*.tar") returned 0 [0085.467] lstrlenA (lpString="*.tar") returned 5 [0085.467] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableUpArrow.jpg", pszSpec="*.gzip") returned 0 [0085.467] lstrlenA (lpString="*.gzip") returned 6 [0085.467] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableUpArrow.jpg", pszSpec="*.jpg") returned 1 [0085.467] lstrlenA (lpString="*.jpg") returned 5 [0085.467] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableUpArrow.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableUpArrow.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableUpArrow.jpg" [0085.467] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableUpArrow.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableUpArrow.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableUpArrow.jpg" [0085.467] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableUpArrow.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableUpArrow.jpg.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableUpArrow.jpg." [0085.467] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableUpArrow.jpg.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableUpArrow.jpg. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableUpArrow.jpg. " [0085.467] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableUpArrow.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifierdisableuparrow.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0085.468] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x307 [0085.468] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x82b9af00, dwHighDateTime=0x1c91151), lpLastAccessTime=0x407536*(dwLowDateTime=0x59590d50, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x82b9af00, dwHighDateTime=0x1c91151)) returned 1 [0085.468] SetFilePointer (in: hFile=0x90, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0085.468] ReadFile (in: hFile=0x90, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x2ad, lpOverlapped=0x0) returned 1 [0085.540] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableUpArrow.jpg") returned="NotifierDisableUpArrow.jpg" [0085.540] SetFilePointer (in: hFile=0x90, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0085.540] WriteFile (in: hFile=0x90, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x2ad, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x2ad, lpOverlapped=0x0) returned 1 [0085.540] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0085.540] CloseHandle (hObject=0x90) returned 1 [0085.541] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableUpArrow.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifierdisableuparrow.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableUpArrow.jpg. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifierdisableuparrow.jpg. ")) returned 1 [0085.542] FindNextFileA (in: hFindFile=0x5b7c78, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0085.542] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0085.542] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="NotifierDownArrow.jpg") returned -1 [0085.542] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="NotifierDownArrow.jpg") returned -1 [0085.542] lstrcmpiA (lpString1="", lpString2="NotifierDownArrow.jpg") returned -1 [0085.542] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableUpArrow.jpg") returned="NotifierDisableUpArrow.jpg" [0085.542] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="NotifierDownArrow.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDownArrow.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDownArrow.jpg" [0085.542] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDownArrow.jpg", pszSpec="*.zip") returned 0 [0085.542] lstrlenA (lpString="*.zip") returned 5 [0085.542] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDownArrow.jpg", pszSpec="*.rar") returned 0 [0085.542] lstrlenA (lpString="*.rar") returned 5 [0085.542] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDownArrow.jpg", pszSpec="*.7z") returned 0 [0085.542] lstrlenA (lpString="*.7z") returned 4 [0085.542] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDownArrow.jpg", pszSpec="*.tar") returned 0 [0085.543] lstrlenA (lpString="*.tar") returned 5 [0085.543] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDownArrow.jpg", pszSpec="*.gzip") returned 0 [0085.543] lstrlenA (lpString="*.gzip") returned 6 [0085.543] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDownArrow.jpg", pszSpec="*.jpg") returned 1 [0085.543] lstrlenA (lpString="*.jpg") returned 5 [0085.543] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDownArrow.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDownArrow.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDownArrow.jpg" [0085.543] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDownArrow.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDownArrow.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDownArrow.jpg" [0085.543] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDownArrow.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDownArrow.jpg.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDownArrow.jpg." [0085.543] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDownArrow.jpg.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDownArrow.jpg. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDownArrow.jpg. " [0085.543] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDownArrow.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifierdownarrow.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0085.543] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x368 [0085.543] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x864d3600, dwHighDateTime=0x1c91151), lpLastAccessTime=0x407536*(dwLowDateTime=0x59590d50, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x864d3600, dwHighDateTime=0x1c91151)) returned 1 [0085.543] SetFilePointer (in: hFile=0x90, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0085.544] ReadFile (in: hFile=0x90, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x30e, lpOverlapped=0x0) returned 1 [0085.565] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDownArrow.jpg") returned="NotifierDownArrow.jpg" [0085.565] SetFilePointer (in: hFile=0x90, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0085.565] WriteFile (in: hFile=0x90, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x30e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x30e, lpOverlapped=0x0) returned 1 [0085.565] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0085.565] CloseHandle (hObject=0x90) returned 1 [0085.566] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDownArrow.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifierdownarrow.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDownArrow.jpg. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifierdownarrow.jpg. ")) returned 1 [0085.567] FindNextFileA (in: hFindFile=0x5b7c78, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0085.567] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0085.567] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="NotifierUpArrow.jpg") returned -1 [0085.567] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="NotifierUpArrow.jpg") returned -1 [0085.567] lstrcmpiA (lpString1="", lpString2="NotifierUpArrow.jpg") returned -1 [0085.567] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDownArrow.jpg") returned="NotifierDownArrow.jpg" [0085.567] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="NotifierUpArrow.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierUpArrow.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierUpArrow.jpg" [0085.567] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierUpArrow.jpg", pszSpec="*.zip") returned 0 [0085.567] lstrlenA (lpString="*.zip") returned 5 [0085.567] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierUpArrow.jpg", pszSpec="*.rar") returned 0 [0085.567] lstrlenA (lpString="*.rar") returned 5 [0085.567] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierUpArrow.jpg", pszSpec="*.7z") returned 0 [0085.567] lstrlenA (lpString="*.7z") returned 4 [0085.567] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierUpArrow.jpg", pszSpec="*.tar") returned 0 [0085.567] lstrlenA (lpString="*.tar") returned 5 [0085.567] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierUpArrow.jpg", pszSpec="*.gzip") returned 0 [0085.567] lstrlenA (lpString="*.gzip") returned 6 [0085.567] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierUpArrow.jpg", pszSpec="*.jpg") returned 1 [0085.567] lstrlenA (lpString="*.jpg") returned 5 [0085.567] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierUpArrow.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierUpArrow.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierUpArrow.jpg" [0085.567] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierUpArrow.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierUpArrow.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierUpArrow.jpg" [0085.567] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierUpArrow.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierUpArrow.jpg.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierUpArrow.jpg." [0085.567] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierUpArrow.jpg.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierUpArrow.jpg. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierUpArrow.jpg. " [0085.567] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierUpArrow.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifieruparrow.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0085.568] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3c0 [0085.568] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x89e0bd00, dwHighDateTime=0x1c91151), lpLastAccessTime=0x407536*(dwLowDateTime=0x6a87fa50, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x89e0bd00, dwHighDateTime=0x1c91151)) returned 1 [0085.568] SetFilePointer (in: hFile=0x90, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0085.568] ReadFile (in: hFile=0x90, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x366, lpOverlapped=0x0) returned 1 [0085.620] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierUpArrow.jpg") returned="NotifierUpArrow.jpg" [0085.620] SetFilePointer (in: hFile=0x90, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0085.621] WriteFile (in: hFile=0x90, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x366, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x366, lpOverlapped=0x0) returned 1 [0085.621] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0085.621] CloseHandle (hObject=0x90) returned 1 [0085.621] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierUpArrow.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifieruparrow.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierUpArrow.jpg. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifieruparrow.jpg. ")) returned 1 [0085.622] FindNextFileA (in: hFindFile=0x5b7c78, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0085.622] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0085.622] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="NotifierWindowMask.bmp") returned -1 [0085.622] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="NotifierWindowMask.bmp") returned -1 [0085.622] lstrcmpiA (lpString1="", lpString2="NotifierWindowMask.bmp") returned -1 [0085.622] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierUpArrow.jpg") returned="NotifierUpArrow.jpg" [0085.622] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="NotifierWindowMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMask.bmp" [0085.622] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMask.bmp", pszSpec="*.zip") returned 0 [0085.623] lstrlenA (lpString="*.zip") returned 5 [0085.623] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMask.bmp", pszSpec="*.rar") returned 0 [0085.623] lstrlenA (lpString="*.rar") returned 5 [0085.623] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMask.bmp", pszSpec="*.7z") returned 0 [0085.623] lstrlenA (lpString="*.7z") returned 4 [0085.623] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMask.bmp", pszSpec="*.tar") returned 0 [0085.623] lstrlenA (lpString="*.tar") returned 5 [0085.623] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMask.bmp", pszSpec="*.gzip") returned 0 [0085.623] lstrlenA (lpString="*.gzip") returned 6 [0085.623] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMask.bmp", pszSpec="*.jpg") returned 0 [0085.623] lstrlenA (lpString="*.jpg") returned 5 [0085.623] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMask.bmp", pszSpec="*.jpeg") returned 0 [0085.623] lstrlenA (lpString="*.jpeg") returned 6 [0085.623] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMask.bmp", pszSpec="*.psd") returned 0 [0085.623] lstrlenA (lpString="*.psd") returned 5 [0085.623] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMask.bmp", pszSpec="*.cdr") returned 0 [0085.623] lstrlenA (lpString="*.cdr") returned 5 [0085.623] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMask.bmp", pszSpec="*.dwg") returned 0 [0085.623] lstrlenA (lpString="*.dwg") returned 5 [0085.623] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMask.bmp", pszSpec="*.max") returned 0 [0085.623] lstrlenA (lpString="*.max") returned 5 [0085.623] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMask.bmp", pszSpec="*.bmp") returned 1 [0085.623] lstrlenA (lpString="*.bmp") returned 5 [0085.623] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMask.bmp" [0085.623] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMask.bmp" [0085.623] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMask.bmp", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMask.bmp.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMask.bmp." [0085.623] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMask.bmp.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMask.bmp. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMask.bmp. " [0085.623] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifierwindowmask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0085.624] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x133a [0085.624] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8472000, dwHighDateTime=0x1c90f02), lpLastAccessTime=0x407536*(dwLowDateTime=0x59590d50, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8472000, dwHighDateTime=0x1c90f02)) returned 1 [0085.624] SetFilePointer (in: hFile=0x90, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0085.624] ReadFile (in: hFile=0x90, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x12e0, lpOverlapped=0x0) returned 1 [0085.653] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMask.bmp") returned="NotifierWindowMask.bmp" [0085.653] SetFilePointer (in: hFile=0x90, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0085.653] WriteFile (in: hFile=0x90, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x12e0, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x12e0, lpOverlapped=0x0) returned 1 [0085.653] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0085.653] CloseHandle (hObject=0x90) returned 1 [0085.654] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifierwindowmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMask.bmp. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifierwindowmask.bmp. ")) returned 1 [0085.655] FindNextFileA (in: hFindFile=0x5b7c78, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0085.655] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0085.655] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="NotifierWindowMaskRTL.bmp") returned -1 [0085.655] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="NotifierWindowMaskRTL.bmp") returned -1 [0085.655] lstrcmpiA (lpString1="", lpString2="NotifierWindowMaskRTL.bmp") returned -1 [0085.655] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMask.bmp") returned="NotifierWindowMask.bmp" [0085.655] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="NotifierWindowMaskRTL.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMaskRTL.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMaskRTL.bmp" [0085.655] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMaskRTL.bmp", pszSpec="*.zip") returned 0 [0085.655] lstrlenA (lpString="*.zip") returned 5 [0085.655] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMaskRTL.bmp", pszSpec="*.rar") returned 0 [0085.655] lstrlenA (lpString="*.rar") returned 5 [0085.655] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMaskRTL.bmp", pszSpec="*.7z") returned 0 [0085.655] lstrlenA (lpString="*.7z") returned 4 [0085.655] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMaskRTL.bmp", pszSpec="*.tar") returned 0 [0085.655] lstrlenA (lpString="*.tar") returned 5 [0085.655] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMaskRTL.bmp", pszSpec="*.gzip") returned 0 [0085.655] lstrlenA (lpString="*.gzip") returned 6 [0085.655] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMaskRTL.bmp", pszSpec="*.jpg") returned 0 [0085.655] lstrlenA (lpString="*.jpg") returned 5 [0085.655] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMaskRTL.bmp", pszSpec="*.jpeg") returned 0 [0085.655] lstrlenA (lpString="*.jpeg") returned 6 [0085.655] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMaskRTL.bmp", pszSpec="*.psd") returned 0 [0085.655] lstrlenA (lpString="*.psd") returned 5 [0085.655] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMaskRTL.bmp", pszSpec="*.cdr") returned 0 [0085.655] lstrlenA (lpString="*.cdr") returned 5 [0085.655] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMaskRTL.bmp", pszSpec="*.dwg") returned 0 [0085.655] lstrlenA (lpString="*.dwg") returned 5 [0085.655] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMaskRTL.bmp", pszSpec="*.max") returned 0 [0085.655] lstrlenA (lpString="*.max") returned 5 [0085.655] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMaskRTL.bmp", pszSpec="*.bmp") returned 1 [0085.655] lstrlenA (lpString="*.bmp") returned 5 [0085.655] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMaskRTL.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMaskRTL.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMaskRTL.bmp" [0085.655] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMaskRTL.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMaskRTL.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMaskRTL.bmp" [0085.655] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMaskRTL.bmp", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMaskRTL.bmp.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMaskRTL.bmp." [0085.655] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMaskRTL.bmp.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMaskRTL.bmp. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMaskRTL.bmp. " [0085.655] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMaskRTL.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifierwindowmaskrtl.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0085.656] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x133a [0085.656] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x3a588200, dwHighDateTime=0x1c90f02), lpLastAccessTime=0x407536*(dwLowDateTime=0x6a87fa50, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x3a588200, dwHighDateTime=0x1c90f02)) returned 1 [0085.656] SetFilePointer (in: hFile=0x90, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0085.656] ReadFile (in: hFile=0x90, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x12e0, lpOverlapped=0x0) returned 1 [0085.673] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMaskRTL.bmp") returned="NotifierWindowMaskRTL.bmp" [0085.673] SetFilePointer (in: hFile=0x90, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0085.673] WriteFile (in: hFile=0x90, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x12e0, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x12e0, lpOverlapped=0x0) returned 1 [0085.673] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0085.673] CloseHandle (hObject=0x90) returned 1 [0085.674] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMaskRTL.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifierwindowmaskrtl.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMaskRTL.bmp. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifierwindowmaskrtl.bmp. ")) returned 1 [0085.675] FindNextFileA (in: hFindFile=0x5b7c78, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0085.675] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0085.675] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="OutlineToolIconImages.jpg") returned -1 [0085.675] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OutlineToolIconImages.jpg") returned -1 [0085.675] lstrcmpiA (lpString1="", lpString2="OutlineToolIconImages.jpg") returned -1 [0085.675] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMaskRTL.bmp") returned="NotifierWindowMaskRTL.bmp" [0085.675] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="OutlineToolIconImages.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImages.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImages.jpg" [0085.675] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImages.jpg", pszSpec="*.zip") returned 0 [0085.675] lstrlenA (lpString="*.zip") returned 5 [0085.675] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImages.jpg", pszSpec="*.rar") returned 0 [0085.675] lstrlenA (lpString="*.rar") returned 5 [0085.675] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImages.jpg", pszSpec="*.7z") returned 0 [0085.675] lstrlenA (lpString="*.7z") returned 4 [0085.675] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImages.jpg", pszSpec="*.tar") returned 0 [0085.675] lstrlenA (lpString="*.tar") returned 5 [0085.675] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImages.jpg", pszSpec="*.gzip") returned 0 [0085.675] lstrlenA (lpString="*.gzip") returned 6 [0085.675] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImages.jpg", pszSpec="*.jpg") returned 1 [0085.675] lstrlenA (lpString="*.jpg") returned 5 [0085.675] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImages.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImages.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImages.jpg" [0085.675] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImages.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImages.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImages.jpg" [0085.675] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImages.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImages.jpg.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImages.jpg." [0085.675] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImages.jpg.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImages.jpg. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImages.jpg. " [0085.676] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\outlinetooliconimages.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0085.676] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1e35 [0085.676] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x7689a500, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x59995270, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x7689a500, dwHighDateTime=0x1c747ea)) returned 1 [0085.676] SetFilePointer (in: hFile=0x90, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0085.676] ReadFile (in: hFile=0x90, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x1ddb, lpOverlapped=0x0) returned 1 [0085.681] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImages.jpg") returned="OutlineToolIconImages.jpg" [0085.681] SetFilePointer (in: hFile=0x90, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0085.681] WriteFile (in: hFile=0x90, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x1ddb, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x1ddb, lpOverlapped=0x0) returned 1 [0085.681] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0085.681] CloseHandle (hObject=0x90) returned 1 [0085.682] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\outlinetooliconimages.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImages.jpg. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\outlinetooliconimages.jpg. ")) returned 1 [0085.685] FindNextFileA (in: hFindFile=0x5b7c78, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0085.685] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0085.685] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="OutlineToolIconImagesMask.bmp") returned -1 [0085.685] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OutlineToolIconImagesMask.bmp") returned -1 [0085.685] lstrcmpiA (lpString1="", lpString2="OutlineToolIconImagesMask.bmp") returned -1 [0085.685] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImages.jpg") returned="OutlineToolIconImages.jpg" [0085.685] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="OutlineToolIconImagesMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImagesMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImagesMask.bmp" [0085.685] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImagesMask.bmp", pszSpec="*.zip") returned 0 [0085.685] lstrlenA (lpString="*.zip") returned 5 [0085.685] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImagesMask.bmp", pszSpec="*.rar") returned 0 [0085.685] lstrlenA (lpString="*.rar") returned 5 [0085.685] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImagesMask.bmp", pszSpec="*.7z") returned 0 [0085.685] lstrlenA (lpString="*.7z") returned 4 [0085.685] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImagesMask.bmp", pszSpec="*.tar") returned 0 [0085.686] lstrlenA (lpString="*.tar") returned 5 [0085.686] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImagesMask.bmp", pszSpec="*.gzip") returned 0 [0085.686] lstrlenA (lpString="*.gzip") returned 6 [0085.686] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImagesMask.bmp", pszSpec="*.jpg") returned 0 [0085.686] lstrlenA (lpString="*.jpg") returned 5 [0085.686] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImagesMask.bmp", pszSpec="*.jpeg") returned 0 [0085.686] lstrlenA (lpString="*.jpeg") returned 6 [0085.686] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImagesMask.bmp", pszSpec="*.psd") returned 0 [0085.686] lstrlenA (lpString="*.psd") returned 5 [0085.686] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImagesMask.bmp", pszSpec="*.cdr") returned 0 [0085.686] lstrlenA (lpString="*.cdr") returned 5 [0085.686] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImagesMask.bmp", pszSpec="*.dwg") returned 0 [0085.686] lstrlenA (lpString="*.dwg") returned 5 [0085.686] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImagesMask.bmp", pszSpec="*.max") returned 0 [0085.686] lstrlenA (lpString="*.max") returned 5 [0085.686] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImagesMask.bmp", pszSpec="*.bmp") returned 1 [0085.686] lstrlenA (lpString="*.bmp") returned 5 [0085.686] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImagesMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImagesMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImagesMask.bmp" [0085.686] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImagesMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImagesMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImagesMask.bmp" [0085.686] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImagesMask.bmp", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImagesMask.bmp.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImagesMask.bmp." [0085.686] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImagesMask.bmp.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImagesMask.bmp. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImagesMask.bmp. " [0085.686] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\outlinetooliconimagesmask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0085.687] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1938 [0085.687] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x77bad200, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x6c393490, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x77bad200, dwHighDateTime=0x1c747ea)) returned 1 [0085.687] SetFilePointer (in: hFile=0x90, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0085.687] ReadFile (in: hFile=0x90, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x18de, lpOverlapped=0x0) returned 1 [0085.713] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImagesMask.bmp") returned="OutlineToolIconImagesMask.bmp" [0085.713] SetFilePointer (in: hFile=0x90, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0085.713] WriteFile (in: hFile=0x90, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x18de, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x18de, lpOverlapped=0x0) returned 1 [0085.713] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0085.713] CloseHandle (hObject=0x90) returned 1 [0085.714] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\outlinetooliconimagesmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImagesMask.bmp. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\outlinetooliconimagesmask.bmp. ")) returned 1 [0085.715] FindNextFileA (in: hFindFile=0x5b7c78, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0085.715] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0085.715] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="OutofSyncIconImages.jpg") returned -1 [0085.715] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OutofSyncIconImages.jpg") returned -1 [0085.715] lstrcmpiA (lpString1="", lpString2="OutofSyncIconImages.jpg") returned -1 [0085.715] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImagesMask.bmp") returned="OutlineToolIconImagesMask.bmp" [0085.715] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="OutofSyncIconImages.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImages.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImages.jpg" [0085.715] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImages.jpg", pszSpec="*.zip") returned 0 [0085.715] lstrlenA (lpString="*.zip") returned 5 [0085.715] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImages.jpg", pszSpec="*.rar") returned 0 [0085.715] lstrlenA (lpString="*.rar") returned 5 [0085.715] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImages.jpg", pszSpec="*.7z") returned 0 [0085.715] lstrlenA (lpString="*.7z") returned 4 [0085.715] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImages.jpg", pszSpec="*.tar") returned 0 [0085.715] lstrlenA (lpString="*.tar") returned 5 [0085.715] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImages.jpg", pszSpec="*.gzip") returned 0 [0085.716] lstrlenA (lpString="*.gzip") returned 6 [0085.716] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImages.jpg", pszSpec="*.jpg") returned 1 [0085.716] lstrlenA (lpString="*.jpg") returned 5 [0085.716] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImages.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImages.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImages.jpg" [0085.716] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImages.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImages.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImages.jpg" [0085.716] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImages.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImages.jpg.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImages.jpg." [0085.716] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImages.jpg.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImages.jpg. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImages.jpg. " [0085.716] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\outofsynciconimages.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0085.717] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xf8d [0085.717] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x77bad200, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x6cd3edf0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x77bad200, dwHighDateTime=0x1c747ea)) returned 1 [0085.717] SetFilePointer (in: hFile=0x90, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0085.717] ReadFile (in: hFile=0x90, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0xf33, lpOverlapped=0x0) returned 1 [0085.725] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImages.jpg") returned="OutofSyncIconImages.jpg" [0085.725] SetFilePointer (in: hFile=0x90, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0085.725] WriteFile (in: hFile=0x90, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0xf33, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0xf33, lpOverlapped=0x0) returned 1 [0085.725] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0085.725] CloseHandle (hObject=0x90) returned 1 [0085.726] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\outofsynciconimages.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImages.jpg. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\outofsynciconimages.jpg. ")) returned 1 [0085.727] FindNextFileA (in: hFindFile=0x5b7c78, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0085.727] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0085.727] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="OutofSyncIconImagesMask.bmp") returned -1 [0085.727] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OutofSyncIconImagesMask.bmp") returned -1 [0085.727] lstrcmpiA (lpString1="", lpString2="OutofSyncIconImagesMask.bmp") returned -1 [0085.727] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImages.jpg") returned="OutofSyncIconImages.jpg" [0085.727] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="OutofSyncIconImagesMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImagesMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImagesMask.bmp" [0085.727] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImagesMask.bmp", pszSpec="*.zip") returned 0 [0085.727] lstrlenA (lpString="*.zip") returned 5 [0085.727] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImagesMask.bmp", pszSpec="*.rar") returned 0 [0085.727] lstrlenA (lpString="*.rar") returned 5 [0085.727] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImagesMask.bmp", pszSpec="*.7z") returned 0 [0085.727] lstrlenA (lpString="*.7z") returned 4 [0085.727] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImagesMask.bmp", pszSpec="*.tar") returned 0 [0085.727] lstrlenA (lpString="*.tar") returned 5 [0085.727] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImagesMask.bmp", pszSpec="*.gzip") returned 0 [0085.727] lstrlenA (lpString="*.gzip") returned 6 [0085.727] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImagesMask.bmp", pszSpec="*.jpg") returned 0 [0085.727] lstrlenA (lpString="*.jpg") returned 5 [0085.727] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImagesMask.bmp", pszSpec="*.jpeg") returned 0 [0085.727] lstrlenA (lpString="*.jpeg") returned 6 [0085.727] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImagesMask.bmp", pszSpec="*.psd") returned 0 [0085.728] lstrlenA (lpString="*.psd") returned 5 [0085.728] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImagesMask.bmp", pszSpec="*.cdr") returned 0 [0085.728] lstrlenA (lpString="*.cdr") returned 5 [0085.728] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImagesMask.bmp", pszSpec="*.dwg") returned 0 [0085.728] lstrlenA (lpString="*.dwg") returned 5 [0085.728] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImagesMask.bmp", pszSpec="*.max") returned 0 [0085.728] lstrlenA (lpString="*.max") returned 5 [0085.728] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImagesMask.bmp", pszSpec="*.bmp") returned 1 [0085.728] lstrlenA (lpString="*.bmp") returned 5 [0085.728] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImagesMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImagesMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImagesMask.bmp" [0085.728] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImagesMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImagesMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImagesMask.bmp" [0085.728] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImagesMask.bmp", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImagesMask.bmp.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImagesMask.bmp." [0085.728] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImagesMask.bmp.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImagesMask.bmp. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImagesMask.bmp. " [0085.728] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\outofsynciconimagesmask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0085.728] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xc0 [0085.728] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x77bad200, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x59c42b30, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x77bad200, dwHighDateTime=0x1c747ea)) returned 1 [0085.728] SetFilePointer (in: hFile=0x90, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0085.729] ReadFile (in: hFile=0x90, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x66, lpOverlapped=0x0) returned 1 [0085.729] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImagesMask.bmp") returned="OutofSyncIconImagesMask.bmp" [0085.729] SetFilePointer (in: hFile=0x90, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0085.729] WriteFile (in: hFile=0x90, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x66, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x66, lpOverlapped=0x0) returned 1 [0085.730] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0085.730] CloseHandle (hObject=0x90) returned 1 [0085.730] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\outofsynciconimagesmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImagesMask.bmp. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\outofsynciconimagesmask.bmp. ")) returned 1 [0085.731] FindNextFileA (in: hFindFile=0x5b7c78, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0085.731] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0085.731] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="PicturesToolIconImages.jpg") returned -1 [0085.731] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PicturesToolIconImages.jpg") returned -1 [0085.731] lstrcmpiA (lpString1="", lpString2="PicturesToolIconImages.jpg") returned -1 [0085.731] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImagesMask.bmp") returned="OutofSyncIconImagesMask.bmp" [0085.731] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="PicturesToolIconImages.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImages.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImages.jpg" [0085.731] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImages.jpg", pszSpec="*.zip") returned 0 [0085.731] lstrlenA (lpString="*.zip") returned 5 [0085.731] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImages.jpg", pszSpec="*.rar") returned 0 [0085.731] lstrlenA (lpString="*.rar") returned 5 [0085.731] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImages.jpg", pszSpec="*.7z") returned 0 [0085.731] lstrlenA (lpString="*.7z") returned 4 [0085.731] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImages.jpg", pszSpec="*.tar") returned 0 [0085.731] lstrlenA (lpString="*.tar") returned 5 [0085.731] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImages.jpg", pszSpec="*.gzip") returned 0 [0085.731] lstrlenA (lpString="*.gzip") returned 6 [0085.731] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImages.jpg", pszSpec="*.jpg") returned 1 [0085.732] lstrlenA (lpString="*.jpg") returned 5 [0085.732] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImages.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImages.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImages.jpg" [0085.732] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImages.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImages.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImages.jpg" [0085.732] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImages.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImages.jpg.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImages.jpg." [0085.732] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImages.jpg.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImages.jpg. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImages.jpg. " [0085.732] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\picturestooliconimages.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0085.733] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x5203 [0085.733] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x7a3c500, dwHighDateTime=0x1ca032f), lpLastAccessTime=0x407536*(dwLowDateTime=0x6cee1d10, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x7a3c500, dwHighDateTime=0x1ca032f)) returned 1 [0085.733] SetFilePointer (in: hFile=0x90, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0085.733] ReadFile (in: hFile=0x90, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x51a9, lpOverlapped=0x0) returned 1 [0085.765] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImages.jpg") returned="PicturesToolIconImages.jpg" [0085.765] SetFilePointer (in: hFile=0x90, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0085.765] WriteFile (in: hFile=0x90, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x51a9, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x51a9, lpOverlapped=0x0) returned 1 [0085.765] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0085.765] CloseHandle (hObject=0x90) returned 1 [0085.766] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\picturestooliconimages.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImages.jpg. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\picturestooliconimages.jpg. ")) returned 1 [0085.768] FindNextFileA (in: hFindFile=0x5b7c78, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0085.768] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0085.768] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="PicturesToolIconImagesMask.bmp") returned -1 [0085.768] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PicturesToolIconImagesMask.bmp") returned -1 [0085.768] lstrcmpiA (lpString1="", lpString2="PicturesToolIconImagesMask.bmp") returned -1 [0085.768] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImages.jpg") returned="PicturesToolIconImages.jpg" [0085.768] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="PicturesToolIconImagesMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImagesMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImagesMask.bmp" [0085.768] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImagesMask.bmp", pszSpec="*.zip") returned 0 [0085.768] lstrlenA (lpString="*.zip") returned 5 [0085.768] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImagesMask.bmp", pszSpec="*.rar") returned 0 [0085.768] lstrlenA (lpString="*.rar") returned 5 [0085.768] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImagesMask.bmp", pszSpec="*.7z") returned 0 [0085.768] lstrlenA (lpString="*.7z") returned 4 [0085.768] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImagesMask.bmp", pszSpec="*.tar") returned 0 [0085.768] lstrlenA (lpString="*.tar") returned 5 [0085.768] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImagesMask.bmp", pszSpec="*.gzip") returned 0 [0085.768] lstrlenA (lpString="*.gzip") returned 6 [0085.768] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImagesMask.bmp", pszSpec="*.jpg") returned 0 [0085.768] lstrlenA (lpString="*.jpg") returned 5 [0085.768] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImagesMask.bmp", pszSpec="*.jpeg") returned 0 [0085.768] lstrlenA (lpString="*.jpeg") returned 6 [0085.768] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImagesMask.bmp", pszSpec="*.psd") returned 0 [0085.768] lstrlenA (lpString="*.psd") returned 5 [0085.768] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImagesMask.bmp", pszSpec="*.cdr") returned 0 [0085.768] lstrlenA (lpString="*.cdr") returned 5 [0085.768] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImagesMask.bmp", pszSpec="*.dwg") returned 0 [0085.768] lstrlenA (lpString="*.dwg") returned 5 [0085.768] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImagesMask.bmp", pszSpec="*.max") returned 0 [0085.768] lstrlenA (lpString="*.max") returned 5 [0085.768] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImagesMask.bmp", pszSpec="*.bmp") returned 1 [0085.768] lstrlenA (lpString="*.bmp") returned 5 [0085.768] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImagesMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImagesMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImagesMask.bmp" [0085.768] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImagesMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImagesMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImagesMask.bmp" [0085.768] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImagesMask.bmp", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImagesMask.bmp.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImagesMask.bmp." [0085.768] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImagesMask.bmp.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImagesMask.bmp. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImagesMask.bmp. " [0085.769] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\picturestooliconimagesmask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0085.769] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1238 [0085.769] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xfe1a5d00, dwHighDateTime=0x1ca032e), lpLastAccessTime=0x407536*(dwLowDateTime=0x5a44b570, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xfe1a5d00, dwHighDateTime=0x1ca032e)) returned 1 [0085.769] SetFilePointer (in: hFile=0x90, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0085.769] ReadFile (in: hFile=0x90, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x11de, lpOverlapped=0x0) returned 1 [0085.790] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImagesMask.bmp") returned="PicturesToolIconImagesMask.bmp" [0085.790] SetFilePointer (in: hFile=0x90, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0085.790] WriteFile (in: hFile=0x90, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x11de, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x11de, lpOverlapped=0x0) returned 1 [0085.790] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0085.790] CloseHandle (hObject=0x90) returned 1 [0085.791] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\picturestooliconimagesmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImagesMask.bmp. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\picturestooliconimagesmask.bmp. ")) returned 1 [0085.792] FindNextFileA (in: hFindFile=0x5b7c78, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0085.792] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0085.792] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="QuestionIcon.jpg") returned -1 [0085.792] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="QuestionIcon.jpg") returned -1 [0085.792] lstrcmpiA (lpString1="", lpString2="QuestionIcon.jpg") returned -1 [0085.792] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImagesMask.bmp") returned="PicturesToolIconImagesMask.bmp" [0085.793] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="QuestionIcon.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIcon.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIcon.jpg" [0085.793] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIcon.jpg", pszSpec="*.zip") returned 0 [0085.793] lstrlenA (lpString="*.zip") returned 5 [0085.793] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIcon.jpg", pszSpec="*.rar") returned 0 [0085.793] lstrlenA (lpString="*.rar") returned 5 [0085.793] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIcon.jpg", pszSpec="*.7z") returned 0 [0085.793] lstrlenA (lpString="*.7z") returned 4 [0085.793] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIcon.jpg", pszSpec="*.tar") returned 0 [0085.793] lstrlenA (lpString="*.tar") returned 5 [0085.793] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIcon.jpg", pszSpec="*.gzip") returned 0 [0085.793] lstrlenA (lpString="*.gzip") returned 6 [0085.793] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIcon.jpg", pszSpec="*.jpg") returned 1 [0085.793] lstrlenA (lpString="*.jpg") returned 5 [0085.793] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIcon.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIcon.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIcon.jpg" [0085.793] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIcon.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIcon.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIcon.jpg" [0085.793] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIcon.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIcon.jpg.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIcon.jpg." [0085.793] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIcon.jpg.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIcon.jpg. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIcon.jpg. " [0085.793] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIcon.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\questionicon.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0085.794] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xc1b [0085.794] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x77bad200, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x6d0d0ef0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x77bad200, dwHighDateTime=0x1c747ea)) returned 1 [0085.794] SetFilePointer (in: hFile=0x90, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0085.794] ReadFile (in: hFile=0x90, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0xbc1, lpOverlapped=0x0) returned 1 [0085.808] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIcon.jpg") returned="QuestionIcon.jpg" [0085.808] SetFilePointer (in: hFile=0x90, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0085.808] WriteFile (in: hFile=0x90, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0xbc1, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0xbc1, lpOverlapped=0x0) returned 1 [0085.808] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0085.808] CloseHandle (hObject=0x90) returned 1 [0085.809] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIcon.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\questionicon.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIcon.jpg. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\questionicon.jpg. ")) returned 1 [0085.810] FindNextFileA (in: hFindFile=0x5b7c78, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0085.810] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0085.810] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="QuestionIconMask.bmp") returned -1 [0085.810] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="QuestionIconMask.bmp") returned -1 [0085.810] lstrcmpiA (lpString1="", lpString2="QuestionIconMask.bmp") returned -1 [0085.810] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIcon.jpg") returned="QuestionIcon.jpg" [0085.810] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="QuestionIconMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIconMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIconMask.bmp" [0085.810] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIconMask.bmp", pszSpec="*.zip") returned 0 [0085.810] lstrlenA (lpString="*.zip") returned 5 [0085.810] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIconMask.bmp", pszSpec="*.rar") returned 0 [0085.810] lstrlenA (lpString="*.rar") returned 5 [0085.810] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIconMask.bmp", pszSpec="*.7z") returned 0 [0085.810] lstrlenA (lpString="*.7z") returned 4 [0085.810] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIconMask.bmp", pszSpec="*.tar") returned 0 [0085.810] lstrlenA (lpString="*.tar") returned 5 [0085.810] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIconMask.bmp", pszSpec="*.gzip") returned 0 [0085.810] lstrlenA (lpString="*.gzip") returned 6 [0085.810] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIconMask.bmp", pszSpec="*.jpg") returned 0 [0085.810] lstrlenA (lpString="*.jpg") returned 5 [0085.810] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIconMask.bmp", pszSpec="*.jpeg") returned 0 [0085.811] lstrlenA (lpString="*.jpeg") returned 6 [0085.811] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIconMask.bmp", pszSpec="*.psd") returned 0 [0085.811] lstrlenA (lpString="*.psd") returned 5 [0085.811] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIconMask.bmp", pszSpec="*.cdr") returned 0 [0085.811] lstrlenA (lpString="*.cdr") returned 5 [0085.811] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIconMask.bmp", pszSpec="*.dwg") returned 0 [0085.811] lstrlenA (lpString="*.dwg") returned 5 [0085.811] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIconMask.bmp", pszSpec="*.max") returned 0 [0085.811] lstrlenA (lpString="*.max") returned 5 [0085.811] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIconMask.bmp", pszSpec="*.bmp") returned 1 [0085.811] lstrlenA (lpString="*.bmp") returned 5 [0085.811] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIconMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIconMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIconMask.bmp" [0085.811] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIconMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIconMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIconMask.bmp" [0085.811] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIconMask.bmp", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIconMask.bmp.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIconMask.bmp." [0085.811] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIconMask.bmp.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIconMask.bmp. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIconMask.bmp. " [0085.811] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIconMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\questioniconmask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0085.811] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x838 [0085.811] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x77bad200, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5a829930, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x77bad200, dwHighDateTime=0x1c747ea)) returned 1 [0085.811] SetFilePointer (in: hFile=0x90, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0085.811] ReadFile (in: hFile=0x90, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x7de, lpOverlapped=0x0) returned 1 [0085.841] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIconMask.bmp") returned="QuestionIconMask.bmp" [0085.842] SetFilePointer (in: hFile=0x90, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0085.842] WriteFile (in: hFile=0x90, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x7de, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x7de, lpOverlapped=0x0) returned 1 [0085.842] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0085.842] CloseHandle (hObject=0x90) returned 1 [0085.842] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIconMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\questioniconmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIconMask.bmp. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\questioniconmask.bmp. ")) returned 1 [0085.843] FindNextFileA (in: hFindFile=0x5b7c78, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0085.843] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0085.843] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Shared16x16Images.jpg") returned -1 [0085.843] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Shared16x16Images.jpg") returned -1 [0085.843] lstrcmpiA (lpString1="", lpString2="Shared16x16Images.jpg") returned -1 [0085.843] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIconMask.bmp") returned="QuestionIconMask.bmp" [0085.843] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="Shared16x16Images.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16Images.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16Images.jpg" [0085.844] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16Images.jpg", pszSpec="*.zip") returned 0 [0085.844] lstrlenA (lpString="*.zip") returned 5 [0085.844] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16Images.jpg", pszSpec="*.rar") returned 0 [0085.844] lstrlenA (lpString="*.rar") returned 5 [0085.844] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16Images.jpg", pszSpec="*.7z") returned 0 [0085.844] lstrlenA (lpString="*.7z") returned 4 [0085.844] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16Images.jpg", pszSpec="*.tar") returned 0 [0085.844] lstrlenA (lpString="*.tar") returned 5 [0085.844] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16Images.jpg", pszSpec="*.gzip") returned 0 [0085.844] lstrlenA (lpString="*.gzip") returned 6 [0085.844] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16Images.jpg", pszSpec="*.jpg") returned 1 [0085.844] lstrlenA (lpString="*.jpg") returned 5 [0085.844] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16Images.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16Images.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16Images.jpg" [0085.844] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16Images.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16Images.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16Images.jpg" [0085.844] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16Images.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16Images.jpg.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16Images.jpg." [0085.844] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16Images.jpg.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16Images.jpg. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16Images.jpg. " [0085.844] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16Images.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\shared16x16images.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0085.845] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x64fa [0085.845] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x77bad200, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x6d299f70, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x77bad200, dwHighDateTime=0x1c747ea)) returned 1 [0085.845] SetFilePointer (in: hFile=0x90, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0085.845] ReadFile (in: hFile=0x90, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x64a0, lpOverlapped=0x0) returned 1 [0085.859] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16Images.jpg") returned="Shared16x16Images.jpg" [0085.859] SetFilePointer (in: hFile=0x90, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0085.860] WriteFile (in: hFile=0x90, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x64a0, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x64a0, lpOverlapped=0x0) returned 1 [0085.860] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0085.860] CloseHandle (hObject=0x90) returned 1 [0085.861] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16Images.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\shared16x16images.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16Images.jpg. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\shared16x16images.jpg. ")) returned 1 [0085.862] FindNextFileA (in: hFindFile=0x5b7c78, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0085.862] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0085.862] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Shared16x16ImagesMask.bmp") returned -1 [0085.862] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Shared16x16ImagesMask.bmp") returned -1 [0085.862] lstrcmpiA (lpString1="", lpString2="Shared16x16ImagesMask.bmp") returned -1 [0085.862] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16Images.jpg") returned="Shared16x16Images.jpg" [0085.862] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="Shared16x16ImagesMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16ImagesMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16ImagesMask.bmp" [0085.862] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16ImagesMask.bmp", pszSpec="*.zip") returned 0 [0085.862] lstrlenA (lpString="*.zip") returned 5 [0085.862] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16ImagesMask.bmp", pszSpec="*.rar") returned 0 [0085.862] lstrlenA (lpString="*.rar") returned 5 [0085.862] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16ImagesMask.bmp", pszSpec="*.7z") returned 0 [0085.862] lstrlenA (lpString="*.7z") returned 4 [0085.862] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16ImagesMask.bmp", pszSpec="*.tar") returned 0 [0085.862] lstrlenA (lpString="*.tar") returned 5 [0085.862] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16ImagesMask.bmp", pszSpec="*.gzip") returned 0 [0085.862] lstrlenA (lpString="*.gzip") returned 6 [0085.862] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16ImagesMask.bmp", pszSpec="*.jpg") returned 0 [0085.862] lstrlenA (lpString="*.jpg") returned 5 [0085.862] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16ImagesMask.bmp", pszSpec="*.jpeg") returned 0 [0085.862] lstrlenA (lpString="*.jpeg") returned 6 [0085.862] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16ImagesMask.bmp", pszSpec="*.psd") returned 0 [0085.862] lstrlenA (lpString="*.psd") returned 5 [0085.862] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16ImagesMask.bmp", pszSpec="*.cdr") returned 0 [0085.862] lstrlenA (lpString="*.cdr") returned 5 [0085.862] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16ImagesMask.bmp", pszSpec="*.dwg") returned 0 [0085.862] lstrlenA (lpString="*.dwg") returned 5 [0085.862] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16ImagesMask.bmp", pszSpec="*.max") returned 0 [0085.862] lstrlenA (lpString="*.max") returned 5 [0085.862] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16ImagesMask.bmp", pszSpec="*.bmp") returned 1 [0085.862] lstrlenA (lpString="*.bmp") returned 5 [0085.862] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16ImagesMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16ImagesMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16ImagesMask.bmp" [0085.863] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16ImagesMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16ImagesMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16ImagesMask.bmp" [0085.863] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16ImagesMask.bmp", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16ImagesMask.bmp.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16ImagesMask.bmp." [0085.863] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16ImagesMask.bmp.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16ImagesMask.bmp. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16ImagesMask.bmp. " [0085.863] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16ImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\shared16x16imagesmask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0085.863] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xf38 [0085.863] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x78ebff00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x6d299f70, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x78ebff00, dwHighDateTime=0x1c747ea)) returned 1 [0085.863] SetFilePointer (in: hFile=0x90, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0085.863] ReadFile (in: hFile=0x90, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0xede, lpOverlapped=0x0) returned 1 [0085.876] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16ImagesMask.bmp") returned="Shared16x16ImagesMask.bmp" [0085.876] SetFilePointer (in: hFile=0x90, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0085.876] WriteFile (in: hFile=0x90, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0xede, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0xede, lpOverlapped=0x0) returned 1 [0085.876] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0085.876] CloseHandle (hObject=0x90) returned 1 [0085.877] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16ImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\shared16x16imagesmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16ImagesMask.bmp. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\shared16x16imagesmask.bmp. ")) returned 1 [0085.878] FindNextFileA (in: hFindFile=0x5b7c78, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0085.878] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0085.878] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Shared24x24Images.jpg") returned -1 [0085.878] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Shared24x24Images.jpg") returned -1 [0085.878] lstrcmpiA (lpString1="", lpString2="Shared24x24Images.jpg") returned -1 [0085.878] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16ImagesMask.bmp") returned="Shared16x16ImagesMask.bmp" [0085.878] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="Shared24x24Images.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24Images.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24Images.jpg" [0085.878] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24Images.jpg", pszSpec="*.zip") returned 0 [0085.878] lstrlenA (lpString="*.zip") returned 5 [0085.878] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24Images.jpg", pszSpec="*.rar") returned 0 [0085.878] lstrlenA (lpString="*.rar") returned 5 [0085.878] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24Images.jpg", pszSpec="*.7z") returned 0 [0085.878] lstrlenA (lpString="*.7z") returned 4 [0085.878] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24Images.jpg", pszSpec="*.tar") returned 0 [0085.878] lstrlenA (lpString="*.tar") returned 5 [0085.878] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24Images.jpg", pszSpec="*.gzip") returned 0 [0085.878] lstrlenA (lpString="*.gzip") returned 6 [0085.878] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24Images.jpg", pszSpec="*.jpg") returned 1 [0085.878] lstrlenA (lpString="*.jpg") returned 5 [0085.878] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24Images.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24Images.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24Images.jpg" [0085.878] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24Images.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24Images.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24Images.jpg" [0085.879] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24Images.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24Images.jpg.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24Images.jpg." [0085.879] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24Images.jpg.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24Images.jpg. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24Images.jpg. " [0085.879] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24Images.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\shared24x24images.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0085.879] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1963 [0085.879] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x78ebff00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x6d299f70, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x78ebff00, dwHighDateTime=0x1c747ea)) returned 1 [0085.879] SetFilePointer (in: hFile=0x90, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0085.879] ReadFile (in: hFile=0x90, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x1909, lpOverlapped=0x0) returned 1 [0085.881] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24Images.jpg") returned="Shared24x24Images.jpg" [0085.881] SetFilePointer (in: hFile=0x90, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0085.881] WriteFile (in: hFile=0x90, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x1909, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x1909, lpOverlapped=0x0) returned 1 [0085.881] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0085.881] CloseHandle (hObject=0x90) returned 1 [0085.881] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24Images.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\shared24x24images.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24Images.jpg. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\shared24x24images.jpg. ")) returned 1 [0085.882] FindNextFileA (in: hFindFile=0x5b7c78, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0085.882] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0085.882] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Shared24x24ImagesMask.bmp") returned -1 [0085.882] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Shared24x24ImagesMask.bmp") returned -1 [0085.882] lstrcmpiA (lpString1="", lpString2="Shared24x24ImagesMask.bmp") returned -1 [0085.882] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24Images.jpg") returned="Shared24x24Images.jpg" [0085.883] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="Shared24x24ImagesMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24ImagesMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24ImagesMask.bmp" [0085.883] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24ImagesMask.bmp", pszSpec="*.zip") returned 0 [0085.883] lstrlenA (lpString="*.zip") returned 5 [0085.883] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24ImagesMask.bmp", pszSpec="*.rar") returned 0 [0085.883] lstrlenA (lpString="*.rar") returned 5 [0085.883] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24ImagesMask.bmp", pszSpec="*.7z") returned 0 [0085.883] lstrlenA (lpString="*.7z") returned 4 [0085.883] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24ImagesMask.bmp", pszSpec="*.tar") returned 0 [0085.883] lstrlenA (lpString="*.tar") returned 5 [0085.883] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24ImagesMask.bmp", pszSpec="*.gzip") returned 0 [0085.883] lstrlenA (lpString="*.gzip") returned 6 [0085.883] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24ImagesMask.bmp", pszSpec="*.jpg") returned 0 [0085.883] lstrlenA (lpString="*.jpg") returned 5 [0085.883] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24ImagesMask.bmp", pszSpec="*.jpeg") returned 0 [0085.883] lstrlenA (lpString="*.jpeg") returned 6 [0085.883] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24ImagesMask.bmp", pszSpec="*.psd") returned 0 [0085.883] lstrlenA (lpString="*.psd") returned 5 [0085.883] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24ImagesMask.bmp", pszSpec="*.cdr") returned 0 [0085.883] lstrlenA (lpString="*.cdr") returned 5 [0085.883] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24ImagesMask.bmp", pszSpec="*.dwg") returned 0 [0085.883] lstrlenA (lpString="*.dwg") returned 5 [0085.883] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24ImagesMask.bmp", pszSpec="*.max") returned 0 [0085.883] lstrlenA (lpString="*.max") returned 5 [0085.883] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24ImagesMask.bmp", pszSpec="*.bmp") returned 1 [0085.883] lstrlenA (lpString="*.bmp") returned 5 [0085.883] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24ImagesMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24ImagesMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24ImagesMask.bmp" [0085.883] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24ImagesMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24ImagesMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24ImagesMask.bmp" [0085.883] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24ImagesMask.bmp", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24ImagesMask.bmp.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24ImagesMask.bmp." [0085.883] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24ImagesMask.bmp.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24ImagesMask.bmp. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24ImagesMask.bmp. " [0085.883] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24ImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\shared24x24imagesmask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0085.884] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1638 [0085.884] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x78ebff00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x6d299f70, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x78ebff00, dwHighDateTime=0x1c747ea)) returned 1 [0085.884] SetFilePointer (in: hFile=0x90, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0085.884] ReadFile (in: hFile=0x90, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x15de, lpOverlapped=0x0) returned 1 [0085.885] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24ImagesMask.bmp") returned="Shared24x24ImagesMask.bmp" [0085.885] SetFilePointer (in: hFile=0x90, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0085.885] WriteFile (in: hFile=0x90, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x15de, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x15de, lpOverlapped=0x0) returned 1 [0085.885] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0085.887] CloseHandle (hObject=0x90) returned 1 [0085.888] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24ImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\shared24x24imagesmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24ImagesMask.bmp. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\shared24x24imagesmask.bmp. ")) returned 1 [0085.888] FindNextFileA (in: hFindFile=0x5b7c78, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0085.888] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0085.888] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="SketchIconImages.bmp") returned -1 [0085.888] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SketchIconImages.bmp") returned -1 [0085.888] lstrcmpiA (lpString1="", lpString2="SketchIconImages.bmp") returned -1 [0085.889] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24ImagesMask.bmp") returned="Shared24x24ImagesMask.bmp" [0085.889] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="SketchIconImages.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\SketchIconImages.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\SketchIconImages.bmp" [0085.889] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\SketchIconImages.bmp", pszSpec="*.zip") returned 0 [0085.889] lstrlenA (lpString="*.zip") returned 5 [0085.889] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\SketchIconImages.bmp", pszSpec="*.rar") returned 0 [0085.889] lstrlenA (lpString="*.rar") returned 5 [0085.889] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\SketchIconImages.bmp", pszSpec="*.7z") returned 0 [0085.889] lstrlenA (lpString="*.7z") returned 4 [0085.889] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\SketchIconImages.bmp", pszSpec="*.tar") returned 0 [0085.889] lstrlenA (lpString="*.tar") returned 5 [0085.889] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\SketchIconImages.bmp", pszSpec="*.gzip") returned 0 [0085.889] lstrlenA (lpString="*.gzip") returned 6 [0085.889] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\SketchIconImages.bmp", pszSpec="*.jpg") returned 0 [0085.889] lstrlenA (lpString="*.jpg") returned 5 [0085.889] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\SketchIconImages.bmp", pszSpec="*.jpeg") returned 0 [0085.889] lstrlenA (lpString="*.jpeg") returned 6 [0085.889] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\SketchIconImages.bmp", pszSpec="*.psd") returned 0 [0085.889] lstrlenA (lpString="*.psd") returned 5 [0085.889] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\SketchIconImages.bmp", pszSpec="*.cdr") returned 0 [0085.889] lstrlenA (lpString="*.cdr") returned 5 [0085.889] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\SketchIconImages.bmp", pszSpec="*.dwg") returned 0 [0085.889] lstrlenA (lpString="*.dwg") returned 5 [0085.889] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\SketchIconImages.bmp", pszSpec="*.max") returned 0 [0085.889] lstrlenA (lpString="*.max") returned 5 [0085.889] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\SketchIconImages.bmp", pszSpec="*.bmp") returned 1 [0085.889] lstrlenA (lpString="*.bmp") returned 5 [0085.889] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\SketchIconImages.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\SketchIconImages.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\SketchIconImages.bmp" [0085.889] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\SketchIconImages.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\SketchIconImages.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\SketchIconImages.bmp" [0085.889] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\SketchIconImages.bmp", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\SketchIconImages.bmp.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\SketchIconImages.bmp." [0085.889] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\SketchIconImages.bmp.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\SketchIconImages.bmp. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\SketchIconImages.bmp. " [0085.889] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\SketchIconImages.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\sketchiconimages.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0085.890] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2d38 [0085.890] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x78ebff00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x6d2c00d0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x78ebff00, dwHighDateTime=0x1c747ea)) returned 1 [0085.890] SetFilePointer (in: hFile=0x90, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0085.890] ReadFile (in: hFile=0x90, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x2cde, lpOverlapped=0x0) returned 1 [0085.904] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\SketchIconImages.bmp") returned="SketchIconImages.bmp" [0085.904] SetFilePointer (in: hFile=0x90, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0085.904] WriteFile (in: hFile=0x90, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x2cde, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x2cde, lpOverlapped=0x0) returned 1 [0085.904] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0085.904] CloseHandle (hObject=0x90) returned 1 [0085.905] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\SketchIconImages.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\sketchiconimages.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\SketchIconImages.bmp. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\sketchiconimages.bmp. ")) returned 1 [0085.906] FindNextFileA (in: hFindFile=0x5b7c78, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0085.906] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0085.906] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="spacebackupicons.jpg") returned -1 [0085.907] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="spacebackupicons.jpg") returned -1 [0085.907] lstrcmpiA (lpString1="", lpString2="spacebackupicons.jpg") returned -1 [0085.907] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\SketchIconImages.bmp") returned="SketchIconImages.bmp" [0085.907] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="spacebackupicons.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupicons.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupicons.jpg" [0085.907] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupicons.jpg", pszSpec="*.zip") returned 0 [0085.907] lstrlenA (lpString="*.zip") returned 5 [0085.907] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupicons.jpg", pszSpec="*.rar") returned 0 [0085.907] lstrlenA (lpString="*.rar") returned 5 [0085.907] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupicons.jpg", pszSpec="*.7z") returned 0 [0085.907] lstrlenA (lpString="*.7z") returned 4 [0085.907] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupicons.jpg", pszSpec="*.tar") returned 0 [0085.907] lstrlenA (lpString="*.tar") returned 5 [0085.907] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupicons.jpg", pszSpec="*.gzip") returned 0 [0085.907] lstrlenA (lpString="*.gzip") returned 6 [0085.907] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupicons.jpg", pszSpec="*.jpg") returned 1 [0085.907] lstrlenA (lpString="*.jpg") returned 5 [0085.907] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupicons.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupicons.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupicons.jpg" [0085.907] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupicons.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupicons.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupicons.jpg" [0085.907] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupicons.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupicons.jpg.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupicons.jpg." [0085.907] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupicons.jpg.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupicons.jpg. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupicons.jpg. " [0085.907] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupicons.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\spacebackupicons.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0085.907] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xd97 [0085.907] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x78ebff00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5aad71f0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x78ebff00, dwHighDateTime=0x1c747ea)) returned 1 [0085.908] SetFilePointer (in: hFile=0x90, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0085.908] ReadFile (in: hFile=0x90, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0xd3d, lpOverlapped=0x0) returned 1 [0085.922] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupicons.jpg") returned="spacebackupicons.jpg" [0085.922] SetFilePointer (in: hFile=0x90, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0085.923] WriteFile (in: hFile=0x90, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0xd3d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0xd3d, lpOverlapped=0x0) returned 1 [0085.923] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0085.923] CloseHandle (hObject=0x90) returned 1 [0085.924] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupicons.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\spacebackupicons.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupicons.jpg. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\spacebackupicons.jpg. ")) returned 1 [0085.924] FindNextFileA (in: hFindFile=0x5b7c78, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0085.924] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0085.924] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="spacebackupiconsmask.bmp") returned -1 [0085.924] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="spacebackupiconsmask.bmp") returned -1 [0085.924] lstrcmpiA (lpString1="", lpString2="spacebackupiconsmask.bmp") returned -1 [0085.925] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupicons.jpg") returned="spacebackupicons.jpg" [0085.925] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="spacebackupiconsmask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupiconsmask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupiconsmask.bmp" [0085.925] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupiconsmask.bmp", pszSpec="*.zip") returned 0 [0085.925] lstrlenA (lpString="*.zip") returned 5 [0085.925] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupiconsmask.bmp", pszSpec="*.rar") returned 0 [0085.925] lstrlenA (lpString="*.rar") returned 5 [0085.925] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupiconsmask.bmp", pszSpec="*.7z") returned 0 [0085.925] lstrlenA (lpString="*.7z") returned 4 [0085.925] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupiconsmask.bmp", pszSpec="*.tar") returned 0 [0085.925] lstrlenA (lpString="*.tar") returned 5 [0085.925] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupiconsmask.bmp", pszSpec="*.gzip") returned 0 [0085.925] lstrlenA (lpString="*.gzip") returned 6 [0085.925] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupiconsmask.bmp", pszSpec="*.jpg") returned 0 [0085.925] lstrlenA (lpString="*.jpg") returned 5 [0085.925] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupiconsmask.bmp", pszSpec="*.jpeg") returned 0 [0085.925] lstrlenA (lpString="*.jpeg") returned 6 [0085.925] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupiconsmask.bmp", pszSpec="*.psd") returned 0 [0085.925] lstrlenA (lpString="*.psd") returned 5 [0085.925] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupiconsmask.bmp", pszSpec="*.cdr") returned 0 [0085.925] lstrlenA (lpString="*.cdr") returned 5 [0085.925] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupiconsmask.bmp", pszSpec="*.dwg") returned 0 [0085.925] lstrlenA (lpString="*.dwg") returned 5 [0085.925] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupiconsmask.bmp", pszSpec="*.max") returned 0 [0085.925] lstrlenA (lpString="*.max") returned 5 [0085.925] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupiconsmask.bmp", pszSpec="*.bmp") returned 1 [0085.925] lstrlenA (lpString="*.bmp") returned 5 [0085.925] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupiconsmask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupiconsmask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupiconsmask.bmp" [0085.925] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupiconsmask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupiconsmask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupiconsmask.bmp" [0085.925] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupiconsmask.bmp", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupiconsmask.bmp.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupiconsmask.bmp." [0085.925] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupiconsmask.bmp.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupiconsmask.bmp. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupiconsmask.bmp. " [0085.925] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupiconsmask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\spacebackupiconsmask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0085.927] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x5a4 [0085.927] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x78ebff00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x6d3a4910, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x78ebff00, dwHighDateTime=0x1c747ea)) returned 1 [0085.927] SetFilePointer (in: hFile=0x90, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0085.927] ReadFile (in: hFile=0x90, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x54a, lpOverlapped=0x0) returned 1 [0085.940] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupiconsmask.bmp") returned="spacebackupiconsmask.bmp" [0085.940] SetFilePointer (in: hFile=0x90, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0085.940] WriteFile (in: hFile=0x90, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x54a, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x54a, lpOverlapped=0x0) returned 1 [0085.940] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0085.940] CloseHandle (hObject=0x90) returned 1 [0085.941] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupiconsmask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\spacebackupiconsmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupiconsmask.bmp. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\spacebackupiconsmask.bmp. ")) returned 1 [0085.943] FindNextFileA (in: hFindFile=0x5b7c78, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0085.943] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0085.943] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="STOPICON.JPG") returned -1 [0085.943] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="STOPICON.JPG") returned -1 [0085.943] lstrcmpiA (lpString1="", lpString2="STOPICON.JPG") returned -1 [0085.943] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupiconsmask.bmp") returned="spacebackupiconsmask.bmp" [0085.943] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="STOPICON.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\STOPICON.JPG") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\STOPICON.JPG" [0085.943] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\STOPICON.JPG", pszSpec="*.zip") returned 0 [0085.943] lstrlenA (lpString="*.zip") returned 5 [0085.943] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\STOPICON.JPG", pszSpec="*.rar") returned 0 [0085.943] lstrlenA (lpString="*.rar") returned 5 [0085.943] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\STOPICON.JPG", pszSpec="*.7z") returned 0 [0085.943] lstrlenA (lpString="*.7z") returned 4 [0085.943] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\STOPICON.JPG", pszSpec="*.tar") returned 0 [0085.943] lstrlenA (lpString="*.tar") returned 5 [0085.943] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\STOPICON.JPG", pszSpec="*.gzip") returned 0 [0085.943] lstrlenA (lpString="*.gzip") returned 6 [0085.943] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\STOPICON.JPG", pszSpec="*.jpg") returned 1 [0085.943] lstrlenA (lpString="*.jpg") returned 5 [0085.943] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\STOPICON.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\STOPICON.JPG") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\STOPICON.JPG" [0085.943] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\STOPICON.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\STOPICON.JPG") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\STOPICON.JPG" [0085.943] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\STOPICON.JPG", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\STOPICON.JPG.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\STOPICON.JPG." [0085.943] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\STOPICON.JPG.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\STOPICON.JPG. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\STOPICON.JPG. " [0085.943] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\STOPICON.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\stopicon.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0085.945] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xd14 [0085.946] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x78ebff00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x6d3f0bd0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x78ebff00, dwHighDateTime=0x1c747ea)) returned 1 [0085.946] SetFilePointer (in: hFile=0x90, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0085.946] ReadFile (in: hFile=0x90, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0xcba, lpOverlapped=0x0) returned 1 [0085.955] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\STOPICON.JPG") returned="STOPICON.JPG" [0085.955] SetFilePointer (in: hFile=0x90, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0085.955] WriteFile (in: hFile=0x90, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0xcba, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0xcba, lpOverlapped=0x0) returned 1 [0085.955] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0085.956] CloseHandle (hObject=0x90) returned 1 [0085.956] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\STOPICON.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\stopicon.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\STOPICON.JPG. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\stopicon.jpg. ")) returned 1 [0085.958] FindNextFileA (in: hFindFile=0x5b7c78, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0085.958] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0085.958] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="StopIconMask.bmp") returned -1 [0085.958] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="StopIconMask.bmp") returned -1 [0085.958] lstrcmpiA (lpString1="", lpString2="StopIconMask.bmp") returned -1 [0085.958] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\STOPICON.JPG") returned="STOPICON.JPG" [0085.958] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="StopIconMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\StopIconMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\StopIconMask.bmp" [0085.958] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\StopIconMask.bmp", pszSpec="*.zip") returned 0 [0085.958] lstrlenA (lpString="*.zip") returned 5 [0085.958] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\StopIconMask.bmp", pszSpec="*.rar") returned 0 [0085.958] lstrlenA (lpString="*.rar") returned 5 [0085.958] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\StopIconMask.bmp", pszSpec="*.7z") returned 0 [0085.958] lstrlenA (lpString="*.7z") returned 4 [0085.958] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\StopIconMask.bmp", pszSpec="*.tar") returned 0 [0085.958] lstrlenA (lpString="*.tar") returned 5 [0085.958] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\StopIconMask.bmp", pszSpec="*.gzip") returned 0 [0085.958] lstrlenA (lpString="*.gzip") returned 6 [0085.958] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\StopIconMask.bmp", pszSpec="*.jpg") returned 0 [0085.958] lstrlenA (lpString="*.jpg") returned 5 [0085.958] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\StopIconMask.bmp", pszSpec="*.jpeg") returned 0 [0085.958] lstrlenA (lpString="*.jpeg") returned 6 [0085.958] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\StopIconMask.bmp", pszSpec="*.psd") returned 0 [0085.958] lstrlenA (lpString="*.psd") returned 5 [0085.958] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\StopIconMask.bmp", pszSpec="*.cdr") returned 0 [0085.958] lstrlenA (lpString="*.cdr") returned 5 [0085.958] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\StopIconMask.bmp", pszSpec="*.dwg") returned 0 [0085.958] lstrlenA (lpString="*.dwg") returned 5 [0085.958] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\StopIconMask.bmp", pszSpec="*.max") returned 0 [0085.958] lstrlenA (lpString="*.max") returned 5 [0085.958] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\StopIconMask.bmp", pszSpec="*.bmp") returned 1 [0085.958] lstrlenA (lpString="*.bmp") returned 5 [0085.958] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\StopIconMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\StopIconMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\StopIconMask.bmp" [0085.958] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\StopIconMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\StopIconMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\StopIconMask.bmp" [0085.958] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\StopIconMask.bmp", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\StopIconMask.bmp.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\StopIconMask.bmp." [0085.958] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\StopIconMask.bmp.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\StopIconMask.bmp. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\StopIconMask.bmp. " [0085.959] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\StopIconMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\stopiconmask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0085.959] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x838 [0085.959] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x78ebff00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x6d3f0bd0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x78ebff00, dwHighDateTime=0x1c747ea)) returned 1 [0085.960] SetFilePointer (in: hFile=0x90, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0085.960] ReadFile (in: hFile=0x90, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x7de, lpOverlapped=0x0) returned 1 [0085.964] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\StopIconMask.bmp") returned="StopIconMask.bmp" [0085.964] SetFilePointer (in: hFile=0x90, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0085.964] WriteFile (in: hFile=0x90, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x7de, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x7de, lpOverlapped=0x0) returned 1 [0085.965] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0085.965] CloseHandle (hObject=0x90) returned 1 [0085.966] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\StopIconMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\stopiconmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\StopIconMask.bmp. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\stopiconmask.bmp. ")) returned 1 [0085.967] FindNextFileA (in: hFindFile=0x5b7c78, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0085.967] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0085.967] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="TaskbarIconImages256Colors.bmp") returned -1 [0085.967] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TaskbarIconImages256Colors.bmp") returned -1 [0085.967] lstrcmpiA (lpString1="", lpString2="TaskbarIconImages256Colors.bmp") returned -1 [0085.967] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\StopIconMask.bmp") returned="StopIconMask.bmp" [0085.967] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="TaskbarIconImages256Colors.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImages256Colors.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImages256Colors.bmp" [0085.967] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImages256Colors.bmp", pszSpec="*.zip") returned 0 [0085.967] lstrlenA (lpString="*.zip") returned 5 [0085.967] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImages256Colors.bmp", pszSpec="*.rar") returned 0 [0085.967] lstrlenA (lpString="*.rar") returned 5 [0085.967] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImages256Colors.bmp", pszSpec="*.7z") returned 0 [0085.967] lstrlenA (lpString="*.7z") returned 4 [0085.967] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImages256Colors.bmp", pszSpec="*.tar") returned 0 [0085.967] lstrlenA (lpString="*.tar") returned 5 [0085.967] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImages256Colors.bmp", pszSpec="*.gzip") returned 0 [0085.967] lstrlenA (lpString="*.gzip") returned 6 [0085.967] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImages256Colors.bmp", pszSpec="*.jpg") returned 0 [0085.967] lstrlenA (lpString="*.jpg") returned 5 [0085.967] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImages256Colors.bmp", pszSpec="*.jpeg") returned 0 [0085.967] lstrlenA (lpString="*.jpeg") returned 6 [0085.968] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImages256Colors.bmp", pszSpec="*.psd") returned 0 [0085.968] lstrlenA (lpString="*.psd") returned 5 [0085.968] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImages256Colors.bmp", pszSpec="*.cdr") returned 0 [0085.968] lstrlenA (lpString="*.cdr") returned 5 [0085.968] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImages256Colors.bmp", pszSpec="*.dwg") returned 0 [0085.968] lstrlenA (lpString="*.dwg") returned 5 [0085.968] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImages256Colors.bmp", pszSpec="*.max") returned 0 [0085.968] lstrlenA (lpString="*.max") returned 5 [0085.968] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImages256Colors.bmp", pszSpec="*.bmp") returned 1 [0085.968] lstrlenA (lpString="*.bmp") returned 5 [0085.968] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImages256Colors.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImages256Colors.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImages256Colors.bmp" [0085.968] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImages256Colors.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImages256Colors.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImages256Colors.bmp" [0085.968] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImages256Colors.bmp", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImages256Colors.bmp.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImages256Colors.bmp." [0085.968] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImages256Colors.bmp.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImages256Colors.bmp. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImages256Colors.bmp. " [0085.968] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImages256Colors.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\taskbariconimages256colors.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0085.969] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xf38 [0085.969] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x5d554a00, dwHighDateTime=0x1ca0b45), lpLastAccessTime=0x407536*(dwLowDateTime=0x6d43ce90, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x5d554a00, dwHighDateTime=0x1ca0b45)) returned 1 [0085.969] SetFilePointer (in: hFile=0x90, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0085.969] ReadFile (in: hFile=0x90, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0xede, lpOverlapped=0x0) returned 1 [0085.978] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImages256Colors.bmp") returned="TaskbarIconImages256Colors.bmp" [0085.978] SetFilePointer (in: hFile=0x90, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0085.978] WriteFile (in: hFile=0x90, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0xede, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0xede, lpOverlapped=0x0) returned 1 [0085.978] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0085.979] CloseHandle (hObject=0x90) returned 1 [0085.980] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImages256Colors.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\taskbariconimages256colors.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImages256Colors.bmp. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\taskbariconimages256colors.bmp. ")) returned 1 [0085.981] FindNextFileA (in: hFindFile=0x5b7c78, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0085.981] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0085.981] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="TaskbarIconImagesMask256Colors.bmp") returned -1 [0085.981] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TaskbarIconImagesMask256Colors.bmp") returned -1 [0085.981] lstrcmpiA (lpString1="", lpString2="TaskbarIconImagesMask256Colors.bmp") returned -1 [0085.981] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImages256Colors.bmp") returned="TaskbarIconImages256Colors.bmp" [0085.981] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="TaskbarIconImagesMask256Colors.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImagesMask256Colors.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImagesMask256Colors.bmp" [0085.981] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImagesMask256Colors.bmp", pszSpec="*.zip") returned 0 [0085.981] lstrlenA (lpString="*.zip") returned 5 [0085.981] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImagesMask256Colors.bmp", pszSpec="*.rar") returned 0 [0085.981] lstrlenA (lpString="*.rar") returned 5 [0085.981] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImagesMask256Colors.bmp", pszSpec="*.7z") returned 0 [0085.981] lstrlenA (lpString="*.7z") returned 4 [0085.981] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImagesMask256Colors.bmp", pszSpec="*.tar") returned 0 [0085.981] lstrlenA (lpString="*.tar") returned 5 [0085.981] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImagesMask256Colors.bmp", pszSpec="*.gzip") returned 0 [0085.981] lstrlenA (lpString="*.gzip") returned 6 [0085.981] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImagesMask256Colors.bmp", pszSpec="*.jpg") returned 0 [0085.981] lstrlenA (lpString="*.jpg") returned 5 [0085.982] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImagesMask256Colors.bmp", pszSpec="*.jpeg") returned 0 [0085.982] lstrlenA (lpString="*.jpeg") returned 6 [0085.982] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImagesMask256Colors.bmp", pszSpec="*.psd") returned 0 [0085.982] lstrlenA (lpString="*.psd") returned 5 [0085.982] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImagesMask256Colors.bmp", pszSpec="*.cdr") returned 0 [0085.982] lstrlenA (lpString="*.cdr") returned 5 [0085.982] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImagesMask256Colors.bmp", pszSpec="*.dwg") returned 0 [0085.982] lstrlenA (lpString="*.dwg") returned 5 [0085.982] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImagesMask256Colors.bmp", pszSpec="*.max") returned 0 [0085.982] lstrlenA (lpString="*.max") returned 5 [0085.982] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImagesMask256Colors.bmp", pszSpec="*.bmp") returned 1 [0085.982] lstrlenA (lpString="*.bmp") returned 5 [0085.982] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImagesMask256Colors.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImagesMask256Colors.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImagesMask256Colors.bmp" [0085.982] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImagesMask256Colors.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImagesMask256Colors.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImagesMask256Colors.bmp" [0085.982] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImagesMask256Colors.bmp", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImagesMask256Colors.bmp.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImagesMask256Colors.bmp." [0085.982] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImagesMask256Colors.bmp.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImagesMask256Colors.bmp. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImagesMask256Colors.bmp. " [0085.982] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImagesMask256Colors.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\taskbariconimagesmask256colors.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0085.983] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x540 [0085.984] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x6cd49300, dwHighDateTime=0x1ca0b45), lpLastAccessTime=0x407536*(dwLowDateTime=0x6d43ce90, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x6cd49300, dwHighDateTime=0x1ca0b45)) returned 1 [0085.984] SetFilePointer (in: hFile=0x90, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0085.984] ReadFile (in: hFile=0x90, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x4e6, lpOverlapped=0x0) returned 1 [0086.002] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImagesMask256Colors.bmp") returned="TaskbarIconImagesMask256Colors.bmp" [0086.002] SetFilePointer (in: hFile=0x90, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0086.002] WriteFile (in: hFile=0x90, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x4e6, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x4e6, lpOverlapped=0x0) returned 1 [0086.002] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0086.002] CloseHandle (hObject=0x90) returned 1 [0086.003] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImagesMask256Colors.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\taskbariconimagesmask256colors.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImagesMask256Colors.bmp. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\taskbariconimagesmask256colors.bmp. ")) returned 1 [0086.004] FindNextFileA (in: hFindFile=0x5b7c78, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0086.004] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0086.004] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="TipsImage.jpg") returned -1 [0086.004] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TipsImage.jpg") returned -1 [0086.004] lstrcmpiA (lpString1="", lpString2="TipsImage.jpg") returned -1 [0086.004] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImagesMask256Colors.bmp") returned="TaskbarIconImagesMask256Colors.bmp" [0086.004] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="TipsImage.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImage.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImage.jpg" [0086.004] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImage.jpg", pszSpec="*.zip") returned 0 [0086.004] lstrlenA (lpString="*.zip") returned 5 [0086.004] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImage.jpg", pszSpec="*.rar") returned 0 [0086.005] lstrlenA (lpString="*.rar") returned 5 [0086.005] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImage.jpg", pszSpec="*.7z") returned 0 [0086.005] lstrlenA (lpString="*.7z") returned 4 [0086.005] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImage.jpg", pszSpec="*.tar") returned 0 [0086.005] lstrlenA (lpString="*.tar") returned 5 [0086.005] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImage.jpg", pszSpec="*.gzip") returned 0 [0086.005] lstrlenA (lpString="*.gzip") returned 6 [0086.005] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImage.jpg", pszSpec="*.jpg") returned 1 [0086.005] lstrlenA (lpString="*.jpg") returned 5 [0086.005] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImage.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImage.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImage.jpg" [0086.005] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImage.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImage.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImage.jpg" [0086.005] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImage.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImage.jpg.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImage.jpg." [0086.005] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImage.jpg.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImage.jpg. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImage.jpg. " [0086.005] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImage.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\tipsimage.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0086.005] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2605 [0086.005] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x7a1d2c00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5adf6ed0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x7a1d2c00, dwHighDateTime=0x1c747ea)) returned 1 [0086.005] SetFilePointer (in: hFile=0x90, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0086.005] ReadFile (in: hFile=0x90, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x25ab, lpOverlapped=0x0) returned 1 [0086.017] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImage.jpg") returned="TipsImage.jpg" [0086.017] SetFilePointer (in: hFile=0x90, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0086.018] WriteFile (in: hFile=0x90, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x25ab, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x25ab, lpOverlapped=0x0) returned 1 [0086.018] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0086.018] CloseHandle (hObject=0x90) returned 1 [0086.021] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImage.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\tipsimage.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImage.jpg. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\tipsimage.jpg. ")) returned 1 [0086.022] FindNextFileA (in: hFindFile=0x5b7c78, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0086.022] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0086.022] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="TipsImageMask.bmp") returned -1 [0086.022] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TipsImageMask.bmp") returned -1 [0086.022] lstrcmpiA (lpString1="", lpString2="TipsImageMask.bmp") returned -1 [0086.022] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImage.jpg") returned="TipsImage.jpg" [0086.022] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="TipsImageMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImageMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImageMask.bmp" [0086.022] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImageMask.bmp", pszSpec="*.zip") returned 0 [0086.022] lstrlenA (lpString="*.zip") returned 5 [0086.022] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImageMask.bmp", pszSpec="*.rar") returned 0 [0086.022] lstrlenA (lpString="*.rar") returned 5 [0086.022] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImageMask.bmp", pszSpec="*.7z") returned 0 [0086.022] lstrlenA (lpString="*.7z") returned 4 [0086.022] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImageMask.bmp", pszSpec="*.tar") returned 0 [0086.022] lstrlenA (lpString="*.tar") returned 5 [0086.022] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImageMask.bmp", pszSpec="*.gzip") returned 0 [0086.022] lstrlenA (lpString="*.gzip") returned 6 [0086.022] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImageMask.bmp", pszSpec="*.jpg") returned 0 [0086.023] lstrlenA (lpString="*.jpg") returned 5 [0086.023] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImageMask.bmp", pszSpec="*.jpeg") returned 0 [0086.023] lstrlenA (lpString="*.jpeg") returned 6 [0086.023] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImageMask.bmp", pszSpec="*.psd") returned 0 [0086.023] lstrlenA (lpString="*.psd") returned 5 [0086.024] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImageMask.bmp", pszSpec="*.cdr") returned 0 [0086.024] lstrlenA (lpString="*.cdr") returned 5 [0086.024] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImageMask.bmp", pszSpec="*.dwg") returned 0 [0086.024] lstrlenA (lpString="*.dwg") returned 5 [0086.024] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImageMask.bmp", pszSpec="*.max") returned 0 [0086.024] lstrlenA (lpString="*.max") returned 5 [0086.024] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImageMask.bmp", pszSpec="*.bmp") returned 1 [0086.024] lstrlenA (lpString="*.bmp") returned 5 [0086.024] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImageMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImageMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImageMask.bmp" [0086.024] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImageMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImageMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImageMask.bmp" [0086.024] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImageMask.bmp", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImageMask.bmp.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImageMask.bmp." [0086.024] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImageMask.bmp.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImageMask.bmp. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImageMask.bmp. " [0086.024] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImageMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\tipsimagemask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0086.025] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x838 [0086.025] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x7a1d2c00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5ae1d030, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x7a1d2c00, dwHighDateTime=0x1c747ea)) returned 1 [0086.025] SetFilePointer (in: hFile=0x90, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0086.025] ReadFile (in: hFile=0x90, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x7de, lpOverlapped=0x0) returned 1 [0086.026] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImageMask.bmp") returned="TipsImageMask.bmp" [0086.026] SetFilePointer (in: hFile=0x90, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0086.026] WriteFile (in: hFile=0x90, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x7de, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x7de, lpOverlapped=0x0) returned 1 [0086.026] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0086.026] CloseHandle (hObject=0x90) returned 1 [0086.027] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImageMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\tipsimagemask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImageMask.bmp. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\tipsimagemask.bmp. ")) returned 1 [0086.029] FindNextFileA (in: hFindFile=0x5b7c78, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0086.029] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0086.029] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="VeriSignLogo.jpg") returned -1 [0086.029] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="VeriSignLogo.jpg") returned -1 [0086.029] lstrcmpiA (lpString1="", lpString2="VeriSignLogo.jpg") returned -1 [0086.029] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImageMask.bmp") returned="TipsImageMask.bmp" [0086.029] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="VeriSignLogo.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\VeriSignLogo.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\VeriSignLogo.jpg" [0086.029] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\VeriSignLogo.jpg", pszSpec="*.zip") returned 0 [0086.029] lstrlenA (lpString="*.zip") returned 5 [0086.029] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\VeriSignLogo.jpg", pszSpec="*.rar") returned 0 [0086.029] lstrlenA (lpString="*.rar") returned 5 [0086.029] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\VeriSignLogo.jpg", pszSpec="*.7z") returned 0 [0086.029] lstrlenA (lpString="*.7z") returned 4 [0086.029] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\VeriSignLogo.jpg", pszSpec="*.tar") returned 0 [0086.029] lstrlenA (lpString="*.tar") returned 5 [0086.029] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\VeriSignLogo.jpg", pszSpec="*.gzip") returned 0 [0086.029] lstrlenA (lpString="*.gzip") returned 6 [0086.029] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\VeriSignLogo.jpg", pszSpec="*.jpg") returned 1 [0086.029] lstrlenA (lpString="*.jpg") returned 5 [0086.029] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\VeriSignLogo.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\VeriSignLogo.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\VeriSignLogo.jpg" [0086.029] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\VeriSignLogo.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\VeriSignLogo.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\VeriSignLogo.jpg" [0086.029] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\VeriSignLogo.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\VeriSignLogo.jpg.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\VeriSignLogo.jpg." [0086.029] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\VeriSignLogo.jpg.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\VeriSignLogo.jpg. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\VeriSignLogo.jpg. " [0086.029] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\VeriSignLogo.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\verisignlogo.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0086.030] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x450 [0086.030] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x7b4e5900, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5e490770, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x7b4e5900, dwHighDateTime=0x1c747ea)) returned 1 [0086.030] SetFilePointer (in: hFile=0x90, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0086.030] ReadFile (in: hFile=0x90, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x3f6, lpOverlapped=0x0) returned 1 [0086.040] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\VeriSignLogo.jpg") returned="VeriSignLogo.jpg" [0086.040] SetFilePointer (in: hFile=0x90, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0086.040] WriteFile (in: hFile=0x90, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x3f6, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x3f6, lpOverlapped=0x0) returned 1 [0086.040] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0086.040] CloseHandle (hObject=0x90) returned 1 [0086.041] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\VeriSignLogo.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\verisignlogo.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\VeriSignLogo.jpg. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\verisignlogo.jpg. ")) returned 1 [0086.042] FindNextFileA (in: hFindFile=0x5b7c78, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0086.042] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0086.042] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="WebToolIconImages.jpg") returned -1 [0086.042] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WebToolIconImages.jpg") returned -1 [0086.042] lstrcmpiA (lpString1="", lpString2="WebToolIconImages.jpg") returned -1 [0086.042] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\VeriSignLogo.jpg") returned="VeriSignLogo.jpg" [0086.042] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="WebToolIconImages.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImages.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImages.jpg" [0086.042] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImages.jpg", pszSpec="*.zip") returned 0 [0086.042] lstrlenA (lpString="*.zip") returned 5 [0086.042] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImages.jpg", pszSpec="*.rar") returned 0 [0086.042] lstrlenA (lpString="*.rar") returned 5 [0086.042] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImages.jpg", pszSpec="*.7z") returned 0 [0086.042] lstrlenA (lpString="*.7z") returned 4 [0086.042] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImages.jpg", pszSpec="*.tar") returned 0 [0086.042] lstrlenA (lpString="*.tar") returned 5 [0086.042] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImages.jpg", pszSpec="*.gzip") returned 0 [0086.042] lstrlenA (lpString="*.gzip") returned 6 [0086.042] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImages.jpg", pszSpec="*.jpg") returned 1 [0086.042] lstrlenA (lpString="*.jpg") returned 5 [0086.042] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImages.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImages.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImages.jpg" [0086.042] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImages.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImages.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImages.jpg" [0086.042] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImages.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImages.jpg.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImages.jpg." [0086.042] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImages.jpg.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImages.jpg. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImages.jpg. " [0086.042] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\webtooliconimages.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0086.043] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x5431 [0086.043] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x90bafc00, dwHighDateTime=0x1ca032f), lpLastAccessTime=0x407536*(dwLowDateTime=0x5e5c1270, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x90bafc00, dwHighDateTime=0x1ca032f)) returned 1 [0086.043] SetFilePointer (in: hFile=0x90, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0086.043] ReadFile (in: hFile=0x90, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x53d7, lpOverlapped=0x0) returned 1 [0086.056] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImages.jpg") returned="WebToolIconImages.jpg" [0086.056] SetFilePointer (in: hFile=0x90, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0086.056] WriteFile (in: hFile=0x90, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x53d7, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x53d7, lpOverlapped=0x0) returned 1 [0086.056] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0086.056] CloseHandle (hObject=0x90) returned 1 [0086.057] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\webtooliconimages.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImages.jpg. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\webtooliconimages.jpg. ")) returned 1 [0086.058] FindNextFileA (in: hFindFile=0x5b7c78, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0086.058] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0086.058] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="WebToolIconImagesMask.bmp") returned -1 [0086.058] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WebToolIconImagesMask.bmp") returned -1 [0086.058] lstrcmpiA (lpString1="", lpString2="WebToolIconImagesMask.bmp") returned -1 [0086.058] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImages.jpg") returned="WebToolIconImages.jpg" [0086.058] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="WebToolIconImagesMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImagesMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImagesMask.bmp" [0086.058] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImagesMask.bmp", pszSpec="*.zip") returned 0 [0086.058] lstrlenA (lpString="*.zip") returned 5 [0086.058] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImagesMask.bmp", pszSpec="*.rar") returned 0 [0086.058] lstrlenA (lpString="*.rar") returned 5 [0086.058] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImagesMask.bmp", pszSpec="*.7z") returned 0 [0086.058] lstrlenA (lpString="*.7z") returned 4 [0086.058] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImagesMask.bmp", pszSpec="*.tar") returned 0 [0086.058] lstrlenA (lpString="*.tar") returned 5 [0086.058] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImagesMask.bmp", pszSpec="*.gzip") returned 0 [0086.058] lstrlenA (lpString="*.gzip") returned 6 [0086.058] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImagesMask.bmp", pszSpec="*.jpg") returned 0 [0086.058] lstrlenA (lpString="*.jpg") returned 5 [0086.058] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImagesMask.bmp", pszSpec="*.jpeg") returned 0 [0086.058] lstrlenA (lpString="*.jpeg") returned 6 [0086.058] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImagesMask.bmp", pszSpec="*.psd") returned 0 [0086.059] lstrlenA (lpString="*.psd") returned 5 [0086.059] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImagesMask.bmp", pszSpec="*.cdr") returned 0 [0086.060] lstrlenA (lpString="*.cdr") returned 5 [0086.060] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImagesMask.bmp", pszSpec="*.dwg") returned 0 [0086.060] lstrlenA (lpString="*.dwg") returned 5 [0086.060] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImagesMask.bmp", pszSpec="*.max") returned 0 [0086.060] lstrlenA (lpString="*.max") returned 5 [0086.060] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImagesMask.bmp", pszSpec="*.bmp") returned 1 [0086.060] lstrlenA (lpString="*.bmp") returned 5 [0086.060] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImagesMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImagesMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImagesMask.bmp" [0086.060] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImagesMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImagesMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImagesMask.bmp" [0086.060] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImagesMask.bmp", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImagesMask.bmp.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImagesMask.bmp." [0086.060] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImagesMask.bmp.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImagesMask.bmp. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImagesMask.bmp. " [0086.060] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\webtooliconimagesmask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0086.061] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1538 [0086.061] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8862c100, dwHighDateTime=0x1ca032f), lpLastAccessTime=0x407536*(dwLowDateTime=0x5e5c1270, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8862c100, dwHighDateTime=0x1ca032f)) returned 1 [0086.061] SetFilePointer (in: hFile=0x90, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0086.061] ReadFile (in: hFile=0x90, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x14de, lpOverlapped=0x0) returned 1 [0086.076] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImagesMask.bmp") returned="WebToolIconImagesMask.bmp" [0086.076] SetFilePointer (in: hFile=0x90, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0086.076] WriteFile (in: hFile=0x90, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x14de, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x14de, lpOverlapped=0x0) returned 1 [0086.077] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0086.077] CloseHandle (hObject=0x90) returned 1 [0086.077] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\webtooliconimagesmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImagesMask.bmp. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\webtooliconimagesmask.bmp. ")) returned 1 [0086.078] FindNextFileA (in: hFindFile=0x5b7c78, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0086.078] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0086.078] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="WebToolImages16x16.jpg") returned -1 [0086.078] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WebToolImages16x16.jpg") returned -1 [0086.078] lstrcmpiA (lpString1="", lpString2="WebToolImages16x16.jpg") returned -1 [0086.078] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImagesMask.bmp") returned="WebToolIconImagesMask.bmp" [0086.078] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="WebToolImages16x16.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImages16x16.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImages16x16.jpg" [0086.078] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImages16x16.jpg", pszSpec="*.zip") returned 0 [0086.078] lstrlenA (lpString="*.zip") returned 5 [0086.080] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImages16x16.jpg", pszSpec="*.rar") returned 0 [0086.080] lstrlenA (lpString="*.rar") returned 5 [0086.080] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImages16x16.jpg", pszSpec="*.7z") returned 0 [0086.080] lstrlenA (lpString="*.7z") returned 4 [0086.080] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImages16x16.jpg", pszSpec="*.tar") returned 0 [0086.080] lstrlenA (lpString="*.tar") returned 5 [0086.080] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImages16x16.jpg", pszSpec="*.gzip") returned 0 [0086.080] lstrlenA (lpString="*.gzip") returned 6 [0086.080] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImages16x16.jpg", pszSpec="*.jpg") returned 1 [0086.080] lstrlenA (lpString="*.jpg") returned 5 [0086.080] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImages16x16.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImages16x16.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImages16x16.jpg" [0086.080] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImages16x16.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImages16x16.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImages16x16.jpg" [0086.080] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImages16x16.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImages16x16.jpg.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImages16x16.jpg." [0086.080] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImages16x16.jpg.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImages16x16.jpg. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImages16x16.jpg. " [0086.080] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImages16x16.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\webtoolimages16x16.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0086.080] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1995 [0086.080] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x7b4e5900, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x708c13f0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x7b4e5900, dwHighDateTime=0x1c747ea)) returned 1 [0086.080] SetFilePointer (in: hFile=0x90, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0086.080] ReadFile (in: hFile=0x90, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x193b, lpOverlapped=0x0) returned 1 [0086.095] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImages16x16.jpg") returned="WebToolImages16x16.jpg" [0086.095] SetFilePointer (in: hFile=0x90, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0086.095] WriteFile (in: hFile=0x90, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x193b, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x193b, lpOverlapped=0x0) returned 1 [0086.095] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0086.095] CloseHandle (hObject=0x90) returned 1 [0086.096] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImages16x16.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\webtoolimages16x16.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImages16x16.jpg. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\webtoolimages16x16.jpg. ")) returned 1 [0086.097] FindNextFileA (in: hFindFile=0x5b7c78, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0086.098] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0086.098] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="WebToolImagesMask16x16.bmp") returned -1 [0086.098] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WebToolImagesMask16x16.bmp") returned -1 [0086.098] lstrcmpiA (lpString1="", lpString2="WebToolImagesMask16x16.bmp") returned -1 [0086.098] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImages16x16.jpg") returned="WebToolImages16x16.jpg" [0086.098] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="WebToolImagesMask16x16.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImagesMask16x16.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImagesMask16x16.bmp" [0086.098] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImagesMask16x16.bmp", pszSpec="*.zip") returned 0 [0086.098] lstrlenA (lpString="*.zip") returned 5 [0086.098] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImagesMask16x16.bmp", pszSpec="*.rar") returned 0 [0086.098] lstrlenA (lpString="*.rar") returned 5 [0086.098] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImagesMask16x16.bmp", pszSpec="*.7z") returned 0 [0086.098] lstrlenA (lpString="*.7z") returned 4 [0086.098] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImagesMask16x16.bmp", pszSpec="*.tar") returned 0 [0086.098] lstrlenA (lpString="*.tar") returned 5 [0086.098] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImagesMask16x16.bmp", pszSpec="*.gzip") returned 0 [0086.098] lstrlenA (lpString="*.gzip") returned 6 [0086.098] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImagesMask16x16.bmp", pszSpec="*.jpg") returned 0 [0086.098] lstrlenA (lpString="*.jpg") returned 5 [0086.098] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImagesMask16x16.bmp", pszSpec="*.jpeg") returned 0 [0086.098] lstrlenA (lpString="*.jpeg") returned 6 [0086.098] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImagesMask16x16.bmp", pszSpec="*.psd") returned 0 [0086.098] lstrlenA (lpString="*.psd") returned 5 [0086.098] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImagesMask16x16.bmp", pszSpec="*.cdr") returned 0 [0086.098] lstrlenA (lpString="*.cdr") returned 5 [0086.098] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImagesMask16x16.bmp", pszSpec="*.dwg") returned 0 [0086.098] lstrlenA (lpString="*.dwg") returned 5 [0086.098] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImagesMask16x16.bmp", pszSpec="*.max") returned 0 [0086.098] lstrlenA (lpString="*.max") returned 5 [0086.098] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImagesMask16x16.bmp", pszSpec="*.bmp") returned 1 [0086.098] lstrlenA (lpString="*.bmp") returned 5 [0086.098] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImagesMask16x16.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImagesMask16x16.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImagesMask16x16.bmp" [0086.098] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImagesMask16x16.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImagesMask16x16.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImagesMask16x16.bmp" [0086.098] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImagesMask16x16.bmp", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImagesMask16x16.bmp.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImagesMask16x16.bmp." [0086.098] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImagesMask16x16.bmp.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImagesMask16x16.bmp. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImagesMask16x16.bmp. " [0086.098] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImagesMask16x16.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\webtoolimagesmask16x16.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0086.100] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x838 [0086.100] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x7b4e5900, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5e5c1270, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x7b4e5900, dwHighDateTime=0x1c747ea)) returned 1 [0086.100] SetFilePointer (in: hFile=0x90, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0086.100] ReadFile (in: hFile=0x90, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x7de, lpOverlapped=0x0) returned 1 [0086.105] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImagesMask16x16.bmp") returned="WebToolImagesMask16x16.bmp" [0086.105] SetFilePointer (in: hFile=0x90, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0086.105] WriteFile (in: hFile=0x90, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x7de, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x7de, lpOverlapped=0x0) returned 1 [0086.105] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0086.105] CloseHandle (hObject=0x90) returned 1 [0086.110] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImagesMask16x16.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\webtoolimagesmask16x16.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImagesMask16x16.bmp. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\webtoolimagesmask16x16.bmp. ")) returned 1 [0086.111] FindNextFileA (in: hFindFile=0x5b7c78, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0086.111] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0086.111] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="WSSFilesToolIconImages.jpg") returned -1 [0086.111] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WSSFilesToolIconImages.jpg") returned -1 [0086.111] lstrcmpiA (lpString1="", lpString2="WSSFilesToolIconImages.jpg") returned -1 [0086.111] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImagesMask16x16.bmp") returned="WebToolImagesMask16x16.bmp" [0086.111] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="WSSFilesToolIconImages.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImages.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImages.jpg" [0086.111] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImages.jpg", pszSpec="*.zip") returned 0 [0086.111] lstrlenA (lpString="*.zip") returned 5 [0086.111] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImages.jpg", pszSpec="*.rar") returned 0 [0086.111] lstrlenA (lpString="*.rar") returned 5 [0086.111] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImages.jpg", pszSpec="*.7z") returned 0 [0086.111] lstrlenA (lpString="*.7z") returned 4 [0086.111] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImages.jpg", pszSpec="*.tar") returned 0 [0086.111] lstrlenA (lpString="*.tar") returned 5 [0086.111] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImages.jpg", pszSpec="*.gzip") returned 0 [0086.111] lstrlenA (lpString="*.gzip") returned 6 [0086.111] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImages.jpg", pszSpec="*.jpg") returned 1 [0086.111] lstrlenA (lpString="*.jpg") returned 5 [0086.111] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImages.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImages.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImages.jpg" [0086.111] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImages.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImages.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImages.jpg" [0086.111] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImages.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImages.jpg.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImages.jpg." [0086.111] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImages.jpg.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImages.jpg. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImages.jpg. " [0086.111] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\wssfilestooliconimages.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0086.112] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2308 [0086.113] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x7c7f8600, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x709f1ef0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x7c7f8600, dwHighDateTime=0x1c747ea)) returned 1 [0086.113] SetFilePointer (in: hFile=0x90, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0086.113] ReadFile (in: hFile=0x90, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x22ae, lpOverlapped=0x0) returned 1 [0086.151] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImages.jpg") returned="WSSFilesToolIconImages.jpg" [0086.151] SetFilePointer (in: hFile=0x90, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0086.151] WriteFile (in: hFile=0x90, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x22ae, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x22ae, lpOverlapped=0x0) returned 1 [0086.151] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0086.151] CloseHandle (hObject=0x90) returned 1 [0086.152] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\wssfilestooliconimages.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImages.jpg. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\wssfilestooliconimages.jpg. ")) returned 1 [0086.154] FindNextFileA (in: hFindFile=0x5b7c78, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0086.154] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0086.154] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="WSSFilesToolIconImagesMask.bmp") returned -1 [0086.154] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WSSFilesToolIconImagesMask.bmp") returned -1 [0086.154] lstrcmpiA (lpString1="", lpString2="WSSFilesToolIconImagesMask.bmp") returned -1 [0086.154] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImages.jpg") returned="WSSFilesToolIconImages.jpg" [0086.154] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", lpString2="WSSFilesToolIconImagesMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImagesMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImagesMask.bmp" [0086.154] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImagesMask.bmp", pszSpec="*.zip") returned 0 [0086.154] lstrlenA (lpString="*.zip") returned 5 [0086.154] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImagesMask.bmp", pszSpec="*.rar") returned 0 [0086.154] lstrlenA (lpString="*.rar") returned 5 [0086.154] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImagesMask.bmp", pszSpec="*.7z") returned 0 [0086.154] lstrlenA (lpString="*.7z") returned 4 [0086.154] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImagesMask.bmp", pszSpec="*.tar") returned 0 [0086.154] lstrlenA (lpString="*.tar") returned 5 [0086.154] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImagesMask.bmp", pszSpec="*.gzip") returned 0 [0086.154] lstrlenA (lpString="*.gzip") returned 6 [0086.154] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImagesMask.bmp", pszSpec="*.jpg") returned 0 [0086.154] lstrlenA (lpString="*.jpg") returned 5 [0086.154] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImagesMask.bmp", pszSpec="*.jpeg") returned 0 [0086.154] lstrlenA (lpString="*.jpeg") returned 6 [0086.154] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImagesMask.bmp", pszSpec="*.psd") returned 0 [0086.154] lstrlenA (lpString="*.psd") returned 5 [0086.154] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImagesMask.bmp", pszSpec="*.cdr") returned 0 [0086.154] lstrlenA (lpString="*.cdr") returned 5 [0086.154] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImagesMask.bmp", pszSpec="*.dwg") returned 0 [0086.154] lstrlenA (lpString="*.dwg") returned 5 [0086.154] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImagesMask.bmp", pszSpec="*.max") returned 0 [0086.154] lstrlenA (lpString="*.max") returned 5 [0086.154] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImagesMask.bmp", pszSpec="*.bmp") returned 1 [0086.154] lstrlenA (lpString="*.bmp") returned 5 [0086.154] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImagesMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImagesMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImagesMask.bmp" [0086.154] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImagesMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImagesMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImagesMask.bmp" [0086.155] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImagesMask.bmp", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImagesMask.bmp.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImagesMask.bmp." [0086.155] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImagesMask.bmp.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImagesMask.bmp. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImagesMask.bmp. " [0086.155] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\wssfilestooliconimagesmask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0086.156] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x638 [0086.156] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x7c7f8600, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5e633690, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x7c7f8600, dwHighDateTime=0x1c747ea)) returned 1 [0086.156] SetFilePointer (in: hFile=0x90, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0086.156] ReadFile (in: hFile=0x90, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x5de, lpOverlapped=0x0) returned 1 [0086.185] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImagesMask.bmp") returned="WSSFilesToolIconImagesMask.bmp" [0086.185] SetFilePointer (in: hFile=0x90, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0086.185] WriteFile (in: hFile=0x90, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x5de, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x5de, lpOverlapped=0x0) returned 1 [0086.185] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0086.185] CloseHandle (hObject=0x90) returned 1 [0086.187] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\wssfilestooliconimagesmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImagesMask.bmp. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\wssfilestooliconimagesmask.bmp. ")) returned 1 [0086.188] FindNextFileA (in: hFindFile=0x5b7c78, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0 [0086.188] FindClose (in: hFindFile=0x5b7c78 | out: hFindFile=0x5b7c78) returned 1 [0086.188] FindNextFileA (in: hFindFile=0x5b7cf0, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0086.188] lstrcmpA (lpString1=".", lpString2="ToolData") returned -1 [0086.188] lstrcmpA (lpString1="..", lpString2="ToolData") returned -1 [0086.188] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\*.*") returned="*.*" [0086.188] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\", lpString2="ToolData" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData" [0086.189] lstrlenA (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData") returned 58 [0086.189] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5b7c78 [0086.238] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0086.238] FindNextFileA (in: hFindFile=0x5b7c78, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0086.239] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0086.239] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0086.239] FindNextFileA (in: hFindFile=0x5b7c78, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0086.239] lstrcmpA (lpString1=".", lpString2="groove.net") returned -1 [0086.239] lstrcmpA (lpString1="..", lpString2="groove.net") returned -1 [0086.239] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\*.*") returned="*.*" [0086.239] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\", lpString2="groove.net" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net" [0086.239] lstrlenA (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net") returned 69 [0086.239] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5b7dd0 [0086.250] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0086.250] FindNextFileA (in: hFindFile=0x5b7dd0, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0086.250] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0086.251] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0086.251] FindNextFileA (in: hFindFile=0x5b7dd0, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0086.251] lstrcmpA (lpString1=".", lpString2="Calendar") returned -1 [0086.251] lstrcmpA (lpString1="..", lpString2="Calendar") returned -1 [0086.251] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\*.*") returned="*.*" [0086.251] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\", lpString2="Calendar" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar" [0086.251] lstrlenA (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar") returned 78 [0086.251] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\*.*", lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 0x5b7d30 [0086.303] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0086.303] FindNextFileA (in: hFindFile=0x5b7d30, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0086.303] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0086.303] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0086.303] FindNextFileA (in: hFindFile=0x5b7d30, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0086.303] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0086.303] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="CalendarToolIconImages.jpg") returned 1 [0086.304] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="CalendarToolIconImages.jpg") returned 1 [0086.304] lstrcmpiA (lpString1="", lpString2="CalendarToolIconImages.jpg") returned -1 [0086.304] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\*.*") returned="*.*" [0086.304] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\", lpString2="CalendarToolIconImages.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImages.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImages.jpg" [0086.304] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImages.jpg", pszSpec="*.zip") returned 0 [0086.304] lstrlenA (lpString="*.zip") returned 5 [0086.304] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImages.jpg", pszSpec="*.rar") returned 0 [0086.304] lstrlenA (lpString="*.rar") returned 5 [0086.304] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImages.jpg", pszSpec="*.7z") returned 0 [0086.304] lstrlenA (lpString="*.7z") returned 4 [0086.304] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImages.jpg", pszSpec="*.tar") returned 0 [0086.304] lstrlenA (lpString="*.tar") returned 5 [0086.304] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImages.jpg", pszSpec="*.gzip") returned 0 [0086.304] lstrlenA (lpString="*.gzip") returned 6 [0086.304] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImages.jpg", pszSpec="*.jpg") returned 1 [0086.304] lstrlenA (lpString="*.jpg") returned 5 [0086.304] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImages.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImages.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImages.jpg" [0086.304] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImages.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImages.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImages.jpg" [0086.304] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImages.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImages.jpg.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImages.jpg." [0086.304] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImages.jpg.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImages.jpg. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImages.jpg. " [0086.304] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\calendar\\calendartooliconimages.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0086.305] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3424 [0086.305] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xc4b62000, dwHighDateTime=0x1ca0408), lpLastAccessTime=0x407536*(dwLowDateTime=0x51bb8730, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xc4b62000, dwHighDateTime=0x1ca0408)) returned 1 [0086.305] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0086.305] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x33ca, lpOverlapped=0x0) returned 1 [0086.306] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImages.jpg") returned="CalendarToolIconImages.jpg" [0086.306] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0086.306] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x33ca, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x33ca, lpOverlapped=0x0) returned 1 [0086.307] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0086.307] CloseHandle (hObject=0x98) returned 1 [0086.307] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\calendar\\calendartooliconimages.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImages.jpg. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\calendar\\calendartooliconimages.jpg. ")) returned 1 [0086.308] FindNextFileA (in: hFindFile=0x5b7d30, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0086.308] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0086.308] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="CalendarToolIconImagesMask.bmp") returned 1 [0086.308] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="CalendarToolIconImagesMask.bmp") returned 1 [0086.309] lstrcmpiA (lpString1="", lpString2="CalendarToolIconImagesMask.bmp") returned -1 [0086.309] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImages.jpg") returned="CalendarToolIconImages.jpg" [0086.309] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\", lpString2="CalendarToolIconImagesMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImagesMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImagesMask.bmp" [0086.309] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImagesMask.bmp", pszSpec="*.zip") returned 0 [0086.309] lstrlenA (lpString="*.zip") returned 5 [0086.309] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImagesMask.bmp", pszSpec="*.rar") returned 0 [0086.309] lstrlenA (lpString="*.rar") returned 5 [0086.309] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImagesMask.bmp", pszSpec="*.7z") returned 0 [0086.309] lstrlenA (lpString="*.7z") returned 4 [0086.309] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImagesMask.bmp", pszSpec="*.tar") returned 0 [0086.309] lstrlenA (lpString="*.tar") returned 5 [0086.309] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImagesMask.bmp", pszSpec="*.gzip") returned 0 [0086.309] lstrlenA (lpString="*.gzip") returned 6 [0086.309] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImagesMask.bmp", pszSpec="*.jpg") returned 0 [0086.309] lstrlenA (lpString="*.jpg") returned 5 [0086.309] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImagesMask.bmp", pszSpec="*.jpeg") returned 0 [0086.309] lstrlenA (lpString="*.jpeg") returned 6 [0086.309] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImagesMask.bmp", pszSpec="*.psd") returned 0 [0086.309] lstrlenA (lpString="*.psd") returned 5 [0086.309] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImagesMask.bmp", pszSpec="*.cdr") returned 0 [0086.309] lstrlenA (lpString="*.cdr") returned 5 [0086.309] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImagesMask.bmp", pszSpec="*.dwg") returned 0 [0086.309] lstrlenA (lpString="*.dwg") returned 5 [0086.309] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImagesMask.bmp", pszSpec="*.max") returned 0 [0086.309] lstrlenA (lpString="*.max") returned 5 [0086.309] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImagesMask.bmp", pszSpec="*.bmp") returned 1 [0086.309] lstrlenA (lpString="*.bmp") returned 5 [0086.309] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImagesMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImagesMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImagesMask.bmp" [0086.309] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImagesMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImagesMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImagesMask.bmp" [0086.309] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImagesMask.bmp", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImagesMask.bmp.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImagesMask.bmp." [0086.309] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImagesMask.bmp.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImagesMask.bmp. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImagesMask.bmp. " [0086.309] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\calendar\\calendartooliconimagesmask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0086.466] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xc38 [0086.466] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xbb2cb800, dwHighDateTime=0x1ca0408), lpLastAccessTime=0x407536*(dwLowDateTime=0x60120f70, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xbb2cb800, dwHighDateTime=0x1ca0408)) returned 1 [0086.466] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0086.466] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0xbde, lpOverlapped=0x0) returned 1 [0086.572] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImagesMask.bmp") returned="CalendarToolIconImagesMask.bmp" [0086.572] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0086.572] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0xbde, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0xbde, lpOverlapped=0x0) returned 1 [0086.572] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0086.573] CloseHandle (hObject=0x98) returned 1 [0086.573] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\calendar\\calendartooliconimagesmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImagesMask.bmp. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\calendar\\calendartooliconimagesmask.bmp. ")) returned 1 [0086.575] FindNextFileA (in: hFindFile=0x5b7d30, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0086.575] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0086.575] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="CalendarViewButtonImages.jpg") returned 1 [0086.575] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="CalendarViewButtonImages.jpg") returned 1 [0086.575] lstrcmpiA (lpString1="", lpString2="CalendarViewButtonImages.jpg") returned -1 [0086.575] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImagesMask.bmp") returned="CalendarToolIconImagesMask.bmp" [0086.575] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\", lpString2="CalendarViewButtonImages.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarViewButtonImages.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarViewButtonImages.jpg" [0086.575] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarViewButtonImages.jpg", pszSpec="*.zip") returned 0 [0086.575] lstrlenA (lpString="*.zip") returned 5 [0086.575] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarViewButtonImages.jpg", pszSpec="*.rar") returned 0 [0086.575] lstrlenA (lpString="*.rar") returned 5 [0086.575] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarViewButtonImages.jpg", pszSpec="*.7z") returned 0 [0086.575] lstrlenA (lpString="*.7z") returned 4 [0086.575] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarViewButtonImages.jpg", pszSpec="*.tar") returned 0 [0086.575] lstrlenA (lpString="*.tar") returned 5 [0086.575] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarViewButtonImages.jpg", pszSpec="*.gzip") returned 0 [0086.575] lstrlenA (lpString="*.gzip") returned 6 [0086.575] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarViewButtonImages.jpg", pszSpec="*.jpg") returned 1 [0086.575] lstrlenA (lpString="*.jpg") returned 5 [0086.575] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarViewButtonImages.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarViewButtonImages.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarViewButtonImages.jpg" [0086.575] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarViewButtonImages.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarViewButtonImages.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarViewButtonImages.jpg" [0086.575] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarViewButtonImages.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarViewButtonImages.jpg.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarViewButtonImages.jpg." [0086.575] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarViewButtonImages.jpg.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarViewButtonImages.jpg. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarViewButtonImages.jpg. " [0086.576] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarViewButtonImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\calendar\\calendarviewbuttonimages.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0086.576] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3fa2 [0086.576] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x7c7f8600, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x51bb8730, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x7c7f8600, dwHighDateTime=0x1c747ea)) returned 1 [0086.576] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0086.576] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x3f48, lpOverlapped=0x0) returned 1 [0086.620] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarViewButtonImages.jpg") returned="CalendarViewButtonImages.jpg" [0086.620] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0086.620] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x3f48, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x3f48, lpOverlapped=0x0) returned 1 [0086.620] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0086.620] CloseHandle (hObject=0x98) returned 1 [0086.621] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarViewButtonImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\calendar\\calendarviewbuttonimages.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarViewButtonImages.jpg. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\calendar\\calendarviewbuttonimages.jpg. ")) returned 1 [0086.622] FindNextFileA (in: hFindFile=0x5b7d30, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0086.622] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0086.622] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="GlobeButtonImage.jpg") returned -1 [0086.622] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="GlobeButtonImage.jpg") returned 1 [0086.622] lstrcmpiA (lpString1="", lpString2="GlobeButtonImage.jpg") returned -1 [0086.622] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarViewButtonImages.jpg") returned="CalendarViewButtonImages.jpg" [0086.622] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\", lpString2="GlobeButtonImage.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImage.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImage.jpg" [0086.622] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImage.jpg", pszSpec="*.zip") returned 0 [0086.622] lstrlenA (lpString="*.zip") returned 5 [0086.622] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImage.jpg", pszSpec="*.rar") returned 0 [0086.622] lstrlenA (lpString="*.rar") returned 5 [0086.622] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImage.jpg", pszSpec="*.7z") returned 0 [0086.622] lstrlenA (lpString="*.7z") returned 4 [0086.622] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImage.jpg", pszSpec="*.tar") returned 0 [0086.622] lstrlenA (lpString="*.tar") returned 5 [0086.622] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImage.jpg", pszSpec="*.gzip") returned 0 [0086.622] lstrlenA (lpString="*.gzip") returned 6 [0086.622] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImage.jpg", pszSpec="*.jpg") returned 1 [0086.622] lstrlenA (lpString="*.jpg") returned 5 [0086.622] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImage.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImage.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImage.jpg" [0086.622] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImage.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImage.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImage.jpg" [0086.622] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImage.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImage.jpg.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImage.jpg." [0086.622] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImage.jpg.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImage.jpg. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImage.jpg. " [0086.622] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImage.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\calendar\\globebuttonimage.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0086.631] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1b49 [0086.631] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x7c7f8600, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x52b0b4d0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x7c7f8600, dwHighDateTime=0x1c747ea)) returned 1 [0086.631] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0086.631] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x1aef, lpOverlapped=0x0) returned 1 [0086.641] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImage.jpg") returned="GlobeButtonImage.jpg" [0086.641] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0086.641] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x1aef, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x1aef, lpOverlapped=0x0) returned 1 [0086.642] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0086.642] CloseHandle (hObject=0x98) returned 1 [0086.643] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImage.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\calendar\\globebuttonimage.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImage.jpg. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\calendar\\globebuttonimage.jpg. ")) returned 1 [0086.644] FindNextFileA (in: hFindFile=0x5b7d30, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0086.644] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0086.644] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="GlobeButtonImageMask.bmp") returned -1 [0086.644] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="GlobeButtonImageMask.bmp") returned 1 [0086.644] lstrcmpiA (lpString1="", lpString2="GlobeButtonImageMask.bmp") returned -1 [0086.644] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImage.jpg") returned="GlobeButtonImage.jpg" [0086.644] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\", lpString2="GlobeButtonImageMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImageMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImageMask.bmp" [0086.644] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImageMask.bmp", pszSpec="*.zip") returned 0 [0086.644] lstrlenA (lpString="*.zip") returned 5 [0086.644] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImageMask.bmp", pszSpec="*.rar") returned 0 [0086.644] lstrlenA (lpString="*.rar") returned 5 [0086.644] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImageMask.bmp", pszSpec="*.7z") returned 0 [0086.644] lstrlenA (lpString="*.7z") returned 4 [0086.644] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImageMask.bmp", pszSpec="*.tar") returned 0 [0086.644] lstrlenA (lpString="*.tar") returned 5 [0086.644] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImageMask.bmp", pszSpec="*.gzip") returned 0 [0086.644] lstrlenA (lpString="*.gzip") returned 6 [0086.644] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImageMask.bmp", pszSpec="*.jpg") returned 0 [0086.644] lstrlenA (lpString="*.jpg") returned 5 [0086.644] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImageMask.bmp", pszSpec="*.jpeg") returned 0 [0086.644] lstrlenA (lpString="*.jpeg") returned 6 [0086.644] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImageMask.bmp", pszSpec="*.psd") returned 0 [0086.644] lstrlenA (lpString="*.psd") returned 5 [0086.644] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImageMask.bmp", pszSpec="*.cdr") returned 0 [0086.644] lstrlenA (lpString="*.cdr") returned 5 [0086.644] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImageMask.bmp", pszSpec="*.dwg") returned 0 [0086.644] lstrlenA (lpString="*.dwg") returned 5 [0086.644] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImageMask.bmp", pszSpec="*.max") returned 0 [0086.644] lstrlenA (lpString="*.max") returned 5 [0086.644] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImageMask.bmp", pszSpec="*.bmp") returned 1 [0086.644] lstrlenA (lpString="*.bmp") returned 5 [0086.644] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImageMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImageMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImageMask.bmp" [0086.644] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImageMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImageMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImageMask.bmp" [0086.644] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImageMask.bmp", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImageMask.bmp.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImageMask.bmp." [0086.644] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImageMask.bmp.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImageMask.bmp. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImageMask.bmp. " [0086.644] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImageMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\calendar\\globebuttonimagemask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0086.645] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x778 [0086.645] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x7c7f8600, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x61a457d0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x7c7f8600, dwHighDateTime=0x1c747ea)) returned 1 [0086.645] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0086.645] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x71e, lpOverlapped=0x0) returned 1 [0086.661] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImageMask.bmp") returned="GlobeButtonImageMask.bmp" [0086.661] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0086.661] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x71e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x71e, lpOverlapped=0x0) returned 1 [0086.661] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0086.661] CloseHandle (hObject=0x98) returned 1 [0086.662] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImageMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\calendar\\globebuttonimagemask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImageMask.bmp. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\calendar\\globebuttonimagemask.bmp. ")) returned 1 [0086.663] FindNextFileA (in: hFindFile=0x5b7d30, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 0 [0086.663] FindClose (in: hFindFile=0x5b7d30 | out: hFindFile=0x5b7d30) returned 1 [0086.663] FindNextFileA (in: hFindFile=0x5b7dd0, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0086.663] lstrcmpA (lpString1=".", lpString2="CommonData") returned -1 [0086.663] lstrcmpA (lpString1="..", lpString2="CommonData") returned -1 [0086.663] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\*.*") returned="*.*" [0086.663] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\", lpString2="CommonData" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData" [0086.663] lstrlenA (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData") returned 80 [0086.663] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\*.*", lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 0x5b7d30 [0086.687] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0086.687] FindNextFileA (in: hFindFile=0x5b7d30, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0086.688] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0086.688] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0086.688] FindNextFileA (in: hFindFile=0x5b7d30, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0086.688] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0086.688] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="AlertImage_Auto.jpg") returned 1 [0086.688] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AlertImage_Auto.jpg") returned 1 [0086.688] lstrcmpiA (lpString1="", lpString2="AlertImage_Auto.jpg") returned -1 [0086.688] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\*.*") returned="*.*" [0086.688] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\", lpString2="AlertImage_Auto.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Auto.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Auto.jpg" [0086.688] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Auto.jpg", pszSpec="*.zip") returned 0 [0086.688] lstrlenA (lpString="*.zip") returned 5 [0086.688] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Auto.jpg", pszSpec="*.rar") returned 0 [0086.688] lstrlenA (lpString="*.rar") returned 5 [0086.688] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Auto.jpg", pszSpec="*.7z") returned 0 [0086.688] lstrlenA (lpString="*.7z") returned 4 [0086.688] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Auto.jpg", pszSpec="*.tar") returned 0 [0086.688] lstrlenA (lpString="*.tar") returned 5 [0086.688] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Auto.jpg", pszSpec="*.gzip") returned 0 [0086.688] lstrlenA (lpString="*.gzip") returned 6 [0086.688] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Auto.jpg", pszSpec="*.jpg") returned 1 [0086.688] lstrlenA (lpString="*.jpg") returned 5 [0086.688] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Auto.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Auto.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Auto.jpg" [0086.688] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Auto.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Auto.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Auto.jpg" [0086.688] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Auto.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Auto.jpg.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Auto.jpg." [0086.688] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Auto.jpg.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Auto.jpg. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Auto.jpg. " [0086.688] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Auto.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_auto.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0086.690] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x44c9 [0086.690] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x633fe700, dwHighDateTime=0x1c95fc8), lpLastAccessTime=0x407536*(dwLowDateTime=0x5eb686b0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x633fe700, dwHighDateTime=0x1c95fc8)) returned 1 [0086.690] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0086.690] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x446f, lpOverlapped=0x0) returned 1 [0086.726] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Auto.jpg") returned="AlertImage_Auto.jpg" [0086.727] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0086.727] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x446f, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x446f, lpOverlapped=0x0) returned 1 [0086.727] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0086.727] CloseHandle (hObject=0x98) returned 1 [0086.728] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Auto.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_auto.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Auto.jpg. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_auto.jpg. ")) returned 1 [0086.729] FindNextFileA (in: hFindFile=0x5b7d30, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0086.729] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0086.729] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="AlertImage_AutoMask.bmp") returned 1 [0086.729] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AlertImage_AutoMask.bmp") returned 1 [0086.729] lstrcmpiA (lpString1="", lpString2="AlertImage_AutoMask.bmp") returned -1 [0086.729] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Auto.jpg") returned="AlertImage_Auto.jpg" [0086.729] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\", lpString2="AlertImage_AutoMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_AutoMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_AutoMask.bmp" [0086.729] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_AutoMask.bmp", pszSpec="*.zip") returned 0 [0086.729] lstrlenA (lpString="*.zip") returned 5 [0086.729] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_AutoMask.bmp", pszSpec="*.rar") returned 0 [0086.729] lstrlenA (lpString="*.rar") returned 5 [0086.729] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_AutoMask.bmp", pszSpec="*.7z") returned 0 [0086.729] lstrlenA (lpString="*.7z") returned 4 [0086.729] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_AutoMask.bmp", pszSpec="*.tar") returned 0 [0086.729] lstrlenA (lpString="*.tar") returned 5 [0086.729] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_AutoMask.bmp", pszSpec="*.gzip") returned 0 [0086.729] lstrlenA (lpString="*.gzip") returned 6 [0086.729] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_AutoMask.bmp", pszSpec="*.jpg") returned 0 [0086.729] lstrlenA (lpString="*.jpg") returned 5 [0086.729] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_AutoMask.bmp", pszSpec="*.jpeg") returned 0 [0086.729] lstrlenA (lpString="*.jpeg") returned 6 [0086.729] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_AutoMask.bmp", pszSpec="*.psd") returned 0 [0086.730] lstrlenA (lpString="*.psd") returned 5 [0086.730] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_AutoMask.bmp", pszSpec="*.cdr") returned 0 [0086.730] lstrlenA (lpString="*.cdr") returned 5 [0086.730] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_AutoMask.bmp", pszSpec="*.dwg") returned 0 [0086.730] lstrlenA (lpString="*.dwg") returned 5 [0086.730] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_AutoMask.bmp", pszSpec="*.max") returned 0 [0086.730] lstrlenA (lpString="*.max") returned 5 [0086.730] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_AutoMask.bmp", pszSpec="*.bmp") returned 1 [0086.730] lstrlenA (lpString="*.bmp") returned 5 [0086.730] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_AutoMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_AutoMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_AutoMask.bmp" [0086.730] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_AutoMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_AutoMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_AutoMask.bmp" [0086.730] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_AutoMask.bmp", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_AutoMask.bmp.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_AutoMask.bmp." [0086.730] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_AutoMask.bmp.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_AutoMask.bmp. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_AutoMask.bmp. " [0086.730] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_AutoMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_automask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0086.730] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1c6e [0086.730] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x3390df00, dwHighDateTime=0x1c95fc8), lpLastAccessTime=0x407536*(dwLowDateTime=0x5eb686b0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x3390df00, dwHighDateTime=0x1c95fc8)) returned 1 [0086.730] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0086.730] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x1c14, lpOverlapped=0x0) returned 1 [0086.744] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_AutoMask.bmp") returned="AlertImage_AutoMask.bmp" [0086.744] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0086.744] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x1c14, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x1c14, lpOverlapped=0x0) returned 1 [0086.744] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0086.744] CloseHandle (hObject=0x98) returned 1 [0086.745] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_AutoMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_automask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_AutoMask.bmp. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_automask.bmp. ")) returned 1 [0086.746] FindNextFileA (in: hFindFile=0x5b7d30, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0086.746] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0086.746] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="AlertImage_ContactHigh.jpg") returned 1 [0086.746] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AlertImage_ContactHigh.jpg") returned 1 [0086.746] lstrcmpiA (lpString1="", lpString2="AlertImage_ContactHigh.jpg") returned -1 [0086.746] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_AutoMask.bmp") returned="AlertImage_AutoMask.bmp" [0086.746] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\", lpString2="AlertImage_ContactHigh.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHigh.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHigh.jpg" [0086.746] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHigh.jpg", pszSpec="*.zip") returned 0 [0086.746] lstrlenA (lpString="*.zip") returned 5 [0086.746] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHigh.jpg", pszSpec="*.rar") returned 0 [0086.746] lstrlenA (lpString="*.rar") returned 5 [0086.746] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHigh.jpg", pszSpec="*.7z") returned 0 [0086.746] lstrlenA (lpString="*.7z") returned 4 [0086.746] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHigh.jpg", pszSpec="*.tar") returned 0 [0086.746] lstrlenA (lpString="*.tar") returned 5 [0086.746] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHigh.jpg", pszSpec="*.gzip") returned 0 [0086.746] lstrlenA (lpString="*.gzip") returned 6 [0086.746] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHigh.jpg", pszSpec="*.jpg") returned 1 [0086.747] lstrlenA (lpString="*.jpg") returned 5 [0086.747] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHigh.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHigh.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHigh.jpg" [0086.747] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHigh.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHigh.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHigh.jpg" [0086.747] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHigh.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHigh.jpg.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHigh.jpg." [0086.747] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHigh.jpg.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHigh.jpg. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHigh.jpg. " [0086.747] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHigh.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_contacthigh.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0086.747] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3356 [0086.747] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x7db0b300, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x51317770, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x7db0b300, dwHighDateTime=0x1c747ea)) returned 1 [0086.747] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0086.747] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x32fc, lpOverlapped=0x0) returned 1 [0086.820] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHigh.jpg") returned="AlertImage_ContactHigh.jpg" [0086.820] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0086.820] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x32fc, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x32fc, lpOverlapped=0x0) returned 1 [0086.820] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0086.820] CloseHandle (hObject=0x98) returned 1 [0086.821] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHigh.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_contacthigh.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHigh.jpg. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_contacthigh.jpg. ")) returned 1 [0086.822] FindNextFileA (in: hFindFile=0x5b7d30, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0086.822] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0086.823] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="AlertImage_ContactHighMask.bmp") returned 1 [0086.823] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AlertImage_ContactHighMask.bmp") returned 1 [0086.823] lstrcmpiA (lpString1="", lpString2="AlertImage_ContactHighMask.bmp") returned -1 [0086.823] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHigh.jpg") returned="AlertImage_ContactHigh.jpg" [0086.823] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\", lpString2="AlertImage_ContactHighMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHighMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHighMask.bmp" [0086.823] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHighMask.bmp", pszSpec="*.zip") returned 0 [0086.823] lstrlenA (lpString="*.zip") returned 5 [0086.823] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHighMask.bmp", pszSpec="*.rar") returned 0 [0086.823] lstrlenA (lpString="*.rar") returned 5 [0086.823] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHighMask.bmp", pszSpec="*.7z") returned 0 [0086.823] lstrlenA (lpString="*.7z") returned 4 [0086.823] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHighMask.bmp", pszSpec="*.tar") returned 0 [0086.823] lstrlenA (lpString="*.tar") returned 5 [0086.823] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHighMask.bmp", pszSpec="*.gzip") returned 0 [0086.823] lstrlenA (lpString="*.gzip") returned 6 [0086.823] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHighMask.bmp", pszSpec="*.jpg") returned 0 [0086.823] lstrlenA (lpString="*.jpg") returned 5 [0086.823] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHighMask.bmp", pszSpec="*.jpeg") returned 0 [0086.823] lstrlenA (lpString="*.jpeg") returned 6 [0086.823] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHighMask.bmp", pszSpec="*.psd") returned 0 [0086.823] lstrlenA (lpString="*.psd") returned 5 [0086.823] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHighMask.bmp", pszSpec="*.cdr") returned 0 [0086.823] lstrlenA (lpString="*.cdr") returned 5 [0086.823] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHighMask.bmp", pszSpec="*.dwg") returned 0 [0086.823] lstrlenA (lpString="*.dwg") returned 5 [0086.823] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHighMask.bmp", pszSpec="*.max") returned 0 [0086.823] lstrlenA (lpString="*.max") returned 5 [0086.823] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHighMask.bmp", pszSpec="*.bmp") returned 1 [0086.823] lstrlenA (lpString="*.bmp") returned 5 [0086.823] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHighMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHighMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHighMask.bmp" [0086.823] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHighMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHighMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHighMask.bmp" [0086.823] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHighMask.bmp", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHighMask.bmp.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHighMask.bmp." [0086.823] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHighMask.bmp.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHighMask.bmp. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHighMask.bmp. " [0086.823] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHighMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_contacthighmask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0086.824] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1c70 [0086.824] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x7db0b300, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x51317770, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x7db0b300, dwHighDateTime=0x1c747ea)) returned 1 [0086.824] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0086.824] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x1c16, lpOverlapped=0x0) returned 1 [0086.846] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHighMask.bmp") returned="AlertImage_ContactHighMask.bmp" [0086.846] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0086.846] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x1c16, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x1c16, lpOverlapped=0x0) returned 1 [0086.846] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0086.846] CloseHandle (hObject=0x98) returned 1 [0086.847] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHighMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_contacthighmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHighMask.bmp. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_contacthighmask.bmp. ")) returned 1 [0086.848] FindNextFileA (in: hFindFile=0x5b7d30, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0086.848] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0086.848] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="AlertImage_ContactLow.jpg") returned 1 [0086.848] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AlertImage_ContactLow.jpg") returned 1 [0086.848] lstrcmpiA (lpString1="", lpString2="AlertImage_ContactLow.jpg") returned -1 [0086.848] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHighMask.bmp") returned="AlertImage_ContactHighMask.bmp" [0086.848] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\", lpString2="AlertImage_ContactLow.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLow.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLow.jpg" [0086.848] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLow.jpg", pszSpec="*.zip") returned 0 [0086.848] lstrlenA (lpString="*.zip") returned 5 [0086.848] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLow.jpg", pszSpec="*.rar") returned 0 [0086.848] lstrlenA (lpString="*.rar") returned 5 [0086.848] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLow.jpg", pszSpec="*.7z") returned 0 [0086.848] lstrlenA (lpString="*.7z") returned 4 [0086.848] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLow.jpg", pszSpec="*.tar") returned 0 [0086.848] lstrlenA (lpString="*.tar") returned 5 [0086.848] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLow.jpg", pszSpec="*.gzip") returned 0 [0086.848] lstrlenA (lpString="*.gzip") returned 6 [0086.848] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLow.jpg", pszSpec="*.jpg") returned 1 [0086.848] lstrlenA (lpString="*.jpg") returned 5 [0086.848] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLow.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLow.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLow.jpg" [0086.849] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLow.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLow.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLow.jpg" [0086.849] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLow.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLow.jpg.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLow.jpg." [0086.849] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLow.jpg.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLow.jpg. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLow.jpg. " [0086.849] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLow.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_contactlow.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0086.849] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2f79 [0086.849] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x7db0b300, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5eb686b0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x7db0b300, dwHighDateTime=0x1c747ea)) returned 1 [0086.849] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0086.849] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x2f1f, lpOverlapped=0x0) returned 1 [0086.892] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLow.jpg") returned="AlertImage_ContactLow.jpg" [0086.893] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0086.893] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x2f1f, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x2f1f, lpOverlapped=0x0) returned 1 [0086.893] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0086.893] CloseHandle (hObject=0x98) returned 1 [0086.894] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLow.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_contactlow.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLow.jpg. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_contactlow.jpg. ")) returned 1 [0086.894] FindNextFileA (in: hFindFile=0x5b7d30, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0086.894] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0086.894] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="AlertImage_ContactLowMask.bmp") returned 1 [0086.894] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AlertImage_ContactLowMask.bmp") returned 1 [0086.895] lstrcmpiA (lpString1="", lpString2="AlertImage_ContactLowMask.bmp") returned -1 [0086.895] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLow.jpg") returned="AlertImage_ContactLow.jpg" [0086.895] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\", lpString2="AlertImage_ContactLowMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLowMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLowMask.bmp" [0086.895] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLowMask.bmp", pszSpec="*.zip") returned 0 [0086.895] lstrlenA (lpString="*.zip") returned 5 [0086.895] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLowMask.bmp", pszSpec="*.rar") returned 0 [0086.895] lstrlenA (lpString="*.rar") returned 5 [0086.895] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLowMask.bmp", pszSpec="*.7z") returned 0 [0086.895] lstrlenA (lpString="*.7z") returned 4 [0086.895] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLowMask.bmp", pszSpec="*.tar") returned 0 [0086.895] lstrlenA (lpString="*.tar") returned 5 [0086.895] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLowMask.bmp", pszSpec="*.gzip") returned 0 [0086.895] lstrlenA (lpString="*.gzip") returned 6 [0086.895] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLowMask.bmp", pszSpec="*.jpg") returned 0 [0086.895] lstrlenA (lpString="*.jpg") returned 5 [0086.895] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLowMask.bmp", pszSpec="*.jpeg") returned 0 [0086.895] lstrlenA (lpString="*.jpeg") returned 6 [0086.895] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLowMask.bmp", pszSpec="*.psd") returned 0 [0086.895] lstrlenA (lpString="*.psd") returned 5 [0086.895] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLowMask.bmp", pszSpec="*.cdr") returned 0 [0086.895] lstrlenA (lpString="*.cdr") returned 5 [0086.895] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLowMask.bmp", pszSpec="*.dwg") returned 0 [0086.895] lstrlenA (lpString="*.dwg") returned 5 [0086.895] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLowMask.bmp", pszSpec="*.max") returned 0 [0086.895] lstrlenA (lpString="*.max") returned 5 [0086.895] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLowMask.bmp", pszSpec="*.bmp") returned 1 [0086.895] lstrlenA (lpString="*.bmp") returned 5 [0086.895] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLowMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLowMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLowMask.bmp" [0086.895] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLowMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLowMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLowMask.bmp" [0086.895] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLowMask.bmp", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLowMask.bmp.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLowMask.bmp." [0086.895] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLowMask.bmp.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLowMask.bmp. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLowMask.bmp. " [0086.895] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLowMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_contactlowmask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0086.896] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1c70 [0086.896] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x7db0b300, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5eb686b0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x7db0b300, dwHighDateTime=0x1c747ea)) returned 1 [0086.896] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0086.896] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x1c16, lpOverlapped=0x0) returned 1 [0086.917] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLowMask.bmp") returned="AlertImage_ContactLowMask.bmp" [0086.917] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0086.917] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x1c16, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x1c16, lpOverlapped=0x0) returned 1 [0086.917] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0086.917] CloseHandle (hObject=0x98) returned 1 [0086.918] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLowMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_contactlowmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLowMask.bmp. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_contactlowmask.bmp. ")) returned 1 [0086.919] FindNextFileA (in: hFindFile=0x5b7d30, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0086.919] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0086.919] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="AlertImage_FileHigh.jpg") returned 1 [0086.919] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AlertImage_FileHigh.jpg") returned 1 [0086.919] lstrcmpiA (lpString1="", lpString2="AlertImage_FileHigh.jpg") returned -1 [0086.919] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLowMask.bmp") returned="AlertImage_ContactLowMask.bmp" [0086.919] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\", lpString2="AlertImage_FileHigh.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHigh.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHigh.jpg" [0086.919] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHigh.jpg", pszSpec="*.zip") returned 0 [0086.919] lstrlenA (lpString="*.zip") returned 5 [0086.920] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHigh.jpg", pszSpec="*.rar") returned 0 [0086.920] lstrlenA (lpString="*.rar") returned 5 [0086.920] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHigh.jpg", pszSpec="*.7z") returned 0 [0086.920] lstrlenA (lpString="*.7z") returned 4 [0086.920] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHigh.jpg", pszSpec="*.tar") returned 0 [0086.920] lstrlenA (lpString="*.tar") returned 5 [0086.920] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHigh.jpg", pszSpec="*.gzip") returned 0 [0086.920] lstrlenA (lpString="*.gzip") returned 6 [0086.920] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHigh.jpg", pszSpec="*.jpg") returned 1 [0086.920] lstrlenA (lpString="*.jpg") returned 5 [0086.920] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHigh.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHigh.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHigh.jpg" [0086.920] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHigh.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHigh.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHigh.jpg" [0086.920] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHigh.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHigh.jpg.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHigh.jpg." [0086.920] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHigh.jpg.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHigh.jpg. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHigh.jpg. " [0086.920] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHigh.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_filehigh.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0086.921] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x480d [0086.922] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xc125fc00, dwHighDateTime=0x1c95fd3), lpLastAccessTime=0x407536*(dwLowDateTime=0x51317770, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xc125fc00, dwHighDateTime=0x1c95fd3)) returned 1 [0086.922] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0086.922] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x47b3, lpOverlapped=0x0) returned 1 [0086.984] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHigh.jpg") returned="AlertImage_FileHigh.jpg" [0086.985] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0086.985] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x47b3, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x47b3, lpOverlapped=0x0) returned 1 [0086.985] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0086.985] CloseHandle (hObject=0x98) returned 1 [0086.986] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHigh.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_filehigh.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHigh.jpg. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_filehigh.jpg. ")) returned 1 [0086.987] FindNextFileA (in: hFindFile=0x5b7d30, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0086.987] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0086.987] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="AlertImage_FileHighMask.bmp") returned 1 [0086.987] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AlertImage_FileHighMask.bmp") returned 1 [0086.987] lstrcmpiA (lpString1="", lpString2="AlertImage_FileHighMask.bmp") returned -1 [0086.987] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHigh.jpg") returned="AlertImage_FileHigh.jpg" [0086.987] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\", lpString2="AlertImage_FileHighMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHighMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHighMask.bmp" [0086.987] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHighMask.bmp", pszSpec="*.zip") returned 0 [0086.987] lstrlenA (lpString="*.zip") returned 5 [0086.987] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHighMask.bmp", pszSpec="*.rar") returned 0 [0086.987] lstrlenA (lpString="*.rar") returned 5 [0086.987] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHighMask.bmp", pszSpec="*.7z") returned 0 [0086.987] lstrlenA (lpString="*.7z") returned 4 [0086.987] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHighMask.bmp", pszSpec="*.tar") returned 0 [0086.987] lstrlenA (lpString="*.tar") returned 5 [0086.987] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHighMask.bmp", pszSpec="*.gzip") returned 0 [0086.987] lstrlenA (lpString="*.gzip") returned 6 [0086.987] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHighMask.bmp", pszSpec="*.jpg") returned 0 [0086.988] lstrlenA (lpString="*.jpg") returned 5 [0086.988] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHighMask.bmp", pszSpec="*.jpeg") returned 0 [0086.988] lstrlenA (lpString="*.jpeg") returned 6 [0086.988] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHighMask.bmp", pszSpec="*.psd") returned 0 [0086.988] lstrlenA (lpString="*.psd") returned 5 [0086.988] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHighMask.bmp", pszSpec="*.cdr") returned 0 [0086.988] lstrlenA (lpString="*.cdr") returned 5 [0086.988] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHighMask.bmp", pszSpec="*.dwg") returned 0 [0086.988] lstrlenA (lpString="*.dwg") returned 5 [0086.988] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHighMask.bmp", pszSpec="*.max") returned 0 [0086.988] lstrlenA (lpString="*.max") returned 5 [0086.988] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHighMask.bmp", pszSpec="*.bmp") returned 1 [0086.988] lstrlenA (lpString="*.bmp") returned 5 [0086.988] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHighMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHighMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHighMask.bmp" [0086.988] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHighMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHighMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHighMask.bmp" [0086.988] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHighMask.bmp", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHighMask.bmp.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHighMask.bmp." [0086.988] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHighMask.bmp.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHighMask.bmp. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHighMask.bmp. " [0086.988] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHighMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_filehighmask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0086.988] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1c6e [0086.989] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x3b558100, dwHighDateTime=0x1c95fd2), lpLastAccessTime=0x407536*(dwLowDateTime=0x51317770, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x3b558100, dwHighDateTime=0x1c95fd2)) returned 1 [0086.989] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0086.989] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x1c14, lpOverlapped=0x0) returned 1 [0087.044] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHighMask.bmp") returned="AlertImage_FileHighMask.bmp" [0087.044] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0087.044] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x1c14, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x1c14, lpOverlapped=0x0) returned 1 [0087.044] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0087.044] CloseHandle (hObject=0x98) returned 1 [0087.045] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHighMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_filehighmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHighMask.bmp. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_filehighmask.bmp. ")) returned 1 [0087.046] FindNextFileA (in: hFindFile=0x5b7d30, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0087.046] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0087.046] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="AlertImage_FileOff.jpg") returned 1 [0087.046] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AlertImage_FileOff.jpg") returned 1 [0087.046] lstrcmpiA (lpString1="", lpString2="AlertImage_FileOff.jpg") returned -1 [0087.046] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHighMask.bmp") returned="AlertImage_FileHighMask.bmp" [0087.046] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\", lpString2="AlertImage_FileOff.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOff.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOff.jpg" [0087.046] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOff.jpg", pszSpec="*.zip") returned 0 [0087.046] lstrlenA (lpString="*.zip") returned 5 [0087.046] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOff.jpg", pszSpec="*.rar") returned 0 [0087.047] lstrlenA (lpString="*.rar") returned 5 [0087.047] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOff.jpg", pszSpec="*.7z") returned 0 [0087.047] lstrlenA (lpString="*.7z") returned 4 [0087.047] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOff.jpg", pszSpec="*.tar") returned 0 [0087.047] lstrlenA (lpString="*.tar") returned 5 [0087.047] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOff.jpg", pszSpec="*.gzip") returned 0 [0087.047] lstrlenA (lpString="*.gzip") returned 6 [0087.047] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOff.jpg", pszSpec="*.jpg") returned 1 [0087.047] lstrlenA (lpString="*.jpg") returned 5 [0087.047] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOff.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOff.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOff.jpg" [0087.047] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOff.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOff.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOff.jpg" [0087.047] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOff.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOff.jpg.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOff.jpg." [0087.047] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOff.jpg.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOff.jpg. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOff.jpg. " [0087.047] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOff.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_fileoff.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0087.047] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x46de [0087.047] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xc5eab000, dwHighDateTime=0x1c95fd3), lpLastAccessTime=0x407536*(dwLowDateTime=0x5eb686b0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xc5eab000, dwHighDateTime=0x1c95fd3)) returned 1 [0087.047] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0087.047] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x4684, lpOverlapped=0x0) returned 1 [0087.159] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOff.jpg") returned="AlertImage_FileOff.jpg" [0087.159] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0087.159] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x4684, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x4684, lpOverlapped=0x0) returned 1 [0087.159] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0087.159] CloseHandle (hObject=0x98) returned 1 [0087.161] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOff.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_fileoff.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOff.jpg. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_fileoff.jpg. ")) returned 1 [0087.162] FindNextFileA (in: hFindFile=0x5b7d30, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0087.162] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0087.162] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="AlertImage_FileOffMask.bmp") returned 1 [0087.162] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AlertImage_FileOffMask.bmp") returned 1 [0087.162] lstrcmpiA (lpString1="", lpString2="AlertImage_FileOffMask.bmp") returned -1 [0087.162] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOff.jpg") returned="AlertImage_FileOff.jpg" [0087.162] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\", lpString2="AlertImage_FileOffMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOffMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOffMask.bmp" [0087.162] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOffMask.bmp", pszSpec="*.zip") returned 0 [0087.162] lstrlenA (lpString="*.zip") returned 5 [0087.162] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOffMask.bmp", pszSpec="*.rar") returned 0 [0087.162] lstrlenA (lpString="*.rar") returned 5 [0087.162] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOffMask.bmp", pszSpec="*.7z") returned 0 [0087.162] lstrlenA (lpString="*.7z") returned 4 [0087.162] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOffMask.bmp", pszSpec="*.tar") returned 0 [0087.162] lstrlenA (lpString="*.tar") returned 5 [0087.162] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOffMask.bmp", pszSpec="*.gzip") returned 0 [0087.162] lstrlenA (lpString="*.gzip") returned 6 [0087.162] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOffMask.bmp", pszSpec="*.jpg") returned 0 [0087.162] lstrlenA (lpString="*.jpg") returned 5 [0087.162] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOffMask.bmp", pszSpec="*.jpeg") returned 0 [0087.162] lstrlenA (lpString="*.jpeg") returned 6 [0087.162] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOffMask.bmp", pszSpec="*.psd") returned 0 [0087.162] lstrlenA (lpString="*.psd") returned 5 [0087.162] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOffMask.bmp", pszSpec="*.cdr") returned 0 [0087.162] lstrlenA (lpString="*.cdr") returned 5 [0087.162] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOffMask.bmp", pszSpec="*.dwg") returned 0 [0087.162] lstrlenA (lpString="*.dwg") returned 5 [0087.162] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOffMask.bmp", pszSpec="*.max") returned 0 [0087.162] lstrlenA (lpString="*.max") returned 5 [0087.162] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOffMask.bmp", pszSpec="*.bmp") returned 1 [0087.162] lstrlenA (lpString="*.bmp") returned 5 [0087.162] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOffMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOffMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOffMask.bmp" [0087.162] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOffMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOffMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOffMask.bmp" [0087.162] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOffMask.bmp", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOffMask.bmp.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOffMask.bmp." [0087.163] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOffMask.bmp.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOffMask.bmp. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOffMask.bmp. " [0087.163] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOffMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_fileoffmask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0087.163] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1c6e [0087.163] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x427c8f00, dwHighDateTime=0x1c95fd2), lpLastAccessTime=0x407536*(dwLowDateTime=0x5eb686b0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x427c8f00, dwHighDateTime=0x1c95fd2)) returned 1 [0087.163] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0087.163] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x1c14, lpOverlapped=0x0) returned 1 [0087.250] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOffMask.bmp") returned="AlertImage_FileOffMask.bmp" [0087.250] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0087.250] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x1c14, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x1c14, lpOverlapped=0x0) returned 1 [0087.250] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0087.250] CloseHandle (hObject=0x98) returned 1 [0087.251] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOffMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_fileoffmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOffMask.bmp. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_fileoffmask.bmp. ")) returned 1 [0087.252] FindNextFileA (in: hFindFile=0x5b7d30, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0087.252] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0087.252] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="AlertImage_High.jpg") returned 1 [0087.252] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AlertImage_High.jpg") returned 1 [0087.252] lstrcmpiA (lpString1="", lpString2="AlertImage_High.jpg") returned -1 [0087.252] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOffMask.bmp") returned="AlertImage_FileOffMask.bmp" [0087.252] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\", lpString2="AlertImage_High.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_High.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_High.jpg" [0087.252] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_High.jpg", pszSpec="*.zip") returned 0 [0087.252] lstrlenA (lpString="*.zip") returned 5 [0087.252] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_High.jpg", pszSpec="*.rar") returned 0 [0087.252] lstrlenA (lpString="*.rar") returned 5 [0087.252] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_High.jpg", pszSpec="*.7z") returned 0 [0087.252] lstrlenA (lpString="*.7z") returned 4 [0087.252] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_High.jpg", pszSpec="*.tar") returned 0 [0087.252] lstrlenA (lpString="*.tar") returned 5 [0087.252] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_High.jpg", pszSpec="*.gzip") returned 0 [0087.252] lstrlenA (lpString="*.gzip") returned 6 [0087.252] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_High.jpg", pszSpec="*.jpg") returned 1 [0087.252] lstrlenA (lpString="*.jpg") returned 5 [0087.252] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_High.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_High.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_High.jpg" [0087.252] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_High.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_High.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_High.jpg" [0087.252] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_High.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_High.jpg.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_High.jpg." [0087.252] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_High.jpg.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_High.jpg. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_High.jpg. " [0087.252] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_High.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_high.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0087.253] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x13ca [0087.253] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xa2b7f600, dwHighDateTime=0x1c95f2a), lpLastAccessTime=0x407536*(dwLowDateTime=0x5eb686b0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xa2b7f600, dwHighDateTime=0x1c95f2a)) returned 1 [0087.253] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0087.253] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x1370, lpOverlapped=0x0) returned 1 [0087.292] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_High.jpg") returned="AlertImage_High.jpg" [0087.292] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0087.292] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x1370, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x1370, lpOverlapped=0x0) returned 1 [0087.293] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0087.293] CloseHandle (hObject=0x98) returned 1 [0087.294] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_High.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_high.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_High.jpg. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_high.jpg. ")) returned 1 [0087.294] FindNextFileA (in: hFindFile=0x5b7d30, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0087.294] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0087.294] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="AlertImage_HighMask.bmp") returned 1 [0087.294] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AlertImage_HighMask.bmp") returned 1 [0087.294] lstrcmpiA (lpString1="", lpString2="AlertImage_HighMask.bmp") returned -1 [0087.294] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_High.jpg") returned="AlertImage_High.jpg" [0087.294] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\", lpString2="AlertImage_HighMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_HighMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_HighMask.bmp" [0087.294] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_HighMask.bmp", pszSpec="*.zip") returned 0 [0087.295] lstrlenA (lpString="*.zip") returned 5 [0087.295] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_HighMask.bmp", pszSpec="*.rar") returned 0 [0087.295] lstrlenA (lpString="*.rar") returned 5 [0087.295] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_HighMask.bmp", pszSpec="*.7z") returned 0 [0087.295] lstrlenA (lpString="*.7z") returned 4 [0087.295] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_HighMask.bmp", pszSpec="*.tar") returned 0 [0087.295] lstrlenA (lpString="*.tar") returned 5 [0087.295] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_HighMask.bmp", pszSpec="*.gzip") returned 0 [0087.295] lstrlenA (lpString="*.gzip") returned 6 [0087.295] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_HighMask.bmp", pszSpec="*.jpg") returned 0 [0087.295] lstrlenA (lpString="*.jpg") returned 5 [0087.295] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_HighMask.bmp", pszSpec="*.jpeg") returned 0 [0087.295] lstrlenA (lpString="*.jpeg") returned 6 [0087.295] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_HighMask.bmp", pszSpec="*.psd") returned 0 [0087.295] lstrlenA (lpString="*.psd") returned 5 [0087.295] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_HighMask.bmp", pszSpec="*.cdr") returned 0 [0087.295] lstrlenA (lpString="*.cdr") returned 5 [0087.295] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_HighMask.bmp", pszSpec="*.dwg") returned 0 [0087.295] lstrlenA (lpString="*.dwg") returned 5 [0087.295] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_HighMask.bmp", pszSpec="*.max") returned 0 [0087.295] lstrlenA (lpString="*.max") returned 5 [0087.295] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_HighMask.bmp", pszSpec="*.bmp") returned 1 [0087.295] lstrlenA (lpString="*.bmp") returned 5 [0087.295] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_HighMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_HighMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_HighMask.bmp" [0087.295] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_HighMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_HighMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_HighMask.bmp" [0087.295] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_HighMask.bmp", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_HighMask.bmp.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_HighMask.bmp." [0087.295] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_HighMask.bmp.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_HighMask.bmp. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_HighMask.bmp. " [0087.295] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_HighMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_highmask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0087.295] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1c6e [0087.296] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xe3177400, dwHighDateTime=0x1c95f2a), lpLastAccessTime=0x407536*(dwLowDateTime=0x51317770, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xe3177400, dwHighDateTime=0x1c95f2a)) returned 1 [0087.296] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0087.296] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x1c14, lpOverlapped=0x0) returned 1 [0087.321] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_HighMask.bmp") returned="AlertImage_HighMask.bmp" [0087.321] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0087.321] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x1c14, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x1c14, lpOverlapped=0x0) returned 1 [0087.321] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0087.321] CloseHandle (hObject=0x98) returned 1 [0087.322] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_HighMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_highmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_HighMask.bmp. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_highmask.bmp. ")) returned 1 [0087.323] FindNextFileA (in: hFindFile=0x5b7d30, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0087.323] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0087.323] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="AlertImage_Medium.jpg") returned 1 [0087.323] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AlertImage_Medium.jpg") returned 1 [0087.323] lstrcmpiA (lpString1="", lpString2="AlertImage_Medium.jpg") returned -1 [0087.323] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_HighMask.bmp") returned="AlertImage_HighMask.bmp" [0087.323] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\", lpString2="AlertImage_Medium.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Medium.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Medium.jpg" [0087.323] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Medium.jpg", pszSpec="*.zip") returned 0 [0087.323] lstrlenA (lpString="*.zip") returned 5 [0087.323] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Medium.jpg", pszSpec="*.rar") returned 0 [0087.323] lstrlenA (lpString="*.rar") returned 5 [0087.323] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Medium.jpg", pszSpec="*.7z") returned 0 [0087.323] lstrlenA (lpString="*.7z") returned 4 [0087.323] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Medium.jpg", pszSpec="*.tar") returned 0 [0087.323] lstrlenA (lpString="*.tar") returned 5 [0087.323] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Medium.jpg", pszSpec="*.gzip") returned 0 [0087.323] lstrlenA (lpString="*.gzip") returned 6 [0087.323] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Medium.jpg", pszSpec="*.jpg") returned 1 [0087.323] lstrlenA (lpString="*.jpg") returned 5 [0087.324] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Medium.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Medium.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Medium.jpg" [0087.324] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Medium.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Medium.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Medium.jpg" [0087.324] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Medium.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Medium.jpg.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Medium.jpg." [0087.324] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Medium.jpg.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Medium.jpg. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Medium.jpg. " [0087.324] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Medium.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_medium.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0087.324] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x41de [0087.324] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xefeaa500, dwHighDateTime=0x1c95fc8), lpLastAccessTime=0x407536*(dwLowDateTime=0x5eb686b0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xefeaa500, dwHighDateTime=0x1c95fc8)) returned 1 [0087.325] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0087.325] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x4184, lpOverlapped=0x0) returned 1 [0087.336] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Medium.jpg") returned="AlertImage_Medium.jpg" [0087.337] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0087.337] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x4184, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x4184, lpOverlapped=0x0) returned 1 [0087.337] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0087.337] CloseHandle (hObject=0x98) returned 1 [0087.338] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Medium.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_medium.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Medium.jpg. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_medium.jpg. ")) returned 1 [0087.338] FindNextFileA (in: hFindFile=0x5b7d30, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0087.338] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0087.338] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="AlertImage_MediumMAsk.bmp") returned 1 [0087.338] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AlertImage_MediumMAsk.bmp") returned 1 [0087.338] lstrcmpiA (lpString1="", lpString2="AlertImage_MediumMAsk.bmp") returned -1 [0087.338] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Medium.jpg") returned="AlertImage_Medium.jpg" [0087.338] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\", lpString2="AlertImage_MediumMAsk.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_MediumMAsk.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_MediumMAsk.bmp" [0087.338] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_MediumMAsk.bmp", pszSpec="*.zip") returned 0 [0087.339] lstrlenA (lpString="*.zip") returned 5 [0087.339] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_MediumMAsk.bmp", pszSpec="*.rar") returned 0 [0087.339] lstrlenA (lpString="*.rar") returned 5 [0087.339] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_MediumMAsk.bmp", pszSpec="*.7z") returned 0 [0087.339] lstrlenA (lpString="*.7z") returned 4 [0087.339] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_MediumMAsk.bmp", pszSpec="*.tar") returned 0 [0087.339] lstrlenA (lpString="*.tar") returned 5 [0087.339] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_MediumMAsk.bmp", pszSpec="*.gzip") returned 0 [0087.339] lstrlenA (lpString="*.gzip") returned 6 [0087.339] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_MediumMAsk.bmp", pszSpec="*.jpg") returned 0 [0087.339] lstrlenA (lpString="*.jpg") returned 5 [0087.339] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_MediumMAsk.bmp", pszSpec="*.jpeg") returned 0 [0087.339] lstrlenA (lpString="*.jpeg") returned 6 [0087.339] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_MediumMAsk.bmp", pszSpec="*.psd") returned 0 [0087.339] lstrlenA (lpString="*.psd") returned 5 [0087.339] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_MediumMAsk.bmp", pszSpec="*.cdr") returned 0 [0087.339] lstrlenA (lpString="*.cdr") returned 5 [0087.339] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_MediumMAsk.bmp", pszSpec="*.dwg") returned 0 [0087.339] lstrlenA (lpString="*.dwg") returned 5 [0087.339] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_MediumMAsk.bmp", pszSpec="*.max") returned 0 [0087.339] lstrlenA (lpString="*.max") returned 5 [0087.339] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_MediumMAsk.bmp", pszSpec="*.bmp") returned 1 [0087.339] lstrlenA (lpString="*.bmp") returned 5 [0087.339] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_MediumMAsk.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_MediumMAsk.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_MediumMAsk.bmp" [0087.339] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_MediumMAsk.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_MediumMAsk.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_MediumMAsk.bmp" [0087.339] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_MediumMAsk.bmp", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_MediumMAsk.bmp.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_MediumMAsk.bmp." [0087.339] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_MediumMAsk.bmp.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_MediumMAsk.bmp. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_MediumMAsk.bmp. " [0087.339] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_MediumMAsk.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_mediummask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0087.340] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1c6e [0087.340] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xd34e6d00, dwHighDateTime=0x1c95fc8), lpLastAccessTime=0x407536*(dwLowDateTime=0x51317770, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xd34e6d00, dwHighDateTime=0x1c95fc8)) returned 1 [0087.340] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0087.340] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x1c14, lpOverlapped=0x0) returned 1 [0087.357] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_MediumMAsk.bmp") returned="AlertImage_MediumMAsk.bmp" [0087.357] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0087.357] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x1c14, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x1c14, lpOverlapped=0x0) returned 1 [0087.357] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0087.357] CloseHandle (hObject=0x98) returned 1 [0087.359] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_MediumMAsk.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_mediummask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_MediumMAsk.bmp. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_mediummask.bmp. ")) returned 1 [0087.360] FindNextFileA (in: hFindFile=0x5b7d30, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0087.360] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0087.360] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="AlertImage_Off.jpg") returned 1 [0087.360] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AlertImage_Off.jpg") returned 1 [0087.360] lstrcmpiA (lpString1="", lpString2="AlertImage_Off.jpg") returned -1 [0087.360] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_MediumMAsk.bmp") returned="AlertImage_MediumMAsk.bmp" [0087.360] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\", lpString2="AlertImage_Off.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Off.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Off.jpg" [0087.360] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Off.jpg", pszSpec="*.zip") returned 0 [0087.360] lstrlenA (lpString="*.zip") returned 5 [0087.360] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Off.jpg", pszSpec="*.rar") returned 0 [0087.360] lstrlenA (lpString="*.rar") returned 5 [0087.360] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Off.jpg", pszSpec="*.7z") returned 0 [0087.360] lstrlenA (lpString="*.7z") returned 4 [0087.360] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Off.jpg", pszSpec="*.tar") returned 0 [0087.360] lstrlenA (lpString="*.tar") returned 5 [0087.360] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Off.jpg", pszSpec="*.gzip") returned 0 [0087.360] lstrlenA (lpString="*.gzip") returned 6 [0087.360] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Off.jpg", pszSpec="*.jpg") returned 1 [0087.360] lstrlenA (lpString="*.jpg") returned 5 [0087.360] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Off.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Off.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Off.jpg" [0087.360] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Off.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Off.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Off.jpg" [0087.360] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Off.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Off.jpg.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Off.jpg." [0087.360] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Off.jpg.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Off.jpg. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Off.jpg. " [0087.360] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Off.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_off.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0087.361] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3e78 [0087.361] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x3e983f00, dwHighDateTime=0x1c95fc9), lpLastAccessTime=0x407536*(dwLowDateTime=0x5eb686b0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x3e983f00, dwHighDateTime=0x1c95fc9)) returned 1 [0087.361] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0087.361] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x3e1e, lpOverlapped=0x0) returned 1 [0087.393] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Off.jpg") returned="AlertImage_Off.jpg" [0087.393] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0087.393] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x3e1e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x3e1e, lpOverlapped=0x0) returned 1 [0087.394] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0087.394] CloseHandle (hObject=0x98) returned 1 [0087.394] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Off.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_off.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Off.jpg. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_off.jpg. ")) returned 1 [0087.395] FindNextFileA (in: hFindFile=0x5b7d30, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0087.395] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0087.395] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="AlertImage_OffMask.bmp") returned 1 [0087.395] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AlertImage_OffMask.bmp") returned 1 [0087.395] lstrcmpiA (lpString1="", lpString2="AlertImage_OffMask.bmp") returned -1 [0087.395] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Off.jpg") returned="AlertImage_Off.jpg" [0087.395] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\", lpString2="AlertImage_OffMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_OffMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_OffMask.bmp" [0087.395] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_OffMask.bmp", pszSpec="*.zip") returned 0 [0087.395] lstrlenA (lpString="*.zip") returned 5 [0087.395] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_OffMask.bmp", pszSpec="*.rar") returned 0 [0087.395] lstrlenA (lpString="*.rar") returned 5 [0087.395] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_OffMask.bmp", pszSpec="*.7z") returned 0 [0087.396] lstrlenA (lpString="*.7z") returned 4 [0087.396] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_OffMask.bmp", pszSpec="*.tar") returned 0 [0087.396] lstrlenA (lpString="*.tar") returned 5 [0087.396] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_OffMask.bmp", pszSpec="*.gzip") returned 0 [0087.396] lstrlenA (lpString="*.gzip") returned 6 [0087.396] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_OffMask.bmp", pszSpec="*.jpg") returned 0 [0087.396] lstrlenA (lpString="*.jpg") returned 5 [0087.396] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_OffMask.bmp", pszSpec="*.jpeg") returned 0 [0087.396] lstrlenA (lpString="*.jpeg") returned 6 [0087.396] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_OffMask.bmp", pszSpec="*.psd") returned 0 [0087.396] lstrlenA (lpString="*.psd") returned 5 [0087.396] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_OffMask.bmp", pszSpec="*.cdr") returned 0 [0087.396] lstrlenA (lpString="*.cdr") returned 5 [0087.396] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_OffMask.bmp", pszSpec="*.dwg") returned 0 [0087.396] lstrlenA (lpString="*.dwg") returned 5 [0087.396] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_OffMask.bmp", pszSpec="*.max") returned 0 [0087.396] lstrlenA (lpString="*.max") returned 5 [0087.396] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_OffMask.bmp", pszSpec="*.bmp") returned 1 [0087.396] lstrlenA (lpString="*.bmp") returned 5 [0087.396] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_OffMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_OffMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_OffMask.bmp" [0087.396] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_OffMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_OffMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_OffMask.bmp" [0087.396] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_OffMask.bmp", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_OffMask.bmp.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_OffMask.bmp." [0087.396] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_OffMask.bmp.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_OffMask.bmp. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_OffMask.bmp. " [0087.396] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_OffMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_offmask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0087.397] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1c6e [0087.397] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x258f8e00, dwHighDateTime=0x1c95fc9), lpLastAccessTime=0x407536*(dwLowDateTime=0x5133d8d0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x258f8e00, dwHighDateTime=0x1c95fc9)) returned 1 [0087.397] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0087.397] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x1c14, lpOverlapped=0x0) returned 1 [0087.449] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_OffMask.bmp") returned="AlertImage_OffMask.bmp" [0087.449] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0087.449] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x1c14, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x1c14, lpOverlapped=0x0) returned 1 [0087.449] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0087.449] CloseHandle (hObject=0x98) returned 1 [0087.450] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_OffMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_offmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_OffMask.bmp. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_offmask.bmp. ")) returned 1 [0087.450] FindNextFileA (in: hFindFile=0x5b7d30, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0087.451] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0087.451] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="CommsIncomingImage.jpg") returned 1 [0087.451] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="CommsIncomingImage.jpg") returned 1 [0087.451] lstrcmpiA (lpString1="", lpString2="CommsIncomingImage.jpg") returned -1 [0087.451] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_OffMask.bmp") returned="AlertImage_OffMask.bmp" [0087.451] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\", lpString2="CommsIncomingImage.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImage.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImage.jpg" [0087.451] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImage.jpg", pszSpec="*.zip") returned 0 [0087.451] lstrlenA (lpString="*.zip") returned 5 [0087.451] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImage.jpg", pszSpec="*.rar") returned 0 [0087.451] lstrlenA (lpString="*.rar") returned 5 [0087.451] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImage.jpg", pszSpec="*.7z") returned 0 [0087.451] lstrlenA (lpString="*.7z") returned 4 [0087.451] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImage.jpg", pszSpec="*.tar") returned 0 [0087.451] lstrlenA (lpString="*.tar") returned 5 [0087.451] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImage.jpg", pszSpec="*.gzip") returned 0 [0087.451] lstrlenA (lpString="*.gzip") returned 6 [0087.451] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImage.jpg", pszSpec="*.jpg") returned 1 [0087.451] lstrlenA (lpString="*.jpg") returned 5 [0087.451] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImage.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImage.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImage.jpg" [0087.451] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImage.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImage.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImage.jpg" [0087.451] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImage.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImage.jpg.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImage.jpg." [0087.451] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImage.jpg.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImage.jpg. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImage.jpg. " [0087.451] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImage.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\commsincomingimage.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0087.514] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2256 [0087.514] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xfbb75100, dwHighDateTime=0x1c9bcb4), lpLastAccessTime=0x407536*(dwLowDateTime=0x603f4990, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xfbb75100, dwHighDateTime=0x1c9bcb4)) returned 1 [0087.514] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0087.514] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x21fc, lpOverlapped=0x0) returned 1 [0087.559] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImage.jpg") returned="CommsIncomingImage.jpg" [0087.559] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0087.559] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x21fc, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x21fc, lpOverlapped=0x0) returned 1 [0087.559] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0087.559] CloseHandle (hObject=0x98) returned 1 [0087.560] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImage.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\commsincomingimage.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImage.jpg. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\commsincomingimage.jpg. ")) returned 1 [0087.561] FindNextFileA (in: hFindFile=0x5b7d30, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0087.561] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0087.561] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="CommsIncomingImageMask.bmp") returned 1 [0087.561] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="CommsIncomingImageMask.bmp") returned 1 [0087.561] lstrcmpiA (lpString1="", lpString2="CommsIncomingImageMask.bmp") returned -1 [0087.561] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImage.jpg") returned="CommsIncomingImage.jpg" [0087.561] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\", lpString2="CommsIncomingImageMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMask.bmp" [0087.561] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMask.bmp", pszSpec="*.zip") returned 0 [0087.561] lstrlenA (lpString="*.zip") returned 5 [0087.561] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMask.bmp", pszSpec="*.rar") returned 0 [0087.561] lstrlenA (lpString="*.rar") returned 5 [0087.561] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMask.bmp", pszSpec="*.7z") returned 0 [0087.561] lstrlenA (lpString="*.7z") returned 4 [0087.561] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMask.bmp", pszSpec="*.tar") returned 0 [0087.561] lstrlenA (lpString="*.tar") returned 5 [0087.561] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMask.bmp", pszSpec="*.gzip") returned 0 [0087.561] lstrlenA (lpString="*.gzip") returned 6 [0087.561] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMask.bmp", pszSpec="*.jpg") returned 0 [0087.561] lstrlenA (lpString="*.jpg") returned 5 [0087.561] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMask.bmp", pszSpec="*.jpeg") returned 0 [0087.561] lstrlenA (lpString="*.jpeg") returned 6 [0087.561] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMask.bmp", pszSpec="*.psd") returned 0 [0087.561] lstrlenA (lpString="*.psd") returned 5 [0087.561] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMask.bmp", pszSpec="*.cdr") returned 0 [0087.561] lstrlenA (lpString="*.cdr") returned 5 [0087.561] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMask.bmp", pszSpec="*.dwg") returned 0 [0087.561] lstrlenA (lpString="*.dwg") returned 5 [0087.561] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMask.bmp", pszSpec="*.max") returned 0 [0087.561] lstrlenA (lpString="*.max") returned 5 [0087.562] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMask.bmp", pszSpec="*.bmp") returned 1 [0087.562] lstrlenA (lpString="*.bmp") returned 5 [0087.562] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMask.bmp" [0087.562] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMask.bmp" [0087.562] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMask.bmp", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMask.bmp.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMask.bmp." [0087.562] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMask.bmp.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMask.bmp. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMask.bmp. " [0087.562] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\commsincomingimagemask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0087.562] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x9d8 [0087.562] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x1d183d00, dwHighDateTime=0x1c9bcb5), lpLastAccessTime=0x407536*(dwLowDateTime=0x603f4990, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x1d183d00, dwHighDateTime=0x1c9bcb5)) returned 1 [0087.562] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0087.562] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x97e, lpOverlapped=0x0) returned 1 [0087.579] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMask.bmp") returned="CommsIncomingImageMask.bmp" [0087.579] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0087.579] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x97e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x97e, lpOverlapped=0x0) returned 1 [0087.579] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0087.579] CloseHandle (hObject=0x98) returned 1 [0087.580] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\commsincomingimagemask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMask.bmp. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\commsincomingimagemask.bmp. ")) returned 1 [0087.581] FindNextFileA (in: hFindFile=0x5b7d30, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0087.581] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0087.581] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="CommsIncomingImageMaskSmall.bmp") returned 1 [0087.581] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="CommsIncomingImageMaskSmall.bmp") returned 1 [0087.581] lstrcmpiA (lpString1="", lpString2="CommsIncomingImageMaskSmall.bmp") returned -1 [0087.581] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMask.bmp") returned="CommsIncomingImageMask.bmp" [0087.581] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\", lpString2="CommsIncomingImageMaskSmall.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMaskSmall.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMaskSmall.bmp" [0087.581] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMaskSmall.bmp", pszSpec="*.zip") returned 0 [0087.581] lstrlenA (lpString="*.zip") returned 5 [0087.581] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMaskSmall.bmp", pszSpec="*.rar") returned 0 [0087.581] lstrlenA (lpString="*.rar") returned 5 [0087.581] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMaskSmall.bmp", pszSpec="*.7z") returned 0 [0087.581] lstrlenA (lpString="*.7z") returned 4 [0087.581] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMaskSmall.bmp", pszSpec="*.tar") returned 0 [0087.581] lstrlenA (lpString="*.tar") returned 5 [0087.581] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMaskSmall.bmp", pszSpec="*.gzip") returned 0 [0087.581] lstrlenA (lpString="*.gzip") returned 6 [0087.581] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMaskSmall.bmp", pszSpec="*.jpg") returned 0 [0087.581] lstrlenA (lpString="*.jpg") returned 5 [0087.581] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMaskSmall.bmp", pszSpec="*.jpeg") returned 0 [0087.581] lstrlenA (lpString="*.jpeg") returned 6 [0087.581] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMaskSmall.bmp", pszSpec="*.psd") returned 0 [0087.581] lstrlenA (lpString="*.psd") returned 5 [0087.581] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMaskSmall.bmp", pszSpec="*.cdr") returned 0 [0087.581] lstrlenA (lpString="*.cdr") returned 5 [0087.581] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMaskSmall.bmp", pszSpec="*.dwg") returned 0 [0087.581] lstrlenA (lpString="*.dwg") returned 5 [0087.581] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMaskSmall.bmp", pszSpec="*.max") returned 0 [0087.581] lstrlenA (lpString="*.max") returned 5 [0087.581] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMaskSmall.bmp", pszSpec="*.bmp") returned 1 [0087.581] lstrlenA (lpString="*.bmp") returned 5 [0087.581] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMaskSmall.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMaskSmall.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMaskSmall.bmp" [0087.581] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMaskSmall.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMaskSmall.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMaskSmall.bmp" [0087.581] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMaskSmall.bmp", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMaskSmall.bmp.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMaskSmall.bmp." [0087.581] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMaskSmall.bmp.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMaskSmall.bmp. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMaskSmall.bmp. " [0087.581] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMaskSmall.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\commsincomingimagemasksmall.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0087.582] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x630 [0087.582] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x7ee1e000, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x51cc30d0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x7ee1e000, dwHighDateTime=0x1c747ea)) returned 1 [0087.582] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0087.582] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x5d6, lpOverlapped=0x0) returned 1 [0087.597] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMaskSmall.bmp") returned="CommsIncomingImageMaskSmall.bmp" [0087.597] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0087.597] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x5d6, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x5d6, lpOverlapped=0x0) returned 1 [0087.597] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0087.597] CloseHandle (hObject=0x98) returned 1 [0087.598] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMaskSmall.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\commsincomingimagemasksmall.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMaskSmall.bmp. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\commsincomingimagemasksmall.bmp. ")) returned 1 [0087.598] FindNextFileA (in: hFindFile=0x5b7d30, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0087.598] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0087.598] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="CommsIncomingImageSmall.jpg") returned 1 [0087.598] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="CommsIncomingImageSmall.jpg") returned 1 [0087.598] lstrcmpiA (lpString1="", lpString2="CommsIncomingImageSmall.jpg") returned -1 [0087.598] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMaskSmall.bmp") returned="CommsIncomingImageMaskSmall.bmp" [0087.599] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\", lpString2="CommsIncomingImageSmall.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageSmall.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageSmall.jpg" [0087.599] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageSmall.jpg", pszSpec="*.zip") returned 0 [0087.599] lstrlenA (lpString="*.zip") returned 5 [0087.599] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageSmall.jpg", pszSpec="*.rar") returned 0 [0087.599] lstrlenA (lpString="*.rar") returned 5 [0087.599] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageSmall.jpg", pszSpec="*.7z") returned 0 [0087.599] lstrlenA (lpString="*.7z") returned 4 [0087.599] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageSmall.jpg", pszSpec="*.tar") returned 0 [0087.599] lstrlenA (lpString="*.tar") returned 5 [0087.599] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageSmall.jpg", pszSpec="*.gzip") returned 0 [0087.599] lstrlenA (lpString="*.gzip") returned 6 [0087.599] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageSmall.jpg", pszSpec="*.jpg") returned 1 [0087.599] lstrlenA (lpString="*.jpg") returned 5 [0087.599] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageSmall.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageSmall.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageSmall.jpg" [0087.599] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageSmall.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageSmall.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageSmall.jpg" [0087.599] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageSmall.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageSmall.jpg.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageSmall.jpg." [0087.599] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageSmall.jpg.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageSmall.jpg. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageSmall.jpg. " [0087.599] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageSmall.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\commsincomingimagesmall.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0087.599] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1de3 [0087.599] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x7ee1e000, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x603f4990, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x7ee1e000, dwHighDateTime=0x1c747ea)) returned 1 [0087.599] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0087.599] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x1d89, lpOverlapped=0x0) returned 1 [0087.614] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageSmall.jpg") returned="CommsIncomingImageSmall.jpg" [0087.614] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0087.614] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x1d89, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x1d89, lpOverlapped=0x0) returned 1 [0087.614] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0087.614] CloseHandle (hObject=0x98) returned 1 [0087.615] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageSmall.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\commsincomingimagesmall.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageSmall.jpg. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\commsincomingimagesmall.jpg. ")) returned 1 [0087.616] FindNextFileA (in: hFindFile=0x5b7d30, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0087.616] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0087.616] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="CommsOutgoingImage.jpg") returned 1 [0087.616] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="CommsOutgoingImage.jpg") returned 1 [0087.616] lstrcmpiA (lpString1="", lpString2="CommsOutgoingImage.jpg") returned -1 [0087.616] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageSmall.jpg") returned="CommsIncomingImageSmall.jpg" [0087.616] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\", lpString2="CommsOutgoingImage.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImage.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImage.jpg" [0087.616] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImage.jpg", pszSpec="*.zip") returned 0 [0087.616] lstrlenA (lpString="*.zip") returned 5 [0087.616] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImage.jpg", pszSpec="*.rar") returned 0 [0087.616] lstrlenA (lpString="*.rar") returned 5 [0087.616] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImage.jpg", pszSpec="*.7z") returned 0 [0087.616] lstrlenA (lpString="*.7z") returned 4 [0087.616] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImage.jpg", pszSpec="*.tar") returned 0 [0087.616] lstrlenA (lpString="*.tar") returned 5 [0087.616] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImage.jpg", pszSpec="*.gzip") returned 0 [0087.616] lstrlenA (lpString="*.gzip") returned 6 [0087.616] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImage.jpg", pszSpec="*.jpg") returned 1 [0087.616] lstrlenA (lpString="*.jpg") returned 5 [0087.616] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImage.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImage.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImage.jpg" [0087.616] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImage.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImage.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImage.jpg" [0087.616] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImage.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImage.jpg.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImage.jpg." [0087.616] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImage.jpg.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImage.jpg. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImage.jpg. " [0087.616] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImage.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\commsoutgoingimage.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0087.618] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x22c0 [0087.618] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x5c468e00, dwHighDateTime=0x1c9bcb5), lpLastAccessTime=0x407536*(dwLowDateTime=0x6041aaf0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x5c468e00, dwHighDateTime=0x1c9bcb5)) returned 1 [0087.618] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0087.618] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x2266, lpOverlapped=0x0) returned 1 [0087.630] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImage.jpg") returned="CommsOutgoingImage.jpg" [0087.630] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0087.630] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x2266, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x2266, lpOverlapped=0x0) returned 1 [0087.630] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0087.630] CloseHandle (hObject=0x98) returned 1 [0087.631] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImage.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\commsoutgoingimage.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImage.jpg. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\commsoutgoingimage.jpg. ")) returned 1 [0087.632] FindNextFileA (in: hFindFile=0x5b7d30, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0087.632] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0087.632] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="CommsOutgoingImageMask.bmp") returned 1 [0087.632] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="CommsOutgoingImageMask.bmp") returned 1 [0087.632] lstrcmpiA (lpString1="", lpString2="CommsOutgoingImageMask.bmp") returned -1 [0087.632] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImage.jpg") returned="CommsOutgoingImage.jpg" [0087.632] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\", lpString2="CommsOutgoingImageMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMask.bmp" [0087.632] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMask.bmp", pszSpec="*.zip") returned 0 [0087.632] lstrlenA (lpString="*.zip") returned 5 [0087.632] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMask.bmp", pszSpec="*.rar") returned 0 [0087.632] lstrlenA (lpString="*.rar") returned 5 [0087.632] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMask.bmp", pszSpec="*.7z") returned 0 [0087.633] lstrlenA (lpString="*.7z") returned 4 [0087.633] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMask.bmp", pszSpec="*.tar") returned 0 [0087.633] lstrlenA (lpString="*.tar") returned 5 [0087.633] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMask.bmp", pszSpec="*.gzip") returned 0 [0087.633] lstrlenA (lpString="*.gzip") returned 6 [0087.633] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMask.bmp", pszSpec="*.jpg") returned 0 [0087.633] lstrlenA (lpString="*.jpg") returned 5 [0087.633] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMask.bmp", pszSpec="*.jpeg") returned 0 [0087.633] lstrlenA (lpString="*.jpeg") returned 6 [0087.633] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMask.bmp", pszSpec="*.psd") returned 0 [0087.633] lstrlenA (lpString="*.psd") returned 5 [0087.633] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMask.bmp", pszSpec="*.cdr") returned 0 [0087.633] lstrlenA (lpString="*.cdr") returned 5 [0087.633] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMask.bmp", pszSpec="*.dwg") returned 0 [0087.633] lstrlenA (lpString="*.dwg") returned 5 [0087.633] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMask.bmp", pszSpec="*.max") returned 0 [0087.633] lstrlenA (lpString="*.max") returned 5 [0087.633] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMask.bmp", pszSpec="*.bmp") returned 1 [0087.633] lstrlenA (lpString="*.bmp") returned 5 [0087.633] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMask.bmp" [0087.633] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMask.bmp" [0087.633] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMask.bmp", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMask.bmp.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMask.bmp." [0087.633] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMask.bmp.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMask.bmp. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMask.bmp. " [0087.633] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\commsoutgoingimagemask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0087.634] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x9d8 [0087.634] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8bf59600, dwHighDateTime=0x1c9bcb5), lpLastAccessTime=0x407536*(dwLowDateTime=0x51cc30d0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8bf59600, dwHighDateTime=0x1c9bcb5)) returned 1 [0087.634] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0087.634] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x97e, lpOverlapped=0x0) returned 1 [0087.648] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMask.bmp") returned="CommsOutgoingImageMask.bmp" [0087.648] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0087.648] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x97e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x97e, lpOverlapped=0x0) returned 1 [0087.649] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0087.649] CloseHandle (hObject=0x98) returned 1 [0087.650] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\commsoutgoingimagemask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMask.bmp. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\commsoutgoingimagemask.bmp. ")) returned 1 [0087.651] FindNextFileA (in: hFindFile=0x5b7d30, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0087.651] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0087.651] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="CommsOutgoingImageMaskSmall.bmp") returned 1 [0087.651] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="CommsOutgoingImageMaskSmall.bmp") returned 1 [0087.651] lstrcmpiA (lpString1="", lpString2="CommsOutgoingImageMaskSmall.bmp") returned -1 [0087.651] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMask.bmp") returned="CommsOutgoingImageMask.bmp" [0087.651] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\", lpString2="CommsOutgoingImageMaskSmall.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMaskSmall.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMaskSmall.bmp" [0087.651] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMaskSmall.bmp", pszSpec="*.zip") returned 0 [0087.651] lstrlenA (lpString="*.zip") returned 5 [0087.651] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMaskSmall.bmp", pszSpec="*.rar") returned 0 [0087.651] lstrlenA (lpString="*.rar") returned 5 [0087.651] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMaskSmall.bmp", pszSpec="*.7z") returned 0 [0087.651] lstrlenA (lpString="*.7z") returned 4 [0087.651] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMaskSmall.bmp", pszSpec="*.tar") returned 0 [0087.651] lstrlenA (lpString="*.tar") returned 5 [0087.651] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMaskSmall.bmp", pszSpec="*.gzip") returned 0 [0087.652] lstrlenA (lpString="*.gzip") returned 6 [0087.652] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMaskSmall.bmp", pszSpec="*.jpg") returned 0 [0087.652] lstrlenA (lpString="*.jpg") returned 5 [0087.652] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMaskSmall.bmp", pszSpec="*.jpeg") returned 0 [0087.652] lstrlenA (lpString="*.jpeg") returned 6 [0087.652] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMaskSmall.bmp", pszSpec="*.psd") returned 0 [0087.652] lstrlenA (lpString="*.psd") returned 5 [0087.652] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMaskSmall.bmp", pszSpec="*.cdr") returned 0 [0087.652] lstrlenA (lpString="*.cdr") returned 5 [0087.652] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMaskSmall.bmp", pszSpec="*.dwg") returned 0 [0087.652] lstrlenA (lpString="*.dwg") returned 5 [0087.652] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMaskSmall.bmp", pszSpec="*.max") returned 0 [0087.652] lstrlenA (lpString="*.max") returned 5 [0087.652] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMaskSmall.bmp", pszSpec="*.bmp") returned 1 [0087.652] lstrlenA (lpString="*.bmp") returned 5 [0087.652] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMaskSmall.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMaskSmall.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMaskSmall.bmp" [0087.652] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMaskSmall.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMaskSmall.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMaskSmall.bmp" [0087.652] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMaskSmall.bmp", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMaskSmall.bmp.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMaskSmall.bmp." [0087.652] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMaskSmall.bmp.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMaskSmall.bmp. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMaskSmall.bmp. " [0087.652] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMaskSmall.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\commsoutgoingimagemasksmall.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0087.653] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x630 [0087.653] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x7ee1e000, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x51cc30d0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x7ee1e000, dwHighDateTime=0x1c747ea)) returned 1 [0087.653] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0087.653] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x5d6, lpOverlapped=0x0) returned 1 [0087.766] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMaskSmall.bmp") returned="CommsOutgoingImageMaskSmall.bmp" [0087.766] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0087.766] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x5d6, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x5d6, lpOverlapped=0x0) returned 1 [0087.766] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0087.767] CloseHandle (hObject=0x98) returned 1 [0087.768] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMaskSmall.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\commsoutgoingimagemasksmall.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMaskSmall.bmp. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\commsoutgoingimagemasksmall.bmp. ")) returned 1 [0087.769] FindNextFileA (in: hFindFile=0x5b7d30, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0087.769] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0087.769] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="CommsOutgoingImageSmall.jpg") returned 1 [0087.769] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="CommsOutgoingImageSmall.jpg") returned 1 [0087.769] lstrcmpiA (lpString1="", lpString2="CommsOutgoingImageSmall.jpg") returned -1 [0087.769] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMaskSmall.bmp") returned="CommsOutgoingImageMaskSmall.bmp" [0087.769] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\", lpString2="CommsOutgoingImageSmall.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageSmall.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageSmall.jpg" [0087.769] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageSmall.jpg", pszSpec="*.zip") returned 0 [0087.769] lstrlenA (lpString="*.zip") returned 5 [0087.769] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageSmall.jpg", pszSpec="*.rar") returned 0 [0087.769] lstrlenA (lpString="*.rar") returned 5 [0087.769] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageSmall.jpg", pszSpec="*.7z") returned 0 [0087.769] lstrlenA (lpString="*.7z") returned 4 [0087.769] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageSmall.jpg", pszSpec="*.tar") returned 0 [0087.769] lstrlenA (lpString="*.tar") returned 5 [0087.769] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageSmall.jpg", pszSpec="*.gzip") returned 0 [0087.769] lstrlenA (lpString="*.gzip") returned 6 [0087.769] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageSmall.jpg", pszSpec="*.jpg") returned 1 [0087.769] lstrlenA (lpString="*.jpg") returned 5 [0087.769] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageSmall.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageSmall.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageSmall.jpg" [0087.769] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageSmall.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageSmall.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageSmall.jpg" [0087.769] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageSmall.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageSmall.jpg.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageSmall.jpg." [0087.769] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageSmall.jpg.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageSmall.jpg. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageSmall.jpg. " [0087.769] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageSmall.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\commsoutgoingimagesmall.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0087.770] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1dd7 [0087.770] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x7ee1e000, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x51cc30d0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x7ee1e000, dwHighDateTime=0x1c747ea)) returned 1 [0087.770] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0087.770] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x1d7d, lpOverlapped=0x0) returned 1 [0087.804] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageSmall.jpg") returned="CommsOutgoingImageSmall.jpg" [0087.804] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0087.804] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x1d7d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x1d7d, lpOverlapped=0x0) returned 1 [0087.804] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0087.805] CloseHandle (hObject=0x98) returned 1 [0087.805] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageSmall.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\commsoutgoingimagesmall.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageSmall.jpg. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\commsoutgoingimagesmall.jpg. ")) returned 1 [0087.806] FindNextFileA (in: hFindFile=0x5b7d30, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0087.806] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0087.806] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="MessageBoxIconImages.jpg") returned -1 [0087.806] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MessageBoxIconImages.jpg") returned -1 [0087.806] lstrcmpiA (lpString1="", lpString2="MessageBoxIconImages.jpg") returned -1 [0087.806] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageSmall.jpg") returned="CommsOutgoingImageSmall.jpg" [0087.806] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\", lpString2="MessageBoxIconImages.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImages.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImages.jpg" [0087.806] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImages.jpg", pszSpec="*.zip") returned 0 [0087.806] lstrlenA (lpString="*.zip") returned 5 [0087.806] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImages.jpg", pszSpec="*.rar") returned 0 [0087.807] lstrlenA (lpString="*.rar") returned 5 [0087.807] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImages.jpg", pszSpec="*.7z") returned 0 [0087.807] lstrlenA (lpString="*.7z") returned 4 [0087.807] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImages.jpg", pszSpec="*.tar") returned 0 [0087.807] lstrlenA (lpString="*.tar") returned 5 [0087.807] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImages.jpg", pszSpec="*.gzip") returned 0 [0087.807] lstrlenA (lpString="*.gzip") returned 6 [0087.807] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImages.jpg", pszSpec="*.jpg") returned 1 [0087.807] lstrlenA (lpString="*.jpg") returned 5 [0087.807] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImages.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImages.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImages.jpg" [0087.807] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImages.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImages.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImages.jpg" [0087.807] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImages.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImages.jpg.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImages.jpg." [0087.807] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImages.jpg.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImages.jpg. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImages.jpg. " [0087.807] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\messageboxiconimages.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0087.807] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2798 [0087.807] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x80130d00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x69a5d7b0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x80130d00, dwHighDateTime=0x1c747ea)) returned 1 [0087.807] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0087.807] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x273e, lpOverlapped=0x0) returned 1 [0087.822] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImages.jpg") returned="MessageBoxIconImages.jpg" [0087.822] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0087.822] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x273e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x273e, lpOverlapped=0x0) returned 1 [0087.822] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0087.822] CloseHandle (hObject=0x98) returned 1 [0087.823] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\messageboxiconimages.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImages.jpg. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\messageboxiconimages.jpg. ")) returned 1 [0087.824] FindNextFileA (in: hFindFile=0x5b7d30, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0087.824] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0087.824] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="MessageBoxIconImagesMask.bmp") returned -1 [0087.824] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MessageBoxIconImagesMask.bmp") returned -1 [0087.824] lstrcmpiA (lpString1="", lpString2="MessageBoxIconImagesMask.bmp") returned -1 [0087.824] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImages.jpg") returned="MessageBoxIconImages.jpg" [0087.824] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\", lpString2="MessageBoxIconImagesMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImagesMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImagesMask.bmp" [0087.824] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImagesMask.bmp", pszSpec="*.zip") returned 0 [0087.824] lstrlenA (lpString="*.zip") returned 5 [0087.824] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImagesMask.bmp", pszSpec="*.rar") returned 0 [0087.824] lstrlenA (lpString="*.rar") returned 5 [0087.824] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImagesMask.bmp", pszSpec="*.7z") returned 0 [0087.824] lstrlenA (lpString="*.7z") returned 4 [0087.824] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImagesMask.bmp", pszSpec="*.tar") returned 0 [0087.824] lstrlenA (lpString="*.tar") returned 5 [0087.824] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImagesMask.bmp", pszSpec="*.gzip") returned 0 [0087.824] lstrlenA (lpString="*.gzip") returned 6 [0087.824] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImagesMask.bmp", pszSpec="*.jpg") returned 0 [0087.824] lstrlenA (lpString="*.jpg") returned 5 [0087.824] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImagesMask.bmp", pszSpec="*.jpeg") returned 0 [0087.824] lstrlenA (lpString="*.jpeg") returned 6 [0087.824] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImagesMask.bmp", pszSpec="*.psd") returned 0 [0087.824] lstrlenA (lpString="*.psd") returned 5 [0087.824] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImagesMask.bmp", pszSpec="*.cdr") returned 0 [0087.825] lstrlenA (lpString="*.cdr") returned 5 [0087.825] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImagesMask.bmp", pszSpec="*.dwg") returned 0 [0087.825] lstrlenA (lpString="*.dwg") returned 5 [0087.825] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImagesMask.bmp", pszSpec="*.max") returned 0 [0087.825] lstrlenA (lpString="*.max") returned 5 [0087.825] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImagesMask.bmp", pszSpec="*.bmp") returned 1 [0087.825] lstrlenA (lpString="*.bmp") returned 5 [0087.825] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImagesMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImagesMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImagesMask.bmp" [0087.825] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImagesMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImagesMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImagesMask.bmp" [0087.825] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImagesMask.bmp", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImagesMask.bmp.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImagesMask.bmp." [0087.825] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImagesMask.bmp.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImagesMask.bmp. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImagesMask.bmp. " [0087.825] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\messageboxiconimagesmask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0087.825] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xc0 [0087.825] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x80130d00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x69a5d7b0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x80130d00, dwHighDateTime=0x1c747ea)) returned 1 [0087.825] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0087.825] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x66, lpOverlapped=0x0) returned 1 [0087.826] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImagesMask.bmp") returned="MessageBoxIconImagesMask.bmp" [0087.826] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0087.826] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x66, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x66, lpOverlapped=0x0) returned 1 [0087.827] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0087.827] CloseHandle (hObject=0x98) returned 1 [0087.827] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\messageboxiconimagesmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImagesMask.bmp. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\messageboxiconimagesmask.bmp. ")) returned 1 [0087.828] FindNextFileA (in: hFindFile=0x5b7d30, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0087.828] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0087.828] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="UnreadIcon.jpg") returned -1 [0087.828] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="UnreadIcon.jpg") returned -1 [0087.828] lstrcmpiA (lpString1="", lpString2="UnreadIcon.jpg") returned -1 [0087.828] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImagesMask.bmp") returned="MessageBoxIconImagesMask.bmp" [0087.828] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\", lpString2="UnreadIcon.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIcon.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIcon.jpg" [0087.828] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIcon.jpg", pszSpec="*.zip") returned 0 [0087.828] lstrlenA (lpString="*.zip") returned 5 [0087.829] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIcon.jpg", pszSpec="*.rar") returned 0 [0087.829] lstrlenA (lpString="*.rar") returned 5 [0087.829] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIcon.jpg", pszSpec="*.7z") returned 0 [0087.829] lstrlenA (lpString="*.7z") returned 4 [0087.829] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIcon.jpg", pszSpec="*.tar") returned 0 [0087.829] lstrlenA (lpString="*.tar") returned 5 [0087.829] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIcon.jpg", pszSpec="*.gzip") returned 0 [0087.829] lstrlenA (lpString="*.gzip") returned 6 [0087.829] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIcon.jpg", pszSpec="*.jpg") returned 1 [0087.829] lstrlenA (lpString="*.jpg") returned 5 [0087.829] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIcon.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIcon.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIcon.jpg" [0087.829] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIcon.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIcon.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIcon.jpg" [0087.829] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIcon.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIcon.jpg.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIcon.jpg." [0087.829] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIcon.jpg.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIcon.jpg. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIcon.jpg. " [0087.829] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIcon.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\unreadicon.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0087.844] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1fec [0087.844] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x6c135400, dwHighDateTime=0x1ca0330), lpLastAccessTime=0x407536*(dwLowDateTime=0x5e3d2090, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x6c135400, dwHighDateTime=0x1ca0330)) returned 1 [0087.844] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0087.844] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x1f92, lpOverlapped=0x0) returned 1 [0087.873] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIcon.jpg") returned="UnreadIcon.jpg" [0087.873] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0087.873] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x1f92, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x1f92, lpOverlapped=0x0) returned 1 [0087.873] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0087.873] CloseHandle (hObject=0x98) returned 1 [0087.874] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIcon.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\unreadicon.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIcon.jpg. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\unreadicon.jpg. ")) returned 1 [0087.875] FindNextFileA (in: hFindFile=0x5b7d30, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0087.875] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0087.875] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="UnreadIconImages.jpg") returned -1 [0087.875] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="UnreadIconImages.jpg") returned -1 [0087.875] lstrcmpiA (lpString1="", lpString2="UnreadIconImages.jpg") returned -1 [0087.875] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIcon.jpg") returned="UnreadIcon.jpg" [0087.875] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\", lpString2="UnreadIconImages.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImages.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImages.jpg" [0087.875] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImages.jpg", pszSpec="*.zip") returned 0 [0087.875] lstrlenA (lpString="*.zip") returned 5 [0087.875] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImages.jpg", pszSpec="*.rar") returned 0 [0087.875] lstrlenA (lpString="*.rar") returned 5 [0087.875] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImages.jpg", pszSpec="*.7z") returned 0 [0087.875] lstrlenA (lpString="*.7z") returned 4 [0087.875] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImages.jpg", pszSpec="*.tar") returned 0 [0087.875] lstrlenA (lpString="*.tar") returned 5 [0087.875] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImages.jpg", pszSpec="*.gzip") returned 0 [0087.875] lstrlenA (lpString="*.gzip") returned 6 [0087.875] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImages.jpg", pszSpec="*.jpg") returned 1 [0087.875] lstrlenA (lpString="*.jpg") returned 5 [0087.876] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImages.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImages.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImages.jpg" [0087.876] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImages.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImages.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImages.jpg" [0087.876] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImages.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImages.jpg.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImages.jpg." [0087.876] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImages.jpg.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImages.jpg. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImages.jpg. " [0087.876] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\unreadiconimages.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0087.878] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1ffe [0087.878] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xb98fc100, dwHighDateTime=0x1ca0330), lpLastAccessTime=0x407536*(dwLowDateTime=0x5e3d2090, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xb98fc100, dwHighDateTime=0x1ca0330)) returned 1 [0087.878] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0087.878] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x1fa4, lpOverlapped=0x0) returned 1 [0087.902] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImages.jpg") returned="UnreadIconImages.jpg" [0087.902] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0087.902] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x1fa4, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x1fa4, lpOverlapped=0x0) returned 1 [0087.902] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0087.903] CloseHandle (hObject=0x98) returned 1 [0087.903] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\unreadiconimages.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImages.jpg. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\unreadiconimages.jpg. ")) returned 1 [0087.904] FindNextFileA (in: hFindFile=0x5b7d30, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0087.904] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0087.904] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="UnreadIconImagesMask.bmp") returned -1 [0087.904] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="UnreadIconImagesMask.bmp") returned -1 [0087.904] lstrcmpiA (lpString1="", lpString2="UnreadIconImagesMask.bmp") returned -1 [0087.904] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImages.jpg") returned="UnreadIconImages.jpg" [0087.904] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\", lpString2="UnreadIconImagesMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImagesMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImagesMask.bmp" [0087.904] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImagesMask.bmp", pszSpec="*.zip") returned 0 [0087.904] lstrlenA (lpString="*.zip") returned 5 [0087.904] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImagesMask.bmp", pszSpec="*.rar") returned 0 [0087.904] lstrlenA (lpString="*.rar") returned 5 [0087.904] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImagesMask.bmp", pszSpec="*.7z") returned 0 [0087.904] lstrlenA (lpString="*.7z") returned 4 [0087.904] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImagesMask.bmp", pszSpec="*.tar") returned 0 [0087.904] lstrlenA (lpString="*.tar") returned 5 [0087.905] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImagesMask.bmp", pszSpec="*.gzip") returned 0 [0087.905] lstrlenA (lpString="*.gzip") returned 6 [0087.905] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImagesMask.bmp", pszSpec="*.jpg") returned 0 [0087.905] lstrlenA (lpString="*.jpg") returned 5 [0087.905] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImagesMask.bmp", pszSpec="*.jpeg") returned 0 [0087.905] lstrlenA (lpString="*.jpeg") returned 6 [0087.905] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImagesMask.bmp", pszSpec="*.psd") returned 0 [0087.905] lstrlenA (lpString="*.psd") returned 5 [0087.905] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImagesMask.bmp", pszSpec="*.cdr") returned 0 [0087.905] lstrlenA (lpString="*.cdr") returned 5 [0087.905] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImagesMask.bmp", pszSpec="*.dwg") returned 0 [0087.905] lstrlenA (lpString="*.dwg") returned 5 [0087.905] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImagesMask.bmp", pszSpec="*.max") returned 0 [0087.905] lstrlenA (lpString="*.max") returned 5 [0087.905] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImagesMask.bmp", pszSpec="*.bmp") returned 1 [0087.905] lstrlenA (lpString="*.bmp") returned 5 [0087.905] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImagesMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImagesMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImagesMask.bmp" [0087.905] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImagesMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImagesMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImagesMask.bmp" [0087.905] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImagesMask.bmp", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImagesMask.bmp.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImagesMask.bmp." [0087.905] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImagesMask.bmp.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImagesMask.bmp. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImagesMask.bmp. " [0087.905] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\unreadiconimagesmask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0087.905] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x5a4 [0087.905] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xb90c2000, dwHighDateTime=0x1ca035a), lpLastAccessTime=0x407536*(dwLowDateTime=0x5e3d2090, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xb90c2000, dwHighDateTime=0x1ca035a)) returned 1 [0087.906] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0087.906] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x54a, lpOverlapped=0x0) returned 1 [0087.908] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImagesMask.bmp") returned="UnreadIconImagesMask.bmp" [0087.908] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0087.908] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x54a, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x54a, lpOverlapped=0x0) returned 1 [0087.908] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0087.908] CloseHandle (hObject=0x98) returned 1 [0087.909] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\unreadiconimagesmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImagesMask.bmp. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\unreadiconimagesmask.bmp. ")) returned 1 [0087.910] FindNextFileA (in: hFindFile=0x5b7d30, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 0 [0087.910] FindClose (in: hFindFile=0x5b7d30 | out: hFindFile=0x5b7d30) returned 1 [0087.910] FindNextFileA (in: hFindFile=0x5b7dd0, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0087.910] lstrcmpA (lpString1=".", lpString2="Computers") returned -1 [0087.910] lstrcmpA (lpString1="..", lpString2="Computers") returned -1 [0087.910] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\*.*") returned="*.*" [0087.910] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\", lpString2="Computers" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers" [0087.910] lstrlenA (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers") returned 79 [0087.910] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\*.*", lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 0x5b7d30 [0087.911] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0087.911] FindNextFileA (in: hFindFile=0x5b7d30, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0087.911] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0087.911] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0087.911] FindNextFileA (in: hFindFile=0x5b7d30, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0087.911] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0087.911] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="computericon.jpg") returned 1 [0087.911] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="computericon.jpg") returned 1 [0087.911] lstrcmpiA (lpString1="", lpString2="computericon.jpg") returned -1 [0087.911] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\*.*") returned="*.*" [0087.911] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\", lpString2="computericon.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericon.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericon.jpg" [0087.911] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericon.jpg", pszSpec="*.zip") returned 0 [0087.911] lstrlenA (lpString="*.zip") returned 5 [0087.911] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericon.jpg", pszSpec="*.rar") returned 0 [0087.911] lstrlenA (lpString="*.rar") returned 5 [0087.911] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericon.jpg", pszSpec="*.7z") returned 0 [0087.911] lstrlenA (lpString="*.7z") returned 4 [0087.911] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericon.jpg", pszSpec="*.tar") returned 0 [0087.911] lstrlenA (lpString="*.tar") returned 5 [0087.911] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericon.jpg", pszSpec="*.gzip") returned 0 [0087.911] lstrlenA (lpString="*.gzip") returned 6 [0087.911] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericon.jpg", pszSpec="*.jpg") returned 1 [0087.911] lstrlenA (lpString="*.jpg") returned 5 [0087.911] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericon.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericon.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericon.jpg" [0087.911] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericon.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericon.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericon.jpg" [0087.911] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericon.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericon.jpg.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericon.jpg." [0087.911] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericon.jpg.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericon.jpg. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericon.jpg. " [0087.911] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericon.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\computers\\computericon.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0087.912] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xe1b [0087.912] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x80130d00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x60440c50, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x80130d00, dwHighDateTime=0x1c747ea)) returned 1 [0087.912] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0087.912] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0xdc1, lpOverlapped=0x0) returned 1 [0087.967] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericon.jpg") returned="computericon.jpg" [0087.967] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0087.967] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0xdc1, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0xdc1, lpOverlapped=0x0) returned 1 [0087.967] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0087.967] CloseHandle (hObject=0x98) returned 1 [0087.968] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericon.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\computers\\computericon.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericon.jpg. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\computers\\computericon.jpg. ")) returned 1 [0087.969] FindNextFileA (in: hFindFile=0x5b7d30, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0087.969] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0087.969] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="computericonMask.bmp") returned 1 [0087.969] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="computericonMask.bmp") returned 1 [0087.969] lstrcmpiA (lpString1="", lpString2="computericonMask.bmp") returned -1 [0087.969] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericon.jpg") returned="computericon.jpg" [0087.969] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\", lpString2="computericonMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericonMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericonMask.bmp" [0087.969] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericonMask.bmp", pszSpec="*.zip") returned 0 [0087.969] lstrlenA (lpString="*.zip") returned 5 [0087.969] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericonMask.bmp", pszSpec="*.rar") returned 0 [0087.969] lstrlenA (lpString="*.rar") returned 5 [0087.969] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericonMask.bmp", pszSpec="*.7z") returned 0 [0087.969] lstrlenA (lpString="*.7z") returned 4 [0087.969] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericonMask.bmp", pszSpec="*.tar") returned 0 [0087.969] lstrlenA (lpString="*.tar") returned 5 [0087.969] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericonMask.bmp", pszSpec="*.gzip") returned 0 [0087.969] lstrlenA (lpString="*.gzip") returned 6 [0087.969] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericonMask.bmp", pszSpec="*.jpg") returned 0 [0087.969] lstrlenA (lpString="*.jpg") returned 5 [0087.969] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericonMask.bmp", pszSpec="*.jpeg") returned 0 [0087.969] lstrlenA (lpString="*.jpeg") returned 6 [0087.969] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericonMask.bmp", pszSpec="*.psd") returned 0 [0087.969] lstrlenA (lpString="*.psd") returned 5 [0087.969] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericonMask.bmp", pszSpec="*.cdr") returned 0 [0087.969] lstrlenA (lpString="*.cdr") returned 5 [0087.969] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericonMask.bmp", pszSpec="*.dwg") returned 0 [0087.969] lstrlenA (lpString="*.dwg") returned 5 [0087.969] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericonMask.bmp", pszSpec="*.max") returned 0 [0087.969] lstrlenA (lpString="*.max") returned 5 [0087.969] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericonMask.bmp", pszSpec="*.bmp") returned 1 [0087.969] lstrlenA (lpString="*.bmp") returned 5 [0087.970] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericonMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericonMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericonMask.bmp" [0087.970] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericonMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericonMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericonMask.bmp" [0087.970] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericonMask.bmp", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericonMask.bmp.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericonMask.bmp." [0087.970] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericonMask.bmp.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericonMask.bmp. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericonMask.bmp. " [0087.970] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericonMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\computers\\computericonmask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0087.970] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x838 [0087.970] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x80130d00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x51cc30d0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x80130d00, dwHighDateTime=0x1c747ea)) returned 1 [0087.970] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0087.970] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x7de, lpOverlapped=0x0) returned 1 [0087.978] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericonMask.bmp") returned="computericonMask.bmp" [0087.978] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0087.978] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x7de, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x7de, lpOverlapped=0x0) returned 1 [0087.978] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0087.979] CloseHandle (hObject=0x98) returned 1 [0087.982] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericonMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\computers\\computericonmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericonMask.bmp. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\computers\\computericonmask.bmp. ")) returned 1 [0087.983] FindNextFileA (in: hFindFile=0x5b7d30, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 0 [0087.983] FindClose (in: hFindFile=0x5b7d30 | out: hFindFile=0x5b7d30) returned 1 [0087.983] FindNextFileA (in: hFindFile=0x5b7dd0, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0087.983] lstrcmpA (lpString1=".", lpString2="Discussion") returned -1 [0087.983] lstrcmpA (lpString1="..", lpString2="Discussion") returned -1 [0087.983] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\*.*") returned="*.*" [0087.983] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\", lpString2="Discussion" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion" [0087.983] lstrlenA (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion") returned 80 [0087.983] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\*.*", lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 0x5b7d30 [0087.986] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0087.986] FindNextFileA (in: hFindFile=0x5b7d30, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0087.986] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0087.986] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0087.986] FindNextFileA (in: hFindFile=0x5b7d30, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0087.986] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0087.986] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="DiscussionToolIconImages.jpg") returned 1 [0087.986] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DiscussionToolIconImages.jpg") returned 1 [0087.986] lstrcmpiA (lpString1="", lpString2="DiscussionToolIconImages.jpg") returned -1 [0087.986] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\*.*") returned="*.*" [0087.986] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\", lpString2="DiscussionToolIconImages.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImages.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImages.jpg" [0087.989] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImages.jpg", pszSpec="*.zip") returned 0 [0087.989] lstrlenA (lpString="*.zip") returned 5 [0087.989] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImages.jpg", pszSpec="*.rar") returned 0 [0087.989] lstrlenA (lpString="*.rar") returned 5 [0087.989] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImages.jpg", pszSpec="*.7z") returned 0 [0087.989] lstrlenA (lpString="*.7z") returned 4 [0087.989] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImages.jpg", pszSpec="*.tar") returned 0 [0087.989] lstrlenA (lpString="*.tar") returned 5 [0087.989] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImages.jpg", pszSpec="*.gzip") returned 0 [0087.989] lstrlenA (lpString="*.gzip") returned 6 [0087.989] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImages.jpg", pszSpec="*.jpg") returned 1 [0087.989] lstrlenA (lpString="*.jpg") returned 5 [0087.989] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImages.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImages.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImages.jpg" [0087.989] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImages.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImages.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImages.jpg" [0087.989] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImages.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImages.jpg.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImages.jpg." [0087.989] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImages.jpg.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImages.jpg. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImages.jpg. " [0087.990] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\discussion\\discussiontooliconimages.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0087.990] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x393c [0087.990] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xb0009600, dwHighDateTime=0x1ca0588), lpLastAccessTime=0x407536*(dwLowDateTime=0x51e19d30, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xb0009600, dwHighDateTime=0x1ca0588)) returned 1 [0087.990] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0087.990] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x38e2, lpOverlapped=0x0) returned 1 [0088.018] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImages.jpg") returned="DiscussionToolIconImages.jpg" [0088.018] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0088.018] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x38e2, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x38e2, lpOverlapped=0x0) returned 1 [0088.018] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0088.018] CloseHandle (hObject=0x98) returned 1 [0088.019] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\discussion\\discussiontooliconimages.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImages.jpg. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\discussion\\discussiontooliconimages.jpg. ")) returned 1 [0088.020] FindNextFileA (in: hFindFile=0x5b7d30, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0088.020] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0088.020] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="DiscussionToolIconImagesMask.bmp") returned 1 [0088.020] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DiscussionToolIconImagesMask.bmp") returned 1 [0088.020] lstrcmpiA (lpString1="", lpString2="DiscussionToolIconImagesMask.bmp") returned -1 [0088.020] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImages.jpg") returned="DiscussionToolIconImages.jpg" [0088.020] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\", lpString2="DiscussionToolIconImagesMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImagesMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImagesMask.bmp" [0088.020] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImagesMask.bmp", pszSpec="*.zip") returned 0 [0088.020] lstrlenA (lpString="*.zip") returned 5 [0088.020] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImagesMask.bmp", pszSpec="*.rar") returned 0 [0088.020] lstrlenA (lpString="*.rar") returned 5 [0088.020] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImagesMask.bmp", pszSpec="*.7z") returned 0 [0088.020] lstrlenA (lpString="*.7z") returned 4 [0088.020] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImagesMask.bmp", pszSpec="*.tar") returned 0 [0088.020] lstrlenA (lpString="*.tar") returned 5 [0088.020] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImagesMask.bmp", pszSpec="*.gzip") returned 0 [0088.020] lstrlenA (lpString="*.gzip") returned 6 [0088.020] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImagesMask.bmp", pszSpec="*.jpg") returned 0 [0088.020] lstrlenA (lpString="*.jpg") returned 5 [0088.020] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImagesMask.bmp", pszSpec="*.jpeg") returned 0 [0088.020] lstrlenA (lpString="*.jpeg") returned 6 [0088.020] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImagesMask.bmp", pszSpec="*.psd") returned 0 [0088.021] lstrlenA (lpString="*.psd") returned 5 [0088.021] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImagesMask.bmp", pszSpec="*.cdr") returned 0 [0088.021] lstrlenA (lpString="*.cdr") returned 5 [0088.021] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImagesMask.bmp", pszSpec="*.dwg") returned 0 [0088.021] lstrlenA (lpString="*.dwg") returned 5 [0088.021] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImagesMask.bmp", pszSpec="*.max") returned 0 [0088.021] lstrlenA (lpString="*.max") returned 5 [0088.021] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImagesMask.bmp", pszSpec="*.bmp") returned 1 [0088.021] lstrlenA (lpString="*.bmp") returned 5 [0088.021] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImagesMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImagesMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImagesMask.bmp" [0088.021] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImagesMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImagesMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImagesMask.bmp" [0088.021] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImagesMask.bmp", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImagesMask.bmp.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImagesMask.bmp." [0088.021] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImagesMask.bmp.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImagesMask.bmp. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImagesMask.bmp. " [0088.021] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\discussion\\discussiontooliconimagesmask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0088.021] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1738 [0088.021] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xc9ac9e00, dwHighDateTime=0x1ca033a), lpLastAccessTime=0x407536*(dwLowDateTime=0x607d2d50, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xc9ac9e00, dwHighDateTime=0x1ca033a)) returned 1 [0088.021] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0088.021] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x16de, lpOverlapped=0x0) returned 1 [0088.031] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImagesMask.bmp") returned="DiscussionToolIconImagesMask.bmp" [0088.031] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0088.031] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x16de, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x16de, lpOverlapped=0x0) returned 1 [0088.031] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0088.031] CloseHandle (hObject=0x98) returned 1 [0088.032] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\discussion\\discussiontooliconimagesmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImagesMask.bmp. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\discussion\\discussiontooliconimagesmask.bmp. ")) returned 1 [0088.033] FindNextFileA (in: hFindFile=0x5b7d30, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 0 [0088.033] FindClose (in: hFindFile=0x5b7d30 | out: hFindFile=0x5b7d30) returned 1 [0088.033] FindNextFileA (in: hFindFile=0x5b7dd0, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0088.033] lstrcmpA (lpString1=".", lpString2="DocumentShare") returned -1 [0088.033] lstrcmpA (lpString1="..", lpString2="DocumentShare") returned -1 [0088.033] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\*.*") returned="*.*" [0088.033] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\", lpString2="DocumentShare" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\DocumentShare") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\DocumentShare" [0088.033] lstrlenA (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\DocumentShare") returned 83 [0088.033] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\DocumentShare\\*.*", lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 0x5b7d30 [0088.034] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0088.034] FindNextFileA (in: hFindFile=0x5b7d30, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0088.034] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0088.034] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0088.034] FindNextFileA (in: hFindFile=0x5b7d30, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0088.034] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0088.034] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="WSSFilesToolHomePageBackground.jpg") returned -1 [0088.034] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WSSFilesToolHomePageBackground.jpg") returned -1 [0088.034] lstrcmpiA (lpString1="", lpString2="WSSFilesToolHomePageBackground.jpg") returned -1 [0088.034] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\DocumentShare\\*.*") returned="*.*" [0088.034] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\DocumentShare\\", lpString2="WSSFilesToolHomePageBackground.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\DocumentShare\\WSSFilesToolHomePageBackground.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\DocumentShare\\WSSFilesToolHomePageBackground.jpg" [0088.034] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\DocumentShare\\WSSFilesToolHomePageBackground.jpg", pszSpec="*.zip") returned 0 [0088.034] lstrlenA (lpString="*.zip") returned 5 [0088.035] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\DocumentShare\\WSSFilesToolHomePageBackground.jpg", pszSpec="*.rar") returned 0 [0088.036] lstrlenA (lpString="*.rar") returned 5 [0088.036] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\DocumentShare\\WSSFilesToolHomePageBackground.jpg", pszSpec="*.7z") returned 0 [0088.036] lstrlenA (lpString="*.7z") returned 4 [0088.036] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\DocumentShare\\WSSFilesToolHomePageBackground.jpg", pszSpec="*.tar") returned 0 [0088.036] lstrlenA (lpString="*.tar") returned 5 [0088.036] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\DocumentShare\\WSSFilesToolHomePageBackground.jpg", pszSpec="*.gzip") returned 0 [0088.036] lstrlenA (lpString="*.gzip") returned 6 [0088.036] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\DocumentShare\\WSSFilesToolHomePageBackground.jpg", pszSpec="*.jpg") returned 1 [0088.036] lstrlenA (lpString="*.jpg") returned 5 [0088.036] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\DocumentShare\\WSSFilesToolHomePageBackground.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\DocumentShare\\WSSFilesToolHomePageBackground.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\DocumentShare\\WSSFilesToolHomePageBackground.jpg" [0088.036] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\DocumentShare\\WSSFilesToolHomePageBackground.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\DocumentShare\\WSSFilesToolHomePageBackground.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\DocumentShare\\WSSFilesToolHomePageBackground.jpg" [0088.036] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\DocumentShare\\WSSFilesToolHomePageBackground.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\DocumentShare\\WSSFilesToolHomePageBackground.jpg.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\DocumentShare\\WSSFilesToolHomePageBackground.jpg." [0088.036] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\DocumentShare\\WSSFilesToolHomePageBackground.jpg.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\DocumentShare\\WSSFilesToolHomePageBackground.jpg. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\DocumentShare\\WSSFilesToolHomePageBackground.jpg. " [0088.036] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\DocumentShare\\WSSFilesToolHomePageBackground.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\documentshare\\wssfilestoolhomepagebackground.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0088.036] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xab11 [0088.036] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x81443a00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x709f1ef0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x81443a00, dwHighDateTime=0x1c747ea)) returned 1 [0088.036] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0088.036] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0xaab7, lpOverlapped=0x0) returned 1 [0088.038] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\DocumentShare\\WSSFilesToolHomePageBackground.jpg") returned="WSSFilesToolHomePageBackground.jpg" [0088.038] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0088.038] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0xaab7, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0xaab7, lpOverlapped=0x0) returned 1 [0088.038] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0088.038] CloseHandle (hObject=0x98) returned 1 [0088.040] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\DocumentShare\\WSSFilesToolHomePageBackground.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\documentshare\\wssfilestoolhomepagebackground.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\DocumentShare\\WSSFilesToolHomePageBackground.jpg. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\documentshare\\wssfilestoolhomepagebackground.jpg. ")) returned 1 [0088.041] FindNextFileA (in: hFindFile=0x5b7d30, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 0 [0088.041] FindClose (in: hFindFile=0x5b7d30 | out: hFindFile=0x5b7d30) returned 1 [0088.041] FindNextFileA (in: hFindFile=0x5b7dd0, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0088.041] lstrcmpA (lpString1=".", lpString2="GrooveDocumentReview") returned -1 [0088.041] lstrcmpA (lpString1="..", lpString2="GrooveDocumentReview") returned -1 [0088.041] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\*.*") returned="*.*" [0088.041] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\", lpString2="GrooveDocumentReview" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview" [0088.041] lstrlenA (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview") returned 90 [0088.041] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\*.*", lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 0x5b7d30 [0088.050] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0088.050] FindNextFileA (in: hFindFile=0x5b7d30, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0088.050] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0088.050] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0088.050] FindNextFileA (in: hFindFile=0x5b7d30, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0088.050] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0088.050] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="ActiveTabImage.jpg") returned 1 [0088.050] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ActiveTabImage.jpg") returned 1 [0088.050] lstrcmpiA (lpString1="", lpString2="ActiveTabImage.jpg") returned -1 [0088.050] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\*.*") returned="*.*" [0088.050] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\", lpString2="ActiveTabImage.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImage.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImage.jpg" [0088.050] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImage.jpg", pszSpec="*.zip") returned 0 [0088.050] lstrlenA (lpString="*.zip") returned 5 [0088.050] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImage.jpg", pszSpec="*.rar") returned 0 [0088.050] lstrlenA (lpString="*.rar") returned 5 [0088.050] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImage.jpg", pszSpec="*.7z") returned 0 [0088.050] lstrlenA (lpString="*.7z") returned 4 [0088.050] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImage.jpg", pszSpec="*.tar") returned 0 [0088.050] lstrlenA (lpString="*.tar") returned 5 [0088.050] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImage.jpg", pszSpec="*.gzip") returned 0 [0088.050] lstrlenA (lpString="*.gzip") returned 6 [0088.050] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImage.jpg", pszSpec="*.jpg") returned 1 [0088.050] lstrlenA (lpString="*.jpg") returned 5 [0088.050] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImage.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImage.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImage.jpg" [0088.050] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImage.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImage.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImage.jpg" [0088.050] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImage.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImage.jpg.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImage.jpg." [0088.050] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImage.jpg.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImage.jpg. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImage.jpg. " [0088.050] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImage.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\groovedocumentreview\\activetabimage.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0088.051] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2519 [0088.051] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x81443a00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x51174850, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x81443a00, dwHighDateTime=0x1c747ea)) returned 1 [0088.051] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0088.051] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x24bf, lpOverlapped=0x0) returned 1 [0088.122] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImage.jpg") returned="ActiveTabImage.jpg" [0088.122] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0088.122] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x24bf, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x24bf, lpOverlapped=0x0) returned 1 [0088.123] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0088.123] CloseHandle (hObject=0x98) returned 1 [0088.123] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImage.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\groovedocumentreview\\activetabimage.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImage.jpg. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\groovedocumentreview\\activetabimage.jpg. ")) returned 1 [0088.124] FindNextFileA (in: hFindFile=0x5b7d30, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0088.125] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0088.125] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="ActiveTabImageMask.bmp") returned 1 [0088.125] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ActiveTabImageMask.bmp") returned 1 [0088.125] lstrcmpiA (lpString1="", lpString2="ActiveTabImageMask.bmp") returned -1 [0088.125] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImage.jpg") returned="ActiveTabImage.jpg" [0088.125] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\", lpString2="ActiveTabImageMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImageMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImageMask.bmp" [0088.125] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImageMask.bmp", pszSpec="*.zip") returned 0 [0088.125] lstrlenA (lpString="*.zip") returned 5 [0088.125] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImageMask.bmp", pszSpec="*.rar") returned 0 [0088.125] lstrlenA (lpString="*.rar") returned 5 [0088.125] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImageMask.bmp", pszSpec="*.7z") returned 0 [0088.125] lstrlenA (lpString="*.7z") returned 4 [0088.125] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImageMask.bmp", pszSpec="*.tar") returned 0 [0088.125] lstrlenA (lpString="*.tar") returned 5 [0088.125] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImageMask.bmp", pszSpec="*.gzip") returned 0 [0088.125] lstrlenA (lpString="*.gzip") returned 6 [0088.125] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImageMask.bmp", pszSpec="*.jpg") returned 0 [0088.125] lstrlenA (lpString="*.jpg") returned 5 [0088.125] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImageMask.bmp", pszSpec="*.jpeg") returned 0 [0088.125] lstrlenA (lpString="*.jpeg") returned 6 [0088.125] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImageMask.bmp", pszSpec="*.psd") returned 0 [0088.125] lstrlenA (lpString="*.psd") returned 5 [0088.125] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImageMask.bmp", pszSpec="*.cdr") returned 0 [0088.125] lstrlenA (lpString="*.cdr") returned 5 [0088.125] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImageMask.bmp", pszSpec="*.dwg") returned 0 [0088.125] lstrlenA (lpString="*.dwg") returned 5 [0088.125] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImageMask.bmp", pszSpec="*.max") returned 0 [0088.125] lstrlenA (lpString="*.max") returned 5 [0088.125] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImageMask.bmp", pszSpec="*.bmp") returned 1 [0088.126] lstrlenA (lpString="*.bmp") returned 5 [0088.126] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImageMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImageMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImageMask.bmp" [0088.126] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImageMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImageMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImageMask.bmp" [0088.126] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImageMask.bmp", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImageMask.bmp.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImageMask.bmp." [0088.126] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImageMask.bmp.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImageMask.bmp. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImageMask.bmp. " [0088.126] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImageMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\groovedocumentreview\\activetabimagemask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0088.178] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xca8 [0088.178] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x81443a00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5e9eb8f0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x81443a00, dwHighDateTime=0x1c747ea)) returned 1 [0088.178] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0088.178] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0xc4e, lpOverlapped=0x0) returned 1 [0088.488] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImageMask.bmp") returned="ActiveTabImageMask.bmp" [0088.488] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0088.488] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0xc4e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0xc4e, lpOverlapped=0x0) returned 1 [0088.488] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0088.488] CloseHandle (hObject=0x98) returned 1 [0088.489] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImageMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\groovedocumentreview\\activetabimagemask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImageMask.bmp. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\groovedocumentreview\\activetabimagemask.bmp. ")) returned 1 [0088.490] FindNextFileA (in: hFindFile=0x5b7d30, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0088.490] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0088.490] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BodyPaneBackground.jpg") returned 1 [0088.490] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BodyPaneBackground.jpg") returned 1 [0088.490] lstrcmpiA (lpString1="", lpString2="BodyPaneBackground.jpg") returned -1 [0088.490] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImageMask.bmp") returned="ActiveTabImageMask.bmp" [0088.490] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\", lpString2="BodyPaneBackground.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\BodyPaneBackground.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\BodyPaneBackground.jpg" [0088.490] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\BodyPaneBackground.jpg", pszSpec="*.zip") returned 0 [0088.490] lstrlenA (lpString="*.zip") returned 5 [0088.490] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\BodyPaneBackground.jpg", pszSpec="*.rar") returned 0 [0088.490] lstrlenA (lpString="*.rar") returned 5 [0088.490] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\BodyPaneBackground.jpg", pszSpec="*.7z") returned 0 [0088.490] lstrlenA (lpString="*.7z") returned 4 [0088.490] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\BodyPaneBackground.jpg", pszSpec="*.tar") returned 0 [0088.490] lstrlenA (lpString="*.tar") returned 5 [0088.490] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\BodyPaneBackground.jpg", pszSpec="*.gzip") returned 0 [0088.490] lstrlenA (lpString="*.gzip") returned 6 [0088.490] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\BodyPaneBackground.jpg", pszSpec="*.jpg") returned 1 [0088.490] lstrlenA (lpString="*.jpg") returned 5 [0088.490] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\BodyPaneBackground.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\BodyPaneBackground.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\BodyPaneBackground.jpg" [0088.490] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\BodyPaneBackground.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\BodyPaneBackground.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\BodyPaneBackground.jpg" [0088.490] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\BodyPaneBackground.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\BodyPaneBackground.jpg.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\BodyPaneBackground.jpg." [0088.490] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\BodyPaneBackground.jpg.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\BodyPaneBackground.jpg. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\BodyPaneBackground.jpg. " [0088.490] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\BodyPaneBackground.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\groovedocumentreview\\bodypanebackground.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0088.492] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x9bd [0088.492] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x82756700, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x51a15810, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x82756700, dwHighDateTime=0x1c747ea)) returned 1 [0088.492] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0088.492] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x963, lpOverlapped=0x0) returned 1 [0088.646] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\BodyPaneBackground.jpg") returned="BodyPaneBackground.jpg" [0088.646] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0088.646] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x963, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x963, lpOverlapped=0x0) returned 1 [0088.646] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0088.647] CloseHandle (hObject=0x98) returned 1 [0088.647] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\BodyPaneBackground.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\groovedocumentreview\\bodypanebackground.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\BodyPaneBackground.jpg. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\groovedocumentreview\\bodypanebackground.jpg. ")) returned 1 [0088.649] FindNextFileA (in: hFindFile=0x5b7d30, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0088.649] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0088.649] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="InactiveTabImage.jpg") returned -1 [0088.649] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="InactiveTabImage.jpg") returned -1 [0088.649] lstrcmpiA (lpString1="", lpString2="InactiveTabImage.jpg") returned -1 [0088.649] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\BodyPaneBackground.jpg") returned="BodyPaneBackground.jpg" [0088.649] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\", lpString2="InactiveTabImage.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImage.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImage.jpg" [0088.649] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImage.jpg", pszSpec="*.zip") returned 0 [0088.649] lstrlenA (lpString="*.zip") returned 5 [0088.649] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImage.jpg", pszSpec="*.rar") returned 0 [0088.649] lstrlenA (lpString="*.rar") returned 5 [0088.649] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImage.jpg", pszSpec="*.7z") returned 0 [0088.649] lstrlenA (lpString="*.7z") returned 4 [0088.649] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImage.jpg", pszSpec="*.tar") returned 0 [0088.649] lstrlenA (lpString="*.tar") returned 5 [0088.649] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImage.jpg", pszSpec="*.gzip") returned 0 [0088.649] lstrlenA (lpString="*.gzip") returned 6 [0088.649] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImage.jpg", pszSpec="*.jpg") returned 1 [0088.649] lstrlenA (lpString="*.jpg") returned 5 [0088.649] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImage.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImage.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImage.jpg" [0088.649] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImage.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImage.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImage.jpg" [0088.649] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImage.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImage.jpg.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImage.jpg." [0088.649] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImage.jpg.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImage.jpg. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImage.jpg. " [0088.649] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImage.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\groovedocumentreview\\inactivetabimage.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0088.694] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x24ed [0088.694] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x82756700, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5392d770, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x82756700, dwHighDateTime=0x1c747ea)) returned 1 [0088.694] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0088.694] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x2493, lpOverlapped=0x0) returned 1 [0088.859] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImage.jpg") returned="InactiveTabImage.jpg" [0088.859] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0088.859] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x2493, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x2493, lpOverlapped=0x0) returned 1 [0088.859] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0088.859] CloseHandle (hObject=0x98) returned 1 [0088.860] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImage.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\groovedocumentreview\\inactivetabimage.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImage.jpg. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\groovedocumentreview\\inactivetabimage.jpg. ")) returned 1 [0088.861] FindNextFileA (in: hFindFile=0x5b7d30, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0088.861] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0088.861] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="InactiveTabImageMask.bmp") returned -1 [0088.861] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="InactiveTabImageMask.bmp") returned -1 [0088.861] lstrcmpiA (lpString1="", lpString2="InactiveTabImageMask.bmp") returned -1 [0088.861] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImage.jpg") returned="InactiveTabImage.jpg" [0088.861] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\", lpString2="InactiveTabImageMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImageMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImageMask.bmp" [0088.861] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImageMask.bmp", pszSpec="*.zip") returned 0 [0088.861] lstrlenA (lpString="*.zip") returned 5 [0088.861] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImageMask.bmp", pszSpec="*.rar") returned 0 [0088.861] lstrlenA (lpString="*.rar") returned 5 [0088.861] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImageMask.bmp", pszSpec="*.7z") returned 0 [0088.861] lstrlenA (lpString="*.7z") returned 4 [0088.861] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImageMask.bmp", pszSpec="*.tar") returned 0 [0088.861] lstrlenA (lpString="*.tar") returned 5 [0088.861] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImageMask.bmp", pszSpec="*.gzip") returned 0 [0088.861] lstrlenA (lpString="*.gzip") returned 6 [0088.861] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImageMask.bmp", pszSpec="*.jpg") returned 0 [0088.861] lstrlenA (lpString="*.jpg") returned 5 [0088.861] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImageMask.bmp", pszSpec="*.jpeg") returned 0 [0088.861] lstrlenA (lpString="*.jpeg") returned 6 [0088.861] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImageMask.bmp", pszSpec="*.psd") returned 0 [0088.861] lstrlenA (lpString="*.psd") returned 5 [0088.861] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImageMask.bmp", pszSpec="*.cdr") returned 0 [0088.861] lstrlenA (lpString="*.cdr") returned 5 [0088.861] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImageMask.bmp", pszSpec="*.dwg") returned 0 [0088.861] lstrlenA (lpString="*.dwg") returned 5 [0088.861] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImageMask.bmp", pszSpec="*.max") returned 0 [0088.861] lstrlenA (lpString="*.max") returned 5 [0088.861] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImageMask.bmp", pszSpec="*.bmp") returned 1 [0088.861] lstrlenA (lpString="*.bmp") returned 5 [0088.861] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImageMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImageMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImageMask.bmp" [0088.861] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImageMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImageMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImageMask.bmp" [0088.861] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImageMask.bmp", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImageMask.bmp.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImageMask.bmp." [0088.861] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImageMask.bmp.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImageMask.bmp. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImageMask.bmp. " [0088.861] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImageMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\groovedocumentreview\\inactivetabimagemask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0088.862] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xca8 [0088.862] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x82756700, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x61cf3090, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x82756700, dwHighDateTime=0x1c747ea)) returned 1 [0088.862] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0088.862] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0xc4e, lpOverlapped=0x0) returned 1 [0088.880] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImageMask.bmp") returned="InactiveTabImageMask.bmp" [0088.880] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0088.880] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0xc4e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0xc4e, lpOverlapped=0x0) returned 1 [0088.880] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0088.880] CloseHandle (hObject=0x98) returned 1 [0088.881] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImageMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\groovedocumentreview\\inactivetabimagemask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImageMask.bmp. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\groovedocumentreview\\inactivetabimagemask.bmp. ")) returned 1 [0088.882] FindNextFileA (in: hFindFile=0x5b7d30, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0088.882] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0088.882] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="MarkupIconImages.jpg") returned -1 [0088.882] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MarkupIconImages.jpg") returned -1 [0088.882] lstrcmpiA (lpString1="", lpString2="MarkupIconImages.jpg") returned -1 [0088.882] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImageMask.bmp") returned="InactiveTabImageMask.bmp" [0088.882] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\", lpString2="MarkupIconImages.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImages.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImages.jpg" [0088.882] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImages.jpg", pszSpec="*.zip") returned 0 [0088.882] lstrlenA (lpString="*.zip") returned 5 [0088.882] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImages.jpg", pszSpec="*.rar") returned 0 [0088.882] lstrlenA (lpString="*.rar") returned 5 [0088.882] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImages.jpg", pszSpec="*.7z") returned 0 [0088.882] lstrlenA (lpString="*.7z") returned 4 [0088.882] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImages.jpg", pszSpec="*.tar") returned 0 [0088.882] lstrlenA (lpString="*.tar") returned 5 [0088.882] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImages.jpg", pszSpec="*.gzip") returned 0 [0088.882] lstrlenA (lpString="*.gzip") returned 6 [0088.882] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImages.jpg", pszSpec="*.jpg") returned 1 [0088.882] lstrlenA (lpString="*.jpg") returned 5 [0088.882] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImages.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImages.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImages.jpg" [0088.882] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImages.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImages.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImages.jpg" [0088.882] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImages.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImages.jpg.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImages.jpg." [0088.882] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImages.jpg.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImages.jpg. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImages.jpg. " [0088.882] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\groovedocumentreview\\markupiconimages.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0088.883] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x98b [0088.883] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x82756700, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x696f1810, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x82756700, dwHighDateTime=0x1c747ea)) returned 1 [0088.883] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0088.883] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x931, lpOverlapped=0x0) returned 1 [0088.884] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImages.jpg") returned="MarkupIconImages.jpg" [0088.884] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0088.884] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x931, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x931, lpOverlapped=0x0) returned 1 [0088.884] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0088.884] CloseHandle (hObject=0x98) returned 1 [0088.885] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\groovedocumentreview\\markupiconimages.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImages.jpg. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\groovedocumentreview\\markupiconimages.jpg. ")) returned 1 [0088.886] FindNextFileA (in: hFindFile=0x5b7d30, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0088.886] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0088.886] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="MarkupIconImagesMask.bmp") returned -1 [0088.886] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MarkupIconImagesMask.bmp") returned -1 [0088.886] lstrcmpiA (lpString1="", lpString2="MarkupIconImagesMask.bmp") returned -1 [0088.886] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImages.jpg") returned="MarkupIconImages.jpg" [0088.886] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\", lpString2="MarkupIconImagesMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImagesMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImagesMask.bmp" [0088.886] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImagesMask.bmp", pszSpec="*.zip") returned 0 [0088.886] lstrlenA (lpString="*.zip") returned 5 [0088.886] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImagesMask.bmp", pszSpec="*.rar") returned 0 [0088.886] lstrlenA (lpString="*.rar") returned 5 [0088.886] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImagesMask.bmp", pszSpec="*.7z") returned 0 [0088.886] lstrlenA (lpString="*.7z") returned 4 [0088.886] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImagesMask.bmp", pszSpec="*.tar") returned 0 [0088.886] lstrlenA (lpString="*.tar") returned 5 [0088.886] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImagesMask.bmp", pszSpec="*.gzip") returned 0 [0088.886] lstrlenA (lpString="*.gzip") returned 6 [0088.886] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImagesMask.bmp", pszSpec="*.jpg") returned 0 [0088.886] lstrlenA (lpString="*.jpg") returned 5 [0088.886] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImagesMask.bmp", pszSpec="*.jpeg") returned 0 [0088.886] lstrlenA (lpString="*.jpeg") returned 6 [0088.886] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImagesMask.bmp", pszSpec="*.psd") returned 0 [0088.886] lstrlenA (lpString="*.psd") returned 5 [0088.886] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImagesMask.bmp", pszSpec="*.cdr") returned 0 [0088.886] lstrlenA (lpString="*.cdr") returned 5 [0088.886] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImagesMask.bmp", pszSpec="*.dwg") returned 0 [0088.887] lstrlenA (lpString="*.dwg") returned 5 [0088.887] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImagesMask.bmp", pszSpec="*.max") returned 0 [0088.887] lstrlenA (lpString="*.max") returned 5 [0088.887] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImagesMask.bmp", pszSpec="*.bmp") returned 1 [0088.887] lstrlenA (lpString="*.bmp") returned 5 [0088.887] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImagesMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImagesMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImagesMask.bmp" [0088.887] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImagesMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImagesMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImagesMask.bmp" [0088.887] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImagesMask.bmp", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImagesMask.bmp.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImagesMask.bmp." [0088.887] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImagesMask.bmp.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImagesMask.bmp. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImagesMask.bmp. " [0088.887] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\groovedocumentreview\\markupiconimagesmask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0088.888] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x74 [0088.888] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x82756700, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x582d2010, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x82756700, dwHighDateTime=0x1c747ea)) returned 1 [0088.888] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0088.888] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x1a, lpOverlapped=0x0) returned 1 [0088.888] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImagesMask.bmp") returned="MarkupIconImagesMask.bmp" [0088.888] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0088.888] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x1a, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x1a, lpOverlapped=0x0) returned 1 [0088.888] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0088.888] CloseHandle (hObject=0x98) returned 1 [0088.890] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\groovedocumentreview\\markupiconimagesmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImagesMask.bmp. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\groovedocumentreview\\markupiconimagesmask.bmp. ")) returned 1 [0088.891] FindNextFileA (in: hFindFile=0x5b7d30, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 0 [0088.891] FindClose (in: hFindFile=0x5b7d30 | out: hFindFile=0x5b7d30) returned 1 [0088.891] FindNextFileA (in: hFindFile=0x5b7dd0, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0088.891] lstrcmpA (lpString1=".", lpString2="GrooveForms") returned -1 [0088.891] lstrcmpA (lpString1="..", lpString2="GrooveForms") returned -1 [0088.891] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\*.*") returned="*.*" [0088.891] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\", lpString2="GrooveForms" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms" [0088.891] lstrlenA (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms") returned 81 [0088.891] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\*.*", lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 0x5b7d30 [0088.972] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0088.972] FindNextFileA (in: hFindFile=0x5b7d30, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0088.973] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0088.973] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0088.973] FindNextFileA (in: hFindFile=0x5b7d30, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0088.973] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0088.973] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="AddToViewArrow.jpg") returned 1 [0088.973] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AddToViewArrow.jpg") returned 1 [0088.973] lstrcmpiA (lpString1="", lpString2="AddToViewArrow.jpg") returned -1 [0088.973] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\*.*") returned="*.*" [0088.973] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="AddToViewArrow.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrow.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrow.jpg" [0088.973] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrow.jpg", pszSpec="*.zip") returned 0 [0088.973] lstrlenA (lpString="*.zip") returned 5 [0088.973] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrow.jpg", pszSpec="*.rar") returned 0 [0088.973] lstrlenA (lpString="*.rar") returned 5 [0088.973] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrow.jpg", pszSpec="*.7z") returned 0 [0088.973] lstrlenA (lpString="*.7z") returned 4 [0088.973] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrow.jpg", pszSpec="*.tar") returned 0 [0088.973] lstrlenA (lpString="*.tar") returned 5 [0088.973] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrow.jpg", pszSpec="*.gzip") returned 0 [0088.973] lstrlenA (lpString="*.gzip") returned 6 [0088.974] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrow.jpg", pszSpec="*.jpg") returned 1 [0088.974] lstrlenA (lpString="*.jpg") returned 5 [0088.974] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrow.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrow.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrow.jpg" [0088.974] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrow.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrow.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrow.jpg" [0088.974] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrow.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrow.jpg.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrow.jpg." [0088.974] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrow.jpg.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrow.jpg. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrow.jpg. " [0088.974] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrow.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\addtoviewarrow.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0089.019] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xbe8 [0089.019] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x82756700, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5127f1f0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x82756700, dwHighDateTime=0x1c747ea)) returned 1 [0089.019] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0089.019] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0xb8e, lpOverlapped=0x0) returned 1 [0089.065] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrow.jpg") returned="AddToViewArrow.jpg" [0089.065] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0089.065] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0xb8e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0xb8e, lpOverlapped=0x0) returned 1 [0089.065] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0089.065] CloseHandle (hObject=0x98) returned 1 [0089.091] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrow.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\addtoviewarrow.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrow.jpg. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\addtoviewarrow.jpg. ")) returned 1 [0089.092] FindNextFileA (in: hFindFile=0x5b7d30, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0089.092] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0089.092] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="AddToViewArrowMask.bmp") returned 1 [0089.092] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AddToViewArrowMask.bmp") returned 1 [0089.092] lstrcmpiA (lpString1="", lpString2="AddToViewArrowMask.bmp") returned -1 [0089.092] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrow.jpg") returned="AddToViewArrow.jpg" [0089.092] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="AddToViewArrowMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrowMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrowMask.bmp" [0089.092] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrowMask.bmp", pszSpec="*.zip") returned 0 [0089.092] lstrlenA (lpString="*.zip") returned 5 [0089.092] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrowMask.bmp", pszSpec="*.rar") returned 0 [0089.092] lstrlenA (lpString="*.rar") returned 5 [0089.092] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrowMask.bmp", pszSpec="*.7z") returned 0 [0089.092] lstrlenA (lpString="*.7z") returned 4 [0089.092] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrowMask.bmp", pszSpec="*.tar") returned 0 [0089.092] lstrlenA (lpString="*.tar") returned 5 [0089.092] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrowMask.bmp", pszSpec="*.gzip") returned 0 [0089.092] lstrlenA (lpString="*.gzip") returned 6 [0089.092] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrowMask.bmp", pszSpec="*.jpg") returned 0 [0089.092] lstrlenA (lpString="*.jpg") returned 5 [0089.092] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrowMask.bmp", pszSpec="*.jpeg") returned 0 [0089.092] lstrlenA (lpString="*.jpeg") returned 6 [0089.093] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrowMask.bmp", pszSpec="*.psd") returned 0 [0089.093] lstrlenA (lpString="*.psd") returned 5 [0089.093] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrowMask.bmp", pszSpec="*.cdr") returned 0 [0089.093] lstrlenA (lpString="*.cdr") returned 5 [0089.093] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrowMask.bmp", pszSpec="*.dwg") returned 0 [0089.093] lstrlenA (lpString="*.dwg") returned 5 [0089.093] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrowMask.bmp", pszSpec="*.max") returned 0 [0089.093] lstrlenA (lpString="*.max") returned 5 [0089.093] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrowMask.bmp", pszSpec="*.bmp") returned 1 [0089.093] lstrlenA (lpString="*.bmp") returned 5 [0089.093] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrowMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrowMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrowMask.bmp" [0089.093] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrowMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrowMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrowMask.bmp" [0089.093] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrowMask.bmp", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrowMask.bmp.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrowMask.bmp." [0089.093] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrowMask.bmp.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrowMask.bmp. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrowMask.bmp. " [0089.093] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrowMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\addtoviewarrowmask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0089.093] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x924 [0089.093] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x83a69400, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5127f1f0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x83a69400, dwHighDateTime=0x1c747ea)) returned 1 [0089.093] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0089.093] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x8ca, lpOverlapped=0x0) returned 1 [0089.145] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrowMask.bmp") returned="AddToViewArrowMask.bmp" [0089.145] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0089.145] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x8ca, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x8ca, lpOverlapped=0x0) returned 1 [0089.145] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0089.145] CloseHandle (hObject=0x98) returned 1 [0089.146] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrowMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\addtoviewarrowmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrowMask.bmp. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\addtoviewarrowmask.bmp. ")) returned 1 [0089.147] FindNextFileA (in: hFindFile=0x5b7d30, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0089.147] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0089.147] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="attention.gif") returned 1 [0089.147] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="attention.gif") returned 1 [0089.147] lstrcmpiA (lpString1="", lpString2="attention.gif") returned -1 [0089.147] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrowMask.bmp") returned="AddToViewArrowMask.bmp" [0089.147] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="attention.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\attention.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\attention.gif" [0089.147] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\attention.gif", pszSpec="*.zip") returned 0 [0089.147] lstrlenA (lpString="*.zip") returned 5 [0089.147] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\attention.gif", pszSpec="*.rar") returned 0 [0089.147] lstrlenA (lpString="*.rar") returned 5 [0089.147] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\attention.gif", pszSpec="*.7z") returned 0 [0089.147] lstrlenA (lpString="*.7z") returned 4 [0089.147] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\attention.gif", pszSpec="*.tar") returned 0 [0089.147] lstrlenA (lpString="*.tar") returned 5 [0089.147] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\attention.gif", pszSpec="*.gzip") returned 0 [0089.147] lstrlenA (lpString="*.gzip") returned 6 [0089.147] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\attention.gif", pszSpec="*.jpg") returned 0 [0089.147] lstrlenA (lpString="*.jpg") returned 5 [0089.147] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\attention.gif", pszSpec="*.jpeg") returned 0 [0089.147] lstrlenA (lpString="*.jpeg") returned 6 [0089.147] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\attention.gif", pszSpec="*.psd") returned 0 [0089.147] lstrlenA (lpString="*.psd") returned 5 [0089.147] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\attention.gif", pszSpec="*.cdr") returned 0 [0089.148] lstrlenA (lpString="*.cdr") returned 5 [0089.148] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\attention.gif", pszSpec="*.dwg") returned 0 [0089.148] lstrlenA (lpString="*.dwg") returned 5 [0089.148] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\attention.gif", pszSpec="*.max") returned 0 [0089.148] lstrlenA (lpString="*.max") returned 5 [0089.148] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\attention.gif", pszSpec="*.bmp") returned 0 [0089.148] lstrlenA (lpString="*.bmp") returned 5 [0089.148] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\attention.gif", pszSpec="*.gif") returned 1 [0089.148] lstrlenA (lpString="*.gif") returned 5 [0089.148] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\attention.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\attention.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\attention.gif" [0089.148] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\attention.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\attention.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\attention.gif" [0089.148] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\attention.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\attention.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\attention.gif." [0089.148] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\attention.gif.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\attention.gif. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\attention.gif. " [0089.148] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\attention.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\attention.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0089.149] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xae8 [0089.149] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x83a69400, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5f409670, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x83a69400, dwHighDateTime=0x1c747ea)) returned 1 [0089.149] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0089.149] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0xa8e, lpOverlapped=0x0) returned 1 [0089.235] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\attention.gif") returned="attention.gif" [0089.235] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0089.236] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0xa8e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0xa8e, lpOverlapped=0x0) returned 1 [0089.236] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0089.236] CloseHandle (hObject=0x98) returned 1 [0089.236] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\attention.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\attention.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\attention.gif. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\attention.gif. ")) returned 1 [0089.237] FindNextFileA (in: hFindFile=0x5b7d30, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0089.237] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0089.237] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BG_ADOBE.GIF") returned 1 [0089.237] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BG_ADOBE.GIF") returned 1 [0089.237] lstrcmpiA (lpString1="", lpString2="BG_ADOBE.GIF") returned -1 [0089.237] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\attention.gif") returned="attention.gif" [0089.238] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="BG_ADOBE.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\BG_ADOBE.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\BG_ADOBE.GIF" [0089.238] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\BG_ADOBE.GIF", pszSpec="*.zip") returned 0 [0089.238] lstrlenA (lpString="*.zip") returned 5 [0089.238] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\BG_ADOBE.GIF", pszSpec="*.rar") returned 0 [0089.238] lstrlenA (lpString="*.rar") returned 5 [0089.238] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\BG_ADOBE.GIF", pszSpec="*.7z") returned 0 [0089.238] lstrlenA (lpString="*.7z") returned 4 [0089.238] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\BG_ADOBE.GIF", pszSpec="*.tar") returned 0 [0089.238] lstrlenA (lpString="*.tar") returned 5 [0089.238] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\BG_ADOBE.GIF", pszSpec="*.gzip") returned 0 [0089.238] lstrlenA (lpString="*.gzip") returned 6 [0089.238] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\BG_ADOBE.GIF", pszSpec="*.jpg") returned 0 [0089.238] lstrlenA (lpString="*.jpg") returned 5 [0089.238] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\BG_ADOBE.GIF", pszSpec="*.jpeg") returned 0 [0089.238] lstrlenA (lpString="*.jpeg") returned 6 [0089.238] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\BG_ADOBE.GIF", pszSpec="*.psd") returned 0 [0089.238] lstrlenA (lpString="*.psd") returned 5 [0089.238] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\BG_ADOBE.GIF", pszSpec="*.cdr") returned 0 [0089.238] lstrlenA (lpString="*.cdr") returned 5 [0089.238] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\BG_ADOBE.GIF", pszSpec="*.dwg") returned 0 [0089.238] lstrlenA (lpString="*.dwg") returned 5 [0089.238] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\BG_ADOBE.GIF", pszSpec="*.max") returned 0 [0089.238] lstrlenA (lpString="*.max") returned 5 [0089.238] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\BG_ADOBE.GIF", pszSpec="*.bmp") returned 0 [0089.238] lstrlenA (lpString="*.bmp") returned 5 [0089.238] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\BG_ADOBE.GIF", pszSpec="*.gif") returned 1 [0089.238] lstrlenA (lpString="*.gif") returned 5 [0089.238] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\BG_ADOBE.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\BG_ADOBE.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\BG_ADOBE.GIF" [0089.238] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\BG_ADOBE.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\BG_ADOBE.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\BG_ADOBE.GIF" [0089.238] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\BG_ADOBE.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\BG_ADOBE.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\BG_ADOBE.GIF." [0089.238] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\BG_ADOBE.GIF.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\BG_ADOBE.GIF. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\BG_ADOBE.GIF. " [0089.238] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\BG_ADOBE.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_adobe.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0089.380] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x614e [0089.380] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x83a69400, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5f61e9b0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x83a69400, dwHighDateTime=0x1c747ea)) returned 1 [0089.380] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0089.380] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x60f4, lpOverlapped=0x0) returned 1 [0089.407] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\BG_ADOBE.GIF") returned="BG_ADOBE.GIF" [0089.407] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0089.407] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x60f4, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x60f4, lpOverlapped=0x0) returned 1 [0089.408] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0089.408] CloseHandle (hObject=0x98) returned 1 [0089.409] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\BG_ADOBE.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_adobe.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\BG_ADOBE.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_adobe.gif. ")) returned 1 [0089.410] FindNextFileA (in: hFindFile=0x5b7d30, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0089.410] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0089.410] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="bg_Casual.gif") returned 1 [0089.410] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bg_Casual.gif") returned 1 [0089.410] lstrcmpiA (lpString1="", lpString2="bg_Casual.gif") returned -1 [0089.410] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\BG_ADOBE.GIF") returned="BG_ADOBE.GIF" [0089.410] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="bg_Casual.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Casual.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Casual.gif" [0089.410] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Casual.gif", pszSpec="*.zip") returned 0 [0089.410] lstrlenA (lpString="*.zip") returned 5 [0089.410] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Casual.gif", pszSpec="*.rar") returned 0 [0089.410] lstrlenA (lpString="*.rar") returned 5 [0089.410] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Casual.gif", pszSpec="*.7z") returned 0 [0089.410] lstrlenA (lpString="*.7z") returned 4 [0089.410] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Casual.gif", pszSpec="*.tar") returned 0 [0089.410] lstrlenA (lpString="*.tar") returned 5 [0089.410] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Casual.gif", pszSpec="*.gzip") returned 0 [0089.410] lstrlenA (lpString="*.gzip") returned 6 [0089.410] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Casual.gif", pszSpec="*.jpg") returned 0 [0089.410] lstrlenA (lpString="*.jpg") returned 5 [0089.410] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Casual.gif", pszSpec="*.jpeg") returned 0 [0089.410] lstrlenA (lpString="*.jpeg") returned 6 [0089.410] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Casual.gif", pszSpec="*.psd") returned 0 [0089.410] lstrlenA (lpString="*.psd") returned 5 [0089.411] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Casual.gif", pszSpec="*.cdr") returned 0 [0089.411] lstrlenA (lpString="*.cdr") returned 5 [0089.411] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Casual.gif", pszSpec="*.dwg") returned 0 [0089.411] lstrlenA (lpString="*.dwg") returned 5 [0089.411] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Casual.gif", pszSpec="*.max") returned 0 [0089.411] lstrlenA (lpString="*.max") returned 5 [0089.411] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Casual.gif", pszSpec="*.bmp") returned 0 [0089.411] lstrlenA (lpString="*.bmp") returned 5 [0089.411] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Casual.gif", pszSpec="*.gif") returned 1 [0089.411] lstrlenA (lpString="*.gif") returned 5 [0089.411] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Casual.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Casual.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Casual.gif" [0089.411] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Casual.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Casual.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Casual.gif" [0089.411] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Casual.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Casual.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Casual.gif." [0089.411] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Casual.gif.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Casual.gif. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Casual.gif. " [0089.411] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Casual.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_casual.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0089.413] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x161d [0089.413] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x83a69400, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5f61e9b0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x83a69400, dwHighDateTime=0x1c747ea)) returned 1 [0089.413] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0089.413] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x15c3, lpOverlapped=0x0) returned 1 [0089.427] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Casual.gif") returned="bg_Casual.gif" [0089.427] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0089.428] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x15c3, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x15c3, lpOverlapped=0x0) returned 1 [0089.428] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0089.428] CloseHandle (hObject=0x98) returned 1 [0089.429] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Casual.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_casual.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Casual.gif. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_casual.gif. ")) returned 1 [0089.429] FindNextFileA (in: hFindFile=0x5b7d30, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0089.429] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0089.429] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="bg_Country.gif") returned 1 [0089.429] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bg_Country.gif") returned 1 [0089.429] lstrcmpiA (lpString1="", lpString2="bg_Country.gif") returned -1 [0089.429] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Casual.gif") returned="bg_Casual.gif" [0089.430] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="bg_Country.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Country.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Country.gif" [0089.430] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Country.gif", pszSpec="*.zip") returned 0 [0089.430] lstrlenA (lpString="*.zip") returned 5 [0089.430] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Country.gif", pszSpec="*.rar") returned 0 [0089.430] lstrlenA (lpString="*.rar") returned 5 [0089.430] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Country.gif", pszSpec="*.7z") returned 0 [0089.430] lstrlenA (lpString="*.7z") returned 4 [0089.430] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Country.gif", pszSpec="*.tar") returned 0 [0089.430] lstrlenA (lpString="*.tar") returned 5 [0089.430] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Country.gif", pszSpec="*.gzip") returned 0 [0089.430] lstrlenA (lpString="*.gzip") returned 6 [0089.430] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Country.gif", pszSpec="*.jpg") returned 0 [0089.430] lstrlenA (lpString="*.jpg") returned 5 [0089.430] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Country.gif", pszSpec="*.jpeg") returned 0 [0089.430] lstrlenA (lpString="*.jpeg") returned 6 [0089.430] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Country.gif", pszSpec="*.psd") returned 0 [0089.430] lstrlenA (lpString="*.psd") returned 5 [0089.430] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Country.gif", pszSpec="*.cdr") returned 0 [0089.430] lstrlenA (lpString="*.cdr") returned 5 [0089.430] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Country.gif", pszSpec="*.dwg") returned 0 [0089.430] lstrlenA (lpString="*.dwg") returned 5 [0089.430] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Country.gif", pszSpec="*.max") returned 0 [0089.430] lstrlenA (lpString="*.max") returned 5 [0089.430] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Country.gif", pszSpec="*.bmp") returned 0 [0089.430] lstrlenA (lpString="*.bmp") returned 5 [0089.430] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Country.gif", pszSpec="*.gif") returned 1 [0089.430] lstrlenA (lpString="*.gif") returned 5 [0089.430] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Country.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Country.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Country.gif" [0089.430] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Country.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Country.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Country.gif" [0089.430] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Country.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Country.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Country.gif." [0089.430] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Country.gif.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Country.gif. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Country.gif. " [0089.430] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Country.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_country.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0089.431] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x7dd3 [0089.431] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x83a69400, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5f644b10, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x83a69400, dwHighDateTime=0x1c747ea)) returned 1 [0089.431] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0089.431] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x7d79, lpOverlapped=0x0) returned 1 [0089.449] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Country.gif") returned="bg_Country.gif" [0089.450] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0089.450] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x7d79, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x7d79, lpOverlapped=0x0) returned 1 [0089.450] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0089.450] CloseHandle (hObject=0x98) returned 1 [0089.451] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Country.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_country.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Country.gif. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_country.gif. ")) returned 1 [0089.452] FindNextFileA (in: hFindFile=0x5b7d30, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0089.452] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0089.452] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="bg_Earthy.gif") returned 1 [0089.452] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bg_Earthy.gif") returned 1 [0089.452] lstrcmpiA (lpString1="", lpString2="bg_Earthy.gif") returned -1 [0089.452] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Country.gif") returned="bg_Country.gif" [0089.452] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="bg_Earthy.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Earthy.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Earthy.gif" [0089.452] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Earthy.gif", pszSpec="*.zip") returned 0 [0089.452] lstrlenA (lpString="*.zip") returned 5 [0089.452] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Earthy.gif", pszSpec="*.rar") returned 0 [0089.452] lstrlenA (lpString="*.rar") returned 5 [0089.452] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Earthy.gif", pszSpec="*.7z") returned 0 [0089.452] lstrlenA (lpString="*.7z") returned 4 [0089.452] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Earthy.gif", pszSpec="*.tar") returned 0 [0089.452] lstrlenA (lpString="*.tar") returned 5 [0089.452] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Earthy.gif", pszSpec="*.gzip") returned 0 [0089.452] lstrlenA (lpString="*.gzip") returned 6 [0089.452] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Earthy.gif", pszSpec="*.jpg") returned 0 [0089.452] lstrlenA (lpString="*.jpg") returned 5 [0089.452] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Earthy.gif", pszSpec="*.jpeg") returned 0 [0089.452] lstrlenA (lpString="*.jpeg") returned 6 [0089.452] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Earthy.gif", pszSpec="*.psd") returned 0 [0089.452] lstrlenA (lpString="*.psd") returned 5 [0089.452] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Earthy.gif", pszSpec="*.cdr") returned 0 [0089.452] lstrlenA (lpString="*.cdr") returned 5 [0089.452] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Earthy.gif", pszSpec="*.dwg") returned 0 [0089.452] lstrlenA (lpString="*.dwg") returned 5 [0089.452] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Earthy.gif", pszSpec="*.max") returned 0 [0089.452] lstrlenA (lpString="*.max") returned 5 [0089.453] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Earthy.gif", pszSpec="*.bmp") returned 0 [0089.453] lstrlenA (lpString="*.bmp") returned 5 [0089.453] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Earthy.gif", pszSpec="*.gif") returned 1 [0089.453] lstrlenA (lpString="*.gif") returned 5 [0089.453] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Earthy.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Earthy.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Earthy.gif" [0089.453] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Earthy.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Earthy.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Earthy.gif" [0089.453] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Earthy.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Earthy.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Earthy.gif." [0089.453] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Earthy.gif.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Earthy.gif. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Earthy.gif. " [0089.453] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Earthy.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_earthy.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0089.461] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x132a [0089.461] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x83a69400, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x519a33f0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x83a69400, dwHighDateTime=0x1c747ea)) returned 1 [0089.461] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0089.461] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x12d0, lpOverlapped=0x0) returned 1 [0089.492] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Earthy.gif") returned="bg_Earthy.gif" [0089.492] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0089.492] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x12d0, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x12d0, lpOverlapped=0x0) returned 1 [0089.492] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0089.492] CloseHandle (hObject=0x98) returned 1 [0089.493] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Earthy.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_earthy.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Earthy.gif. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_earthy.gif. ")) returned 1 [0089.495] FindNextFileA (in: hFindFile=0x5b7d30, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0089.496] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0089.496] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="bg_FormsHomePage.gif") returned 1 [0089.496] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bg_FormsHomePage.gif") returned 1 [0089.496] lstrcmpiA (lpString1="", lpString2="bg_FormsHomePage.gif") returned -1 [0089.496] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Earthy.gif") returned="bg_Earthy.gif" [0089.496] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="bg_FormsHomePage.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePage.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePage.gif" [0089.496] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePage.gif", pszSpec="*.zip") returned 0 [0089.496] lstrlenA (lpString="*.zip") returned 5 [0089.496] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePage.gif", pszSpec="*.rar") returned 0 [0089.496] lstrlenA (lpString="*.rar") returned 5 [0089.496] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePage.gif", pszSpec="*.7z") returned 0 [0089.496] lstrlenA (lpString="*.7z") returned 4 [0089.496] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePage.gif", pszSpec="*.tar") returned 0 [0089.496] lstrlenA (lpString="*.tar") returned 5 [0089.496] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePage.gif", pszSpec="*.gzip") returned 0 [0089.496] lstrlenA (lpString="*.gzip") returned 6 [0089.496] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePage.gif", pszSpec="*.jpg") returned 0 [0089.496] lstrlenA (lpString="*.jpg") returned 5 [0089.496] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePage.gif", pszSpec="*.jpeg") returned 0 [0089.496] lstrlenA (lpString="*.jpeg") returned 6 [0089.496] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePage.gif", pszSpec="*.psd") returned 0 [0089.496] lstrlenA (lpString="*.psd") returned 5 [0089.496] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePage.gif", pszSpec="*.cdr") returned 0 [0089.496] lstrlenA (lpString="*.cdr") returned 5 [0089.496] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePage.gif", pszSpec="*.dwg") returned 0 [0089.496] lstrlenA (lpString="*.dwg") returned 5 [0089.496] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePage.gif", pszSpec="*.max") returned 0 [0089.496] lstrlenA (lpString="*.max") returned 5 [0089.496] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePage.gif", pszSpec="*.bmp") returned 0 [0089.496] lstrlenA (lpString="*.bmp") returned 5 [0089.496] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePage.gif", pszSpec="*.gif") returned 1 [0089.496] lstrlenA (lpString="*.gif") returned 5 [0089.496] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePage.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePage.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePage.gif" [0089.496] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePage.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePage.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePage.gif" [0089.496] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePage.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePage.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePage.gif." [0089.496] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePage.gif.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePage.gif. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePage.gif. " [0089.496] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePage.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_formshomepage.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0089.498] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb9b8 [0089.498] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x83a69400, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5f644b10, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x83a69400, dwHighDateTime=0x1c747ea)) returned 1 [0089.498] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0089.498] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0xb95e, lpOverlapped=0x0) returned 1 [0089.527] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePage.gif") returned="bg_FormsHomePage.gif" [0089.527] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0089.527] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0xb95e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0xb95e, lpOverlapped=0x0) returned 1 [0089.527] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0089.527] CloseHandle (hObject=0x98) returned 1 [0089.528] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePage.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_formshomepage.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePage.gif. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_formshomepage.gif. ")) returned 1 [0089.529] FindNextFileA (in: hFindFile=0x5b7d30, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0089.529] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0089.529] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="bg_FormsHomePageBlank.gif") returned 1 [0089.529] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bg_FormsHomePageBlank.gif") returned 1 [0089.529] lstrcmpiA (lpString1="", lpString2="bg_FormsHomePageBlank.gif") returned -1 [0089.529] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePage.gif") returned="bg_FormsHomePage.gif" [0089.530] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="bg_FormsHomePageBlank.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePageBlank.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePageBlank.gif" [0089.530] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePageBlank.gif", pszSpec="*.zip") returned 0 [0089.530] lstrlenA (lpString="*.zip") returned 5 [0089.530] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePageBlank.gif", pszSpec="*.rar") returned 0 [0089.530] lstrlenA (lpString="*.rar") returned 5 [0089.530] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePageBlank.gif", pszSpec="*.7z") returned 0 [0089.530] lstrlenA (lpString="*.7z") returned 4 [0089.530] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePageBlank.gif", pszSpec="*.tar") returned 0 [0089.530] lstrlenA (lpString="*.tar") returned 5 [0089.530] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePageBlank.gif", pszSpec="*.gzip") returned 0 [0089.530] lstrlenA (lpString="*.gzip") returned 6 [0089.530] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePageBlank.gif", pszSpec="*.jpg") returned 0 [0089.530] lstrlenA (lpString="*.jpg") returned 5 [0089.530] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePageBlank.gif", pszSpec="*.jpeg") returned 0 [0089.530] lstrlenA (lpString="*.jpeg") returned 6 [0089.530] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePageBlank.gif", pszSpec="*.psd") returned 0 [0089.530] lstrlenA (lpString="*.psd") returned 5 [0089.530] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePageBlank.gif", pszSpec="*.cdr") returned 0 [0089.530] lstrlenA (lpString="*.cdr") returned 5 [0089.530] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePageBlank.gif", pszSpec="*.dwg") returned 0 [0089.530] lstrlenA (lpString="*.dwg") returned 5 [0089.530] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePageBlank.gif", pszSpec="*.max") returned 0 [0089.530] lstrlenA (lpString="*.max") returned 5 [0089.530] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePageBlank.gif", pszSpec="*.bmp") returned 0 [0089.530] lstrlenA (lpString="*.bmp") returned 5 [0089.530] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePageBlank.gif", pszSpec="*.gif") returned 1 [0089.530] lstrlenA (lpString="*.gif") returned 5 [0089.530] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePageBlank.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePageBlank.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePageBlank.gif" [0089.530] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePageBlank.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePageBlank.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePageBlank.gif" [0089.530] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePageBlank.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePageBlank.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePageBlank.gif." [0089.530] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePageBlank.gif.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePageBlank.gif. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePageBlank.gif. " [0089.530] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePageBlank.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_formshomepageblank.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0089.531] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4ebb [0089.531] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x83a69400, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5f644b10, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x83a69400, dwHighDateTime=0x1c747ea)) returned 1 [0089.531] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0089.531] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x4e61, lpOverlapped=0x0) returned 1 [0089.534] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePageBlank.gif") returned="bg_FormsHomePageBlank.gif" [0089.534] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0089.534] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x4e61, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x4e61, lpOverlapped=0x0) returned 1 [0089.534] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0089.534] CloseHandle (hObject=0x98) returned 1 [0089.535] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePageBlank.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_formshomepageblank.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePageBlank.gif. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_formshomepageblank.gif. ")) returned 1 [0089.536] FindNextFileA (in: hFindFile=0x5b7d30, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0089.536] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0089.536] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="bg_GreenTea.gif") returned 1 [0089.536] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bg_GreenTea.gif") returned 1 [0089.536] lstrcmpiA (lpString1="", lpString2="bg_GreenTea.gif") returned -1 [0089.536] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePageBlank.gif") returned="bg_FormsHomePageBlank.gif" [0089.536] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="bg_GreenTea.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_GreenTea.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_GreenTea.gif" [0089.536] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_GreenTea.gif", pszSpec="*.zip") returned 0 [0089.536] lstrlenA (lpString="*.zip") returned 5 [0089.536] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_GreenTea.gif", pszSpec="*.rar") returned 0 [0089.536] lstrlenA (lpString="*.rar") returned 5 [0089.536] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_GreenTea.gif", pszSpec="*.7z") returned 0 [0089.536] lstrlenA (lpString="*.7z") returned 4 [0089.536] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_GreenTea.gif", pszSpec="*.tar") returned 0 [0089.536] lstrlenA (lpString="*.tar") returned 5 [0089.536] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_GreenTea.gif", pszSpec="*.gzip") returned 0 [0089.536] lstrlenA (lpString="*.gzip") returned 6 [0089.537] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_GreenTea.gif", pszSpec="*.jpg") returned 0 [0089.537] lstrlenA (lpString="*.jpg") returned 5 [0089.537] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_GreenTea.gif", pszSpec="*.jpeg") returned 0 [0089.537] lstrlenA (lpString="*.jpeg") returned 6 [0089.537] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_GreenTea.gif", pszSpec="*.psd") returned 0 [0089.537] lstrlenA (lpString="*.psd") returned 5 [0089.537] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_GreenTea.gif", pszSpec="*.cdr") returned 0 [0089.537] lstrlenA (lpString="*.cdr") returned 5 [0089.537] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_GreenTea.gif", pszSpec="*.dwg") returned 0 [0089.537] lstrlenA (lpString="*.dwg") returned 5 [0089.537] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_GreenTea.gif", pszSpec="*.max") returned 0 [0089.537] lstrlenA (lpString="*.max") returned 5 [0089.537] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_GreenTea.gif", pszSpec="*.bmp") returned 0 [0089.537] lstrlenA (lpString="*.bmp") returned 5 [0089.537] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_GreenTea.gif", pszSpec="*.gif") returned 1 [0089.537] lstrlenA (lpString="*.gif") returned 5 [0089.537] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_GreenTea.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_GreenTea.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_GreenTea.gif" [0089.537] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_GreenTea.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_GreenTea.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_GreenTea.gif" [0089.537] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_GreenTea.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_GreenTea.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_GreenTea.gif." [0089.537] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_GreenTea.gif.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_GreenTea.gif. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_GreenTea.gif. " [0089.537] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_GreenTea.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_greentea.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0089.538] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x5690 [0089.538] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x83a69400, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5f644b10, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x83a69400, dwHighDateTime=0x1c747ea)) returned 1 [0089.538] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0089.538] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x5636, lpOverlapped=0x0) returned 1 [0089.563] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_GreenTea.gif") returned="bg_GreenTea.gif" [0089.563] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0089.563] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x5636, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x5636, lpOverlapped=0x0) returned 1 [0089.563] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0089.563] CloseHandle (hObject=0x98) returned 1 [0089.564] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_GreenTea.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_greentea.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_GreenTea.gif. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_greentea.gif. ")) returned 1 [0089.565] FindNextFileA (in: hFindFile=0x5b7d30, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0089.565] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0089.565] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="bg_Groove.gif") returned 1 [0089.565] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bg_Groove.gif") returned 1 [0089.565] lstrcmpiA (lpString1="", lpString2="bg_Groove.gif") returned -1 [0089.565] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_GreenTea.gif") returned="bg_GreenTea.gif" [0089.565] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="bg_Groove.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Groove.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Groove.gif" [0089.565] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Groove.gif", pszSpec="*.zip") returned 0 [0089.565] lstrlenA (lpString="*.zip") returned 5 [0089.565] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Groove.gif", pszSpec="*.rar") returned 0 [0089.565] lstrlenA (lpString="*.rar") returned 5 [0089.565] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Groove.gif", pszSpec="*.7z") returned 0 [0089.565] lstrlenA (lpString="*.7z") returned 4 [0089.565] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Groove.gif", pszSpec="*.tar") returned 0 [0089.565] lstrlenA (lpString="*.tar") returned 5 [0089.565] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Groove.gif", pszSpec="*.gzip") returned 0 [0089.565] lstrlenA (lpString="*.gzip") returned 6 [0089.565] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Groove.gif", pszSpec="*.jpg") returned 0 [0089.565] lstrlenA (lpString="*.jpg") returned 5 [0089.565] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Groove.gif", pszSpec="*.jpeg") returned 0 [0089.565] lstrlenA (lpString="*.jpeg") returned 6 [0089.565] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Groove.gif", pszSpec="*.psd") returned 0 [0089.565] lstrlenA (lpString="*.psd") returned 5 [0089.565] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Groove.gif", pszSpec="*.cdr") returned 0 [0089.565] lstrlenA (lpString="*.cdr") returned 5 [0089.565] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Groove.gif", pszSpec="*.dwg") returned 0 [0089.565] lstrlenA (lpString="*.dwg") returned 5 [0089.565] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Groove.gif", pszSpec="*.max") returned 0 [0089.565] lstrlenA (lpString="*.max") returned 5 [0089.565] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Groove.gif", pszSpec="*.bmp") returned 0 [0089.565] lstrlenA (lpString="*.bmp") returned 5 [0089.565] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Groove.gif", pszSpec="*.gif") returned 1 [0089.565] lstrlenA (lpString="*.gif") returned 5 [0089.565] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Groove.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Groove.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Groove.gif" [0089.565] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Groove.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Groove.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Groove.gif" [0089.566] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Groove.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Groove.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Groove.gif." [0089.566] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Groove.gif.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Groove.gif. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Groove.gif. " [0089.566] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Groove.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_groove.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0089.566] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x6a [0089.566] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x83a69400, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x519a33f0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x83a69400, dwHighDateTime=0x1c747ea)) returned 1 [0089.566] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0089.566] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x10, lpOverlapped=0x0) returned 1 [0089.567] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Groove.gif") returned="bg_Groove.gif" [0089.567] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0089.567] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x10, lpOverlapped=0x0) returned 1 [0089.567] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0089.567] CloseHandle (hObject=0x98) returned 1 [0089.568] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Groove.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_groove.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Groove.gif. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_groove.gif. ")) returned 1 [0089.570] FindNextFileA (in: hFindFile=0x5b7d30, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0089.570] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0089.570] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="bg_LightSpirit.gif") returned 1 [0089.570] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bg_LightSpirit.gif") returned 1 [0089.570] lstrcmpiA (lpString1="", lpString2="bg_LightSpirit.gif") returned -1 [0089.570] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Groove.gif") returned="bg_Groove.gif" [0089.570] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="bg_LightSpirit.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_LightSpirit.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_LightSpirit.gif" [0089.570] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_LightSpirit.gif", pszSpec="*.zip") returned 0 [0089.570] lstrlenA (lpString="*.zip") returned 5 [0089.570] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_LightSpirit.gif", pszSpec="*.rar") returned 0 [0089.570] lstrlenA (lpString="*.rar") returned 5 [0089.570] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_LightSpirit.gif", pszSpec="*.7z") returned 0 [0089.570] lstrlenA (lpString="*.7z") returned 4 [0089.570] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_LightSpirit.gif", pszSpec="*.tar") returned 0 [0089.570] lstrlenA (lpString="*.tar") returned 5 [0089.570] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_LightSpirit.gif", pszSpec="*.gzip") returned 0 [0089.570] lstrlenA (lpString="*.gzip") returned 6 [0089.570] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_LightSpirit.gif", pszSpec="*.jpg") returned 0 [0089.570] lstrlenA (lpString="*.jpg") returned 5 [0089.570] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_LightSpirit.gif", pszSpec="*.jpeg") returned 0 [0089.570] lstrlenA (lpString="*.jpeg") returned 6 [0089.571] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_LightSpirit.gif", pszSpec="*.psd") returned 0 [0089.571] lstrlenA (lpString="*.psd") returned 5 [0089.571] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_LightSpirit.gif", pszSpec="*.cdr") returned 0 [0089.571] lstrlenA (lpString="*.cdr") returned 5 [0089.571] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_LightSpirit.gif", pszSpec="*.dwg") returned 0 [0089.571] lstrlenA (lpString="*.dwg") returned 5 [0089.571] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_LightSpirit.gif", pszSpec="*.max") returned 0 [0089.571] lstrlenA (lpString="*.max") returned 5 [0089.571] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_LightSpirit.gif", pszSpec="*.bmp") returned 0 [0089.571] lstrlenA (lpString="*.bmp") returned 5 [0089.571] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_LightSpirit.gif", pszSpec="*.gif") returned 1 [0089.571] lstrlenA (lpString="*.gif") returned 5 [0089.571] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_LightSpirit.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_LightSpirit.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_LightSpirit.gif" [0089.571] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_LightSpirit.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_LightSpirit.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_LightSpirit.gif" [0089.571] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_LightSpirit.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_LightSpirit.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_LightSpirit.gif." [0089.571] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_LightSpirit.gif.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_LightSpirit.gif. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_LightSpirit.gif. " [0089.571] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_LightSpirit.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_lightspirit.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0089.572] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x21a6 [0089.572] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x83a69400, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x519a33f0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x83a69400, dwHighDateTime=0x1c747ea)) returned 1 [0089.572] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0089.572] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x214c, lpOverlapped=0x0) returned 1 [0089.601] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_LightSpirit.gif") returned="bg_LightSpirit.gif" [0089.601] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0089.601] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x214c, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x214c, lpOverlapped=0x0) returned 1 [0089.601] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0089.601] CloseHandle (hObject=0x98) returned 1 [0089.602] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_LightSpirit.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_lightspirit.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_LightSpirit.gif. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_lightspirit.gif. ")) returned 1 [0089.603] FindNextFileA (in: hFindFile=0x5b7d30, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0089.603] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0089.603] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="bg_OliveGreen.gif") returned 1 [0089.603] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bg_OliveGreen.gif") returned 1 [0089.603] lstrcmpiA (lpString1="", lpString2="bg_OliveGreen.gif") returned -1 [0089.603] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_LightSpirit.gif") returned="bg_LightSpirit.gif" [0089.603] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="bg_OliveGreen.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_OliveGreen.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_OliveGreen.gif" [0089.603] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_OliveGreen.gif", pszSpec="*.zip") returned 0 [0089.603] lstrlenA (lpString="*.zip") returned 5 [0089.603] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_OliveGreen.gif", pszSpec="*.rar") returned 0 [0089.603] lstrlenA (lpString="*.rar") returned 5 [0089.603] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_OliveGreen.gif", pszSpec="*.7z") returned 0 [0089.603] lstrlenA (lpString="*.7z") returned 4 [0089.603] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_OliveGreen.gif", pszSpec="*.tar") returned 0 [0089.603] lstrlenA (lpString="*.tar") returned 5 [0089.603] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_OliveGreen.gif", pszSpec="*.gzip") returned 0 [0089.603] lstrlenA (lpString="*.gzip") returned 6 [0089.603] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_OliveGreen.gif", pszSpec="*.jpg") returned 0 [0089.603] lstrlenA (lpString="*.jpg") returned 5 [0089.603] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_OliveGreen.gif", pszSpec="*.jpeg") returned 0 [0089.603] lstrlenA (lpString="*.jpeg") returned 6 [0089.603] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_OliveGreen.gif", pszSpec="*.psd") returned 0 [0089.603] lstrlenA (lpString="*.psd") returned 5 [0089.603] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_OliveGreen.gif", pszSpec="*.cdr") returned 0 [0089.603] lstrlenA (lpString="*.cdr") returned 5 [0089.603] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_OliveGreen.gif", pszSpec="*.dwg") returned 0 [0089.603] lstrlenA (lpString="*.dwg") returned 5 [0089.603] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_OliveGreen.gif", pszSpec="*.max") returned 0 [0089.603] lstrlenA (lpString="*.max") returned 5 [0089.603] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_OliveGreen.gif", pszSpec="*.bmp") returned 0 [0089.603] lstrlenA (lpString="*.bmp") returned 5 [0089.603] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_OliveGreen.gif", pszSpec="*.gif") returned 1 [0089.603] lstrlenA (lpString="*.gif") returned 5 [0089.603] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_OliveGreen.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_OliveGreen.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_OliveGreen.gif" [0089.604] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_OliveGreen.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_OliveGreen.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_OliveGreen.gif" [0089.604] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_OliveGreen.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_OliveGreen.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_OliveGreen.gif." [0089.604] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_OliveGreen.gif.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_OliveGreen.gif. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_OliveGreen.gif. " [0089.604] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_OliveGreen.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_olivegreen.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0089.604] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3d57 [0089.604] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x84d7c100, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5f66ac70, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x84d7c100, dwHighDateTime=0x1c747ea)) returned 1 [0089.604] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0089.604] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x3cfd, lpOverlapped=0x0) returned 1 [0089.637] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_OliveGreen.gif") returned="bg_OliveGreen.gif" [0089.637] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0089.637] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x3cfd, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x3cfd, lpOverlapped=0x0) returned 1 [0089.638] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0089.638] CloseHandle (hObject=0x98) returned 1 [0089.639] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_OliveGreen.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_olivegreen.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_OliveGreen.gif. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_olivegreen.gif. ")) returned 1 [0089.640] FindNextFileA (in: hFindFile=0x5b7d30, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0089.640] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0089.640] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="bg_Premium.gif") returned 1 [0089.640] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bg_Premium.gif") returned 1 [0089.640] lstrcmpiA (lpString1="", lpString2="bg_Premium.gif") returned -1 [0089.640] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_OliveGreen.gif") returned="bg_OliveGreen.gif" [0089.640] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="bg_Premium.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Premium.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Premium.gif" [0089.640] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Premium.gif", pszSpec="*.zip") returned 0 [0089.640] lstrlenA (lpString="*.zip") returned 5 [0089.640] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Premium.gif", pszSpec="*.rar") returned 0 [0089.640] lstrlenA (lpString="*.rar") returned 5 [0089.640] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Premium.gif", pszSpec="*.7z") returned 0 [0089.640] lstrlenA (lpString="*.7z") returned 4 [0089.640] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Premium.gif", pszSpec="*.tar") returned 0 [0089.640] lstrlenA (lpString="*.tar") returned 5 [0089.640] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Premium.gif", pszSpec="*.gzip") returned 0 [0089.640] lstrlenA (lpString="*.gzip") returned 6 [0089.640] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Premium.gif", pszSpec="*.jpg") returned 0 [0089.640] lstrlenA (lpString="*.jpg") returned 5 [0089.640] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Premium.gif", pszSpec="*.jpeg") returned 0 [0089.640] lstrlenA (lpString="*.jpeg") returned 6 [0089.641] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Premium.gif", pszSpec="*.psd") returned 0 [0089.641] lstrlenA (lpString="*.psd") returned 5 [0089.641] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Premium.gif", pszSpec="*.cdr") returned 0 [0089.641] lstrlenA (lpString="*.cdr") returned 5 [0089.641] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Premium.gif", pszSpec="*.dwg") returned 0 [0089.641] lstrlenA (lpString="*.dwg") returned 5 [0089.641] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Premium.gif", pszSpec="*.max") returned 0 [0089.641] lstrlenA (lpString="*.max") returned 5 [0089.641] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Premium.gif", pszSpec="*.bmp") returned 0 [0089.641] lstrlenA (lpString="*.bmp") returned 5 [0089.641] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Premium.gif", pszSpec="*.gif") returned 1 [0089.641] lstrlenA (lpString="*.gif") returned 5 [0089.641] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Premium.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Premium.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Premium.gif" [0089.641] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Premium.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Premium.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Premium.gif" [0089.641] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Premium.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Premium.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Premium.gif." [0089.641] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Premium.gif.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Premium.gif. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Premium.gif. " [0089.641] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Premium.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_premium.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0089.642] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1845 [0089.642] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x84d7c100, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5f66ac70, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x84d7c100, dwHighDateTime=0x1c747ea)) returned 1 [0089.642] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0089.642] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x17eb, lpOverlapped=0x0) returned 1 [0089.645] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Premium.gif") returned="bg_Premium.gif" [0089.645] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0089.645] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x17eb, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x17eb, lpOverlapped=0x0) returned 1 [0089.645] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0089.645] CloseHandle (hObject=0x98) returned 1 [0089.648] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Premium.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_premium.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Premium.gif. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_premium.gif. ")) returned 1 [0089.649] FindNextFileA (in: hFindFile=0x5b7d30, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0089.649] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0089.649] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="bg_SlateBlue.gif") returned 1 [0089.649] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bg_SlateBlue.gif") returned 1 [0089.649] lstrcmpiA (lpString1="", lpString2="bg_SlateBlue.gif") returned -1 [0089.649] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Premium.gif") returned="bg_Premium.gif" [0089.649] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="bg_SlateBlue.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_SlateBlue.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_SlateBlue.gif" [0089.649] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_SlateBlue.gif", pszSpec="*.zip") returned 0 [0089.649] lstrlenA (lpString="*.zip") returned 5 [0089.649] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_SlateBlue.gif", pszSpec="*.rar") returned 0 [0089.649] lstrlenA (lpString="*.rar") returned 5 [0089.649] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_SlateBlue.gif", pszSpec="*.7z") returned 0 [0089.649] lstrlenA (lpString="*.7z") returned 4 [0089.649] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_SlateBlue.gif", pszSpec="*.tar") returned 0 [0089.649] lstrlenA (lpString="*.tar") returned 5 [0089.649] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_SlateBlue.gif", pszSpec="*.gzip") returned 0 [0089.649] lstrlenA (lpString="*.gzip") returned 6 [0089.649] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_SlateBlue.gif", pszSpec="*.jpg") returned 0 [0089.649] lstrlenA (lpString="*.jpg") returned 5 [0089.649] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_SlateBlue.gif", pszSpec="*.jpeg") returned 0 [0089.649] lstrlenA (lpString="*.jpeg") returned 6 [0089.650] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_SlateBlue.gif", pszSpec="*.psd") returned 0 [0089.650] lstrlenA (lpString="*.psd") returned 5 [0089.650] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_SlateBlue.gif", pszSpec="*.cdr") returned 0 [0089.650] lstrlenA (lpString="*.cdr") returned 5 [0089.650] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_SlateBlue.gif", pszSpec="*.dwg") returned 0 [0089.650] lstrlenA (lpString="*.dwg") returned 5 [0089.650] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_SlateBlue.gif", pszSpec="*.max") returned 0 [0089.650] lstrlenA (lpString="*.max") returned 5 [0089.650] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_SlateBlue.gif", pszSpec="*.bmp") returned 0 [0089.650] lstrlenA (lpString="*.bmp") returned 5 [0089.650] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_SlateBlue.gif", pszSpec="*.gif") returned 1 [0089.650] lstrlenA (lpString="*.gif") returned 5 [0089.650] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_SlateBlue.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_SlateBlue.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_SlateBlue.gif" [0089.650] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_SlateBlue.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_SlateBlue.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_SlateBlue.gif" [0089.650] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_SlateBlue.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_SlateBlue.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_SlateBlue.gif." [0089.650] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_SlateBlue.gif.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_SlateBlue.gif. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_SlateBlue.gif. " [0089.650] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_SlateBlue.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_slateblue.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0089.651] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x5141 [0089.651] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x84d7c100, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5f66ac70, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x84d7c100, dwHighDateTime=0x1c747ea)) returned 1 [0089.651] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0089.651] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x50e7, lpOverlapped=0x0) returned 1 [0089.655] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_SlateBlue.gif") returned="bg_SlateBlue.gif" [0089.655] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0089.655] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x50e7, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x50e7, lpOverlapped=0x0) returned 1 [0089.655] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0089.655] CloseHandle (hObject=0x98) returned 1 [0089.656] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_SlateBlue.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_slateblue.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_SlateBlue.gif. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_slateblue.gif. ")) returned 1 [0089.657] FindNextFileA (in: hFindFile=0x5b7d30, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0089.657] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0089.657] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="bg_TexturedBlue.gif") returned 1 [0089.657] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bg_TexturedBlue.gif") returned 1 [0089.657] lstrcmpiA (lpString1="", lpString2="bg_TexturedBlue.gif") returned -1 [0089.657] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_SlateBlue.gif") returned="bg_SlateBlue.gif" [0089.657] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="bg_TexturedBlue.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_TexturedBlue.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_TexturedBlue.gif" [0089.657] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_TexturedBlue.gif", pszSpec="*.zip") returned 0 [0089.657] lstrlenA (lpString="*.zip") returned 5 [0089.657] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_TexturedBlue.gif", pszSpec="*.rar") returned 0 [0089.657] lstrlenA (lpString="*.rar") returned 5 [0089.657] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_TexturedBlue.gif", pszSpec="*.7z") returned 0 [0089.657] lstrlenA (lpString="*.7z") returned 4 [0089.657] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_TexturedBlue.gif", pszSpec="*.tar") returned 0 [0089.657] lstrlenA (lpString="*.tar") returned 5 [0089.657] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_TexturedBlue.gif", pszSpec="*.gzip") returned 0 [0089.657] lstrlenA (lpString="*.gzip") returned 6 [0089.657] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_TexturedBlue.gif", pszSpec="*.jpg") returned 0 [0089.657] lstrlenA (lpString="*.jpg") returned 5 [0089.657] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_TexturedBlue.gif", pszSpec="*.jpeg") returned 0 [0089.657] lstrlenA (lpString="*.jpeg") returned 6 [0089.657] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_TexturedBlue.gif", pszSpec="*.psd") returned 0 [0089.657] lstrlenA (lpString="*.psd") returned 5 [0089.657] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_TexturedBlue.gif", pszSpec="*.cdr") returned 0 [0089.657] lstrlenA (lpString="*.cdr") returned 5 [0089.657] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_TexturedBlue.gif", pszSpec="*.dwg") returned 0 [0089.657] lstrlenA (lpString="*.dwg") returned 5 [0089.658] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_TexturedBlue.gif", pszSpec="*.max") returned 0 [0089.658] lstrlenA (lpString="*.max") returned 5 [0089.658] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_TexturedBlue.gif", pszSpec="*.bmp") returned 0 [0089.658] lstrlenA (lpString="*.bmp") returned 5 [0089.658] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_TexturedBlue.gif", pszSpec="*.gif") returned 1 [0089.658] lstrlenA (lpString="*.gif") returned 5 [0089.658] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_TexturedBlue.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_TexturedBlue.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_TexturedBlue.gif" [0089.658] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_TexturedBlue.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_TexturedBlue.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_TexturedBlue.gif" [0089.658] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_TexturedBlue.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_TexturedBlue.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_TexturedBlue.gif." [0089.658] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_TexturedBlue.gif.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_TexturedBlue.gif. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_TexturedBlue.gif. " [0089.658] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_TexturedBlue.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_texturedblue.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0089.665] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x193c [0089.665] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x84d7c100, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x519a33f0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x84d7c100, dwHighDateTime=0x1c747ea)) returned 1 [0089.665] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0089.665] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x18e2, lpOverlapped=0x0) returned 1 [0089.677] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_TexturedBlue.gif") returned="bg_TexturedBlue.gif" [0089.677] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0089.677] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x18e2, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x18e2, lpOverlapped=0x0) returned 1 [0089.678] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0089.678] CloseHandle (hObject=0x98) returned 1 [0089.679] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_TexturedBlue.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_texturedblue.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_TexturedBlue.gif. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_texturedblue.gif. ")) returned 1 [0089.680] FindNextFileA (in: hFindFile=0x5b7d30, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0089.680] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0089.680] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="bg_VelvetRose.gif") returned 1 [0089.680] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bg_VelvetRose.gif") returned 1 [0089.680] lstrcmpiA (lpString1="", lpString2="bg_VelvetRose.gif") returned -1 [0089.680] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_TexturedBlue.gif") returned="bg_TexturedBlue.gif" [0089.680] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="bg_VelvetRose.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_VelvetRose.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_VelvetRose.gif" [0089.680] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_VelvetRose.gif", pszSpec="*.zip") returned 0 [0089.680] lstrlenA (lpString="*.zip") returned 5 [0089.680] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_VelvetRose.gif", pszSpec="*.rar") returned 0 [0089.680] lstrlenA (lpString="*.rar") returned 5 [0089.680] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_VelvetRose.gif", pszSpec="*.7z") returned 0 [0089.680] lstrlenA (lpString="*.7z") returned 4 [0089.680] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_VelvetRose.gif", pszSpec="*.tar") returned 0 [0089.680] lstrlenA (lpString="*.tar") returned 5 [0089.680] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_VelvetRose.gif", pszSpec="*.gzip") returned 0 [0089.680] lstrlenA (lpString="*.gzip") returned 6 [0089.680] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_VelvetRose.gif", pszSpec="*.jpg") returned 0 [0089.680] lstrlenA (lpString="*.jpg") returned 5 [0089.680] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_VelvetRose.gif", pszSpec="*.jpeg") returned 0 [0089.680] lstrlenA (lpString="*.jpeg") returned 6 [0089.680] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_VelvetRose.gif", pszSpec="*.psd") returned 0 [0089.680] lstrlenA (lpString="*.psd") returned 5 [0089.680] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_VelvetRose.gif", pszSpec="*.cdr") returned 0 [0089.680] lstrlenA (lpString="*.cdr") returned 5 [0089.680] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_VelvetRose.gif", pszSpec="*.dwg") returned 0 [0089.680] lstrlenA (lpString="*.dwg") returned 5 [0089.680] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_VelvetRose.gif", pszSpec="*.max") returned 0 [0089.680] lstrlenA (lpString="*.max") returned 5 [0089.680] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_VelvetRose.gif", pszSpec="*.bmp") returned 0 [0089.680] lstrlenA (lpString="*.bmp") returned 5 [0089.680] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_VelvetRose.gif", pszSpec="*.gif") returned 1 [0089.681] lstrlenA (lpString="*.gif") returned 5 [0089.681] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_VelvetRose.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_VelvetRose.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_VelvetRose.gif" [0089.681] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_VelvetRose.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_VelvetRose.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_VelvetRose.gif" [0089.681] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_VelvetRose.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_VelvetRose.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_VelvetRose.gif." [0089.681] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_VelvetRose.gif.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_VelvetRose.gif. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_VelvetRose.gif. " [0089.681] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_VelvetRose.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_velvetrose.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0089.681] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3c64 [0089.681] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x84d7c100, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x519a33f0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x84d7c100, dwHighDateTime=0x1c747ea)) returned 1 [0089.681] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0089.681] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x3c0a, lpOverlapped=0x0) returned 1 [0089.855] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_VelvetRose.gif") returned="bg_VelvetRose.gif" [0089.855] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0089.855] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x3c0a, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x3c0a, lpOverlapped=0x0) returned 1 [0089.855] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0089.856] CloseHandle (hObject=0x98) returned 1 [0089.856] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_VelvetRose.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_velvetrose.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_VelvetRose.gif. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_velvetrose.gif. ")) returned 1 [0089.857] FindNextFileA (in: hFindFile=0x5b7d30, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0089.858] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0089.858] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="button_left.gif") returned 1 [0089.858] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="button_left.gif") returned 1 [0089.858] lstrcmpiA (lpString1="", lpString2="button_left.gif") returned -1 [0089.858] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_VelvetRose.gif") returned="bg_VelvetRose.gif" [0089.858] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="button_left.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left.gif" [0089.858] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left.gif", pszSpec="*.zip") returned 0 [0089.858] lstrlenA (lpString="*.zip") returned 5 [0089.858] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left.gif", pszSpec="*.rar") returned 0 [0089.858] lstrlenA (lpString="*.rar") returned 5 [0089.858] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left.gif", pszSpec="*.7z") returned 0 [0089.858] lstrlenA (lpString="*.7z") returned 4 [0089.858] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left.gif", pszSpec="*.tar") returned 0 [0089.858] lstrlenA (lpString="*.tar") returned 5 [0089.858] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left.gif", pszSpec="*.gzip") returned 0 [0089.858] lstrlenA (lpString="*.gzip") returned 6 [0089.858] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left.gif", pszSpec="*.jpg") returned 0 [0089.858] lstrlenA (lpString="*.jpg") returned 5 [0089.858] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left.gif", pszSpec="*.jpeg") returned 0 [0089.858] lstrlenA (lpString="*.jpeg") returned 6 [0089.858] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left.gif", pszSpec="*.psd") returned 0 [0089.858] lstrlenA (lpString="*.psd") returned 5 [0089.858] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left.gif", pszSpec="*.cdr") returned 0 [0089.858] lstrlenA (lpString="*.cdr") returned 5 [0089.858] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left.gif", pszSpec="*.dwg") returned 0 [0089.858] lstrlenA (lpString="*.dwg") returned 5 [0089.858] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left.gif", pszSpec="*.max") returned 0 [0089.858] lstrlenA (lpString="*.max") returned 5 [0089.858] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left.gif", pszSpec="*.bmp") returned 0 [0089.858] lstrlenA (lpString="*.bmp") returned 5 [0089.858] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left.gif", pszSpec="*.gif") returned 1 [0089.858] lstrlenA (lpString="*.gif") returned 5 [0089.858] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left.gif" [0089.858] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left.gif" [0089.858] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left.gif." [0089.858] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left.gif.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left.gif. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left.gif. " [0089.858] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\button_left.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0089.879] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x276 [0089.879] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x84d7c100, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x51b6c470, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x84d7c100, dwHighDateTime=0x1c747ea)) returned 1 [0089.879] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0089.879] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x21c, lpOverlapped=0x0) returned 1 [0090.035] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left.gif") returned="button_left.gif" [0090.035] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0090.035] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x21c, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x21c, lpOverlapped=0x0) returned 1 [0090.035] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0090.035] CloseHandle (hObject=0x98) returned 1 [0090.036] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\button_left.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left.gif. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\button_left.gif. ")) returned 1 [0090.037] FindNextFileA (in: hFindFile=0x5b7d30, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0090.037] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0090.037] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="button_left_disable.gif") returned 1 [0090.037] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="button_left_disable.gif") returned 1 [0090.037] lstrcmpiA (lpString1="", lpString2="button_left_disable.gif") returned -1 [0090.037] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left.gif") returned="button_left.gif" [0090.037] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="button_left_disable.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_disable.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_disable.gif" [0090.037] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_disable.gif", pszSpec="*.zip") returned 0 [0090.037] lstrlenA (lpString="*.zip") returned 5 [0090.037] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_disable.gif", pszSpec="*.rar") returned 0 [0090.037] lstrlenA (lpString="*.rar") returned 5 [0090.037] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_disable.gif", pszSpec="*.7z") returned 0 [0090.037] lstrlenA (lpString="*.7z") returned 4 [0090.037] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_disable.gif", pszSpec="*.tar") returned 0 [0090.037] lstrlenA (lpString="*.tar") returned 5 [0090.038] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_disable.gif", pszSpec="*.gzip") returned 0 [0090.038] lstrlenA (lpString="*.gzip") returned 6 [0090.038] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_disable.gif", pszSpec="*.jpg") returned 0 [0090.038] lstrlenA (lpString="*.jpg") returned 5 [0090.038] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_disable.gif", pszSpec="*.jpeg") returned 0 [0090.038] lstrlenA (lpString="*.jpeg") returned 6 [0090.038] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_disable.gif", pszSpec="*.psd") returned 0 [0090.038] lstrlenA (lpString="*.psd") returned 5 [0090.038] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_disable.gif", pszSpec="*.cdr") returned 0 [0090.038] lstrlenA (lpString="*.cdr") returned 5 [0090.038] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_disable.gif", pszSpec="*.dwg") returned 0 [0090.038] lstrlenA (lpString="*.dwg") returned 5 [0090.038] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_disable.gif", pszSpec="*.max") returned 0 [0090.038] lstrlenA (lpString="*.max") returned 5 [0090.038] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_disable.gif", pszSpec="*.bmp") returned 0 [0090.038] lstrlenA (lpString="*.bmp") returned 5 [0090.038] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_disable.gif", pszSpec="*.gif") returned 1 [0090.038] lstrlenA (lpString="*.gif") returned 5 [0090.038] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_disable.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_disable.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_disable.gif" [0090.038] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_disable.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_disable.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_disable.gif" [0090.038] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_disable.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_disable.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_disable.gif." [0090.038] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_disable.gif.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_disable.gif. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_disable.gif. " [0090.038] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_disable.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\button_left_disable.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0090.049] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xe6 [0090.049] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x84d7c100, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x51b6c470, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x84d7c100, dwHighDateTime=0x1c747ea)) returned 1 [0090.049] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0090.049] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x8c, lpOverlapped=0x0) returned 1 [0090.050] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_disable.gif") returned="button_left_disable.gif" [0090.050] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0090.050] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x8c, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x8c, lpOverlapped=0x0) returned 1 [0090.050] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0090.050] CloseHandle (hObject=0x98) returned 1 [0090.051] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_disable.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\button_left_disable.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_disable.gif. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\button_left_disable.gif. ")) returned 1 [0090.053] FindNextFileA (in: hFindFile=0x5b7d30, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0090.053] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0090.053] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="button_left_over.gif") returned 1 [0090.053] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="button_left_over.gif") returned 1 [0090.053] lstrcmpiA (lpString1="", lpString2="button_left_over.gif") returned -1 [0090.053] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_disable.gif") returned="button_left_disable.gif" [0090.053] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="button_left_over.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_over.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_over.gif" [0090.053] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_over.gif", pszSpec="*.zip") returned 0 [0090.053] lstrlenA (lpString="*.zip") returned 5 [0090.053] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_over.gif", pszSpec="*.rar") returned 0 [0090.053] lstrlenA (lpString="*.rar") returned 5 [0090.053] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_over.gif", pszSpec="*.7z") returned 0 [0090.053] lstrlenA (lpString="*.7z") returned 4 [0090.053] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_over.gif", pszSpec="*.tar") returned 0 [0090.053] lstrlenA (lpString="*.tar") returned 5 [0090.053] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_over.gif", pszSpec="*.gzip") returned 0 [0090.053] lstrlenA (lpString="*.gzip") returned 6 [0090.053] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_over.gif", pszSpec="*.jpg") returned 0 [0090.053] lstrlenA (lpString="*.jpg") returned 5 [0090.053] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_over.gif", pszSpec="*.jpeg") returned 0 [0090.053] lstrlenA (lpString="*.jpeg") returned 6 [0090.053] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_over.gif", pszSpec="*.psd") returned 0 [0090.053] lstrlenA (lpString="*.psd") returned 5 [0090.053] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_over.gif", pszSpec="*.cdr") returned 0 [0090.053] lstrlenA (lpString="*.cdr") returned 5 [0090.053] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_over.gif", pszSpec="*.dwg") returned 0 [0090.053] lstrlenA (lpString="*.dwg") returned 5 [0090.054] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_over.gif", pszSpec="*.max") returned 0 [0090.054] lstrlenA (lpString="*.max") returned 5 [0090.054] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_over.gif", pszSpec="*.bmp") returned 0 [0090.054] lstrlenA (lpString="*.bmp") returned 5 [0090.054] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_over.gif", pszSpec="*.gif") returned 1 [0090.054] lstrlenA (lpString="*.gif") returned 5 [0090.054] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_over.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_over.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_over.gif" [0090.054] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_over.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_over.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_over.gif" [0090.054] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_over.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_over.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_over.gif." [0090.054] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_over.gif.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_over.gif. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_over.gif. " [0090.054] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_over.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\button_left_over.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0090.055] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x41b [0090.055] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x84d7c100, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x600aeb50, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x84d7c100, dwHighDateTime=0x1c747ea)) returned 1 [0090.056] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0090.056] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x3c1, lpOverlapped=0x0) returned 1 [0090.072] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_over.gif") returned="button_left_over.gif" [0090.072] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0090.073] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x3c1, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x3c1, lpOverlapped=0x0) returned 1 [0090.073] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0090.073] CloseHandle (hObject=0x98) returned 1 [0090.074] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_over.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\button_left_over.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_over.gif. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\button_left_over.gif. ")) returned 1 [0090.075] FindNextFileA (in: hFindFile=0x5b7d30, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0090.075] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0090.075] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="button_mid.gif") returned 1 [0090.075] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="button_mid.gif") returned 1 [0090.075] lstrcmpiA (lpString1="", lpString2="button_mid.gif") returned -1 [0090.075] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_over.gif") returned="button_left_over.gif" [0090.075] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="button_mid.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid.gif" [0090.075] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid.gif", pszSpec="*.zip") returned 0 [0090.075] lstrlenA (lpString="*.zip") returned 5 [0090.075] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid.gif", pszSpec="*.rar") returned 0 [0090.075] lstrlenA (lpString="*.rar") returned 5 [0090.075] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid.gif", pszSpec="*.7z") returned 0 [0090.075] lstrlenA (lpString="*.7z") returned 4 [0090.075] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid.gif", pszSpec="*.tar") returned 0 [0090.075] lstrlenA (lpString="*.tar") returned 5 [0090.075] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid.gif", pszSpec="*.gzip") returned 0 [0090.075] lstrlenA (lpString="*.gzip") returned 6 [0090.075] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid.gif", pszSpec="*.jpg") returned 0 [0090.075] lstrlenA (lpString="*.jpg") returned 5 [0090.075] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid.gif", pszSpec="*.jpeg") returned 0 [0090.075] lstrlenA (lpString="*.jpeg") returned 6 [0090.075] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid.gif", pszSpec="*.psd") returned 0 [0090.075] lstrlenA (lpString="*.psd") returned 5 [0090.076] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid.gif", pszSpec="*.cdr") returned 0 [0090.076] lstrlenA (lpString="*.cdr") returned 5 [0090.076] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid.gif", pszSpec="*.dwg") returned 0 [0090.076] lstrlenA (lpString="*.dwg") returned 5 [0090.076] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid.gif", pszSpec="*.max") returned 0 [0090.076] lstrlenA (lpString="*.max") returned 5 [0090.076] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid.gif", pszSpec="*.bmp") returned 0 [0090.076] lstrlenA (lpString="*.bmp") returned 5 [0090.076] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid.gif", pszSpec="*.gif") returned 1 [0090.076] lstrlenA (lpString="*.gif") returned 5 [0090.076] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid.gif" [0090.076] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid.gif" [0090.076] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid.gif." [0090.076] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid.gif.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid.gif. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid.gif. " [0090.076] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\button_mid.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0090.082] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb9 [0090.082] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x84d7c100, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x51b6c470, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x84d7c100, dwHighDateTime=0x1c747ea)) returned 1 [0090.082] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0090.082] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x5f, lpOverlapped=0x0) returned 1 [0090.083] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid.gif") returned="button_mid.gif" [0090.083] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0090.083] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x5f, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x5f, lpOverlapped=0x0) returned 1 [0090.083] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0090.083] CloseHandle (hObject=0x98) returned 1 [0090.083] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\button_mid.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid.gif. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\button_mid.gif. ")) returned 1 [0090.084] FindNextFileA (in: hFindFile=0x5b7d30, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0090.084] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0090.084] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="button_mid_disable.gif") returned 1 [0090.084] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="button_mid_disable.gif") returned 1 [0090.084] lstrcmpiA (lpString1="", lpString2="button_mid_disable.gif") returned -1 [0090.084] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid.gif") returned="button_mid.gif" [0090.084] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="button_mid_disable.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_disable.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_disable.gif" [0090.084] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_disable.gif", pszSpec="*.zip") returned 0 [0090.084] lstrlenA (lpString="*.zip") returned 5 [0090.084] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_disable.gif", pszSpec="*.rar") returned 0 [0090.084] lstrlenA (lpString="*.rar") returned 5 [0090.084] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_disable.gif", pszSpec="*.7z") returned 0 [0090.084] lstrlenA (lpString="*.7z") returned 4 [0090.084] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_disable.gif", pszSpec="*.tar") returned 0 [0090.084] lstrlenA (lpString="*.tar") returned 5 [0090.084] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_disable.gif", pszSpec="*.gzip") returned 0 [0090.084] lstrlenA (lpString="*.gzip") returned 6 [0090.085] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_disable.gif", pszSpec="*.jpg") returned 0 [0090.085] lstrlenA (lpString="*.jpg") returned 5 [0090.085] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_disable.gif", pszSpec="*.jpeg") returned 0 [0090.085] lstrlenA (lpString="*.jpeg") returned 6 [0090.085] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_disable.gif", pszSpec="*.psd") returned 0 [0090.085] lstrlenA (lpString="*.psd") returned 5 [0090.085] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_disable.gif", pszSpec="*.cdr") returned 0 [0090.085] lstrlenA (lpString="*.cdr") returned 5 [0090.085] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_disable.gif", pszSpec="*.dwg") returned 0 [0090.085] lstrlenA (lpString="*.dwg") returned 5 [0090.085] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_disable.gif", pszSpec="*.max") returned 0 [0090.085] lstrlenA (lpString="*.max") returned 5 [0090.085] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_disable.gif", pszSpec="*.bmp") returned 0 [0090.085] lstrlenA (lpString="*.bmp") returned 5 [0090.085] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_disable.gif", pszSpec="*.gif") returned 1 [0090.085] lstrlenA (lpString="*.gif") returned 5 [0090.085] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_disable.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_disable.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_disable.gif" [0090.085] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_disable.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_disable.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_disable.gif" [0090.085] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_disable.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_disable.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_disable.gif." [0090.085] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_disable.gif.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_disable.gif. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_disable.gif. " [0090.085] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_disable.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\button_mid_disable.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0090.086] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x35 [0090.086] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x84d7c100, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x600aeb50, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x84d7c100, dwHighDateTime=0x1c747ea)) returned 1 [0090.086] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0090.086] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x0, lpOverlapped=0x0) returned 1 [0090.087] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0090.088] CloseHandle (hObject=0x98) returned 1 [0090.088] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_disable.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\button_mid_disable.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_disable.gif. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\button_mid_disable.gif. ")) returned 1 [0090.089] FindNextFileA (in: hFindFile=0x5b7d30, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0090.089] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0090.089] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="button_mid_over.gif") returned 1 [0090.089] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="button_mid_over.gif") returned 1 [0090.089] lstrcmpiA (lpString1="", lpString2="button_mid_over.gif") returned -1 [0090.089] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_disable.gif") returned="button_mid_disable.gif" [0090.089] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="button_mid_over.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_over.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_over.gif" [0090.089] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_over.gif", pszSpec="*.zip") returned 0 [0090.089] lstrlenA (lpString="*.zip") returned 5 [0090.089] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_over.gif", pszSpec="*.rar") returned 0 [0090.089] lstrlenA (lpString="*.rar") returned 5 [0090.089] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_over.gif", pszSpec="*.7z") returned 0 [0090.089] lstrlenA (lpString="*.7z") returned 4 [0090.089] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_over.gif", pszSpec="*.tar") returned 0 [0090.089] lstrlenA (lpString="*.tar") returned 5 [0090.089] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_over.gif", pszSpec="*.gzip") returned 0 [0090.089] lstrlenA (lpString="*.gzip") returned 6 [0090.089] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_over.gif", pszSpec="*.jpg") returned 0 [0090.089] lstrlenA (lpString="*.jpg") returned 5 [0090.089] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_over.gif", pszSpec="*.jpeg") returned 0 [0090.089] lstrlenA (lpString="*.jpeg") returned 6 [0090.089] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_over.gif", pszSpec="*.psd") returned 0 [0090.089] lstrlenA (lpString="*.psd") returned 5 [0090.089] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_over.gif", pszSpec="*.cdr") returned 0 [0090.089] lstrlenA (lpString="*.cdr") returned 5 [0090.089] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_over.gif", pszSpec="*.dwg") returned 0 [0090.089] lstrlenA (lpString="*.dwg") returned 5 [0090.089] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_over.gif", pszSpec="*.max") returned 0 [0090.089] lstrlenA (lpString="*.max") returned 5 [0090.089] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_over.gif", pszSpec="*.bmp") returned 0 [0090.089] lstrlenA (lpString="*.bmp") returned 5 [0090.089] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_over.gif", pszSpec="*.gif") returned 1 [0090.089] lstrlenA (lpString="*.gif") returned 5 [0090.089] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_over.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_over.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_over.gif" [0090.089] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_over.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_over.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_over.gif" [0090.089] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_over.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_over.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_over.gif." [0090.090] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_over.gif.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_over.gif. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_over.gif. " [0090.090] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_over.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\button_mid_over.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0090.090] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xbb [0090.090] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x84d7c100, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x600aeb50, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x84d7c100, dwHighDateTime=0x1c747ea)) returned 1 [0090.090] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0090.090] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x61, lpOverlapped=0x0) returned 1 [0090.091] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_over.gif") returned="button_mid_over.gif" [0090.091] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0090.091] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x61, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x61, lpOverlapped=0x0) returned 1 [0090.091] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0090.091] CloseHandle (hObject=0x98) returned 1 [0090.092] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_over.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\button_mid_over.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_over.gif. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\button_mid_over.gif. ")) returned 1 [0090.092] FindNextFileA (in: hFindFile=0x5b7d30, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0090.092] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0090.092] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="button_right.gif") returned 1 [0090.092] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="button_right.gif") returned 1 [0090.092] lstrcmpiA (lpString1="", lpString2="button_right.gif") returned -1 [0090.092] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_over.gif") returned="button_mid_over.gif" [0090.092] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="button_right.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right.gif" [0090.092] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right.gif", pszSpec="*.zip") returned 0 [0090.092] lstrlenA (lpString="*.zip") returned 5 [0090.093] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right.gif", pszSpec="*.rar") returned 0 [0090.093] lstrlenA (lpString="*.rar") returned 5 [0090.093] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right.gif", pszSpec="*.7z") returned 0 [0090.093] lstrlenA (lpString="*.7z") returned 4 [0090.093] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right.gif", pszSpec="*.tar") returned 0 [0090.093] lstrlenA (lpString="*.tar") returned 5 [0090.093] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right.gif", pszSpec="*.gzip") returned 0 [0090.093] lstrlenA (lpString="*.gzip") returned 6 [0090.093] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right.gif", pszSpec="*.jpg") returned 0 [0090.093] lstrlenA (lpString="*.jpg") returned 5 [0090.093] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right.gif", pszSpec="*.jpeg") returned 0 [0090.093] lstrlenA (lpString="*.jpeg") returned 6 [0090.093] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right.gif", pszSpec="*.psd") returned 0 [0090.093] lstrlenA (lpString="*.psd") returned 5 [0090.093] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right.gif", pszSpec="*.cdr") returned 0 [0090.093] lstrlenA (lpString="*.cdr") returned 5 [0090.093] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right.gif", pszSpec="*.dwg") returned 0 [0090.093] lstrlenA (lpString="*.dwg") returned 5 [0090.093] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right.gif", pszSpec="*.max") returned 0 [0090.093] lstrlenA (lpString="*.max") returned 5 [0090.093] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right.gif", pszSpec="*.bmp") returned 0 [0090.093] lstrlenA (lpString="*.bmp") returned 5 [0090.093] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right.gif", pszSpec="*.gif") returned 1 [0090.093] lstrlenA (lpString="*.gif") returned 5 [0090.093] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right.gif" [0090.093] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right.gif" [0090.093] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right.gif." [0090.093] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right.gif.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right.gif. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right.gif. " [0090.093] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\button_right.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0090.105] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x26e [0090.105] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x84d7c100, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x60120f70, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x84d7c100, dwHighDateTime=0x1c747ea)) returned 1 [0090.105] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0090.105] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x214, lpOverlapped=0x0) returned 1 [0090.139] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right.gif") returned="button_right.gif" [0090.139] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0090.139] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x214, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x214, lpOverlapped=0x0) returned 1 [0090.139] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0090.139] CloseHandle (hObject=0x98) returned 1 [0090.140] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\button_right.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right.gif. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\button_right.gif. ")) returned 1 [0090.141] FindNextFileA (in: hFindFile=0x5b7d30, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0090.141] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0090.141] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="button_right_disable.gif") returned 1 [0090.141] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="button_right_disable.gif") returned 1 [0090.141] lstrcmpiA (lpString1="", lpString2="button_right_disable.gif") returned -1 [0090.141] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right.gif") returned="button_right.gif" [0090.141] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="button_right_disable.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_disable.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_disable.gif" [0090.141] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_disable.gif", pszSpec="*.zip") returned 0 [0090.141] lstrlenA (lpString="*.zip") returned 5 [0090.141] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_disable.gif", pszSpec="*.rar") returned 0 [0090.141] lstrlenA (lpString="*.rar") returned 5 [0090.141] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_disable.gif", pszSpec="*.7z") returned 0 [0090.141] lstrlenA (lpString="*.7z") returned 4 [0090.141] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_disable.gif", pszSpec="*.tar") returned 0 [0090.141] lstrlenA (lpString="*.tar") returned 5 [0090.141] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_disable.gif", pszSpec="*.gzip") returned 0 [0090.141] lstrlenA (lpString="*.gzip") returned 6 [0090.141] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_disable.gif", pszSpec="*.jpg") returned 0 [0090.141] lstrlenA (lpString="*.jpg") returned 5 [0090.141] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_disable.gif", pszSpec="*.jpeg") returned 0 [0090.141] lstrlenA (lpString="*.jpeg") returned 6 [0090.141] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_disable.gif", pszSpec="*.psd") returned 0 [0090.141] lstrlenA (lpString="*.psd") returned 5 [0090.141] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_disable.gif", pszSpec="*.cdr") returned 0 [0090.141] lstrlenA (lpString="*.cdr") returned 5 [0090.141] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_disable.gif", pszSpec="*.dwg") returned 0 [0090.141] lstrlenA (lpString="*.dwg") returned 5 [0090.141] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_disable.gif", pszSpec="*.max") returned 0 [0090.141] lstrlenA (lpString="*.max") returned 5 [0090.141] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_disable.gif", pszSpec="*.bmp") returned 0 [0090.141] lstrlenA (lpString="*.bmp") returned 5 [0090.141] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_disable.gif", pszSpec="*.gif") returned 1 [0090.141] lstrlenA (lpString="*.gif") returned 5 [0090.141] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_disable.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_disable.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_disable.gif" [0090.141] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_disable.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_disable.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_disable.gif" [0090.141] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_disable.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_disable.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_disable.gif." [0090.141] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_disable.gif.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_disable.gif. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_disable.gif. " [0090.142] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_disable.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\button_right_disable.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0090.142] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xe1 [0090.142] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x84d7c100, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x60120f70, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x84d7c100, dwHighDateTime=0x1c747ea)) returned 1 [0090.142] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0090.142] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x87, lpOverlapped=0x0) returned 1 [0090.143] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_disable.gif") returned="button_right_disable.gif" [0090.143] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0090.143] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x87, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x87, lpOverlapped=0x0) returned 1 [0090.143] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0090.143] CloseHandle (hObject=0x98) returned 1 [0090.144] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_disable.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\button_right_disable.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_disable.gif. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\button_right_disable.gif. ")) returned 1 [0090.144] FindNextFileA (in: hFindFile=0x5b7d30, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0090.144] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0090.144] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="button_right_over.gif") returned 1 [0090.144] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="button_right_over.gif") returned 1 [0090.144] lstrcmpiA (lpString1="", lpString2="button_right_over.gif") returned -1 [0090.144] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_disable.gif") returned="button_right_disable.gif" [0090.144] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="button_right_over.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_over.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_over.gif" [0090.145] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_over.gif", pszSpec="*.zip") returned 0 [0090.145] lstrlenA (lpString="*.zip") returned 5 [0090.145] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_over.gif", pszSpec="*.rar") returned 0 [0090.145] lstrlenA (lpString="*.rar") returned 5 [0090.145] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_over.gif", pszSpec="*.7z") returned 0 [0090.145] lstrlenA (lpString="*.7z") returned 4 [0090.145] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_over.gif", pszSpec="*.tar") returned 0 [0090.145] lstrlenA (lpString="*.tar") returned 5 [0090.145] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_over.gif", pszSpec="*.gzip") returned 0 [0090.145] lstrlenA (lpString="*.gzip") returned 6 [0090.145] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_over.gif", pszSpec="*.jpg") returned 0 [0090.145] lstrlenA (lpString="*.jpg") returned 5 [0090.145] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_over.gif", pszSpec="*.jpeg") returned 0 [0090.145] lstrlenA (lpString="*.jpeg") returned 6 [0090.145] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_over.gif", pszSpec="*.psd") returned 0 [0090.145] lstrlenA (lpString="*.psd") returned 5 [0090.145] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_over.gif", pszSpec="*.cdr") returned 0 [0090.145] lstrlenA (lpString="*.cdr") returned 5 [0090.145] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_over.gif", pszSpec="*.dwg") returned 0 [0090.145] lstrlenA (lpString="*.dwg") returned 5 [0090.145] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_over.gif", pszSpec="*.max") returned 0 [0090.145] lstrlenA (lpString="*.max") returned 5 [0090.145] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_over.gif", pszSpec="*.bmp") returned 0 [0090.145] lstrlenA (lpString="*.bmp") returned 5 [0090.145] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_over.gif", pszSpec="*.gif") returned 1 [0090.145] lstrlenA (lpString="*.gif") returned 5 [0090.145] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_over.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_over.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_over.gif" [0090.145] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_over.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_over.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_over.gif" [0090.145] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_over.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_over.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_over.gif." [0090.145] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_over.gif.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_over.gif. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_over.gif. " [0090.145] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_over.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\button_right_over.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0090.145] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x41b [0090.145] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8608ee00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x51b925d0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8608ee00, dwHighDateTime=0x1c747ea)) returned 1 [0090.146] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0090.146] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x3c1, lpOverlapped=0x0) returned 1 [0090.167] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_over.gif") returned="button_right_over.gif" [0090.167] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0090.167] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x3c1, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x3c1, lpOverlapped=0x0) returned 1 [0090.167] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0090.168] CloseHandle (hObject=0x98) returned 1 [0090.168] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_over.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\button_right_over.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_over.gif. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\button_right_over.gif. ")) returned 1 [0090.169] FindNextFileA (in: hFindFile=0x5b7d30, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0090.169] lstrcmpA (lpString1=".", lpString2="FieldTypePreview") returned -1 [0090.169] lstrcmpA (lpString1="..", lpString2="FieldTypePreview") returned -1 [0090.169] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_over.gif") returned="button_right_over.gif" [0090.169] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="FieldTypePreview" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview" [0090.169] lstrlenA (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview") returned 98 [0090.169] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\*.*", lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 0x5b7d70 [0090.267] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0090.267] FindNextFileA (in: hFindFile=0x5b7d70, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0090.267] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0090.267] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0090.267] FindNextFileA (in: hFindFile=0x5b7d70, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0090.267] PeekMessageA (in: lpMsg=0xaece4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaece4) returned 0 [0090.267] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Attachments.jpg") returned 1 [0090.267] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Attachments.jpg") returned 1 [0090.268] lstrcmpiA (lpString1="", lpString2="Attachments.jpg") returned -1 [0090.268] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\*.*") returned="*.*" [0090.268] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\", lpString2="Attachments.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\Attachments.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\Attachments.jpg" [0090.268] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\Attachments.jpg", pszSpec="*.zip") returned 0 [0090.268] lstrlenA (lpString="*.zip") returned 5 [0090.268] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\Attachments.jpg", pszSpec="*.rar") returned 0 [0090.268] lstrlenA (lpString="*.rar") returned 5 [0090.268] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\Attachments.jpg", pszSpec="*.7z") returned 0 [0090.268] lstrlenA (lpString="*.7z") returned 4 [0090.268] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\Attachments.jpg", pszSpec="*.tar") returned 0 [0090.268] lstrlenA (lpString="*.tar") returned 5 [0090.268] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\Attachments.jpg", pszSpec="*.gzip") returned 0 [0090.268] lstrlenA (lpString="*.gzip") returned 6 [0090.268] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\Attachments.jpg", pszSpec="*.jpg") returned 1 [0090.268] lstrlenA (lpString="*.jpg") returned 5 [0090.268] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\Attachments.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\Attachments.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\Attachments.jpg" [0090.268] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\Attachments.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\Attachments.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\Attachments.jpg" [0090.268] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\Attachments.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\Attachments.jpg.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\Attachments.jpg." [0090.268] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\Attachments.jpg.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\Attachments.jpg. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\Attachments.jpg. " [0090.268] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\Attachments.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\attachments.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9c [0090.269] GetFileSize (in: hFile=0x9c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x368c [0090.269] GetFileTime (in: hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8608ee00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x51767f50, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8608ee00, dwHighDateTime=0x1c747ea)) returned 1 [0090.269] SetFilePointer (in: hFile=0x9c, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0090.269] ReadFile (in: hFile=0x9c, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x3632, lpOverlapped=0x0) returned 1 [0090.293] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\Attachments.jpg") returned="Attachments.jpg" [0090.293] SetFilePointer (in: hFile=0x9c, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0090.293] WriteFile (in: hFile=0x9c, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x3632, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x3632, lpOverlapped=0x0) returned 1 [0090.555] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0090.555] CloseHandle (hObject=0x9c) returned 1 [0090.556] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\Attachments.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\attachments.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\Attachments.jpg. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\attachments.jpg. ")) returned 1 [0090.557] FindNextFileA (in: hFindFile=0x5b7d70, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0090.557] PeekMessageA (in: lpMsg=0xaece4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaece4) returned 0 [0090.557] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BREAK.JPG") returned 1 [0090.557] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BREAK.JPG") returned 1 [0090.557] lstrcmpiA (lpString1="", lpString2="BREAK.JPG") returned -1 [0090.557] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\Attachments.jpg") returned="Attachments.jpg" [0090.557] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\", lpString2="BREAK.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BREAK.JPG") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BREAK.JPG" [0090.557] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BREAK.JPG", pszSpec="*.zip") returned 0 [0090.557] lstrlenA (lpString="*.zip") returned 5 [0090.557] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BREAK.JPG", pszSpec="*.rar") returned 0 [0090.557] lstrlenA (lpString="*.rar") returned 5 [0090.557] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BREAK.JPG", pszSpec="*.7z") returned 0 [0090.557] lstrlenA (lpString="*.7z") returned 4 [0090.557] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BREAK.JPG", pszSpec="*.tar") returned 0 [0090.557] lstrlenA (lpString="*.tar") returned 5 [0090.557] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BREAK.JPG", pszSpec="*.gzip") returned 0 [0090.557] lstrlenA (lpString="*.gzip") returned 6 [0090.557] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BREAK.JPG", pszSpec="*.jpg") returned 1 [0090.557] lstrlenA (lpString="*.jpg") returned 5 [0090.558] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BREAK.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BREAK.JPG") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BREAK.JPG" [0090.558] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BREAK.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BREAK.JPG") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BREAK.JPG" [0090.558] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BREAK.JPG", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BREAK.JPG.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BREAK.JPG." [0090.558] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BREAK.JPG.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BREAK.JPG. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BREAK.JPG. " [0090.558] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BREAK.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\break.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9c [0090.558] GetFileSize (in: hFile=0x9c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3a68 [0090.558] GetFileTime (in: hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8608ee00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x6003c730, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8608ee00, dwHighDateTime=0x1c747ea)) returned 1 [0090.559] SetFilePointer (in: hFile=0x9c, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0090.559] ReadFile (in: hFile=0x9c, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x3a0e, lpOverlapped=0x0) returned 1 [0090.573] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BREAK.JPG") returned="BREAK.JPG" [0090.573] SetFilePointer (in: hFile=0x9c, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0090.574] WriteFile (in: hFile=0x9c, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x3a0e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x3a0e, lpOverlapped=0x0) returned 1 [0090.574] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0090.574] CloseHandle (hObject=0x9c) returned 1 [0090.575] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BREAK.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\break.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BREAK.JPG. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\break.jpg. ")) returned 1 [0090.576] FindNextFileA (in: hFindFile=0x5b7d70, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0090.576] PeekMessageA (in: lpMsg=0xaece4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaece4) returned 0 [0090.576] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BUTTON.JPG") returned 1 [0090.576] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BUTTON.JPG") returned 1 [0090.576] lstrcmpiA (lpString1="", lpString2="BUTTON.JPG") returned -1 [0090.576] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BREAK.JPG") returned="BREAK.JPG" [0090.576] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\", lpString2="BUTTON.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BUTTON.JPG") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BUTTON.JPG" [0090.576] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BUTTON.JPG", pszSpec="*.zip") returned 0 [0090.576] lstrlenA (lpString="*.zip") returned 5 [0090.576] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BUTTON.JPG", pszSpec="*.rar") returned 0 [0090.576] lstrlenA (lpString="*.rar") returned 5 [0090.576] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BUTTON.JPG", pszSpec="*.7z") returned 0 [0090.576] lstrlenA (lpString="*.7z") returned 4 [0090.576] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BUTTON.JPG", pszSpec="*.tar") returned 0 [0090.576] lstrlenA (lpString="*.tar") returned 5 [0090.576] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BUTTON.JPG", pszSpec="*.gzip") returned 0 [0090.576] lstrlenA (lpString="*.gzip") returned 6 [0090.576] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BUTTON.JPG", pszSpec="*.jpg") returned 1 [0090.576] lstrlenA (lpString="*.jpg") returned 5 [0090.576] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BUTTON.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BUTTON.JPG") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BUTTON.JPG" [0090.576] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BUTTON.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BUTTON.JPG") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BUTTON.JPG" [0090.576] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BUTTON.JPG", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BUTTON.JPG.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BUTTON.JPG." [0090.577] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BUTTON.JPG.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BUTTON.JPG. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BUTTON.JPG. " [0090.577] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BUTTON.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\button.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9c [0090.579] GetFileSize (in: hFile=0x9c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3004 [0090.579] GetFileTime (in: hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8608ee00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x51b6c470, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8608ee00, dwHighDateTime=0x1c747ea)) returned 1 [0090.579] SetFilePointer (in: hFile=0x9c, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0090.579] ReadFile (in: hFile=0x9c, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x2faa, lpOverlapped=0x0) returned 1 [0090.580] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BUTTON.JPG") returned="BUTTON.JPG" [0090.581] SetFilePointer (in: hFile=0x9c, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0090.581] WriteFile (in: hFile=0x9c, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x2faa, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x2faa, lpOverlapped=0x0) returned 1 [0090.581] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0090.581] CloseHandle (hObject=0x9c) returned 1 [0090.582] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BUTTON.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\button.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BUTTON.JPG. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\button.jpg. ")) returned 1 [0090.584] FindNextFileA (in: hFindFile=0x5b7d70, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0090.584] PeekMessageA (in: lpMsg=0xaece4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaece4) returned 0 [0090.584] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="CHECKBOX.JPG") returned 1 [0090.584] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="CHECKBOX.JPG") returned 1 [0090.584] lstrcmpiA (lpString1="", lpString2="CHECKBOX.JPG") returned -1 [0090.584] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BUTTON.JPG") returned="BUTTON.JPG" [0090.584] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\", lpString2="CHECKBOX.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CHECKBOX.JPG") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CHECKBOX.JPG" [0090.584] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CHECKBOX.JPG", pszSpec="*.zip") returned 0 [0090.585] lstrlenA (lpString="*.zip") returned 5 [0090.585] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CHECKBOX.JPG", pszSpec="*.rar") returned 0 [0090.585] lstrlenA (lpString="*.rar") returned 5 [0090.585] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CHECKBOX.JPG", pszSpec="*.7z") returned 0 [0090.585] lstrlenA (lpString="*.7z") returned 4 [0090.585] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CHECKBOX.JPG", pszSpec="*.tar") returned 0 [0090.585] lstrlenA (lpString="*.tar") returned 5 [0090.585] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CHECKBOX.JPG", pszSpec="*.gzip") returned 0 [0090.585] lstrlenA (lpString="*.gzip") returned 6 [0090.585] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CHECKBOX.JPG", pszSpec="*.jpg") returned 1 [0090.585] lstrlenA (lpString="*.jpg") returned 5 [0090.585] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CHECKBOX.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CHECKBOX.JPG") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CHECKBOX.JPG" [0090.585] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CHECKBOX.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CHECKBOX.JPG") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CHECKBOX.JPG" [0090.585] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CHECKBOX.JPG", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CHECKBOX.JPG.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CHECKBOX.JPG." [0090.585] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CHECKBOX.JPG.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CHECKBOX.JPG. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CHECKBOX.JPG. " [0090.585] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CHECKBOX.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\checkbox.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9c [0090.586] GetFileSize (in: hFile=0x9c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x33d6 [0090.586] GetFileTime (in: hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8608ee00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x60382570, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8608ee00, dwHighDateTime=0x1c747ea)) returned 1 [0090.586] SetFilePointer (in: hFile=0x9c, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0090.587] ReadFile (in: hFile=0x9c, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x337c, lpOverlapped=0x0) returned 1 [0090.600] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CHECKBOX.JPG") returned="CHECKBOX.JPG" [0090.600] SetFilePointer (in: hFile=0x9c, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0090.600] WriteFile (in: hFile=0x9c, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x337c, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x337c, lpOverlapped=0x0) returned 1 [0090.600] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0090.600] CloseHandle (hObject=0x9c) returned 1 [0090.601] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CHECKBOX.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\checkbox.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CHECKBOX.JPG. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\checkbox.jpg. ")) returned 1 [0090.602] FindNextFileA (in: hFindFile=0x5b7d70, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0090.602] PeekMessageA (in: lpMsg=0xaece4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaece4) returned 0 [0090.602] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="COMBOBOX.JPG") returned 1 [0090.602] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="COMBOBOX.JPG") returned 1 [0090.602] lstrcmpiA (lpString1="", lpString2="COMBOBOX.JPG") returned -1 [0090.602] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CHECKBOX.JPG") returned="CHECKBOX.JPG" [0090.602] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\", lpString2="COMBOBOX.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\COMBOBOX.JPG") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\COMBOBOX.JPG" [0090.602] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\COMBOBOX.JPG", pszSpec="*.zip") returned 0 [0090.602] lstrlenA (lpString="*.zip") returned 5 [0090.602] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\COMBOBOX.JPG", pszSpec="*.rar") returned 0 [0090.602] lstrlenA (lpString="*.rar") returned 5 [0090.602] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\COMBOBOX.JPG", pszSpec="*.7z") returned 0 [0090.602] lstrlenA (lpString="*.7z") returned 4 [0090.602] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\COMBOBOX.JPG", pszSpec="*.tar") returned 0 [0090.602] lstrlenA (lpString="*.tar") returned 5 [0090.602] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\COMBOBOX.JPG", pszSpec="*.gzip") returned 0 [0090.603] lstrlenA (lpString="*.gzip") returned 6 [0090.603] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\COMBOBOX.JPG", pszSpec="*.jpg") returned 1 [0090.603] lstrlenA (lpString="*.jpg") returned 5 [0090.603] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\COMBOBOX.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\COMBOBOX.JPG") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\COMBOBOX.JPG" [0090.603] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\COMBOBOX.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\COMBOBOX.JPG") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\COMBOBOX.JPG" [0090.603] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\COMBOBOX.JPG", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\COMBOBOX.JPG.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\COMBOBOX.JPG." [0090.603] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\COMBOBOX.JPG.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\COMBOBOX.JPG. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\COMBOBOX.JPG. " [0090.603] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\COMBOBOX.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\combobox.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9c [0090.605] GetFileSize (in: hFile=0x9c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x43a3 [0090.605] GetFileTime (in: hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8608ee00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x51cc30d0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8608ee00, dwHighDateTime=0x1c747ea)) returned 1 [0090.605] SetFilePointer (in: hFile=0x9c, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0090.605] ReadFile (in: hFile=0x9c, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x4349, lpOverlapped=0x0) returned 1 [0090.627] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\COMBOBOX.JPG") returned="COMBOBOX.JPG" [0090.627] SetFilePointer (in: hFile=0x9c, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0090.627] WriteFile (in: hFile=0x9c, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x4349, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x4349, lpOverlapped=0x0) returned 1 [0090.627] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0090.628] CloseHandle (hObject=0x9c) returned 1 [0090.628] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\COMBOBOX.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\combobox.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\COMBOBOX.JPG. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\combobox.jpg. ")) returned 1 [0090.629] FindNextFileA (in: hFindFile=0x5b7d70, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0090.629] PeekMessageA (in: lpMsg=0xaece4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaece4) returned 0 [0090.629] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="CONTACT.JPG") returned 1 [0090.629] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="CONTACT.JPG") returned 1 [0090.629] lstrcmpiA (lpString1="", lpString2="CONTACT.JPG") returned -1 [0090.629] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\COMBOBOX.JPG") returned="COMBOBOX.JPG" [0090.629] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\", lpString2="CONTACT.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CONTACT.JPG") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CONTACT.JPG" [0090.629] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CONTACT.JPG", pszSpec="*.zip") returned 0 [0090.629] lstrlenA (lpString="*.zip") returned 5 [0090.629] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CONTACT.JPG", pszSpec="*.rar") returned 0 [0090.629] lstrlenA (lpString="*.rar") returned 5 [0090.630] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CONTACT.JPG", pszSpec="*.7z") returned 0 [0090.630] lstrlenA (lpString="*.7z") returned 4 [0090.630] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CONTACT.JPG", pszSpec="*.tar") returned 0 [0090.630] lstrlenA (lpString="*.tar") returned 5 [0090.630] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CONTACT.JPG", pszSpec="*.gzip") returned 0 [0090.630] lstrlenA (lpString="*.gzip") returned 6 [0090.630] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CONTACT.JPG", pszSpec="*.jpg") returned 1 [0090.630] lstrlenA (lpString="*.jpg") returned 5 [0090.630] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CONTACT.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CONTACT.JPG") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CONTACT.JPG" [0090.630] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CONTACT.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CONTACT.JPG") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CONTACT.JPG" [0090.630] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CONTACT.JPG", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CONTACT.JPG.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CONTACT.JPG." [0090.630] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CONTACT.JPG.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CONTACT.JPG. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CONTACT.JPG. " [0090.630] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CONTACT.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\contact.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9c [0090.631] GetFileSize (in: hFile=0x9c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x36bd [0090.631] GetFileTime (in: hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8608ee00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x6048cf10, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8608ee00, dwHighDateTime=0x1c747ea)) returned 1 [0090.631] SetFilePointer (in: hFile=0x9c, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0090.631] ReadFile (in: hFile=0x9c, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x3663, lpOverlapped=0x0) returned 1 [0090.632] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CONTACT.JPG") returned="CONTACT.JPG" [0090.632] SetFilePointer (in: hFile=0x9c, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0090.632] WriteFile (in: hFile=0x9c, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x3663, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x3663, lpOverlapped=0x0) returned 1 [0090.632] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0090.632] CloseHandle (hObject=0x9c) returned 1 [0090.633] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CONTACT.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\contact.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CONTACT.JPG. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\contact.jpg. ")) returned 1 [0090.634] FindNextFileA (in: hFindFile=0x5b7d70, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0090.634] PeekMessageA (in: lpMsg=0xaece4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaece4) returned 0 [0090.634] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="CURRENCY.JPG") returned 1 [0090.634] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="CURRENCY.JPG") returned 1 [0090.634] lstrcmpiA (lpString1="", lpString2="CURRENCY.JPG") returned -1 [0090.634] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CONTACT.JPG") returned="CONTACT.JPG" [0090.634] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\", lpString2="CURRENCY.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CURRENCY.JPG") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CURRENCY.JPG" [0090.634] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CURRENCY.JPG", pszSpec="*.zip") returned 0 [0090.634] lstrlenA (lpString="*.zip") returned 5 [0090.634] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CURRENCY.JPG", pszSpec="*.rar") returned 0 [0090.634] lstrlenA (lpString="*.rar") returned 5 [0090.634] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CURRENCY.JPG", pszSpec="*.7z") returned 0 [0090.634] lstrlenA (lpString="*.7z") returned 4 [0090.634] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CURRENCY.JPG", pszSpec="*.tar") returned 0 [0090.634] lstrlenA (lpString="*.tar") returned 5 [0090.634] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CURRENCY.JPG", pszSpec="*.gzip") returned 0 [0090.634] lstrlenA (lpString="*.gzip") returned 6 [0090.634] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CURRENCY.JPG", pszSpec="*.jpg") returned 1 [0090.634] lstrlenA (lpString="*.jpg") returned 5 [0090.634] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CURRENCY.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CURRENCY.JPG") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CURRENCY.JPG" [0090.634] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CURRENCY.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CURRENCY.JPG") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CURRENCY.JPG" [0090.634] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CURRENCY.JPG", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CURRENCY.JPG.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CURRENCY.JPG." [0090.634] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CURRENCY.JPG.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CURRENCY.JPG. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CURRENCY.JPG. " [0090.634] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CURRENCY.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\currency.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9c [0090.635] GetFileSize (in: hFile=0x9c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3d22 [0090.635] GetFileTime (in: hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8608ee00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x606ee510, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8608ee00, dwHighDateTime=0x1c747ea)) returned 1 [0090.635] SetFilePointer (in: hFile=0x9c, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0090.635] ReadFile (in: hFile=0x9c, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x3cc8, lpOverlapped=0x0) returned 1 [0090.659] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CURRENCY.JPG") returned="CURRENCY.JPG" [0090.659] SetFilePointer (in: hFile=0x9c, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0090.659] WriteFile (in: hFile=0x9c, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x3cc8, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x3cc8, lpOverlapped=0x0) returned 1 [0090.659] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0090.659] CloseHandle (hObject=0x9c) returned 1 [0090.660] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CURRENCY.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\currency.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CURRENCY.JPG. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\currency.jpg. ")) returned 1 [0090.661] FindNextFileA (in: hFindFile=0x5b7d70, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0090.661] PeekMessageA (in: lpMsg=0xaece4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaece4) returned 0 [0090.661] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="DATE.JPG") returned 1 [0090.661] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DATE.JPG") returned 1 [0090.661] lstrcmpiA (lpString1="", lpString2="DATE.JPG") returned -1 [0090.661] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CURRENCY.JPG") returned="CURRENCY.JPG" [0090.661] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\", lpString2="DATE.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATE.JPG") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATE.JPG" [0090.661] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATE.JPG", pszSpec="*.zip") returned 0 [0090.661] lstrlenA (lpString="*.zip") returned 5 [0090.661] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATE.JPG", pszSpec="*.rar") returned 0 [0090.661] lstrlenA (lpString="*.rar") returned 5 [0090.661] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATE.JPG", pszSpec="*.7z") returned 0 [0090.661] lstrlenA (lpString="*.7z") returned 4 [0090.661] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATE.JPG", pszSpec="*.tar") returned 0 [0090.661] lstrlenA (lpString="*.tar") returned 5 [0090.661] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATE.JPG", pszSpec="*.gzip") returned 0 [0090.661] lstrlenA (lpString="*.gzip") returned 6 [0090.661] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATE.JPG", pszSpec="*.jpg") returned 1 [0090.661] lstrlenA (lpString="*.jpg") returned 5 [0090.661] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATE.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATE.JPG") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATE.JPG" [0090.661] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATE.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATE.JPG") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATE.JPG" [0090.661] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATE.JPG", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATE.JPG.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATE.JPG." [0090.661] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATE.JPG.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATE.JPG. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATE.JPG. " [0090.661] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATE.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\date.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9c [0090.662] GetFileSize (in: hFile=0x9c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x42af [0090.662] GetFileTime (in: hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8608ee00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x606ee510, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8608ee00, dwHighDateTime=0x1c747ea)) returned 1 [0090.662] SetFilePointer (in: hFile=0x9c, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0090.662] ReadFile (in: hFile=0x9c, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x4255, lpOverlapped=0x0) returned 1 [0090.684] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATE.JPG") returned="DATE.JPG" [0090.684] SetFilePointer (in: hFile=0x9c, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0090.684] WriteFile (in: hFile=0x9c, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x4255, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x4255, lpOverlapped=0x0) returned 1 [0090.684] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0090.685] CloseHandle (hObject=0x9c) returned 1 [0090.686] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATE.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\date.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATE.JPG. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\date.jpg. ")) returned 1 [0090.723] FindNextFileA (in: hFindFile=0x5b7d70, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0090.723] PeekMessageA (in: lpMsg=0xaece4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaece4) returned 0 [0090.723] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="DATETIME.JPG") returned 1 [0090.723] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DATETIME.JPG") returned 1 [0090.723] lstrcmpiA (lpString1="", lpString2="DATETIME.JPG") returned -1 [0090.723] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATE.JPG") returned="DATE.JPG" [0090.723] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\", lpString2="DATETIME.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATETIME.JPG") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATETIME.JPG" [0090.723] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATETIME.JPG", pszSpec="*.zip") returned 0 [0090.723] lstrlenA (lpString="*.zip") returned 5 [0090.723] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATETIME.JPG", pszSpec="*.rar") returned 0 [0090.724] lstrlenA (lpString="*.rar") returned 5 [0090.724] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATETIME.JPG", pszSpec="*.7z") returned 0 [0090.724] lstrlenA (lpString="*.7z") returned 4 [0090.724] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATETIME.JPG", pszSpec="*.tar") returned 0 [0090.724] lstrlenA (lpString="*.tar") returned 5 [0090.724] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATETIME.JPG", pszSpec="*.gzip") returned 0 [0090.724] lstrlenA (lpString="*.gzip") returned 6 [0090.724] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATETIME.JPG", pszSpec="*.jpg") returned 1 [0090.724] lstrlenA (lpString="*.jpg") returned 5 [0090.724] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATETIME.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATETIME.JPG") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATETIME.JPG" [0090.724] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATETIME.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATETIME.JPG") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATETIME.JPG" [0090.724] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATETIME.JPG", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATETIME.JPG.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATETIME.JPG." [0090.724] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATETIME.JPG.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATETIME.JPG. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATETIME.JPG. " [0090.724] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATETIME.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\datetime.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9c [0090.724] GetFileSize (in: hFile=0x9c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4139 [0090.724] GetFileTime (in: hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8608ee00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x606ee510, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8608ee00, dwHighDateTime=0x1c747ea)) returned 1 [0090.724] SetFilePointer (in: hFile=0x9c, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0090.724] ReadFile (in: hFile=0x9c, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x40df, lpOverlapped=0x0) returned 1 [0090.783] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATETIME.JPG") returned="DATETIME.JPG" [0090.783] SetFilePointer (in: hFile=0x9c, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0090.783] WriteFile (in: hFile=0x9c, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x40df, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x40df, lpOverlapped=0x0) returned 1 [0090.783] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0090.783] CloseHandle (hObject=0x9c) returned 1 [0090.784] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATETIME.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\datetime.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATETIME.JPG. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\datetime.jpg. ")) returned 1 [0090.785] FindNextFileA (in: hFindFile=0x5b7d70, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0090.785] PeekMessageA (in: lpMsg=0xaece4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaece4) returned 0 [0090.785] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="DigitalInk.jpg") returned 1 [0090.785] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DigitalInk.jpg") returned 1 [0090.785] lstrcmpiA (lpString1="", lpString2="DigitalInk.jpg") returned -1 [0090.785] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATETIME.JPG") returned="DATETIME.JPG" [0090.785] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\", lpString2="DigitalInk.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DigitalInk.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DigitalInk.jpg" [0090.785] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DigitalInk.jpg", pszSpec="*.zip") returned 0 [0090.785] lstrlenA (lpString="*.zip") returned 5 [0090.785] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DigitalInk.jpg", pszSpec="*.rar") returned 0 [0090.785] lstrlenA (lpString="*.rar") returned 5 [0090.785] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DigitalInk.jpg", pszSpec="*.7z") returned 0 [0090.785] lstrlenA (lpString="*.7z") returned 4 [0090.785] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DigitalInk.jpg", pszSpec="*.tar") returned 0 [0090.785] lstrlenA (lpString="*.tar") returned 5 [0090.785] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DigitalInk.jpg", pszSpec="*.gzip") returned 0 [0090.785] lstrlenA (lpString="*.gzip") returned 6 [0090.786] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DigitalInk.jpg", pszSpec="*.jpg") returned 1 [0090.786] lstrlenA (lpString="*.jpg") returned 5 [0090.786] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DigitalInk.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DigitalInk.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DigitalInk.jpg" [0090.786] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DigitalInk.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DigitalInk.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DigitalInk.jpg" [0090.786] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DigitalInk.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DigitalInk.jpg.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DigitalInk.jpg." [0090.786] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DigitalInk.jpg.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DigitalInk.jpg. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DigitalInk.jpg. " [0090.786] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DigitalInk.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\digitalink.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9c [0090.786] GetFileSize (in: hFile=0x9c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3e01 [0090.786] GetFileTime (in: hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8608ee00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x607d2d50, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8608ee00, dwHighDateTime=0x1c747ea)) returned 1 [0090.786] SetFilePointer (in: hFile=0x9c, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0090.786] ReadFile (in: hFile=0x9c, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x3da7, lpOverlapped=0x0) returned 1 [0090.807] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DigitalInk.jpg") returned="DigitalInk.jpg" [0090.807] SetFilePointer (in: hFile=0x9c, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0090.807] WriteFile (in: hFile=0x9c, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x3da7, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x3da7, lpOverlapped=0x0) returned 1 [0090.808] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0090.808] CloseHandle (hObject=0x9c) returned 1 [0090.809] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DigitalInk.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\digitalink.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DigitalInk.jpg. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\digitalink.jpg. ")) returned 1 [0090.810] FindNextFileA (in: hFindFile=0x5b7d70, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0090.810] PeekMessageA (in: lpMsg=0xaece4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaece4) returned 0 [0090.810] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="EmbeddedView.jpg") returned -1 [0090.810] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="EmbeddedView.jpg") returned 1 [0090.810] lstrcmpiA (lpString1="", lpString2="EmbeddedView.jpg") returned -1 [0090.810] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DigitalInk.jpg") returned="DigitalInk.jpg" [0090.810] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\", lpString2="EmbeddedView.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\EmbeddedView.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\EmbeddedView.jpg" [0090.810] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\EmbeddedView.jpg", pszSpec="*.zip") returned 0 [0090.810] lstrlenA (lpString="*.zip") returned 5 [0090.810] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\EmbeddedView.jpg", pszSpec="*.rar") returned 0 [0090.810] lstrlenA (lpString="*.rar") returned 5 [0090.810] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\EmbeddedView.jpg", pszSpec="*.7z") returned 0 [0090.810] lstrlenA (lpString="*.7z") returned 4 [0090.810] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\EmbeddedView.jpg", pszSpec="*.tar") returned 0 [0090.810] lstrlenA (lpString="*.tar") returned 5 [0090.810] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\EmbeddedView.jpg", pszSpec="*.gzip") returned 0 [0090.810] lstrlenA (lpString="*.gzip") returned 6 [0090.810] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\EmbeddedView.jpg", pszSpec="*.jpg") returned 1 [0090.810] lstrlenA (lpString="*.jpg") returned 5 [0090.810] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\EmbeddedView.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\EmbeddedView.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\EmbeddedView.jpg" [0090.810] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\EmbeddedView.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\EmbeddedView.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\EmbeddedView.jpg" [0090.810] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\EmbeddedView.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\EmbeddedView.jpg.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\EmbeddedView.jpg." [0090.810] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\EmbeddedView.jpg.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\EmbeddedView.jpg. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\EmbeddedView.jpg. " [0090.810] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\EmbeddedView.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\embeddedview.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9c [0090.811] GetFileSize (in: hFile=0x9c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x20e8 [0090.811] GetFileTime (in: hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8608ee00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x51f96af0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8608ee00, dwHighDateTime=0x1c747ea)) returned 1 [0090.811] SetFilePointer (in: hFile=0x9c, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0090.811] ReadFile (in: hFile=0x9c, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x208e, lpOverlapped=0x0) returned 1 [0090.826] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\EmbeddedView.jpg") returned="EmbeddedView.jpg" [0090.826] SetFilePointer (in: hFile=0x9c, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0090.827] WriteFile (in: hFile=0x9c, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x208e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x208e, lpOverlapped=0x0) returned 1 [0090.827] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0090.827] CloseHandle (hObject=0x9c) returned 1 [0090.828] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\EmbeddedView.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\embeddedview.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\EmbeddedView.jpg. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\embeddedview.jpg. ")) returned 1 [0090.829] FindNextFileA (in: hFindFile=0x5b7d70, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0090.829] PeekMessageA (in: lpMsg=0xaece4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaece4) returned 0 [0090.829] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="HEADING.JPG") returned -1 [0090.829] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="HEADING.JPG") returned 1 [0090.829] lstrcmpiA (lpString1="", lpString2="HEADING.JPG") returned -1 [0090.829] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\EmbeddedView.jpg") returned="EmbeddedView.jpg" [0090.829] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\", lpString2="HEADING.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HEADING.JPG") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HEADING.JPG" [0090.829] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HEADING.JPG", pszSpec="*.zip") returned 0 [0090.829] lstrlenA (lpString="*.zip") returned 5 [0090.829] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HEADING.JPG", pszSpec="*.rar") returned 0 [0090.829] lstrlenA (lpString="*.rar") returned 5 [0090.829] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HEADING.JPG", pszSpec="*.7z") returned 0 [0090.829] lstrlenA (lpString="*.7z") returned 4 [0090.829] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HEADING.JPG", pszSpec="*.tar") returned 0 [0090.829] lstrlenA (lpString="*.tar") returned 5 [0090.829] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HEADING.JPG", pszSpec="*.gzip") returned 0 [0090.829] lstrlenA (lpString="*.gzip") returned 6 [0090.829] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HEADING.JPG", pszSpec="*.jpg") returned 1 [0090.830] lstrlenA (lpString="*.jpg") returned 5 [0090.830] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HEADING.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HEADING.JPG") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HEADING.JPG" [0090.830] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HEADING.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HEADING.JPG") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HEADING.JPG" [0090.830] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HEADING.JPG", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HEADING.JPG.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HEADING.JPG." [0090.830] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HEADING.JPG.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HEADING.JPG. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HEADING.JPG. " [0090.830] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HEADING.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\heading.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9c [0090.878] GetFileSize (in: hFile=0x9c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3e72 [0090.878] GetFileTime (in: hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x873a1b00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5386f090, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x873a1b00, dwHighDateTime=0x1c747ea)) returned 1 [0090.878] SetFilePointer (in: hFile=0x9c, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0090.878] ReadFile (in: hFile=0x9c, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x3e18, lpOverlapped=0x0) returned 1 [0090.888] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HEADING.JPG") returned="HEADING.JPG" [0090.888] SetFilePointer (in: hFile=0x9c, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0090.888] WriteFile (in: hFile=0x9c, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x3e18, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x3e18, lpOverlapped=0x0) returned 1 [0090.888] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0090.888] CloseHandle (hObject=0x9c) returned 1 [0090.889] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HEADING.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\heading.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HEADING.JPG. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\heading.jpg. ")) returned 1 [0090.890] FindNextFileA (in: hFindFile=0x5b7d70, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0090.890] PeekMessageA (in: lpMsg=0xaece4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaece4) returned 0 [0090.890] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="IMAGE.JPG") returned -1 [0090.890] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="IMAGE.JPG") returned -1 [0090.890] lstrcmpiA (lpString1="", lpString2="IMAGE.JPG") returned -1 [0090.890] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HEADING.JPG") returned="HEADING.JPG" [0090.890] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\", lpString2="IMAGE.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\IMAGE.JPG") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\IMAGE.JPG" [0090.890] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\IMAGE.JPG", pszSpec="*.zip") returned 0 [0090.890] lstrlenA (lpString="*.zip") returned 5 [0090.890] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\IMAGE.JPG", pszSpec="*.rar") returned 0 [0090.890] lstrlenA (lpString="*.rar") returned 5 [0090.890] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\IMAGE.JPG", pszSpec="*.7z") returned 0 [0090.890] lstrlenA (lpString="*.7z") returned 4 [0090.890] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\IMAGE.JPG", pszSpec="*.tar") returned 0 [0090.890] lstrlenA (lpString="*.tar") returned 5 [0090.890] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\IMAGE.JPG", pszSpec="*.gzip") returned 0 [0090.890] lstrlenA (lpString="*.gzip") returned 6 [0090.890] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\IMAGE.JPG", pszSpec="*.jpg") returned 1 [0090.890] lstrlenA (lpString="*.jpg") returned 5 [0090.890] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\IMAGE.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\IMAGE.JPG") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\IMAGE.JPG" [0090.890] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\IMAGE.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\IMAGE.JPG") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\IMAGE.JPG" [0090.890] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\IMAGE.JPG", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\IMAGE.JPG.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\IMAGE.JPG." [0090.890] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\IMAGE.JPG.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\IMAGE.JPG. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\IMAGE.JPG. " [0090.890] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\IMAGE.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\image.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9c [0090.920] GetFileSize (in: hFile=0x9c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x139a [0090.920] GetFileTime (in: hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x873a1b00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5392d770, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x873a1b00, dwHighDateTime=0x1c747ea)) returned 1 [0090.920] SetFilePointer (in: hFile=0x9c, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0090.920] ReadFile (in: hFile=0x9c, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x1340, lpOverlapped=0x0) returned 1 [0090.931] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\IMAGE.JPG") returned="IMAGE.JPG" [0090.931] SetFilePointer (in: hFile=0x9c, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0090.931] WriteFile (in: hFile=0x9c, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x1340, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x1340, lpOverlapped=0x0) returned 1 [0090.931] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0090.931] CloseHandle (hObject=0x9c) returned 1 [0090.932] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\IMAGE.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\image.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\IMAGE.JPG. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\image.jpg. ")) returned 1 [0090.933] FindNextFileA (in: hFindFile=0x5b7d70, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0090.933] PeekMessageA (in: lpMsg=0xaece4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaece4) returned 0 [0090.933] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="LINE.JPG") returned -1 [0090.933] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="LINE.JPG") returned -1 [0090.933] lstrcmpiA (lpString1="", lpString2="LINE.JPG") returned -1 [0090.934] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\IMAGE.JPG") returned="IMAGE.JPG" [0090.934] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\", lpString2="LINE.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LINE.JPG") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LINE.JPG" [0090.934] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LINE.JPG", pszSpec="*.zip") returned 0 [0090.934] lstrlenA (lpString="*.zip") returned 5 [0090.934] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LINE.JPG", pszSpec="*.rar") returned 0 [0090.934] lstrlenA (lpString="*.rar") returned 5 [0090.934] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LINE.JPG", pszSpec="*.7z") returned 0 [0090.934] lstrlenA (lpString="*.7z") returned 4 [0090.934] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LINE.JPG", pszSpec="*.tar") returned 0 [0090.934] lstrlenA (lpString="*.tar") returned 5 [0090.934] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LINE.JPG", pszSpec="*.gzip") returned 0 [0090.934] lstrlenA (lpString="*.gzip") returned 6 [0090.934] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LINE.JPG", pszSpec="*.jpg") returned 1 [0090.934] lstrlenA (lpString="*.jpg") returned 5 [0090.934] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LINE.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LINE.JPG") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LINE.JPG" [0090.934] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LINE.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LINE.JPG") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LINE.JPG" [0090.934] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LINE.JPG", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LINE.JPG.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LINE.JPG." [0090.934] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LINE.JPG.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LINE.JPG. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LINE.JPG. " [0090.934] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LINE.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\line.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9c [0090.938] GetFileSize (in: hFile=0x9c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xe65 [0090.938] GetFileTime (in: hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x873a1b00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x568309f0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x873a1b00, dwHighDateTime=0x1c747ea)) returned 1 [0090.938] SetFilePointer (in: hFile=0x9c, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0090.938] ReadFile (in: hFile=0x9c, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0xe0b, lpOverlapped=0x0) returned 1 [0090.978] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LINE.JPG") returned="LINE.JPG" [0090.978] SetFilePointer (in: hFile=0x9c, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0090.978] WriteFile (in: hFile=0x9c, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0xe0b, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0xe0b, lpOverlapped=0x0) returned 1 [0090.978] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0090.978] CloseHandle (hObject=0x9c) returned 1 [0090.979] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LINE.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\line.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LINE.JPG. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\line.jpg. ")) returned 1 [0090.980] FindNextFileA (in: hFindFile=0x5b7d70, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0090.980] PeekMessageA (in: lpMsg=0xaece4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaece4) returned 0 [0090.980] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="LISTBOX.JPG") returned -1 [0090.980] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="LISTBOX.JPG") returned -1 [0090.980] lstrcmpiA (lpString1="", lpString2="LISTBOX.JPG") returned -1 [0090.980] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LINE.JPG") returned="LINE.JPG" [0090.980] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\", lpString2="LISTBOX.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LISTBOX.JPG") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LISTBOX.JPG" [0090.980] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LISTBOX.JPG", pszSpec="*.zip") returned 0 [0090.980] lstrlenA (lpString="*.zip") returned 5 [0090.981] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LISTBOX.JPG", pszSpec="*.rar") returned 0 [0090.981] lstrlenA (lpString="*.rar") returned 5 [0090.981] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LISTBOX.JPG", pszSpec="*.7z") returned 0 [0090.981] lstrlenA (lpString="*.7z") returned 4 [0090.981] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LISTBOX.JPG", pszSpec="*.tar") returned 0 [0090.981] lstrlenA (lpString="*.tar") returned 5 [0090.981] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LISTBOX.JPG", pszSpec="*.gzip") returned 0 [0090.981] lstrlenA (lpString="*.gzip") returned 6 [0090.981] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LISTBOX.JPG", pszSpec="*.jpg") returned 1 [0090.981] lstrlenA (lpString="*.jpg") returned 5 [0090.981] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LISTBOX.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LISTBOX.JPG") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LISTBOX.JPG" [0090.981] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LISTBOX.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LISTBOX.JPG") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LISTBOX.JPG" [0090.981] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LISTBOX.JPG", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LISTBOX.JPG.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LISTBOX.JPG." [0090.981] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LISTBOX.JPG.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LISTBOX.JPG. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LISTBOX.JPG. " [0090.981] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LISTBOX.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\listbox.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9c [0090.982] GetFileSize (in: hFile=0x9c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3b3f [0090.982] GetFileTime (in: hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x873a1b00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x66293410, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x873a1b00, dwHighDateTime=0x1c747ea)) returned 1 [0090.982] SetFilePointer (in: hFile=0x9c, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0090.982] ReadFile (in: hFile=0x9c, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x3ae5, lpOverlapped=0x0) returned 1 [0090.994] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LISTBOX.JPG") returned="LISTBOX.JPG" [0090.995] SetFilePointer (in: hFile=0x9c, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0090.995] WriteFile (in: hFile=0x9c, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x3ae5, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x3ae5, lpOverlapped=0x0) returned 1 [0090.995] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0090.995] CloseHandle (hObject=0x9c) returned 1 [0090.996] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LISTBOX.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\listbox.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LISTBOX.JPG. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\listbox.jpg. ")) returned 1 [0090.997] FindNextFileA (in: hFindFile=0x5b7d70, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0090.997] PeekMessageA (in: lpMsg=0xaece4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaece4) returned 0 [0090.997] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="NUMERIC.JPG") returned -1 [0090.997] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="NUMERIC.JPG") returned -1 [0090.997] lstrcmpiA (lpString1="", lpString2="NUMERIC.JPG") returned -1 [0090.997] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LISTBOX.JPG") returned="LISTBOX.JPG" [0090.997] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\", lpString2="NUMERIC.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\NUMERIC.JPG") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\NUMERIC.JPG" [0090.997] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\NUMERIC.JPG", pszSpec="*.zip") returned 0 [0090.997] lstrlenA (lpString="*.zip") returned 5 [0090.997] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\NUMERIC.JPG", pszSpec="*.rar") returned 0 [0090.997] lstrlenA (lpString="*.rar") returned 5 [0090.997] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\NUMERIC.JPG", pszSpec="*.7z") returned 0 [0090.997] lstrlenA (lpString="*.7z") returned 4 [0090.997] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\NUMERIC.JPG", pszSpec="*.tar") returned 0 [0090.997] lstrlenA (lpString="*.tar") returned 5 [0090.997] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\NUMERIC.JPG", pszSpec="*.gzip") returned 0 [0090.997] lstrlenA (lpString="*.gzip") returned 6 [0090.997] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\NUMERIC.JPG", pszSpec="*.jpg") returned 1 [0090.997] lstrlenA (lpString="*.jpg") returned 5 [0090.997] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\NUMERIC.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\NUMERIC.JPG") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\NUMERIC.JPG" [0090.997] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\NUMERIC.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\NUMERIC.JPG") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\NUMERIC.JPG" [0090.997] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\NUMERIC.JPG", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\NUMERIC.JPG.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\NUMERIC.JPG." [0090.997] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\NUMERIC.JPG.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\NUMERIC.JPG. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\NUMERIC.JPG. " [0090.997] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\NUMERIC.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\numeric.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9c [0090.998] GetFileSize (in: hFile=0x9c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x443a [0090.998] GetFileTime (in: hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x873a1b00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x6a87fa50, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x873a1b00, dwHighDateTime=0x1c747ea)) returned 1 [0090.998] SetFilePointer (in: hFile=0x9c, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0090.998] ReadFile (in: hFile=0x9c, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x43e0, lpOverlapped=0x0) returned 1 [0091.005] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\NUMERIC.JPG") returned="NUMERIC.JPG" [0091.005] SetFilePointer (in: hFile=0x9c, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0091.005] WriteFile (in: hFile=0x9c, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x43e0, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x43e0, lpOverlapped=0x0) returned 1 [0091.006] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0091.006] CloseHandle (hObject=0x9c) returned 1 [0091.007] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\NUMERIC.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\numeric.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\NUMERIC.JPG. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\numeric.jpg. ")) returned 1 [0091.008] FindNextFileA (in: hFindFile=0x5b7d70, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0091.008] PeekMessageA (in: lpMsg=0xaece4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaece4) returned 0 [0091.008] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="PASSWORD.JPG") returned -1 [0091.008] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PASSWORD.JPG") returned -1 [0091.008] lstrcmpiA (lpString1="", lpString2="PASSWORD.JPG") returned -1 [0091.008] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\NUMERIC.JPG") returned="NUMERIC.JPG" [0091.008] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\", lpString2="PASSWORD.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\PASSWORD.JPG") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\PASSWORD.JPG" [0091.008] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\PASSWORD.JPG", pszSpec="*.zip") returned 0 [0091.008] lstrlenA (lpString="*.zip") returned 5 [0091.008] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\PASSWORD.JPG", pszSpec="*.rar") returned 0 [0091.008] lstrlenA (lpString="*.rar") returned 5 [0091.008] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\PASSWORD.JPG", pszSpec="*.7z") returned 0 [0091.008] lstrlenA (lpString="*.7z") returned 4 [0091.008] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\PASSWORD.JPG", pszSpec="*.tar") returned 0 [0091.008] lstrlenA (lpString="*.tar") returned 5 [0091.008] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\PASSWORD.JPG", pszSpec="*.gzip") returned 0 [0091.009] lstrlenA (lpString="*.gzip") returned 6 [0091.009] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\PASSWORD.JPG", pszSpec="*.jpg") returned 1 [0091.009] lstrlenA (lpString="*.jpg") returned 5 [0091.009] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\PASSWORD.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\PASSWORD.JPG") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\PASSWORD.JPG" [0091.009] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\PASSWORD.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\PASSWORD.JPG") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\PASSWORD.JPG" [0091.009] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\PASSWORD.JPG", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\PASSWORD.JPG.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\PASSWORD.JPG." [0091.009] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\PASSWORD.JPG.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\PASSWORD.JPG. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\PASSWORD.JPG. " [0091.009] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\PASSWORD.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\password.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9c [0091.010] GetFileSize (in: hFile=0x9c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x12f5 [0091.010] GetFileTime (in: hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x873a1b00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x6cd8b0b0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x873a1b00, dwHighDateTime=0x1c747ea)) returned 1 [0091.010] SetFilePointer (in: hFile=0x9c, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0091.010] ReadFile (in: hFile=0x9c, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x129b, lpOverlapped=0x0) returned 1 [0091.026] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\PASSWORD.JPG") returned="PASSWORD.JPG" [0091.026] SetFilePointer (in: hFile=0x9c, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0091.026] WriteFile (in: hFile=0x9c, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x129b, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x129b, lpOverlapped=0x0) returned 1 [0091.026] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0091.027] CloseHandle (hObject=0x9c) returned 1 [0091.028] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\PASSWORD.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\password.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\PASSWORD.JPG. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\password.jpg. ")) returned 1 [0091.030] FindNextFileA (in: hFindFile=0x5b7d70, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0091.030] PeekMessageA (in: lpMsg=0xaece4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaece4) returned 0 [0091.030] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="RADIO.JPG") returned -1 [0091.030] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="RADIO.JPG") returned -1 [0091.030] lstrcmpiA (lpString1="", lpString2="RADIO.JPG") returned -1 [0091.030] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\PASSWORD.JPG") returned="PASSWORD.JPG" [0091.031] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\", lpString2="RADIO.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\RADIO.JPG") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\RADIO.JPG" [0091.031] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\RADIO.JPG", pszSpec="*.zip") returned 0 [0091.031] lstrlenA (lpString="*.zip") returned 5 [0091.031] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\RADIO.JPG", pszSpec="*.rar") returned 0 [0091.031] lstrlenA (lpString="*.rar") returned 5 [0091.031] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\RADIO.JPG", pszSpec="*.7z") returned 0 [0091.031] lstrlenA (lpString="*.7z") returned 4 [0091.031] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\RADIO.JPG", pszSpec="*.tar") returned 0 [0091.031] lstrlenA (lpString="*.tar") returned 5 [0091.031] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\RADIO.JPG", pszSpec="*.gzip") returned 0 [0091.031] lstrlenA (lpString="*.gzip") returned 6 [0091.031] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\RADIO.JPG", pszSpec="*.jpg") returned 1 [0091.031] lstrlenA (lpString="*.jpg") returned 5 [0091.031] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\RADIO.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\RADIO.JPG") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\RADIO.JPG" [0091.031] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\RADIO.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\RADIO.JPG") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\RADIO.JPG" [0091.031] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\RADIO.JPG", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\RADIO.JPG.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\RADIO.JPG." [0091.031] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\RADIO.JPG.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\RADIO.JPG. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\RADIO.JPG. " [0091.031] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\RADIO.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\radio.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9c [0091.050] GetFileSize (in: hFile=0x9c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x43c8 [0091.050] GetFileTime (in: hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x873a1b00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5a829930, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x873a1b00, dwHighDateTime=0x1c747ea)) returned 1 [0091.050] SetFilePointer (in: hFile=0x9c, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0091.050] ReadFile (in: hFile=0x9c, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x436e, lpOverlapped=0x0) returned 1 [0091.066] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\RADIO.JPG") returned="RADIO.JPG" [0091.066] SetFilePointer (in: hFile=0x9c, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0091.066] WriteFile (in: hFile=0x9c, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x436e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x436e, lpOverlapped=0x0) returned 1 [0091.067] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0091.067] CloseHandle (hObject=0x9c) returned 1 [0091.068] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\RADIO.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\radio.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\RADIO.JPG. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\radio.jpg. ")) returned 1 [0091.069] FindNextFileA (in: hFindFile=0x5b7d70, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0091.069] PeekMessageA (in: lpMsg=0xaece4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaece4) returned 0 [0091.069] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="SectionHeading.jpg") returned -1 [0091.069] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SectionHeading.jpg") returned -1 [0091.069] lstrcmpiA (lpString1="", lpString2="SectionHeading.jpg") returned -1 [0091.069] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\RADIO.JPG") returned="RADIO.JPG" [0091.069] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\", lpString2="SectionHeading.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\SectionHeading.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\SectionHeading.jpg" [0091.069] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\SectionHeading.jpg", pszSpec="*.zip") returned 0 [0091.069] lstrlenA (lpString="*.zip") returned 5 [0091.069] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\SectionHeading.jpg", pszSpec="*.rar") returned 0 [0091.069] lstrlenA (lpString="*.rar") returned 5 [0091.069] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\SectionHeading.jpg", pszSpec="*.7z") returned 0 [0091.069] lstrlenA (lpString="*.7z") returned 4 [0091.069] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\SectionHeading.jpg", pszSpec="*.tar") returned 0 [0091.069] lstrlenA (lpString="*.tar") returned 5 [0091.069] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\SectionHeading.jpg", pszSpec="*.gzip") returned 0 [0091.069] lstrlenA (lpString="*.gzip") returned 6 [0091.069] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\SectionHeading.jpg", pszSpec="*.jpg") returned 1 [0091.069] lstrlenA (lpString="*.jpg") returned 5 [0091.069] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\SectionHeading.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\SectionHeading.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\SectionHeading.jpg" [0091.069] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\SectionHeading.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\SectionHeading.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\SectionHeading.jpg" [0091.069] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\SectionHeading.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\SectionHeading.jpg.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\SectionHeading.jpg." [0091.069] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\SectionHeading.jpg.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\SectionHeading.jpg. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\SectionHeading.jpg. " [0091.069] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\SectionHeading.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\sectionheading.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9c [0091.071] GetFileSize (in: hFile=0x9c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3ad9 [0091.071] GetFileTime (in: hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x873a1b00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5a9342d0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x873a1b00, dwHighDateTime=0x1c747ea)) returned 1 [0091.071] SetFilePointer (in: hFile=0x9c, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0091.071] ReadFile (in: hFile=0x9c, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x3a7f, lpOverlapped=0x0) returned 1 [0091.087] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\SectionHeading.jpg") returned="SectionHeading.jpg" [0091.087] SetFilePointer (in: hFile=0x9c, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0091.087] WriteFile (in: hFile=0x9c, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x3a7f, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x3a7f, lpOverlapped=0x0) returned 1 [0091.087] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0091.087] CloseHandle (hObject=0x9c) returned 1 [0091.088] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\SectionHeading.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\sectionheading.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\SectionHeading.jpg. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\sectionheading.jpg. ")) returned 1 [0091.089] FindNextFileA (in: hFindFile=0x5b7d70, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0091.089] PeekMessageA (in: lpMsg=0xaece4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaece4) returned 0 [0091.089] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="StaticText.jpg") returned -1 [0091.089] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="StaticText.jpg") returned -1 [0091.089] lstrcmpiA (lpString1="", lpString2="StaticText.jpg") returned -1 [0091.089] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\SectionHeading.jpg") returned="SectionHeading.jpg" [0091.089] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\", lpString2="StaticText.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\StaticText.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\StaticText.jpg" [0091.089] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\StaticText.jpg", pszSpec="*.zip") returned 0 [0091.089] lstrlenA (lpString="*.zip") returned 5 [0091.090] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\StaticText.jpg", pszSpec="*.rar") returned 0 [0091.090] lstrlenA (lpString="*.rar") returned 5 [0091.090] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\StaticText.jpg", pszSpec="*.7z") returned 0 [0091.090] lstrlenA (lpString="*.7z") returned 4 [0091.090] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\StaticText.jpg", pszSpec="*.tar") returned 0 [0091.090] lstrlenA (lpString="*.tar") returned 5 [0091.090] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\StaticText.jpg", pszSpec="*.gzip") returned 0 [0091.090] lstrlenA (lpString="*.gzip") returned 6 [0091.090] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\StaticText.jpg", pszSpec="*.jpg") returned 1 [0091.090] lstrlenA (lpString="*.jpg") returned 5 [0091.090] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\StaticText.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\StaticText.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\StaticText.jpg" [0091.090] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\StaticText.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\StaticText.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\StaticText.jpg" [0091.090] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\StaticText.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\StaticText.jpg.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\StaticText.jpg." [0091.090] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\StaticText.jpg.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\StaticText.jpg. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\StaticText.jpg. " [0091.090] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\StaticText.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\statictext.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9c [0091.102] GetFileSize (in: hFile=0x9c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x37a7 [0091.102] GetFileTime (in: hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x873a1b00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5abe1b90, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x873a1b00, dwHighDateTime=0x1c747ea)) returned 1 [0091.102] SetFilePointer (in: hFile=0x9c, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0091.102] ReadFile (in: hFile=0x9c, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x374d, lpOverlapped=0x0) returned 1 [0091.158] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\StaticText.jpg") returned="StaticText.jpg" [0091.158] SetFilePointer (in: hFile=0x9c, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0091.158] WriteFile (in: hFile=0x9c, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x374d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x374d, lpOverlapped=0x0) returned 1 [0091.158] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0091.159] CloseHandle (hObject=0x9c) returned 1 [0091.159] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\StaticText.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\statictext.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\StaticText.jpg. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\statictext.jpg. ")) returned 1 [0091.160] FindNextFileA (in: hFindFile=0x5b7d70, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0091.160] PeekMessageA (in: lpMsg=0xaece4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaece4) returned 0 [0091.160] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="TEXTAREA.JPG") returned -1 [0091.160] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TEXTAREA.JPG") returned -1 [0091.160] lstrcmpiA (lpString1="", lpString2="TEXTAREA.JPG") returned -1 [0091.160] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\StaticText.jpg") returned="StaticText.jpg" [0091.160] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\", lpString2="TEXTAREA.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTAREA.JPG") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTAREA.JPG" [0091.160] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTAREA.JPG", pszSpec="*.zip") returned 0 [0091.160] lstrlenA (lpString="*.zip") returned 5 [0091.160] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTAREA.JPG", pszSpec="*.rar") returned 0 [0091.161] lstrlenA (lpString="*.rar") returned 5 [0091.161] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTAREA.JPG", pszSpec="*.7z") returned 0 [0091.161] lstrlenA (lpString="*.7z") returned 4 [0091.161] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTAREA.JPG", pszSpec="*.tar") returned 0 [0091.161] lstrlenA (lpString="*.tar") returned 5 [0091.161] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTAREA.JPG", pszSpec="*.gzip") returned 0 [0091.161] lstrlenA (lpString="*.gzip") returned 6 [0091.161] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTAREA.JPG", pszSpec="*.jpg") returned 1 [0091.161] lstrlenA (lpString="*.jpg") returned 5 [0091.161] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTAREA.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTAREA.JPG") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTAREA.JPG" [0091.161] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTAREA.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTAREA.JPG") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTAREA.JPG" [0091.161] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTAREA.JPG", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTAREA.JPG.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTAREA.JPG." [0091.161] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTAREA.JPG.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTAREA.JPG. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTAREA.JPG. " [0091.161] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTAREA.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\textarea.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9c [0091.161] GetFileSize (in: hFile=0x9c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3983 [0091.161] GetFileTime (in: hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x873a1b00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x6d462ff0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x873a1b00, dwHighDateTime=0x1c747ea)) returned 1 [0091.161] SetFilePointer (in: hFile=0x9c, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0091.161] ReadFile (in: hFile=0x9c, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x3929, lpOverlapped=0x0) returned 1 [0091.162] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTAREA.JPG") returned="TEXTAREA.JPG" [0091.162] SetFilePointer (in: hFile=0x9c, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0091.162] WriteFile (in: hFile=0x9c, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x3929, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x3929, lpOverlapped=0x0) returned 1 [0091.163] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0091.163] CloseHandle (hObject=0x9c) returned 1 [0091.163] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTAREA.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\textarea.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTAREA.JPG. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\textarea.jpg. ")) returned 1 [0091.164] FindNextFileA (in: hFindFile=0x5b7d70, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0091.165] PeekMessageA (in: lpMsg=0xaece4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaece4) returned 0 [0091.165] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="TEXTBOX.JPG") returned -1 [0091.165] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TEXTBOX.JPG") returned -1 [0091.165] lstrcmpiA (lpString1="", lpString2="TEXTBOX.JPG") returned -1 [0091.165] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTAREA.JPG") returned="TEXTAREA.JPG" [0091.165] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\", lpString2="TEXTBOX.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTBOX.JPG") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTBOX.JPG" [0091.165] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTBOX.JPG", pszSpec="*.zip") returned 0 [0091.165] lstrlenA (lpString="*.zip") returned 5 [0091.165] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTBOX.JPG", pszSpec="*.rar") returned 0 [0091.165] lstrlenA (lpString="*.rar") returned 5 [0091.165] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTBOX.JPG", pszSpec="*.7z") returned 0 [0091.165] lstrlenA (lpString="*.7z") returned 4 [0091.165] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTBOX.JPG", pszSpec="*.tar") returned 0 [0091.165] lstrlenA (lpString="*.tar") returned 5 [0091.165] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTBOX.JPG", pszSpec="*.gzip") returned 0 [0091.165] lstrlenA (lpString="*.gzip") returned 6 [0091.165] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTBOX.JPG", pszSpec="*.jpg") returned 1 [0091.165] lstrlenA (lpString="*.jpg") returned 5 [0091.165] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTBOX.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTBOX.JPG") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTBOX.JPG" [0091.165] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTBOX.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTBOX.JPG") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTBOX.JPG" [0091.165] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTBOX.JPG", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTBOX.JPG.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTBOX.JPG." [0091.165] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTBOX.JPG.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTBOX.JPG. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTBOX.JPG. " [0091.165] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTBOX.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\textbox.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9c [0091.165] GetFileSize (in: hFile=0x9c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3a97 [0091.165] GetFileTime (in: hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x873a1b00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5ad12690, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x873a1b00, dwHighDateTime=0x1c747ea)) returned 1 [0091.165] SetFilePointer (in: hFile=0x9c, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0091.165] ReadFile (in: hFile=0x9c, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x3a3d, lpOverlapped=0x0) returned 1 [0091.212] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTBOX.JPG") returned="TEXTBOX.JPG" [0091.212] SetFilePointer (in: hFile=0x9c, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0091.212] WriteFile (in: hFile=0x9c, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x3a3d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x3a3d, lpOverlapped=0x0) returned 1 [0091.212] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0091.212] CloseHandle (hObject=0x9c) returned 1 [0091.213] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTBOX.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\textbox.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTBOX.JPG. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\textbox.jpg. ")) returned 1 [0091.214] FindNextFileA (in: hFindFile=0x5b7d70, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0091.214] PeekMessageA (in: lpMsg=0xaece4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaece4) returned 0 [0091.215] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="TEXTVIEW.JPG") returned -1 [0091.215] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TEXTVIEW.JPG") returned -1 [0091.215] lstrcmpiA (lpString1="", lpString2="TEXTVIEW.JPG") returned -1 [0091.215] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTBOX.JPG") returned="TEXTBOX.JPG" [0091.215] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\", lpString2="TEXTVIEW.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTVIEW.JPG") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTVIEW.JPG" [0091.215] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTVIEW.JPG", pszSpec="*.zip") returned 0 [0091.215] lstrlenA (lpString="*.zip") returned 5 [0091.215] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTVIEW.JPG", pszSpec="*.rar") returned 0 [0091.215] lstrlenA (lpString="*.rar") returned 5 [0091.215] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTVIEW.JPG", pszSpec="*.7z") returned 0 [0091.215] lstrlenA (lpString="*.7z") returned 4 [0091.215] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTVIEW.JPG", pszSpec="*.tar") returned 0 [0091.215] lstrlenA (lpString="*.tar") returned 5 [0091.215] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTVIEW.JPG", pszSpec="*.gzip") returned 0 [0091.215] lstrlenA (lpString="*.gzip") returned 6 [0091.215] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTVIEW.JPG", pszSpec="*.jpg") returned 1 [0091.215] lstrlenA (lpString="*.jpg") returned 5 [0091.215] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTVIEW.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTVIEW.JPG") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTVIEW.JPG" [0091.215] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTVIEW.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTVIEW.JPG") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTVIEW.JPG" [0091.215] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTVIEW.JPG", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTVIEW.JPG.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTVIEW.JPG." [0091.215] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTVIEW.JPG.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTVIEW.JPG. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTVIEW.JPG. " [0091.215] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTVIEW.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\textview.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9c [0091.216] GetFileSize (in: hFile=0x9c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x42fa [0091.216] GetFileTime (in: hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x886b4800, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x6d462ff0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x886b4800, dwHighDateTime=0x1c747ea)) returned 1 [0091.216] SetFilePointer (in: hFile=0x9c, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0091.216] ReadFile (in: hFile=0x9c, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x42a0, lpOverlapped=0x0) returned 1 [0091.236] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTVIEW.JPG") returned="TEXTVIEW.JPG" [0091.236] SetFilePointer (in: hFile=0x9c, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0091.236] WriteFile (in: hFile=0x9c, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x42a0, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x42a0, lpOverlapped=0x0) returned 1 [0091.236] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0091.236] CloseHandle (hObject=0x9c) returned 1 [0091.237] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTVIEW.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\textview.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTVIEW.JPG. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\textview.jpg. ")) returned 1 [0091.238] FindNextFileA (in: hFindFile=0x5b7d70, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0091.238] PeekMessageA (in: lpMsg=0xaece4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaece4) returned 0 [0091.238] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="UnformattedNumeric.jpg") returned -1 [0091.238] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="UnformattedNumeric.jpg") returned -1 [0091.239] lstrcmpiA (lpString1="", lpString2="UnformattedNumeric.jpg") returned -1 [0091.239] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTVIEW.JPG") returned="TEXTVIEW.JPG" [0091.239] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\", lpString2="UnformattedNumeric.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\UnformattedNumeric.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\UnformattedNumeric.jpg" [0091.239] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\UnformattedNumeric.jpg", pszSpec="*.zip") returned 0 [0091.239] lstrlenA (lpString="*.zip") returned 5 [0091.239] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\UnformattedNumeric.jpg", pszSpec="*.rar") returned 0 [0091.239] lstrlenA (lpString="*.rar") returned 5 [0091.239] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\UnformattedNumeric.jpg", pszSpec="*.7z") returned 0 [0091.239] lstrlenA (lpString="*.7z") returned 4 [0091.239] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\UnformattedNumeric.jpg", pszSpec="*.tar") returned 0 [0091.239] lstrlenA (lpString="*.tar") returned 5 [0091.239] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\UnformattedNumeric.jpg", pszSpec="*.gzip") returned 0 [0091.239] lstrlenA (lpString="*.gzip") returned 6 [0091.239] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\UnformattedNumeric.jpg", pszSpec="*.jpg") returned 1 [0091.239] lstrlenA (lpString="*.jpg") returned 5 [0091.239] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\UnformattedNumeric.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\UnformattedNumeric.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\UnformattedNumeric.jpg" [0091.239] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\UnformattedNumeric.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\UnformattedNumeric.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\UnformattedNumeric.jpg" [0091.239] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\UnformattedNumeric.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\UnformattedNumeric.jpg.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\UnformattedNumeric.jpg." [0091.239] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\UnformattedNumeric.jpg.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\UnformattedNumeric.jpg. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\UnformattedNumeric.jpg. " [0091.239] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\UnformattedNumeric.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\unformattednumeric.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9c [0091.239] GetFileSize (in: hFile=0x9c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4127 [0091.240] GetFileTime (in: hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x886b4800, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5e3d2090, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x886b4800, dwHighDateTime=0x1c747ea)) returned 1 [0091.240] SetFilePointer (in: hFile=0x9c, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0091.240] ReadFile (in: hFile=0x9c, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x40cd, lpOverlapped=0x0) returned 1 [0091.257] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\UnformattedNumeric.jpg") returned="UnformattedNumeric.jpg" [0091.257] SetFilePointer (in: hFile=0x9c, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0091.257] WriteFile (in: hFile=0x9c, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x40cd, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x40cd, lpOverlapped=0x0) returned 1 [0091.257] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0091.257] CloseHandle (hObject=0x9c) returned 1 [0091.258] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\UnformattedNumeric.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\unformattednumeric.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\UnformattedNumeric.jpg. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\unformattednumeric.jpg. ")) returned 1 [0091.259] FindNextFileA (in: hFindFile=0x5b7d70, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 0 [0091.259] FindClose (in: hFindFile=0x5b7d70 | out: hFindFile=0x5b7d70) returned 1 [0091.260] FindNextFileA (in: hFindFile=0x5b7d30, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0091.260] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0091.260] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="FORM.ICO") returned -1 [0091.260] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FORM.ICO") returned 1 [0091.260] lstrcmpiA (lpString1="", lpString2="FORM.ICO") returned -1 [0091.260] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\*.*") returned="*.*" [0091.260] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="FORM.ICO" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FORM.ICO") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FORM.ICO" [0091.260] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FORM.ICO", pszSpec="*.zip") returned 0 [0091.260] lstrlenA (lpString="*.zip") returned 5 [0091.260] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FORM.ICO", pszSpec="*.rar") returned 0 [0091.260] lstrlenA (lpString="*.rar") returned 5 [0091.260] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FORM.ICO", pszSpec="*.7z") returned 0 [0091.260] lstrlenA (lpString="*.7z") returned 4 [0091.260] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FORM.ICO", pszSpec="*.tar") returned 0 [0091.260] lstrlenA (lpString="*.tar") returned 5 [0091.260] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FORM.ICO", pszSpec="*.gzip") returned 0 [0091.260] lstrlenA (lpString="*.gzip") returned 6 [0091.260] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FORM.ICO", pszSpec="*.jpg") returned 0 [0091.260] lstrlenA (lpString="*.jpg") returned 5 [0091.260] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FORM.ICO", pszSpec="*.jpeg") returned 0 [0091.260] lstrlenA (lpString="*.jpeg") returned 6 [0091.260] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FORM.ICO", pszSpec="*.psd") returned 0 [0091.260] lstrlenA (lpString="*.psd") returned 5 [0091.260] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FORM.ICO", pszSpec="*.cdr") returned 0 [0091.260] lstrlenA (lpString="*.cdr") returned 5 [0091.260] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FORM.ICO", pszSpec="*.dwg") returned 0 [0091.260] lstrlenA (lpString="*.dwg") returned 5 [0091.260] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FORM.ICO", pszSpec="*.max") returned 0 [0091.260] lstrlenA (lpString="*.max") returned 5 [0091.260] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FORM.ICO", pszSpec="*.bmp") returned 0 [0091.260] lstrlenA (lpString="*.bmp") returned 5 [0091.260] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FORM.ICO", pszSpec="*.gif") returned 0 [0091.260] lstrlenA (lpString="*.gif") returned 5 [0091.260] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FORM.ICO", pszSpec="*.png") returned 0 [0091.260] lstrlenA (lpString="*.png") returned 5 [0091.261] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FORM.ICO", pszSpec="*.doc") returned 0 [0091.261] lstrlenA (lpString="*.doc") returned 5 [0091.261] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FORM.ICO", pszSpec="*.docx") returned 0 [0091.261] lstrlenA (lpString="*.docx") returned 6 [0091.261] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FORM.ICO", pszSpec="*.xls") returned 0 [0091.261] lstrlenA (lpString="*.xls") returned 5 [0091.261] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FORM.ICO", pszSpec="*.xlsx") returned 0 [0091.261] lstrlenA (lpString="*.xlsx") returned 6 [0091.261] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FORM.ICO", pszSpec="*.ppt") returned 0 [0091.261] lstrlenA (lpString="*.ppt") returned 5 [0091.261] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FORM.ICO", pszSpec="*.pptx") returned 0 [0091.261] lstrlenA (lpString="*.pptx") returned 6 [0091.261] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FORM.ICO", pszSpec="*.txt") returned 0 [0091.261] lstrlenA (lpString="*.txt") returned 5 [0091.261] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FORM.ICO", pszSpec="*.pdf") returned 0 [0091.261] lstrlenA (lpString="*.pdf") returned 5 [0091.261] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FORM.ICO", pszSpec="*.djvu") returned 0 [0091.261] lstrlenA (lpString="*.djvu") returned 6 [0091.261] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FORM.ICO", pszSpec="*.htm") returned 0 [0091.261] lstrlenA (lpString="*.htm") returned 5 [0091.261] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FORM.ICO", pszSpec="*.html") returned 0 [0091.261] lstrlenA (lpString="*.html") returned 6 [0091.261] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FORM.ICO", pszSpec="*.mdb") returned 0 [0091.261] lstrlenA (lpString="*.mdb") returned 5 [0091.261] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FORM.ICO", pszSpec="*.cer") returned 0 [0091.262] lstrlenA (lpString="*.cer") returned 5 [0091.262] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FORM.ICO", pszSpec="*.p12") returned 0 [0091.262] lstrlenA (lpString="*.p12") returned 5 [0091.262] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FORM.ICO", pszSpec="*.pfx") returned 0 [0091.262] lstrlenA (lpString="*.pfx") returned 5 [0091.262] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FORM.ICO", pszSpec="*.kwm") returned 0 [0091.262] lstrlenA (lpString="*.kwm") returned 5 [0091.262] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FORM.ICO", pszSpec="*.pwm") returned 0 [0091.262] lstrlenA (lpString="*.pwm") returned 5 [0091.262] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FORM.ICO", pszSpec="*.1cd") returned 0 [0091.262] lstrlenA (lpString="*.1cd") returned 5 [0091.262] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FORM.ICO", pszSpec="*.md") returned 0 [0091.262] lstrlenA (lpString="*.md") returned 4 [0091.262] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FORM.ICO", pszSpec="*.mdf") returned 0 [0091.262] lstrlenA (lpString="*.mdf") returned 5 [0091.262] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FORM.ICO", pszSpec="*.dbf") returned 0 [0091.262] lstrlenA (lpString="*.dbf") returned 5 [0091.262] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FORM.ICO", pszSpec="*.odt") returned 0 [0091.262] lstrlenA (lpString="*.odt") returned 5 [0091.262] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FORM.ICO", pszSpec="*.vob") returned 0 [0091.262] lstrlenA (lpString="*.vob") returned 5 [0091.262] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FORM.ICO", pszSpec="*.ifo") returned 0 [0091.262] lstrlenA (lpString="*.ifo") returned 5 [0091.262] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FORM.ICO", pszSpec="*.lnk") returned 0 [0091.262] lstrlenA (lpString="*.lnk") returned 5 [0091.262] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FORM.ICO", pszSpec="*.torrent") returned 0 [0091.262] lstrlenA (lpString="*.torrent") returned 9 [0091.262] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FORM.ICO", pszSpec="*.mov") returned 0 [0091.262] lstrlenA (lpString="*.mov") returned 5 [0091.262] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FORM.ICO", pszSpec="*.m2v") returned 0 [0091.262] lstrlenA (lpString="*.m2v") returned 5 [0091.262] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FORM.ICO", pszSpec="*.3gp") returned 0 [0091.262] lstrlenA (lpString="*.3gp") returned 5 [0091.262] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FORM.ICO", pszSpec="*.mpeg") returned 0 [0091.262] lstrlenA (lpString="*.mpeg") returned 6 [0091.262] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FORM.ICO", pszSpec="*.mpg") returned 0 [0091.262] lstrlenA (lpString="*.mpg") returned 5 [0091.262] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FORM.ICO", pszSpec="*.flv") returned 0 [0091.262] lstrlenA (lpString="*.flv") returned 5 [0091.262] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FORM.ICO", pszSpec="*.avi") returned 0 [0091.263] lstrlenA (lpString="*.avi") returned 5 [0091.263] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FORM.ICO", pszSpec="*.mp4") returned 0 [0091.263] lstrlenA (lpString="*.mp4") returned 5 [0091.263] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FORM.ICO", pszSpec="*.wmv") returned 0 [0091.263] lstrlenA (lpString="*.wmv") returned 5 [0091.263] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FORM.ICO", pszSpec="*.divx") returned 0 [0091.263] lstrlenA (lpString="*.divx") returned 6 [0091.263] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FORM.ICO", pszSpec="*.mkv") returned 0 [0091.263] lstrlenA (lpString="*.mkv") returned 5 [0091.263] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FORM.ICO", pszSpec="*.mp3") returned 0 [0091.263] lstrlenA (lpString="*.mp3") returned 5 [0091.263] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FORM.ICO", pszSpec="*.wav") returned 0 [0091.263] lstrlenA (lpString="*.wav") returned 5 [0091.263] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FORM.ICO", pszSpec="*.flac") returned 0 [0091.263] lstrlenA (lpString="*.flac") returned 6 [0091.263] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FORM.ICO", pszSpec="*.ape") returned 0 [0091.263] lstrlenA (lpString="*.ape") returned 5 [0091.263] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FORM.ICO", pszSpec="*.wma") returned 0 [0091.263] lstrlenA (lpString="*.wma") returned 5 [0091.263] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FORM.ICO", pszSpec="*.ac3") returned 0 [0091.263] lstrlenA (lpString="*.ac3") returned 5 [0091.263] FindNextFileA (in: hFindFile=0x5b7d30, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0091.263] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0091.263] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="FormsBlankPage.html") returned -1 [0091.263] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FormsBlankPage.html") returned 1 [0091.263] lstrcmpiA (lpString1="", lpString2="FormsBlankPage.html") returned -1 [0091.263] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FORM.ICO") returned="FORM.ICO" [0091.263] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="FormsBlankPage.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBlankPage.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBlankPage.html" [0091.263] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBlankPage.html", pszSpec="*.zip") returned 0 [0091.263] lstrlenA (lpString="*.zip") returned 5 [0091.263] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBlankPage.html", pszSpec="*.rar") returned 0 [0091.263] lstrlenA (lpString="*.rar") returned 5 [0091.263] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBlankPage.html", pszSpec="*.7z") returned 0 [0091.263] lstrlenA (lpString="*.7z") returned 4 [0091.263] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBlankPage.html", pszSpec="*.tar") returned 0 [0091.263] lstrlenA (lpString="*.tar") returned 5 [0091.263] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBlankPage.html", pszSpec="*.gzip") returned 0 [0091.263] lstrlenA (lpString="*.gzip") returned 6 [0091.264] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBlankPage.html", pszSpec="*.jpg") returned 0 [0091.264] lstrlenA (lpString="*.jpg") returned 5 [0091.264] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBlankPage.html", pszSpec="*.jpeg") returned 0 [0091.264] lstrlenA (lpString="*.jpeg") returned 6 [0091.264] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBlankPage.html", pszSpec="*.psd") returned 0 [0091.264] lstrlenA (lpString="*.psd") returned 5 [0091.264] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBlankPage.html", pszSpec="*.cdr") returned 0 [0091.264] lstrlenA (lpString="*.cdr") returned 5 [0091.264] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBlankPage.html", pszSpec="*.dwg") returned 0 [0091.264] lstrlenA (lpString="*.dwg") returned 5 [0091.264] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBlankPage.html", pszSpec="*.max") returned 0 [0091.264] lstrlenA (lpString="*.max") returned 5 [0091.264] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBlankPage.html", pszSpec="*.bmp") returned 0 [0091.264] lstrlenA (lpString="*.bmp") returned 5 [0091.264] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBlankPage.html", pszSpec="*.gif") returned 0 [0091.264] lstrlenA (lpString="*.gif") returned 5 [0091.264] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBlankPage.html", pszSpec="*.png") returned 0 [0091.264] lstrlenA (lpString="*.png") returned 5 [0091.264] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBlankPage.html", pszSpec="*.doc") returned 0 [0091.264] lstrlenA (lpString="*.doc") returned 5 [0091.264] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBlankPage.html", pszSpec="*.docx") returned 0 [0091.264] lstrlenA (lpString="*.docx") returned 6 [0091.264] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBlankPage.html", pszSpec="*.xls") returned 0 [0091.264] lstrlenA (lpString="*.xls") returned 5 [0091.264] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBlankPage.html", pszSpec="*.xlsx") returned 0 [0091.264] lstrlenA (lpString="*.xlsx") returned 6 [0091.264] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBlankPage.html", pszSpec="*.ppt") returned 0 [0091.264] lstrlenA (lpString="*.ppt") returned 5 [0091.264] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBlankPage.html", pszSpec="*.pptx") returned 0 [0091.264] lstrlenA (lpString="*.pptx") returned 6 [0091.264] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBlankPage.html", pszSpec="*.txt") returned 0 [0091.264] lstrlenA (lpString="*.txt") returned 5 [0091.264] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBlankPage.html", pszSpec="*.pdf") returned 0 [0091.264] lstrlenA (lpString="*.pdf") returned 5 [0091.264] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBlankPage.html", pszSpec="*.djvu") returned 0 [0091.264] lstrlenA (lpString="*.djvu") returned 6 [0091.264] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBlankPage.html", pszSpec="*.htm") returned 0 [0091.264] lstrlenA (lpString="*.htm") returned 5 [0091.264] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBlankPage.html", pszSpec="*.html") returned 1 [0091.264] lstrlenA (lpString="*.html") returned 6 [0091.264] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBlankPage.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBlankPage.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBlankPage.html" [0091.264] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBlankPage.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBlankPage.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBlankPage.html" [0091.264] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBlankPage.html", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBlankPage.html.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBlankPage.html." [0091.265] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBlankPage.html.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBlankPage.html. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBlankPage.html. " [0091.265] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBlankPage.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formsblankpage.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0091.277] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4b2 [0091.277] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x886b4800, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5291c2f0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x886b4800, dwHighDateTime=0x1c747ea)) returned 1 [0091.277] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0091.277] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x458, lpOverlapped=0x0) returned 1 [0091.323] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBlankPage.html") returned="FormsBlankPage.html" [0091.323] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0091.323] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x458, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x458, lpOverlapped=0x0) returned 1 [0091.323] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0091.323] CloseHandle (hObject=0x98) returned 1 [0091.324] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBlankPage.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formsblankpage.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBlankPage.html. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formsblankpage.html. ")) returned 1 [0091.325] FindNextFileA (in: hFindFile=0x5b7d30, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0091.325] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0091.325] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="FormsBrowserUpgrade.html") returned -1 [0091.325] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FormsBrowserUpgrade.html") returned 1 [0091.325] lstrcmpiA (lpString1="", lpString2="FormsBrowserUpgrade.html") returned -1 [0091.325] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBlankPage.html") returned="FormsBlankPage.html" [0091.325] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="FormsBrowserUpgrade.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBrowserUpgrade.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBrowserUpgrade.html" [0091.326] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBrowserUpgrade.html", pszSpec="*.zip") returned 0 [0091.326] lstrlenA (lpString="*.zip") returned 5 [0091.326] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBrowserUpgrade.html", pszSpec="*.rar") returned 0 [0091.326] lstrlenA (lpString="*.rar") returned 5 [0091.326] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBrowserUpgrade.html", pszSpec="*.7z") returned 0 [0091.326] lstrlenA (lpString="*.7z") returned 4 [0091.326] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBrowserUpgrade.html", pszSpec="*.tar") returned 0 [0091.326] lstrlenA (lpString="*.tar") returned 5 [0091.326] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBrowserUpgrade.html", pszSpec="*.gzip") returned 0 [0091.326] lstrlenA (lpString="*.gzip") returned 6 [0091.326] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBrowserUpgrade.html", pszSpec="*.jpg") returned 0 [0091.326] lstrlenA (lpString="*.jpg") returned 5 [0091.326] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBrowserUpgrade.html", pszSpec="*.jpeg") returned 0 [0091.326] lstrlenA (lpString="*.jpeg") returned 6 [0091.326] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBrowserUpgrade.html", pszSpec="*.psd") returned 0 [0091.326] lstrlenA (lpString="*.psd") returned 5 [0091.326] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBrowserUpgrade.html", pszSpec="*.cdr") returned 0 [0091.326] lstrlenA (lpString="*.cdr") returned 5 [0091.326] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBrowserUpgrade.html", pszSpec="*.dwg") returned 0 [0091.326] lstrlenA (lpString="*.dwg") returned 5 [0091.326] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBrowserUpgrade.html", pszSpec="*.max") returned 0 [0091.326] lstrlenA (lpString="*.max") returned 5 [0091.326] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBrowserUpgrade.html", pszSpec="*.bmp") returned 0 [0091.326] lstrlenA (lpString="*.bmp") returned 5 [0091.326] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBrowserUpgrade.html", pszSpec="*.gif") returned 0 [0091.326] lstrlenA (lpString="*.gif") returned 5 [0091.326] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBrowserUpgrade.html", pszSpec="*.png") returned 0 [0091.326] lstrlenA (lpString="*.png") returned 5 [0091.326] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBrowserUpgrade.html", pszSpec="*.doc") returned 0 [0091.326] lstrlenA (lpString="*.doc") returned 5 [0091.326] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBrowserUpgrade.html", pszSpec="*.docx") returned 0 [0091.326] lstrlenA (lpString="*.docx") returned 6 [0091.326] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBrowserUpgrade.html", pszSpec="*.xls") returned 0 [0091.326] lstrlenA (lpString="*.xls") returned 5 [0091.326] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBrowserUpgrade.html", pszSpec="*.xlsx") returned 0 [0091.326] lstrlenA (lpString="*.xlsx") returned 6 [0091.326] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBrowserUpgrade.html", pszSpec="*.ppt") returned 0 [0091.326] lstrlenA (lpString="*.ppt") returned 5 [0091.326] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBrowserUpgrade.html", pszSpec="*.pptx") returned 0 [0091.326] lstrlenA (lpString="*.pptx") returned 6 [0091.326] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBrowserUpgrade.html", pszSpec="*.txt") returned 0 [0091.326] lstrlenA (lpString="*.txt") returned 5 [0091.326] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBrowserUpgrade.html", pszSpec="*.pdf") returned 0 [0091.326] lstrlenA (lpString="*.pdf") returned 5 [0091.326] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBrowserUpgrade.html", pszSpec="*.djvu") returned 0 [0091.327] lstrlenA (lpString="*.djvu") returned 6 [0091.327] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBrowserUpgrade.html", pszSpec="*.htm") returned 0 [0091.327] lstrlenA (lpString="*.htm") returned 5 [0091.327] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBrowserUpgrade.html", pszSpec="*.html") returned 1 [0091.327] lstrlenA (lpString="*.html") returned 6 [0091.327] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBrowserUpgrade.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBrowserUpgrade.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBrowserUpgrade.html" [0091.327] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBrowserUpgrade.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBrowserUpgrade.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBrowserUpgrade.html" [0091.327] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBrowserUpgrade.html", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBrowserUpgrade.html.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBrowserUpgrade.html." [0091.327] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBrowserUpgrade.html.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBrowserUpgrade.html. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBrowserUpgrade.html. " [0091.327] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBrowserUpgrade.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formsbrowserupgrade.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0091.360] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x7a7 [0091.360] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x886b4800, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5291c2f0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x886b4800, dwHighDateTime=0x1c747ea)) returned 1 [0091.360] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0091.360] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x74d, lpOverlapped=0x0) returned 1 [0091.370] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBrowserUpgrade.html") returned="FormsBrowserUpgrade.html" [0091.370] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0091.370] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x74d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x74d, lpOverlapped=0x0) returned 1 [0091.371] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0091.371] CloseHandle (hObject=0x98) returned 1 [0091.371] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBrowserUpgrade.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formsbrowserupgrade.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBrowserUpgrade.html. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formsbrowserupgrade.html. ")) returned 1 [0091.372] FindNextFileA (in: hFindFile=0x5b7d30, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0091.373] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0091.373] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="FormsDoNotTrust.html") returned -1 [0091.373] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FormsDoNotTrust.html") returned 1 [0091.373] lstrcmpiA (lpString1="", lpString2="FormsDoNotTrust.html") returned -1 [0091.373] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBrowserUpgrade.html") returned="FormsBrowserUpgrade.html" [0091.373] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="FormsDoNotTrust.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsDoNotTrust.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsDoNotTrust.html" [0091.373] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsDoNotTrust.html", pszSpec="*.zip") returned 0 [0091.373] lstrlenA (lpString="*.zip") returned 5 [0091.373] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsDoNotTrust.html", pszSpec="*.rar") returned 0 [0091.373] lstrlenA (lpString="*.rar") returned 5 [0091.373] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsDoNotTrust.html", pszSpec="*.7z") returned 0 [0091.373] lstrlenA (lpString="*.7z") returned 4 [0091.373] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsDoNotTrust.html", pszSpec="*.tar") returned 0 [0091.373] lstrlenA (lpString="*.tar") returned 5 [0091.373] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsDoNotTrust.html", pszSpec="*.gzip") returned 0 [0091.373] lstrlenA (lpString="*.gzip") returned 6 [0091.373] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsDoNotTrust.html", pszSpec="*.jpg") returned 0 [0091.373] lstrlenA (lpString="*.jpg") returned 5 [0091.373] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsDoNotTrust.html", pszSpec="*.jpeg") returned 0 [0091.373] lstrlenA (lpString="*.jpeg") returned 6 [0091.374] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsDoNotTrust.html", pszSpec="*.psd") returned 0 [0091.374] lstrlenA (lpString="*.psd") returned 5 [0091.374] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsDoNotTrust.html", pszSpec="*.cdr") returned 0 [0091.374] lstrlenA (lpString="*.cdr") returned 5 [0091.374] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsDoNotTrust.html", pszSpec="*.dwg") returned 0 [0091.374] lstrlenA (lpString="*.dwg") returned 5 [0091.374] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsDoNotTrust.html", pszSpec="*.max") returned 0 [0091.374] lstrlenA (lpString="*.max") returned 5 [0091.374] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsDoNotTrust.html", pszSpec="*.bmp") returned 0 [0091.374] lstrlenA (lpString="*.bmp") returned 5 [0091.374] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsDoNotTrust.html", pszSpec="*.gif") returned 0 [0091.374] lstrlenA (lpString="*.gif") returned 5 [0091.374] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsDoNotTrust.html", pszSpec="*.png") returned 0 [0091.374] lstrlenA (lpString="*.png") returned 5 [0091.374] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsDoNotTrust.html", pszSpec="*.doc") returned 0 [0091.374] lstrlenA (lpString="*.doc") returned 5 [0091.374] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsDoNotTrust.html", pszSpec="*.docx") returned 0 [0091.374] lstrlenA (lpString="*.docx") returned 6 [0091.374] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsDoNotTrust.html", pszSpec="*.xls") returned 0 [0091.374] lstrlenA (lpString="*.xls") returned 5 [0091.374] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsDoNotTrust.html", pszSpec="*.xlsx") returned 0 [0091.374] lstrlenA (lpString="*.xlsx") returned 6 [0091.374] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsDoNotTrust.html", pszSpec="*.ppt") returned 0 [0091.374] lstrlenA (lpString="*.ppt") returned 5 [0091.374] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsDoNotTrust.html", pszSpec="*.pptx") returned 0 [0091.374] lstrlenA (lpString="*.pptx") returned 6 [0091.374] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsDoNotTrust.html", pszSpec="*.txt") returned 0 [0091.374] lstrlenA (lpString="*.txt") returned 5 [0091.374] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsDoNotTrust.html", pszSpec="*.pdf") returned 0 [0091.374] lstrlenA (lpString="*.pdf") returned 5 [0091.374] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsDoNotTrust.html", pszSpec="*.djvu") returned 0 [0091.374] lstrlenA (lpString="*.djvu") returned 6 [0091.374] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsDoNotTrust.html", pszSpec="*.htm") returned 0 [0091.374] lstrlenA (lpString="*.htm") returned 5 [0091.374] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsDoNotTrust.html", pszSpec="*.html") returned 1 [0091.374] lstrlenA (lpString="*.html") returned 6 [0091.374] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsDoNotTrust.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsDoNotTrust.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsDoNotTrust.html" [0091.375] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsDoNotTrust.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsDoNotTrust.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsDoNotTrust.html" [0091.375] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsDoNotTrust.html", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsDoNotTrust.html.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsDoNotTrust.html." [0091.375] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsDoNotTrust.html.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsDoNotTrust.html. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsDoNotTrust.html. " [0091.375] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsDoNotTrust.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formsdonottrust.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0091.376] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x805 [0091.376] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x886b4800, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x618c8a10, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x886b4800, dwHighDateTime=0x1c747ea)) returned 1 [0091.376] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0091.376] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x7ab, lpOverlapped=0x0) returned 1 [0091.434] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsDoNotTrust.html") returned="FormsDoNotTrust.html" [0091.434] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0091.434] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x7ab, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x7ab, lpOverlapped=0x0) returned 1 [0091.434] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0091.434] CloseHandle (hObject=0x98) returned 1 [0091.435] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsDoNotTrust.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formsdonottrust.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsDoNotTrust.html. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formsdonottrust.html. ")) returned 1 [0091.436] FindNextFileA (in: hFindFile=0x5b7d30, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0091.436] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0091.436] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="FormsHomePage.html") returned -1 [0091.436] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FormsHomePage.html") returned 1 [0091.436] lstrcmpiA (lpString1="", lpString2="FormsHomePage.html") returned -1 [0091.436] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsDoNotTrust.html") returned="FormsDoNotTrust.html" [0091.436] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="FormsHomePage.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePage.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePage.html" [0091.436] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePage.html", pszSpec="*.zip") returned 0 [0091.436] lstrlenA (lpString="*.zip") returned 5 [0091.436] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePage.html", pszSpec="*.rar") returned 0 [0091.436] lstrlenA (lpString="*.rar") returned 5 [0091.436] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePage.html", pszSpec="*.7z") returned 0 [0091.436] lstrlenA (lpString="*.7z") returned 4 [0091.436] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePage.html", pszSpec="*.tar") returned 0 [0091.437] lstrlenA (lpString="*.tar") returned 5 [0091.437] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePage.html", pszSpec="*.gzip") returned 0 [0091.437] lstrlenA (lpString="*.gzip") returned 6 [0091.437] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePage.html", pszSpec="*.jpg") returned 0 [0091.437] lstrlenA (lpString="*.jpg") returned 5 [0091.437] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePage.html", pszSpec="*.jpeg") returned 0 [0091.437] lstrlenA (lpString="*.jpeg") returned 6 [0091.437] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePage.html", pszSpec="*.psd") returned 0 [0091.437] lstrlenA (lpString="*.psd") returned 5 [0091.437] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePage.html", pszSpec="*.cdr") returned 0 [0091.437] lstrlenA (lpString="*.cdr") returned 5 [0091.437] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePage.html", pszSpec="*.dwg") returned 0 [0091.437] lstrlenA (lpString="*.dwg") returned 5 [0091.437] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePage.html", pszSpec="*.max") returned 0 [0091.437] lstrlenA (lpString="*.max") returned 5 [0091.437] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePage.html", pszSpec="*.bmp") returned 0 [0091.437] lstrlenA (lpString="*.bmp") returned 5 [0091.437] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePage.html", pszSpec="*.gif") returned 0 [0091.437] lstrlenA (lpString="*.gif") returned 5 [0091.437] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePage.html", pszSpec="*.png") returned 0 [0091.437] lstrlenA (lpString="*.png") returned 5 [0091.437] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePage.html", pszSpec="*.doc") returned 0 [0091.437] lstrlenA (lpString="*.doc") returned 5 [0091.437] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePage.html", pszSpec="*.docx") returned 0 [0091.437] lstrlenA (lpString="*.docx") returned 6 [0091.437] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePage.html", pszSpec="*.xls") returned 0 [0091.437] lstrlenA (lpString="*.xls") returned 5 [0091.437] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePage.html", pszSpec="*.xlsx") returned 0 [0091.437] lstrlenA (lpString="*.xlsx") returned 6 [0091.437] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePage.html", pszSpec="*.ppt") returned 0 [0091.437] lstrlenA (lpString="*.ppt") returned 5 [0091.437] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePage.html", pszSpec="*.pptx") returned 0 [0091.437] lstrlenA (lpString="*.pptx") returned 6 [0091.437] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePage.html", pszSpec="*.txt") returned 0 [0091.437] lstrlenA (lpString="*.txt") returned 5 [0091.437] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePage.html", pszSpec="*.pdf") returned 0 [0091.437] lstrlenA (lpString="*.pdf") returned 5 [0091.437] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePage.html", pszSpec="*.djvu") returned 0 [0091.437] lstrlenA (lpString="*.djvu") returned 6 [0091.437] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePage.html", pszSpec="*.htm") returned 0 [0091.437] lstrlenA (lpString="*.htm") returned 5 [0091.437] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePage.html", pszSpec="*.html") returned 1 [0091.437] lstrlenA (lpString="*.html") returned 6 [0091.437] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePage.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePage.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePage.html" [0091.437] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePage.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePage.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePage.html" [0091.437] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePage.html", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePage.html.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePage.html." [0091.438] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePage.html.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePage.html. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePage.html. " [0091.438] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePage.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formshomepage.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0091.439] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xc96 [0091.439] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x886b4800, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5291c2f0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x886b4800, dwHighDateTime=0x1c747ea)) returned 1 [0091.439] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0091.439] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0xc3c, lpOverlapped=0x0) returned 1 [0091.453] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePage.html") returned="FormsHomePage.html" [0091.453] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0091.453] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0xc3c, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0xc3c, lpOverlapped=0x0) returned 1 [0091.453] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0091.454] CloseHandle (hObject=0x98) returned 1 [0091.454] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePage.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formshomepage.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePage.html. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formshomepage.html. ")) returned 1 [0091.455] FindNextFileA (in: hFindFile=0x5b7d30, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0091.455] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0091.455] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="FormsHomePageScript.js") returned -1 [0091.455] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FormsHomePageScript.js") returned 1 [0091.455] lstrcmpiA (lpString1="", lpString2="FormsHomePageScript.js") returned -1 [0091.455] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePage.html") returned="FormsHomePage.html" [0091.455] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="FormsHomePageScript.js" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageScript.js") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageScript.js" [0091.455] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageScript.js", pszSpec="*.zip") returned 0 [0091.455] lstrlenA (lpString="*.zip") returned 5 [0091.455] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageScript.js", pszSpec="*.rar") returned 0 [0091.456] lstrlenA (lpString="*.rar") returned 5 [0091.456] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageScript.js", pszSpec="*.7z") returned 0 [0091.456] lstrlenA (lpString="*.7z") returned 4 [0091.456] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageScript.js", pszSpec="*.tar") returned 0 [0091.456] lstrlenA (lpString="*.tar") returned 5 [0091.456] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageScript.js", pszSpec="*.gzip") returned 0 [0091.456] lstrlenA (lpString="*.gzip") returned 6 [0091.456] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageScript.js", pszSpec="*.jpg") returned 0 [0091.456] lstrlenA (lpString="*.jpg") returned 5 [0091.456] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageScript.js", pszSpec="*.jpeg") returned 0 [0091.456] lstrlenA (lpString="*.jpeg") returned 6 [0091.456] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageScript.js", pszSpec="*.psd") returned 0 [0091.456] lstrlenA (lpString="*.psd") returned 5 [0091.456] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageScript.js", pszSpec="*.cdr") returned 0 [0091.456] lstrlenA (lpString="*.cdr") returned 5 [0091.456] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageScript.js", pszSpec="*.dwg") returned 0 [0091.456] lstrlenA (lpString="*.dwg") returned 5 [0091.456] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageScript.js", pszSpec="*.max") returned 0 [0091.456] lstrlenA (lpString="*.max") returned 5 [0091.456] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageScript.js", pszSpec="*.bmp") returned 0 [0091.456] lstrlenA (lpString="*.bmp") returned 5 [0091.456] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageScript.js", pszSpec="*.gif") returned 0 [0091.456] lstrlenA (lpString="*.gif") returned 5 [0091.456] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageScript.js", pszSpec="*.png") returned 0 [0091.456] lstrlenA (lpString="*.png") returned 5 [0091.456] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageScript.js", pszSpec="*.doc") returned 0 [0091.456] lstrlenA (lpString="*.doc") returned 5 [0091.456] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageScript.js", pszSpec="*.docx") returned 0 [0091.456] lstrlenA (lpString="*.docx") returned 6 [0091.456] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageScript.js", pszSpec="*.xls") returned 0 [0091.456] lstrlenA (lpString="*.xls") returned 5 [0091.456] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageScript.js", pszSpec="*.xlsx") returned 0 [0091.456] lstrlenA (lpString="*.xlsx") returned 6 [0091.456] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageScript.js", pszSpec="*.ppt") returned 0 [0091.456] lstrlenA (lpString="*.ppt") returned 5 [0091.456] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageScript.js", pszSpec="*.pptx") returned 0 [0091.456] lstrlenA (lpString="*.pptx") returned 6 [0091.456] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageScript.js", pszSpec="*.txt") returned 0 [0091.456] lstrlenA (lpString="*.txt") returned 5 [0091.456] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageScript.js", pszSpec="*.pdf") returned 0 [0091.456] lstrlenA (lpString="*.pdf") returned 5 [0091.456] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageScript.js", pszSpec="*.djvu") returned 0 [0091.457] lstrlenA (lpString="*.djvu") returned 6 [0091.457] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageScript.js", pszSpec="*.htm") returned 0 [0091.457] lstrlenA (lpString="*.htm") returned 5 [0091.457] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageScript.js", pszSpec="*.html") returned 0 [0091.457] lstrlenA (lpString="*.html") returned 6 [0091.457] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageScript.js", pszSpec="*.mdb") returned 0 [0091.457] lstrlenA (lpString="*.mdb") returned 5 [0091.457] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageScript.js", pszSpec="*.cer") returned 0 [0091.457] lstrlenA (lpString="*.cer") returned 5 [0091.457] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageScript.js", pszSpec="*.p12") returned 0 [0091.457] lstrlenA (lpString="*.p12") returned 5 [0091.457] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageScript.js", pszSpec="*.pfx") returned 0 [0091.457] lstrlenA (lpString="*.pfx") returned 5 [0091.457] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageScript.js", pszSpec="*.kwm") returned 0 [0091.457] lstrlenA (lpString="*.kwm") returned 5 [0091.457] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageScript.js", pszSpec="*.pwm") returned 0 [0091.457] lstrlenA (lpString="*.pwm") returned 5 [0091.457] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageScript.js", pszSpec="*.1cd") returned 0 [0091.457] lstrlenA (lpString="*.1cd") returned 5 [0091.457] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageScript.js", pszSpec="*.md") returned 0 [0091.457] lstrlenA (lpString="*.md") returned 4 [0091.457] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageScript.js", pszSpec="*.mdf") returned 0 [0091.457] lstrlenA (lpString="*.mdf") returned 5 [0091.457] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageScript.js", pszSpec="*.dbf") returned 0 [0091.457] lstrlenA (lpString="*.dbf") returned 5 [0091.457] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageScript.js", pszSpec="*.odt") returned 0 [0091.457] lstrlenA (lpString="*.odt") returned 5 [0091.457] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageScript.js", pszSpec="*.vob") returned 0 [0091.457] lstrlenA (lpString="*.vob") returned 5 [0091.457] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageScript.js", pszSpec="*.ifo") returned 0 [0091.457] lstrlenA (lpString="*.ifo") returned 5 [0091.457] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageScript.js", pszSpec="*.lnk") returned 0 [0091.457] lstrlenA (lpString="*.lnk") returned 5 [0091.457] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageScript.js", pszSpec="*.torrent") returned 0 [0091.457] lstrlenA (lpString="*.torrent") returned 9 [0091.457] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageScript.js", pszSpec="*.mov") returned 0 [0091.457] lstrlenA (lpString="*.mov") returned 5 [0091.457] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageScript.js", pszSpec="*.m2v") returned 0 [0091.457] lstrlenA (lpString="*.m2v") returned 5 [0091.457] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageScript.js", pszSpec="*.3gp") returned 0 [0091.457] lstrlenA (lpString="*.3gp") returned 5 [0091.457] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageScript.js", pszSpec="*.mpeg") returned 0 [0091.458] lstrlenA (lpString="*.mpeg") returned 6 [0091.458] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageScript.js", pszSpec="*.mpg") returned 0 [0091.458] lstrlenA (lpString="*.mpg") returned 5 [0091.458] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageScript.js", pszSpec="*.flv") returned 0 [0091.458] lstrlenA (lpString="*.flv") returned 5 [0091.458] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageScript.js", pszSpec="*.avi") returned 0 [0091.458] lstrlenA (lpString="*.avi") returned 5 [0091.458] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageScript.js", pszSpec="*.mp4") returned 0 [0091.458] lstrlenA (lpString="*.mp4") returned 5 [0091.458] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageScript.js", pszSpec="*.wmv") returned 0 [0091.458] lstrlenA (lpString="*.wmv") returned 5 [0091.458] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageScript.js", pszSpec="*.divx") returned 0 [0091.458] lstrlenA (lpString="*.divx") returned 6 [0091.458] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageScript.js", pszSpec="*.mkv") returned 0 [0091.458] lstrlenA (lpString="*.mkv") returned 5 [0091.458] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageScript.js", pszSpec="*.mp3") returned 0 [0091.458] lstrlenA (lpString="*.mp3") returned 5 [0091.458] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageScript.js", pszSpec="*.wav") returned 0 [0091.458] lstrlenA (lpString="*.wav") returned 5 [0091.458] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageScript.js", pszSpec="*.flac") returned 0 [0091.458] lstrlenA (lpString="*.flac") returned 6 [0091.458] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageScript.js", pszSpec="*.ape") returned 0 [0091.458] lstrlenA (lpString="*.ape") returned 5 [0091.458] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageScript.js", pszSpec="*.wma") returned 0 [0091.458] lstrlenA (lpString="*.wma") returned 5 [0091.458] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageScript.js", pszSpec="*.ac3") returned 0 [0091.458] lstrlenA (lpString="*.ac3") returned 5 [0091.458] FindNextFileA (in: hFindFile=0x5b7d30, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0091.458] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0091.458] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="FormsHomePageStyle.css") returned -1 [0091.458] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FormsHomePageStyle.css") returned 1 [0091.458] lstrcmpiA (lpString1="", lpString2="FormsHomePageStyle.css") returned -1 [0091.458] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageScript.js") returned="FormsHomePageScript.js" [0091.458] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="FormsHomePageStyle.css" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageStyle.css") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageStyle.css" [0091.458] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageStyle.css", pszSpec="*.zip") returned 0 [0091.458] lstrlenA (lpString="*.zip") returned 5 [0091.458] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageStyle.css", pszSpec="*.rar") returned 0 [0091.458] lstrlenA (lpString="*.rar") returned 5 [0091.458] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageStyle.css", pszSpec="*.7z") returned 0 [0091.458] lstrlenA (lpString="*.7z") returned 4 [0091.458] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageStyle.css", pszSpec="*.tar") returned 0 [0091.459] lstrlenA (lpString="*.tar") returned 5 [0091.459] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageStyle.css", pszSpec="*.gzip") returned 0 [0091.459] lstrlenA (lpString="*.gzip") returned 6 [0091.459] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageStyle.css", pszSpec="*.jpg") returned 0 [0091.459] lstrlenA (lpString="*.jpg") returned 5 [0091.459] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageStyle.css", pszSpec="*.jpeg") returned 0 [0091.459] lstrlenA (lpString="*.jpeg") returned 6 [0091.459] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageStyle.css", pszSpec="*.psd") returned 0 [0091.459] lstrlenA (lpString="*.psd") returned 5 [0091.459] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageStyle.css", pszSpec="*.cdr") returned 0 [0091.459] lstrlenA (lpString="*.cdr") returned 5 [0091.459] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageStyle.css", pszSpec="*.dwg") returned 0 [0091.459] lstrlenA (lpString="*.dwg") returned 5 [0091.459] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageStyle.css", pszSpec="*.max") returned 0 [0091.459] lstrlenA (lpString="*.max") returned 5 [0091.459] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageStyle.css", pszSpec="*.bmp") returned 0 [0091.459] lstrlenA (lpString="*.bmp") returned 5 [0091.459] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageStyle.css", pszSpec="*.gif") returned 0 [0091.459] lstrlenA (lpString="*.gif") returned 5 [0091.459] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageStyle.css", pszSpec="*.png") returned 0 [0091.459] lstrlenA (lpString="*.png") returned 5 [0091.459] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageStyle.css", pszSpec="*.doc") returned 0 [0091.459] lstrlenA (lpString="*.doc") returned 5 [0091.459] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageStyle.css", pszSpec="*.docx") returned 0 [0091.459] lstrlenA (lpString="*.docx") returned 6 [0091.459] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageStyle.css", pszSpec="*.xls") returned 0 [0091.459] lstrlenA (lpString="*.xls") returned 5 [0091.459] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageStyle.css", pszSpec="*.xlsx") returned 0 [0091.459] lstrlenA (lpString="*.xlsx") returned 6 [0091.459] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageStyle.css", pszSpec="*.ppt") returned 0 [0091.459] lstrlenA (lpString="*.ppt") returned 5 [0091.459] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageStyle.css", pszSpec="*.pptx") returned 0 [0091.459] lstrlenA (lpString="*.pptx") returned 6 [0091.459] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageStyle.css", pszSpec="*.txt") returned 0 [0091.459] lstrlenA (lpString="*.txt") returned 5 [0091.459] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageStyle.css", pszSpec="*.pdf") returned 0 [0091.459] lstrlenA (lpString="*.pdf") returned 5 [0091.459] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageStyle.css", pszSpec="*.djvu") returned 0 [0091.459] lstrlenA (lpString="*.djvu") returned 6 [0091.459] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageStyle.css", pszSpec="*.htm") returned 0 [0091.459] lstrlenA (lpString="*.htm") returned 5 [0091.459] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageStyle.css", pszSpec="*.html") returned 0 [0091.459] lstrlenA (lpString="*.html") returned 6 [0091.460] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageStyle.css", pszSpec="*.mdb") returned 0 [0091.460] lstrlenA (lpString="*.mdb") returned 5 [0091.460] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageStyle.css", pszSpec="*.cer") returned 0 [0091.460] lstrlenA (lpString="*.cer") returned 5 [0091.460] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageStyle.css", pszSpec="*.p12") returned 0 [0091.460] lstrlenA (lpString="*.p12") returned 5 [0091.460] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageStyle.css", pszSpec="*.pfx") returned 0 [0091.460] lstrlenA (lpString="*.pfx") returned 5 [0091.460] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageStyle.css", pszSpec="*.kwm") returned 0 [0091.460] lstrlenA (lpString="*.kwm") returned 5 [0091.460] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageStyle.css", pszSpec="*.pwm") returned 0 [0091.460] lstrlenA (lpString="*.pwm") returned 5 [0091.460] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageStyle.css", pszSpec="*.1cd") returned 0 [0091.460] lstrlenA (lpString="*.1cd") returned 5 [0091.460] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageStyle.css", pszSpec="*.md") returned 0 [0091.460] lstrlenA (lpString="*.md") returned 4 [0091.460] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageStyle.css", pszSpec="*.mdf") returned 0 [0091.460] lstrlenA (lpString="*.mdf") returned 5 [0091.460] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageStyle.css", pszSpec="*.dbf") returned 0 [0091.460] lstrlenA (lpString="*.dbf") returned 5 [0091.460] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageStyle.css", pszSpec="*.odt") returned 0 [0091.460] lstrlenA (lpString="*.odt") returned 5 [0091.460] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageStyle.css", pszSpec="*.vob") returned 0 [0091.460] lstrlenA (lpString="*.vob") returned 5 [0091.460] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageStyle.css", pszSpec="*.ifo") returned 0 [0091.460] lstrlenA (lpString="*.ifo") returned 5 [0091.460] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageStyle.css", pszSpec="*.lnk") returned 0 [0091.460] lstrlenA (lpString="*.lnk") returned 5 [0091.460] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageStyle.css", pszSpec="*.torrent") returned 0 [0091.460] lstrlenA (lpString="*.torrent") returned 9 [0091.460] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageStyle.css", pszSpec="*.mov") returned 0 [0091.460] lstrlenA (lpString="*.mov") returned 5 [0091.460] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageStyle.css", pszSpec="*.m2v") returned 0 [0091.460] lstrlenA (lpString="*.m2v") returned 5 [0091.460] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageStyle.css", pszSpec="*.3gp") returned 0 [0091.460] lstrlenA (lpString="*.3gp") returned 5 [0091.460] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageStyle.css", pszSpec="*.mpeg") returned 0 [0091.460] lstrlenA (lpString="*.mpeg") returned 6 [0091.460] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageStyle.css", pszSpec="*.mpg") returned 0 [0091.460] lstrlenA (lpString="*.mpg") returned 5 [0091.460] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageStyle.css", pszSpec="*.flv") returned 0 [0091.460] lstrlenA (lpString="*.flv") returned 5 [0091.460] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageStyle.css", pszSpec="*.avi") returned 0 [0091.461] lstrlenA (lpString="*.avi") returned 5 [0091.461] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageStyle.css", pszSpec="*.mp4") returned 0 [0091.461] lstrlenA (lpString="*.mp4") returned 5 [0091.461] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageStyle.css", pszSpec="*.wmv") returned 0 [0091.461] lstrlenA (lpString="*.wmv") returned 5 [0091.461] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageStyle.css", pszSpec="*.divx") returned 0 [0091.461] lstrlenA (lpString="*.divx") returned 6 [0091.461] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageStyle.css", pszSpec="*.mkv") returned 0 [0091.461] lstrlenA (lpString="*.mkv") returned 5 [0091.461] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageStyle.css", pszSpec="*.mp3") returned 0 [0091.461] lstrlenA (lpString="*.mp3") returned 5 [0091.461] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageStyle.css", pszSpec="*.wav") returned 0 [0091.461] lstrlenA (lpString="*.wav") returned 5 [0091.461] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageStyle.css", pszSpec="*.flac") returned 0 [0091.461] lstrlenA (lpString="*.flac") returned 6 [0091.461] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageStyle.css", pszSpec="*.ape") returned 0 [0091.461] lstrlenA (lpString="*.ape") returned 5 [0091.461] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageStyle.css", pszSpec="*.wma") returned 0 [0091.461] lstrlenA (lpString="*.wma") returned 5 [0091.461] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageStyle.css", pszSpec="*.ac3") returned 0 [0091.461] lstrlenA (lpString="*.ac3") returned 5 [0091.461] FindNextFileA (in: hFindFile=0x5b7d30, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0091.461] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0091.461] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="FormsPreviewTemplate.html") returned -1 [0091.461] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FormsPreviewTemplate.html") returned 1 [0091.461] lstrcmpiA (lpString1="", lpString2="FormsPreviewTemplate.html") returned -1 [0091.461] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageStyle.css") returned="FormsHomePageStyle.css" [0091.461] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="FormsPreviewTemplate.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPreviewTemplate.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPreviewTemplate.html" [0091.461] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPreviewTemplate.html", pszSpec="*.zip") returned 0 [0091.461] lstrlenA (lpString="*.zip") returned 5 [0091.461] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPreviewTemplate.html", pszSpec="*.rar") returned 0 [0091.461] lstrlenA (lpString="*.rar") returned 5 [0091.461] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPreviewTemplate.html", pszSpec="*.7z") returned 0 [0091.461] lstrlenA (lpString="*.7z") returned 4 [0091.461] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPreviewTemplate.html", pszSpec="*.tar") returned 0 [0091.461] lstrlenA (lpString="*.tar") returned 5 [0091.461] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPreviewTemplate.html", pszSpec="*.gzip") returned 0 [0091.461] lstrlenA (lpString="*.gzip") returned 6 [0091.461] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPreviewTemplate.html", pszSpec="*.jpg") returned 0 [0091.461] lstrlenA (lpString="*.jpg") returned 5 [0091.461] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPreviewTemplate.html", pszSpec="*.jpeg") returned 0 [0091.462] lstrlenA (lpString="*.jpeg") returned 6 [0091.462] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPreviewTemplate.html", pszSpec="*.psd") returned 0 [0091.462] lstrlenA (lpString="*.psd") returned 5 [0091.462] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPreviewTemplate.html", pszSpec="*.cdr") returned 0 [0091.462] lstrlenA (lpString="*.cdr") returned 5 [0091.462] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPreviewTemplate.html", pszSpec="*.dwg") returned 0 [0091.462] lstrlenA (lpString="*.dwg") returned 5 [0091.462] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPreviewTemplate.html", pszSpec="*.max") returned 0 [0091.462] lstrlenA (lpString="*.max") returned 5 [0091.462] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPreviewTemplate.html", pszSpec="*.bmp") returned 0 [0091.462] lstrlenA (lpString="*.bmp") returned 5 [0091.462] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPreviewTemplate.html", pszSpec="*.gif") returned 0 [0091.462] lstrlenA (lpString="*.gif") returned 5 [0091.462] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPreviewTemplate.html", pszSpec="*.png") returned 0 [0091.462] lstrlenA (lpString="*.png") returned 5 [0091.462] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPreviewTemplate.html", pszSpec="*.doc") returned 0 [0091.462] lstrlenA (lpString="*.doc") returned 5 [0091.462] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPreviewTemplate.html", pszSpec="*.docx") returned 0 [0091.462] lstrlenA (lpString="*.docx") returned 6 [0091.462] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPreviewTemplate.html", pszSpec="*.xls") returned 0 [0091.462] lstrlenA (lpString="*.xls") returned 5 [0091.462] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPreviewTemplate.html", pszSpec="*.xlsx") returned 0 [0091.462] lstrlenA (lpString="*.xlsx") returned 6 [0091.462] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPreviewTemplate.html", pszSpec="*.ppt") returned 0 [0091.462] lstrlenA (lpString="*.ppt") returned 5 [0091.462] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPreviewTemplate.html", pszSpec="*.pptx") returned 0 [0091.462] lstrlenA (lpString="*.pptx") returned 6 [0091.462] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPreviewTemplate.html", pszSpec="*.txt") returned 0 [0091.462] lstrlenA (lpString="*.txt") returned 5 [0091.462] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPreviewTemplate.html", pszSpec="*.pdf") returned 0 [0091.462] lstrlenA (lpString="*.pdf") returned 5 [0091.462] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPreviewTemplate.html", pszSpec="*.djvu") returned 0 [0091.462] lstrlenA (lpString="*.djvu") returned 6 [0091.462] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPreviewTemplate.html", pszSpec="*.htm") returned 0 [0091.462] lstrlenA (lpString="*.htm") returned 5 [0091.462] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPreviewTemplate.html", pszSpec="*.html") returned 1 [0091.462] lstrlenA (lpString="*.html") returned 6 [0091.462] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPreviewTemplate.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPreviewTemplate.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPreviewTemplate.html" [0091.462] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPreviewTemplate.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPreviewTemplate.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPreviewTemplate.html" [0091.462] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPreviewTemplate.html", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPreviewTemplate.html.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPreviewTemplate.html." [0091.462] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPreviewTemplate.html.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPreviewTemplate.html. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPreviewTemplate.html. " [0091.463] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPreviewTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formspreviewtemplate.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0091.464] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3a2 [0091.464] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x886b4800, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x618eeb70, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x886b4800, dwHighDateTime=0x1c747ea)) returned 1 [0091.464] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0091.464] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x348, lpOverlapped=0x0) returned 1 [0091.465] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPreviewTemplate.html") returned="FormsPreviewTemplate.html" [0091.465] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0091.465] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x348, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x348, lpOverlapped=0x0) returned 1 [0091.465] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0091.465] CloseHandle (hObject=0x98) returned 1 [0091.466] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPreviewTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formspreviewtemplate.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPreviewTemplate.html. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formspreviewtemplate.html. ")) returned 1 [0091.467] FindNextFileA (in: hFindFile=0x5b7d30, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0091.467] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0091.467] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="FormsPrintTemplate.html") returned -1 [0091.467] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FormsPrintTemplate.html") returned 1 [0091.467] lstrcmpiA (lpString1="", lpString2="FormsPrintTemplate.html") returned -1 [0091.467] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPreviewTemplate.html") returned="FormsPreviewTemplate.html" [0091.467] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="FormsPrintTemplate.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPrintTemplate.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPrintTemplate.html" [0091.467] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPrintTemplate.html", pszSpec="*.zip") returned 0 [0091.467] lstrlenA (lpString="*.zip") returned 5 [0091.467] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPrintTemplate.html", pszSpec="*.rar") returned 0 [0091.467] lstrlenA (lpString="*.rar") returned 5 [0091.467] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPrintTemplate.html", pszSpec="*.7z") returned 0 [0091.467] lstrlenA (lpString="*.7z") returned 4 [0091.467] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPrintTemplate.html", pszSpec="*.tar") returned 0 [0091.467] lstrlenA (lpString="*.tar") returned 5 [0091.467] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPrintTemplate.html", pszSpec="*.gzip") returned 0 [0091.467] lstrlenA (lpString="*.gzip") returned 6 [0091.467] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPrintTemplate.html", pszSpec="*.jpg") returned 0 [0091.467] lstrlenA (lpString="*.jpg") returned 5 [0091.467] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPrintTemplate.html", pszSpec="*.jpeg") returned 0 [0091.467] lstrlenA (lpString="*.jpeg") returned 6 [0091.468] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPrintTemplate.html", pszSpec="*.psd") returned 0 [0091.468] lstrlenA (lpString="*.psd") returned 5 [0091.468] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPrintTemplate.html", pszSpec="*.cdr") returned 0 [0091.468] lstrlenA (lpString="*.cdr") returned 5 [0091.468] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPrintTemplate.html", pszSpec="*.dwg") returned 0 [0091.468] lstrlenA (lpString="*.dwg") returned 5 [0091.468] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPrintTemplate.html", pszSpec="*.max") returned 0 [0091.468] lstrlenA (lpString="*.max") returned 5 [0091.468] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPrintTemplate.html", pszSpec="*.bmp") returned 0 [0091.468] lstrlenA (lpString="*.bmp") returned 5 [0091.468] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPrintTemplate.html", pszSpec="*.gif") returned 0 [0091.468] lstrlenA (lpString="*.gif") returned 5 [0091.468] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPrintTemplate.html", pszSpec="*.png") returned 0 [0091.468] lstrlenA (lpString="*.png") returned 5 [0091.468] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPrintTemplate.html", pszSpec="*.doc") returned 0 [0091.468] lstrlenA (lpString="*.doc") returned 5 [0091.468] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPrintTemplate.html", pszSpec="*.docx") returned 0 [0091.468] lstrlenA (lpString="*.docx") returned 6 [0091.468] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPrintTemplate.html", pszSpec="*.xls") returned 0 [0091.468] lstrlenA (lpString="*.xls") returned 5 [0091.468] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPrintTemplate.html", pszSpec="*.xlsx") returned 0 [0091.468] lstrlenA (lpString="*.xlsx") returned 6 [0091.468] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPrintTemplate.html", pszSpec="*.ppt") returned 0 [0091.468] lstrlenA (lpString="*.ppt") returned 5 [0091.468] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPrintTemplate.html", pszSpec="*.pptx") returned 0 [0091.468] lstrlenA (lpString="*.pptx") returned 6 [0091.468] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPrintTemplate.html", pszSpec="*.txt") returned 0 [0091.468] lstrlenA (lpString="*.txt") returned 5 [0091.468] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPrintTemplate.html", pszSpec="*.pdf") returned 0 [0091.468] lstrlenA (lpString="*.pdf") returned 5 [0091.468] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPrintTemplate.html", pszSpec="*.djvu") returned 0 [0091.468] lstrlenA (lpString="*.djvu") returned 6 [0091.468] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPrintTemplate.html", pszSpec="*.htm") returned 0 [0091.468] lstrlenA (lpString="*.htm") returned 5 [0091.468] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPrintTemplate.html", pszSpec="*.html") returned 1 [0091.468] lstrlenA (lpString="*.html") returned 6 [0091.468] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPrintTemplate.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPrintTemplate.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPrintTemplate.html" [0091.468] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPrintTemplate.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPrintTemplate.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPrintTemplate.html" [0091.469] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPrintTemplate.html", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPrintTemplate.html.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPrintTemplate.html." [0091.469] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPrintTemplate.html.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPrintTemplate.html. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPrintTemplate.html. " [0091.469] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPrintTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formsprinttemplate.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0091.486] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x262 [0091.486] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x886b4800, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5298e710, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x886b4800, dwHighDateTime=0x1c747ea)) returned 1 [0091.486] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0091.486] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x208, lpOverlapped=0x0) returned 1 [0091.492] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPrintTemplate.html") returned="FormsPrintTemplate.html" [0091.492] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0091.492] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x208, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x208, lpOverlapped=0x0) returned 1 [0091.492] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0091.492] CloseHandle (hObject=0x98) returned 1 [0091.493] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPrintTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formsprinttemplate.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPrintTemplate.html. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formsprinttemplate.html. ")) returned 1 [0091.494] FindNextFileA (in: hFindFile=0x5b7d30, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0091.494] lstrcmpA (lpString1=".", lpString2="FormsTemplates") returned -1 [0091.494] lstrcmpA (lpString1="..", lpString2="FormsTemplates") returned -1 [0091.495] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPrintTemplate.html") returned="FormsPrintTemplate.html" [0091.495] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="FormsTemplates" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates" [0091.495] lstrlenA (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates") returned 96 [0091.495] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\*.*", lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 0x5b7d70 [0091.527] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0091.527] FindNextFileA (in: hFindFile=0x5b7d70, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0091.527] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0091.527] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0091.527] FindNextFileA (in: hFindFile=0x5b7d70, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0091.527] PeekMessageA (in: lpMsg=0xaece4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaece4) returned 0 [0091.527] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Customer Support.fdt") returned 1 [0091.527] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Customer Support.fdt") returned 1 [0091.527] lstrcmpiA (lpString1="", lpString2="Customer Support.fdt") returned -1 [0091.527] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\*.*") returned="*.*" [0091.527] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\", lpString2="Customer Support.fdt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Customer Support.fdt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Customer Support.fdt" [0091.527] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Customer Support.fdt", pszSpec="*.zip") returned 0 [0091.527] lstrlenA (lpString="*.zip") returned 5 [0091.527] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Customer Support.fdt", pszSpec="*.rar") returned 0 [0091.527] lstrlenA (lpString="*.rar") returned 5 [0091.527] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Customer Support.fdt", pszSpec="*.7z") returned 0 [0091.527] lstrlenA (lpString="*.7z") returned 4 [0091.527] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Customer Support.fdt", pszSpec="*.tar") returned 0 [0091.527] lstrlenA (lpString="*.tar") returned 5 [0091.527] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Customer Support.fdt", pszSpec="*.gzip") returned 0 [0091.527] lstrlenA (lpString="*.gzip") returned 6 [0091.527] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Customer Support.fdt", pszSpec="*.jpg") returned 0 [0091.527] lstrlenA (lpString="*.jpg") returned 5 [0091.527] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Customer Support.fdt", pszSpec="*.jpeg") returned 0 [0091.527] lstrlenA (lpString="*.jpeg") returned 6 [0091.527] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Customer Support.fdt", pszSpec="*.psd") returned 0 [0091.527] lstrlenA (lpString="*.psd") returned 5 [0091.527] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Customer Support.fdt", pszSpec="*.cdr") returned 0 [0091.527] lstrlenA (lpString="*.cdr") returned 5 [0091.527] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Customer Support.fdt", pszSpec="*.dwg") returned 0 [0091.527] lstrlenA (lpString="*.dwg") returned 5 [0091.527] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Customer Support.fdt", pszSpec="*.max") returned 0 [0091.527] lstrlenA (lpString="*.max") returned 5 [0091.527] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Customer Support.fdt", pszSpec="*.bmp") returned 0 [0091.527] lstrlenA (lpString="*.bmp") returned 5 [0091.527] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Customer Support.fdt", pszSpec="*.gif") returned 0 [0091.527] lstrlenA (lpString="*.gif") returned 5 [0091.527] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Customer Support.fdt", pszSpec="*.png") returned 0 [0091.527] lstrlenA (lpString="*.png") returned 5 [0091.527] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Customer Support.fdt", pszSpec="*.doc") returned 0 [0091.527] lstrlenA (lpString="*.doc") returned 5 [0091.527] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Customer Support.fdt", pszSpec="*.docx") returned 0 [0091.527] lstrlenA (lpString="*.docx") returned 6 [0091.528] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Customer Support.fdt", pszSpec="*.xls") returned 0 [0091.528] lstrlenA (lpString="*.xls") returned 5 [0091.528] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Customer Support.fdt", pszSpec="*.xlsx") returned 0 [0091.528] lstrlenA (lpString="*.xlsx") returned 6 [0091.528] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Customer Support.fdt", pszSpec="*.ppt") returned 0 [0091.528] lstrlenA (lpString="*.ppt") returned 5 [0091.528] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Customer Support.fdt", pszSpec="*.pptx") returned 0 [0091.528] lstrlenA (lpString="*.pptx") returned 6 [0091.528] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Customer Support.fdt", pszSpec="*.txt") returned 0 [0091.528] lstrlenA (lpString="*.txt") returned 5 [0091.528] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Customer Support.fdt", pszSpec="*.pdf") returned 0 [0091.528] lstrlenA (lpString="*.pdf") returned 5 [0091.528] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Customer Support.fdt", pszSpec="*.djvu") returned 0 [0091.528] lstrlenA (lpString="*.djvu") returned 6 [0091.528] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Customer Support.fdt", pszSpec="*.htm") returned 0 [0091.528] lstrlenA (lpString="*.htm") returned 5 [0091.528] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Customer Support.fdt", pszSpec="*.html") returned 0 [0091.528] lstrlenA (lpString="*.html") returned 6 [0091.528] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Customer Support.fdt", pszSpec="*.mdb") returned 0 [0091.528] lstrlenA (lpString="*.mdb") returned 5 [0091.528] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Customer Support.fdt", pszSpec="*.cer") returned 0 [0091.528] lstrlenA (lpString="*.cer") returned 5 [0091.528] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Customer Support.fdt", pszSpec="*.p12") returned 0 [0091.528] lstrlenA (lpString="*.p12") returned 5 [0091.528] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Customer Support.fdt", pszSpec="*.pfx") returned 0 [0091.528] lstrlenA (lpString="*.pfx") returned 5 [0091.528] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Customer Support.fdt", pszSpec="*.kwm") returned 0 [0091.528] lstrlenA (lpString="*.kwm") returned 5 [0091.528] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Customer Support.fdt", pszSpec="*.pwm") returned 0 [0091.528] lstrlenA (lpString="*.pwm") returned 5 [0091.528] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Customer Support.fdt", pszSpec="*.1cd") returned 0 [0091.528] lstrlenA (lpString="*.1cd") returned 5 [0091.528] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Customer Support.fdt", pszSpec="*.md") returned 0 [0091.528] lstrlenA (lpString="*.md") returned 4 [0091.528] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Customer Support.fdt", pszSpec="*.mdf") returned 0 [0091.528] lstrlenA (lpString="*.mdf") returned 5 [0091.528] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Customer Support.fdt", pszSpec="*.dbf") returned 0 [0091.528] lstrlenA (lpString="*.dbf") returned 5 [0091.528] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Customer Support.fdt", pszSpec="*.odt") returned 0 [0091.528] lstrlenA (lpString="*.odt") returned 5 [0091.528] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Customer Support.fdt", pszSpec="*.vob") returned 0 [0091.528] lstrlenA (lpString="*.vob") returned 5 [0091.528] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Customer Support.fdt", pszSpec="*.ifo") returned 0 [0091.528] lstrlenA (lpString="*.ifo") returned 5 [0091.528] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Customer Support.fdt", pszSpec="*.lnk") returned 0 [0091.528] lstrlenA (lpString="*.lnk") returned 5 [0091.528] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Customer Support.fdt", pszSpec="*.torrent") returned 0 [0091.528] lstrlenA (lpString="*.torrent") returned 9 [0091.528] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Customer Support.fdt", pszSpec="*.mov") returned 0 [0091.529] lstrlenA (lpString="*.mov") returned 5 [0091.529] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Customer Support.fdt", pszSpec="*.m2v") returned 0 [0091.529] lstrlenA (lpString="*.m2v") returned 5 [0091.529] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Customer Support.fdt", pszSpec="*.3gp") returned 0 [0091.529] lstrlenA (lpString="*.3gp") returned 5 [0091.529] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Customer Support.fdt", pszSpec="*.mpeg") returned 0 [0091.529] lstrlenA (lpString="*.mpeg") returned 6 [0091.529] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Customer Support.fdt", pszSpec="*.mpg") returned 0 [0091.529] lstrlenA (lpString="*.mpg") returned 5 [0091.529] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Customer Support.fdt", pszSpec="*.flv") returned 0 [0091.529] lstrlenA (lpString="*.flv") returned 5 [0091.529] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Customer Support.fdt", pszSpec="*.avi") returned 0 [0091.529] lstrlenA (lpString="*.avi") returned 5 [0091.529] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Customer Support.fdt", pszSpec="*.mp4") returned 0 [0091.529] lstrlenA (lpString="*.mp4") returned 5 [0091.529] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Customer Support.fdt", pszSpec="*.wmv") returned 0 [0091.529] lstrlenA (lpString="*.wmv") returned 5 [0091.529] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Customer Support.fdt", pszSpec="*.divx") returned 0 [0091.529] lstrlenA (lpString="*.divx") returned 6 [0091.529] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Customer Support.fdt", pszSpec="*.mkv") returned 0 [0091.529] lstrlenA (lpString="*.mkv") returned 5 [0091.529] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Customer Support.fdt", pszSpec="*.mp3") returned 0 [0091.529] lstrlenA (lpString="*.mp3") returned 5 [0091.529] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Customer Support.fdt", pszSpec="*.wav") returned 0 [0091.529] lstrlenA (lpString="*.wav") returned 5 [0091.529] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Customer Support.fdt", pszSpec="*.flac") returned 0 [0091.529] lstrlenA (lpString="*.flac") returned 6 [0091.529] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Customer Support.fdt", pszSpec="*.ape") returned 0 [0091.529] lstrlenA (lpString="*.ape") returned 5 [0091.529] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Customer Support.fdt", pszSpec="*.wma") returned 0 [0091.529] lstrlenA (lpString="*.wma") returned 5 [0091.529] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Customer Support.fdt", pszSpec="*.ac3") returned 0 [0091.529] lstrlenA (lpString="*.ac3") returned 5 [0091.529] FindNextFileA (in: hFindFile=0x5b7d70, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0091.529] PeekMessageA (in: lpMsg=0xaece4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaece4) returned 0 [0091.529] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Hardware Tracker.fdt") returned -1 [0091.529] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Hardware Tracker.fdt") returned 1 [0091.529] lstrcmpiA (lpString1="", lpString2="Hardware Tracker.fdt") returned -1 [0091.529] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Customer Support.fdt") returned="Customer Support.fdt" [0091.530] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\", lpString2="Hardware Tracker.fdt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hardware Tracker.fdt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hardware Tracker.fdt" [0091.530] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hardware Tracker.fdt", pszSpec="*.zip") returned 0 [0091.530] lstrlenA (lpString="*.zip") returned 5 [0091.530] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hardware Tracker.fdt", pszSpec="*.rar") returned 0 [0091.530] lstrlenA (lpString="*.rar") returned 5 [0091.530] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hardware Tracker.fdt", pszSpec="*.7z") returned 0 [0091.530] lstrlenA (lpString="*.7z") returned 4 [0091.530] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hardware Tracker.fdt", pszSpec="*.tar") returned 0 [0091.530] lstrlenA (lpString="*.tar") returned 5 [0091.530] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hardware Tracker.fdt", pszSpec="*.gzip") returned 0 [0091.530] lstrlenA (lpString="*.gzip") returned 6 [0091.530] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hardware Tracker.fdt", pszSpec="*.jpg") returned 0 [0091.530] lstrlenA (lpString="*.jpg") returned 5 [0091.530] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hardware Tracker.fdt", pszSpec="*.jpeg") returned 0 [0091.530] lstrlenA (lpString="*.jpeg") returned 6 [0091.530] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hardware Tracker.fdt", pszSpec="*.psd") returned 0 [0091.530] lstrlenA (lpString="*.psd") returned 5 [0091.530] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hardware Tracker.fdt", pszSpec="*.cdr") returned 0 [0091.530] lstrlenA (lpString="*.cdr") returned 5 [0091.530] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hardware Tracker.fdt", pszSpec="*.dwg") returned 0 [0091.530] lstrlenA (lpString="*.dwg") returned 5 [0091.530] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hardware Tracker.fdt", pszSpec="*.max") returned 0 [0091.530] lstrlenA (lpString="*.max") returned 5 [0091.530] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hardware Tracker.fdt", pszSpec="*.bmp") returned 0 [0091.530] lstrlenA (lpString="*.bmp") returned 5 [0091.530] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hardware Tracker.fdt", pszSpec="*.gif") returned 0 [0091.530] lstrlenA (lpString="*.gif") returned 5 [0091.530] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hardware Tracker.fdt", pszSpec="*.png") returned 0 [0091.530] lstrlenA (lpString="*.png") returned 5 [0091.530] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hardware Tracker.fdt", pszSpec="*.doc") returned 0 [0091.530] lstrlenA (lpString="*.doc") returned 5 [0091.530] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hardware Tracker.fdt", pszSpec="*.docx") returned 0 [0091.530] lstrlenA (lpString="*.docx") returned 6 [0091.530] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hardware Tracker.fdt", pszSpec="*.xls") returned 0 [0091.530] lstrlenA (lpString="*.xls") returned 5 [0091.530] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hardware Tracker.fdt", pszSpec="*.xlsx") returned 0 [0091.530] lstrlenA (lpString="*.xlsx") returned 6 [0091.530] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hardware Tracker.fdt", pszSpec="*.ppt") returned 0 [0091.530] lstrlenA (lpString="*.ppt") returned 5 [0091.530] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hardware Tracker.fdt", pszSpec="*.pptx") returned 0 [0091.530] lstrlenA (lpString="*.pptx") returned 6 [0091.530] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hardware Tracker.fdt", pszSpec="*.txt") returned 0 [0091.530] lstrlenA (lpString="*.txt") returned 5 [0091.530] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hardware Tracker.fdt", pszSpec="*.pdf") returned 0 [0091.530] lstrlenA (lpString="*.pdf") returned 5 [0091.530] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hardware Tracker.fdt", pszSpec="*.djvu") returned 0 [0091.530] lstrlenA (lpString="*.djvu") returned 6 [0091.530] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hardware Tracker.fdt", pszSpec="*.htm") returned 0 [0091.530] lstrlenA (lpString="*.htm") returned 5 [0091.530] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hardware Tracker.fdt", pszSpec="*.html") returned 0 [0091.531] lstrlenA (lpString="*.html") returned 6 [0091.531] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hardware Tracker.fdt", pszSpec="*.mdb") returned 0 [0091.531] lstrlenA (lpString="*.mdb") returned 5 [0091.531] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hardware Tracker.fdt", pszSpec="*.cer") returned 0 [0091.531] lstrlenA (lpString="*.cer") returned 5 [0091.531] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hardware Tracker.fdt", pszSpec="*.p12") returned 0 [0091.531] lstrlenA (lpString="*.p12") returned 5 [0091.531] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hardware Tracker.fdt", pszSpec="*.pfx") returned 0 [0091.531] lstrlenA (lpString="*.pfx") returned 5 [0091.531] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hardware Tracker.fdt", pszSpec="*.kwm") returned 0 [0091.531] lstrlenA (lpString="*.kwm") returned 5 [0091.531] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hardware Tracker.fdt", pszSpec="*.pwm") returned 0 [0091.531] lstrlenA (lpString="*.pwm") returned 5 [0091.531] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hardware Tracker.fdt", pszSpec="*.1cd") returned 0 [0091.531] lstrlenA (lpString="*.1cd") returned 5 [0091.531] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hardware Tracker.fdt", pszSpec="*.md") returned 0 [0091.531] lstrlenA (lpString="*.md") returned 4 [0091.531] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hardware Tracker.fdt", pszSpec="*.mdf") returned 0 [0091.531] lstrlenA (lpString="*.mdf") returned 5 [0091.531] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hardware Tracker.fdt", pszSpec="*.dbf") returned 0 [0091.531] lstrlenA (lpString="*.dbf") returned 5 [0091.531] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hardware Tracker.fdt", pszSpec="*.odt") returned 0 [0091.531] lstrlenA (lpString="*.odt") returned 5 [0091.531] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hardware Tracker.fdt", pszSpec="*.vob") returned 0 [0091.531] lstrlenA (lpString="*.vob") returned 5 [0091.531] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hardware Tracker.fdt", pszSpec="*.ifo") returned 0 [0091.531] lstrlenA (lpString="*.ifo") returned 5 [0091.531] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hardware Tracker.fdt", pszSpec="*.lnk") returned 0 [0091.531] lstrlenA (lpString="*.lnk") returned 5 [0091.531] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hardware Tracker.fdt", pszSpec="*.torrent") returned 0 [0091.531] lstrlenA (lpString="*.torrent") returned 9 [0091.531] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hardware Tracker.fdt", pszSpec="*.mov") returned 0 [0091.531] lstrlenA (lpString="*.mov") returned 5 [0091.531] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hardware Tracker.fdt", pszSpec="*.m2v") returned 0 [0091.531] lstrlenA (lpString="*.m2v") returned 5 [0091.531] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hardware Tracker.fdt", pszSpec="*.3gp") returned 0 [0091.531] lstrlenA (lpString="*.3gp") returned 5 [0091.531] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hardware Tracker.fdt", pszSpec="*.mpeg") returned 0 [0091.531] lstrlenA (lpString="*.mpeg") returned 6 [0091.531] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hardware Tracker.fdt", pszSpec="*.mpg") returned 0 [0091.531] lstrlenA (lpString="*.mpg") returned 5 [0091.531] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hardware Tracker.fdt", pszSpec="*.flv") returned 0 [0091.531] lstrlenA (lpString="*.flv") returned 5 [0091.531] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hardware Tracker.fdt", pszSpec="*.avi") returned 0 [0091.531] lstrlenA (lpString="*.avi") returned 5 [0091.531] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hardware Tracker.fdt", pszSpec="*.mp4") returned 0 [0091.531] lstrlenA (lpString="*.mp4") returned 5 [0091.531] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hardware Tracker.fdt", pszSpec="*.wmv") returned 0 [0091.531] lstrlenA (lpString="*.wmv") returned 5 [0091.531] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hardware Tracker.fdt", pszSpec="*.divx") returned 0 [0091.532] lstrlenA (lpString="*.divx") returned 6 [0091.532] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hardware Tracker.fdt", pszSpec="*.mkv") returned 0 [0091.532] lstrlenA (lpString="*.mkv") returned 5 [0091.532] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hardware Tracker.fdt", pszSpec="*.mp3") returned 0 [0091.532] lstrlenA (lpString="*.mp3") returned 5 [0091.532] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hardware Tracker.fdt", pszSpec="*.wav") returned 0 [0091.532] lstrlenA (lpString="*.wav") returned 5 [0091.532] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hardware Tracker.fdt", pszSpec="*.flac") returned 0 [0091.532] lstrlenA (lpString="*.flac") returned 6 [0091.532] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hardware Tracker.fdt", pszSpec="*.ape") returned 0 [0091.532] lstrlenA (lpString="*.ape") returned 5 [0091.532] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hardware Tracker.fdt", pszSpec="*.wma") returned 0 [0091.532] lstrlenA (lpString="*.wma") returned 5 [0091.532] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hardware Tracker.fdt", pszSpec="*.ac3") returned 0 [0091.532] lstrlenA (lpString="*.ac3") returned 5 [0091.532] FindNextFileA (in: hFindFile=0x5b7d70, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0091.532] PeekMessageA (in: lpMsg=0xaece4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaece4) returned 0 [0091.532] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Hiring Requisition - Customized.fdt") returned -1 [0091.532] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Hiring Requisition - Customized.fdt") returned 1 [0091.532] lstrcmpiA (lpString1="", lpString2="Hiring Requisition - Customized.fdt") returned -1 [0091.532] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hardware Tracker.fdt") returned="Hardware Tracker.fdt" [0091.532] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\", lpString2="Hiring Requisition - Customized.fdt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition - Customized.fdt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition - Customized.fdt" [0091.532] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition - Customized.fdt", pszSpec="*.zip") returned 0 [0091.532] lstrlenA (lpString="*.zip") returned 5 [0091.532] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition - Customized.fdt", pszSpec="*.rar") returned 0 [0091.532] lstrlenA (lpString="*.rar") returned 5 [0091.532] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition - Customized.fdt", pszSpec="*.7z") returned 0 [0091.532] lstrlenA (lpString="*.7z") returned 4 [0091.532] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition - Customized.fdt", pszSpec="*.tar") returned 0 [0091.532] lstrlenA (lpString="*.tar") returned 5 [0091.532] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition - Customized.fdt", pszSpec="*.gzip") returned 0 [0091.532] lstrlenA (lpString="*.gzip") returned 6 [0091.532] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition - Customized.fdt", pszSpec="*.jpg") returned 0 [0091.532] lstrlenA (lpString="*.jpg") returned 5 [0091.532] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition - Customized.fdt", pszSpec="*.jpeg") returned 0 [0091.532] lstrlenA (lpString="*.jpeg") returned 6 [0091.533] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition - Customized.fdt", pszSpec="*.psd") returned 0 [0091.533] lstrlenA (lpString="*.psd") returned 5 [0091.533] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition - Customized.fdt", pszSpec="*.cdr") returned 0 [0091.533] lstrlenA (lpString="*.cdr") returned 5 [0091.533] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition - Customized.fdt", pszSpec="*.dwg") returned 0 [0091.533] lstrlenA (lpString="*.dwg") returned 5 [0091.533] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition - Customized.fdt", pszSpec="*.max") returned 0 [0091.533] lstrlenA (lpString="*.max") returned 5 [0091.533] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition - Customized.fdt", pszSpec="*.bmp") returned 0 [0091.533] lstrlenA (lpString="*.bmp") returned 5 [0091.533] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition - Customized.fdt", pszSpec="*.gif") returned 0 [0091.533] lstrlenA (lpString="*.gif") returned 5 [0091.533] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition - Customized.fdt", pszSpec="*.png") returned 0 [0091.533] lstrlenA (lpString="*.png") returned 5 [0091.533] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition - Customized.fdt", pszSpec="*.doc") returned 0 [0091.533] lstrlenA (lpString="*.doc") returned 5 [0091.533] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition - Customized.fdt", pszSpec="*.docx") returned 0 [0091.533] lstrlenA (lpString="*.docx") returned 6 [0091.533] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition - Customized.fdt", pszSpec="*.xls") returned 0 [0091.533] lstrlenA (lpString="*.xls") returned 5 [0091.533] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition - Customized.fdt", pszSpec="*.xlsx") returned 0 [0091.533] lstrlenA (lpString="*.xlsx") returned 6 [0091.533] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition - Customized.fdt", pszSpec="*.ppt") returned 0 [0091.533] lstrlenA (lpString="*.ppt") returned 5 [0091.533] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition - Customized.fdt", pszSpec="*.pptx") returned 0 [0091.533] lstrlenA (lpString="*.pptx") returned 6 [0091.533] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition - Customized.fdt", pszSpec="*.txt") returned 0 [0091.533] lstrlenA (lpString="*.txt") returned 5 [0091.533] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition - Customized.fdt", pszSpec="*.pdf") returned 0 [0091.533] lstrlenA (lpString="*.pdf") returned 5 [0091.533] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition - Customized.fdt", pszSpec="*.djvu") returned 0 [0091.533] lstrlenA (lpString="*.djvu") returned 6 [0091.533] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition - Customized.fdt", pszSpec="*.htm") returned 0 [0091.533] lstrlenA (lpString="*.htm") returned 5 [0091.533] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition - Customized.fdt", pszSpec="*.html") returned 0 [0091.533] lstrlenA (lpString="*.html") returned 6 [0091.533] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition - Customized.fdt", pszSpec="*.mdb") returned 0 [0091.533] lstrlenA (lpString="*.mdb") returned 5 [0091.533] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition - Customized.fdt", pszSpec="*.cer") returned 0 [0091.533] lstrlenA (lpString="*.cer") returned 5 [0091.533] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition - Customized.fdt", pszSpec="*.p12") returned 0 [0091.533] lstrlenA (lpString="*.p12") returned 5 [0091.533] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition - Customized.fdt", pszSpec="*.pfx") returned 0 [0091.533] lstrlenA (lpString="*.pfx") returned 5 [0091.533] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition - Customized.fdt", pszSpec="*.kwm") returned 0 [0091.533] lstrlenA (lpString="*.kwm") returned 5 [0091.533] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition - Customized.fdt", pszSpec="*.pwm") returned 0 [0091.533] lstrlenA (lpString="*.pwm") returned 5 [0091.534] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition - Customized.fdt", pszSpec="*.1cd") returned 0 [0091.534] lstrlenA (lpString="*.1cd") returned 5 [0091.534] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition - Customized.fdt", pszSpec="*.md") returned 0 [0091.534] lstrlenA (lpString="*.md") returned 4 [0091.534] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition - Customized.fdt", pszSpec="*.mdf") returned 0 [0091.534] lstrlenA (lpString="*.mdf") returned 5 [0091.534] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition - Customized.fdt", pszSpec="*.dbf") returned 0 [0091.534] lstrlenA (lpString="*.dbf") returned 5 [0091.534] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition - Customized.fdt", pszSpec="*.odt") returned 0 [0091.534] lstrlenA (lpString="*.odt") returned 5 [0091.534] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition - Customized.fdt", pszSpec="*.vob") returned 0 [0091.534] lstrlenA (lpString="*.vob") returned 5 [0091.534] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition - Customized.fdt", pszSpec="*.ifo") returned 0 [0091.534] lstrlenA (lpString="*.ifo") returned 5 [0091.534] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition - Customized.fdt", pszSpec="*.lnk") returned 0 [0091.534] lstrlenA (lpString="*.lnk") returned 5 [0091.534] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition - Customized.fdt", pszSpec="*.torrent") returned 0 [0091.534] lstrlenA (lpString="*.torrent") returned 9 [0091.534] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition - Customized.fdt", pszSpec="*.mov") returned 0 [0091.534] lstrlenA (lpString="*.mov") returned 5 [0091.534] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition - Customized.fdt", pszSpec="*.m2v") returned 0 [0091.534] lstrlenA (lpString="*.m2v") returned 5 [0091.534] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition - Customized.fdt", pszSpec="*.3gp") returned 0 [0091.534] lstrlenA (lpString="*.3gp") returned 5 [0091.534] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition - Customized.fdt", pszSpec="*.mpeg") returned 0 [0091.534] lstrlenA (lpString="*.mpeg") returned 6 [0091.534] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition - Customized.fdt", pszSpec="*.mpg") returned 0 [0091.534] lstrlenA (lpString="*.mpg") returned 5 [0091.534] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition - Customized.fdt", pszSpec="*.flv") returned 0 [0091.534] lstrlenA (lpString="*.flv") returned 5 [0091.534] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition - Customized.fdt", pszSpec="*.avi") returned 0 [0091.534] lstrlenA (lpString="*.avi") returned 5 [0091.534] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition - Customized.fdt", pszSpec="*.mp4") returned 0 [0091.534] lstrlenA (lpString="*.mp4") returned 5 [0091.534] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition - Customized.fdt", pszSpec="*.wmv") returned 0 [0091.534] lstrlenA (lpString="*.wmv") returned 5 [0091.534] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition - Customized.fdt", pszSpec="*.divx") returned 0 [0091.534] lstrlenA (lpString="*.divx") returned 6 [0091.534] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition - Customized.fdt", pszSpec="*.mkv") returned 0 [0091.534] lstrlenA (lpString="*.mkv") returned 5 [0091.534] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition - Customized.fdt", pszSpec="*.mp3") returned 0 [0091.534] lstrlenA (lpString="*.mp3") returned 5 [0091.534] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition - Customized.fdt", pszSpec="*.wav") returned 0 [0091.534] lstrlenA (lpString="*.wav") returned 5 [0091.534] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition - Customized.fdt", pszSpec="*.flac") returned 0 [0091.534] lstrlenA (lpString="*.flac") returned 6 [0091.534] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition - Customized.fdt", pszSpec="*.ape") returned 0 [0091.534] lstrlenA (lpString="*.ape") returned 5 [0091.534] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition - Customized.fdt", pszSpec="*.wma") returned 0 [0091.534] lstrlenA (lpString="*.wma") returned 5 [0091.534] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition - Customized.fdt", pszSpec="*.ac3") returned 0 [0091.535] lstrlenA (lpString="*.ac3") returned 5 [0091.535] FindNextFileA (in: hFindFile=0x5b7d70, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0091.535] PeekMessageA (in: lpMsg=0xaece4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaece4) returned 0 [0091.535] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Hiring Requisition.fdt") returned -1 [0091.535] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Hiring Requisition.fdt") returned 1 [0091.535] lstrcmpiA (lpString1="", lpString2="Hiring Requisition.fdt") returned -1 [0091.535] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition - Customized.fdt") returned="Hiring Requisition - Customized.fdt" [0091.535] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\", lpString2="Hiring Requisition.fdt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition.fdt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition.fdt" [0091.535] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition.fdt", pszSpec="*.zip") returned 0 [0091.535] lstrlenA (lpString="*.zip") returned 5 [0091.535] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition.fdt", pszSpec="*.rar") returned 0 [0091.535] lstrlenA (lpString="*.rar") returned 5 [0091.535] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition.fdt", pszSpec="*.7z") returned 0 [0091.535] lstrlenA (lpString="*.7z") returned 4 [0091.535] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition.fdt", pszSpec="*.tar") returned 0 [0091.535] lstrlenA (lpString="*.tar") returned 5 [0091.535] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition.fdt", pszSpec="*.gzip") returned 0 [0091.535] lstrlenA (lpString="*.gzip") returned 6 [0091.535] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition.fdt", pszSpec="*.jpg") returned 0 [0091.535] lstrlenA (lpString="*.jpg") returned 5 [0091.535] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition.fdt", pszSpec="*.jpeg") returned 0 [0091.535] lstrlenA (lpString="*.jpeg") returned 6 [0091.535] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition.fdt", pszSpec="*.psd") returned 0 [0091.535] lstrlenA (lpString="*.psd") returned 5 [0091.535] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition.fdt", pszSpec="*.cdr") returned 0 [0091.535] lstrlenA (lpString="*.cdr") returned 5 [0091.535] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition.fdt", pszSpec="*.dwg") returned 0 [0091.535] lstrlenA (lpString="*.dwg") returned 5 [0091.535] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition.fdt", pszSpec="*.max") returned 0 [0091.535] lstrlenA (lpString="*.max") returned 5 [0091.535] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition.fdt", pszSpec="*.bmp") returned 0 [0091.535] lstrlenA (lpString="*.bmp") returned 5 [0091.535] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition.fdt", pszSpec="*.gif") returned 0 [0091.535] lstrlenA (lpString="*.gif") returned 5 [0091.535] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition.fdt", pszSpec="*.png") returned 0 [0091.535] lstrlenA (lpString="*.png") returned 5 [0091.535] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition.fdt", pszSpec="*.doc") returned 0 [0091.535] lstrlenA (lpString="*.doc") returned 5 [0091.535] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition.fdt", pszSpec="*.docx") returned 0 [0091.535] lstrlenA (lpString="*.docx") returned 6 [0091.535] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition.fdt", pszSpec="*.xls") returned 0 [0091.535] lstrlenA (lpString="*.xls") returned 5 [0091.535] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition.fdt", pszSpec="*.xlsx") returned 0 [0091.535] lstrlenA (lpString="*.xlsx") returned 6 [0091.535] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition.fdt", pszSpec="*.ppt") returned 0 [0091.535] lstrlenA (lpString="*.ppt") returned 5 [0091.535] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition.fdt", pszSpec="*.pptx") returned 0 [0091.535] lstrlenA (lpString="*.pptx") returned 6 [0091.535] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition.fdt", pszSpec="*.txt") returned 0 [0091.535] lstrlenA (lpString="*.txt") returned 5 [0091.536] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition.fdt", pszSpec="*.pdf") returned 0 [0091.536] lstrlenA (lpString="*.pdf") returned 5 [0091.536] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition.fdt", pszSpec="*.djvu") returned 0 [0091.536] lstrlenA (lpString="*.djvu") returned 6 [0091.536] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition.fdt", pszSpec="*.htm") returned 0 [0091.536] lstrlenA (lpString="*.htm") returned 5 [0091.536] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition.fdt", pszSpec="*.html") returned 0 [0091.536] lstrlenA (lpString="*.html") returned 6 [0091.536] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition.fdt", pszSpec="*.mdb") returned 0 [0091.536] lstrlenA (lpString="*.mdb") returned 5 [0091.536] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition.fdt", pszSpec="*.cer") returned 0 [0091.536] lstrlenA (lpString="*.cer") returned 5 [0091.536] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition.fdt", pszSpec="*.p12") returned 0 [0091.536] lstrlenA (lpString="*.p12") returned 5 [0091.536] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition.fdt", pszSpec="*.pfx") returned 0 [0091.536] lstrlenA (lpString="*.pfx") returned 5 [0091.536] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition.fdt", pszSpec="*.kwm") returned 0 [0091.536] lstrlenA (lpString="*.kwm") returned 5 [0091.536] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition.fdt", pszSpec="*.pwm") returned 0 [0091.536] lstrlenA (lpString="*.pwm") returned 5 [0091.536] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition.fdt", pszSpec="*.1cd") returned 0 [0091.536] lstrlenA (lpString="*.1cd") returned 5 [0091.536] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition.fdt", pszSpec="*.md") returned 0 [0091.536] lstrlenA (lpString="*.md") returned 4 [0091.536] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition.fdt", pszSpec="*.mdf") returned 0 [0091.536] lstrlenA (lpString="*.mdf") returned 5 [0091.536] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition.fdt", pszSpec="*.dbf") returned 0 [0091.536] lstrlenA (lpString="*.dbf") returned 5 [0091.536] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition.fdt", pszSpec="*.odt") returned 0 [0091.536] lstrlenA (lpString="*.odt") returned 5 [0091.536] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition.fdt", pszSpec="*.vob") returned 0 [0091.536] lstrlenA (lpString="*.vob") returned 5 [0091.536] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition.fdt", pszSpec="*.ifo") returned 0 [0091.536] lstrlenA (lpString="*.ifo") returned 5 [0091.536] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition.fdt", pszSpec="*.lnk") returned 0 [0091.536] lstrlenA (lpString="*.lnk") returned 5 [0091.536] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition.fdt", pszSpec="*.torrent") returned 0 [0091.536] lstrlenA (lpString="*.torrent") returned 9 [0091.536] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition.fdt", pszSpec="*.mov") returned 0 [0091.536] lstrlenA (lpString="*.mov") returned 5 [0091.536] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition.fdt", pszSpec="*.m2v") returned 0 [0091.536] lstrlenA (lpString="*.m2v") returned 5 [0091.536] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition.fdt", pszSpec="*.3gp") returned 0 [0091.536] lstrlenA (lpString="*.3gp") returned 5 [0091.536] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition.fdt", pszSpec="*.mpeg") returned 0 [0091.536] lstrlenA (lpString="*.mpeg") returned 6 [0091.536] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition.fdt", pszSpec="*.mpg") returned 0 [0091.536] lstrlenA (lpString="*.mpg") returned 5 [0091.536] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition.fdt", pszSpec="*.flv") returned 0 [0091.536] lstrlenA (lpString="*.flv") returned 5 [0091.536] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition.fdt", pszSpec="*.avi") returned 0 [0091.537] lstrlenA (lpString="*.avi") returned 5 [0091.537] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition.fdt", pszSpec="*.mp4") returned 0 [0091.537] lstrlenA (lpString="*.mp4") returned 5 [0091.537] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition.fdt", pszSpec="*.wmv") returned 0 [0091.537] lstrlenA (lpString="*.wmv") returned 5 [0091.537] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition.fdt", pszSpec="*.divx") returned 0 [0091.537] lstrlenA (lpString="*.divx") returned 6 [0091.537] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition.fdt", pszSpec="*.mkv") returned 0 [0091.537] lstrlenA (lpString="*.mkv") returned 5 [0091.537] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition.fdt", pszSpec="*.mp3") returned 0 [0091.537] lstrlenA (lpString="*.mp3") returned 5 [0091.537] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition.fdt", pszSpec="*.wav") returned 0 [0091.537] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition.fdt", pszSpec="*.flac") returned 0 [0091.537] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition.fdt", pszSpec="*.ape") returned 0 [0091.537] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition.fdt", pszSpec="*.wma") returned 0 [0091.537] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition.fdt", pszSpec="*.ac3") returned 0 [0091.537] FindNextFileA (in: hFindFile=0x5b7d70, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0091.537] PeekMessageA (in: lpMsg=0xaece4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaece4) returned 0 [0091.537] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="POLICIES.FDT") returned -1 [0091.537] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="POLICIES.FDT") returned -1 [0091.537] lstrcmpiA (lpString1="", lpString2="POLICIES.FDT") returned -1 [0091.537] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition.fdt") returned="Hiring Requisition.fdt" [0091.537] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\", lpString2="POLICIES.FDT" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\POLICIES.FDT") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\POLICIES.FDT" [0091.537] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\POLICIES.FDT", pszSpec="*.zip") returned 0 [0091.537] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\POLICIES.FDT", pszSpec="*.rar") returned 0 [0091.537] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\POLICIES.FDT", pszSpec="*.7z") returned 0 [0091.537] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\POLICIES.FDT", pszSpec="*.tar") returned 0 [0091.537] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\POLICIES.FDT", pszSpec="*.gzip") returned 0 [0091.537] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\POLICIES.FDT", pszSpec="*.jpg") returned 0 [0091.537] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\POLICIES.FDT", pszSpec="*.jpeg") returned 0 [0091.537] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\POLICIES.FDT", pszSpec="*.psd") returned 0 [0091.537] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\POLICIES.FDT", pszSpec="*.cdr") returned 0 [0091.537] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\POLICIES.FDT", pszSpec="*.dwg") returned 0 [0091.537] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\POLICIES.FDT", pszSpec="*.max") returned 0 [0091.537] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\POLICIES.FDT", pszSpec="*.bmp") returned 0 [0091.538] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\POLICIES.FDT", pszSpec="*.gif") returned 0 [0091.538] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\POLICIES.FDT", pszSpec="*.png") returned 0 [0091.538] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\POLICIES.FDT", pszSpec="*.doc") returned 0 [0091.538] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\POLICIES.FDT", pszSpec="*.docx") returned 0 [0091.538] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\POLICIES.FDT", pszSpec="*.xls") returned 0 [0091.538] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\POLICIES.FDT", pszSpec="*.xlsx") returned 0 [0091.538] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\POLICIES.FDT", pszSpec="*.ppt") returned 0 [0091.538] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\POLICIES.FDT", pszSpec="*.pptx") returned 0 [0091.538] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\POLICIES.FDT", pszSpec="*.txt") returned 0 [0091.538] FindNextFileA (in: hFindFile=0x5b7d70, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0091.538] PeekMessageA (in: lpMsg=0xaece4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaece4) returned 0 [0091.538] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Process Library.fdt") returned -1 [0091.538] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Process Library.fdt") returned -1 [0091.538] lstrcmpiA (lpString1="", lpString2="Process Library.fdt") returned -1 [0091.538] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\POLICIES.FDT") returned="POLICIES.FDT" [0091.538] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\", lpString2="Process Library.fdt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Process Library.fdt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Process Library.fdt" [0091.538] FindNextFileA (in: hFindFile=0x5b7d70, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0091.538] PeekMessageA (in: lpMsg=0xaece4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaece4) returned 0 [0091.538] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Status Report.fdt") returned -1 [0091.538] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Status Report.fdt") returned -1 [0091.538] lstrcmpiA (lpString1="", lpString2="Status Report.fdt") returned -1 [0091.538] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Process Library.fdt") returned="Process Library.fdt" [0091.538] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\", lpString2="Status Report.fdt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Status Report.fdt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Status Report.fdt" [0091.538] FindNextFileA (in: hFindFile=0x5b7d70, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0091.538] PeekMessageA (in: lpMsg=0xaece4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaece4) returned 0 [0091.538] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Track Issues.fdt") returned -1 [0091.538] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Track Issues.fdt") returned -1 [0091.538] lstrcmpiA (lpString1="", lpString2="Track Issues.fdt") returned -1 [0091.538] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Status Report.fdt") returned="Status Report.fdt" [0091.538] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\", lpString2="Track Issues.fdt" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Track Issues.fdt") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Track Issues.fdt" [0091.539] FindNextFileA (in: hFindFile=0x5b7d70, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 0 [0091.539] FindClose (in: hFindFile=0x5b7d70 | out: hFindFile=0x5b7d70) returned 1 [0091.539] FindNextFileA (in: hFindFile=0x5b7d30, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0091.539] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0091.539] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="FormsVersion1Warning.htm") returned -1 [0091.540] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FormsVersion1Warning.htm") returned 1 [0091.540] lstrcmpiA (lpString1="", lpString2="FormsVersion1Warning.htm") returned -1 [0091.540] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\*.*") returned="*.*" [0091.540] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="FormsVersion1Warning.htm" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsVersion1Warning.htm") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsVersion1Warning.htm" [0091.540] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsVersion1Warning.htm" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsVersion1Warning.htm") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsVersion1Warning.htm" [0091.540] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsVersion1Warning.htm" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsVersion1Warning.htm") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsVersion1Warning.htm" [0091.540] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsVersion1Warning.htm", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsVersion1Warning.htm.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsVersion1Warning.htm." [0091.540] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsVersion1Warning.htm.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsVersion1Warning.htm. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsVersion1Warning.htm. " [0091.540] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsVersion1Warning.htm" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formsversion1warning.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0091.541] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x6fc [0091.541] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x899c7500, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x618eeb70, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x899c7500, dwHighDateTime=0x1c747ea)) returned 1 [0091.541] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0091.541] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x6a2, lpOverlapped=0x0) returned 1 [0091.546] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsVersion1Warning.htm") returned="FormsVersion1Warning.htm" [0091.546] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0091.546] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x6a2, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x6a2, lpOverlapped=0x0) returned 1 [0091.547] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0091.547] CloseHandle (hObject=0x98) returned 1 [0091.547] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsVersion1Warning.htm" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formsversion1warning.htm"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsVersion1Warning.htm. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formsversion1warning.htm. ")) returned 1 [0091.549] FindNextFileA (in: hFindFile=0x5b7d30, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0091.549] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0091.549] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="FormsViewAttachmentIcons.jpg") returned -1 [0091.549] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FormsViewAttachmentIcons.jpg") returned 1 [0091.549] lstrcmpiA (lpString1="", lpString2="FormsViewAttachmentIcons.jpg") returned -1 [0091.549] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsVersion1Warning.htm") returned="FormsVersion1Warning.htm" [0091.549] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="FormsViewAttachmentIcons.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIcons.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIcons.jpg" [0091.549] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIcons.jpg", pszSpec="*.zip") returned 0 [0091.549] lstrlenA (lpString="*.zip") returned 5 [0091.549] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIcons.jpg", pszSpec="*.rar") returned 0 [0091.549] lstrlenA (lpString="*.rar") returned 5 [0091.549] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIcons.jpg", pszSpec="*.7z") returned 0 [0091.549] lstrlenA (lpString="*.7z") returned 4 [0091.549] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIcons.jpg", pszSpec="*.tar") returned 0 [0091.549] lstrlenA (lpString="*.tar") returned 5 [0091.549] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIcons.jpg", pszSpec="*.gzip") returned 0 [0091.549] lstrlenA (lpString="*.gzip") returned 6 [0091.549] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIcons.jpg", pszSpec="*.jpg") returned 1 [0091.549] lstrlenA (lpString="*.jpg") returned 5 [0091.549] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIcons.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIcons.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIcons.jpg" [0091.549] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIcons.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIcons.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIcons.jpg" [0091.549] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIcons.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIcons.jpg.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIcons.jpg." [0091.549] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIcons.jpg.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIcons.jpg. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIcons.jpg. " [0091.549] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIcons.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formsviewattachmenticons.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0091.550] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1499 [0091.550] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x899c7500, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x618eeb70, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x899c7500, dwHighDateTime=0x1c747ea)) returned 1 [0091.550] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0091.550] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x143f, lpOverlapped=0x0) returned 1 [0091.551] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIcons.jpg") returned="FormsViewAttachmentIcons.jpg" [0091.551] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0091.551] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x143f, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x143f, lpOverlapped=0x0) returned 1 [0091.552] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0091.552] CloseHandle (hObject=0x98) returned 1 [0091.553] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIcons.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formsviewattachmenticons.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIcons.jpg. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formsviewattachmenticons.jpg. ")) returned 1 [0091.553] FindNextFileA (in: hFindFile=0x5b7d30, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0091.554] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0091.554] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="FormsViewAttachmentIconsMask.bmp") returned -1 [0091.554] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FormsViewAttachmentIconsMask.bmp") returned 1 [0091.554] lstrcmpiA (lpString1="", lpString2="FormsViewAttachmentIconsMask.bmp") returned -1 [0091.554] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIcons.jpg") returned="FormsViewAttachmentIcons.jpg" [0091.554] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="FormsViewAttachmentIconsMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIconsMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIconsMask.bmp" [0091.554] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.zip") returned 0 [0091.554] lstrlenA (lpString="*.zip") returned 5 [0091.554] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.rar") returned 0 [0091.554] lstrlenA (lpString="*.rar") returned 5 [0091.554] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.7z") returned 0 [0091.554] lstrlenA (lpString="*.7z") returned 4 [0091.554] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.tar") returned 0 [0091.554] lstrlenA (lpString="*.tar") returned 5 [0091.554] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.gzip") returned 0 [0091.554] lstrlenA (lpString="*.gzip") returned 6 [0091.554] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.jpg") returned 0 [0091.554] lstrlenA (lpString="*.jpg") returned 5 [0091.554] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.jpeg") returned 0 [0091.554] lstrlenA (lpString="*.jpeg") returned 6 [0091.554] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.psd") returned 0 [0091.554] lstrlenA (lpString="*.psd") returned 5 [0091.554] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.cdr") returned 0 [0091.554] lstrlenA (lpString="*.cdr") returned 5 [0091.554] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.dwg") returned 0 [0091.554] lstrlenA (lpString="*.dwg") returned 5 [0091.554] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.max") returned 0 [0091.554] lstrlenA (lpString="*.max") returned 5 [0091.554] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.bmp") returned 1 [0091.554] lstrlenA (lpString="*.bmp") returned 5 [0091.554] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIconsMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIconsMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIconsMask.bmp" [0091.554] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIconsMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIconsMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIconsMask.bmp" [0091.554] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIconsMask.bmp", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIconsMask.bmp.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIconsMask.bmp." [0091.554] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIconsMask.bmp.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIconsMask.bmp. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIconsMask.bmp. " [0091.554] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIconsMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formsviewattachmenticonsmask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0091.555] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x638 [0091.555] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x899c7500, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5298e710, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x899c7500, dwHighDateTime=0x1c747ea)) returned 1 [0091.555] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0091.555] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x5de, lpOverlapped=0x0) returned 1 [0091.570] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIconsMask.bmp") returned="FormsViewAttachmentIconsMask.bmp" [0091.570] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0091.570] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x5de, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x5de, lpOverlapped=0x0) returned 1 [0091.570] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0091.570] CloseHandle (hObject=0x98) returned 1 [0091.571] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIconsMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formsviewattachmenticonsmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIconsMask.bmp. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formsviewattachmenticonsmask.bmp. ")) returned 1 [0091.572] FindNextFileA (in: hFindFile=0x5b7d30, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0091.572] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0091.572] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="FormsViewFrame.html") returned -1 [0091.572] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FormsViewFrame.html") returned 1 [0091.572] lstrcmpiA (lpString1="", lpString2="FormsViewFrame.html") returned -1 [0091.572] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIconsMask.bmp") returned="FormsViewAttachmentIconsMask.bmp" [0091.573] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="FormsViewFrame.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewFrame.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewFrame.html" [0091.573] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewFrame.html", pszSpec="*.zip") returned 0 [0091.573] lstrlenA (lpString="*.zip") returned 5 [0091.573] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewFrame.html", pszSpec="*.rar") returned 0 [0091.573] lstrlenA (lpString="*.rar") returned 5 [0091.573] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewFrame.html", pszSpec="*.7z") returned 0 [0091.573] lstrlenA (lpString="*.7z") returned 4 [0091.573] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewFrame.html", pszSpec="*.tar") returned 0 [0091.573] lstrlenA (lpString="*.tar") returned 5 [0091.573] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewFrame.html", pszSpec="*.gzip") returned 0 [0091.573] lstrlenA (lpString="*.gzip") returned 6 [0091.573] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewFrame.html", pszSpec="*.jpg") returned 0 [0091.573] lstrlenA (lpString="*.jpg") returned 5 [0091.573] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewFrame.html", pszSpec="*.jpeg") returned 0 [0091.573] lstrlenA (lpString="*.jpeg") returned 6 [0091.573] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewFrame.html", pszSpec="*.psd") returned 0 [0091.573] lstrlenA (lpString="*.psd") returned 5 [0091.573] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewFrame.html", pszSpec="*.cdr") returned 0 [0091.573] lstrlenA (lpString="*.cdr") returned 5 [0091.573] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewFrame.html", pszSpec="*.dwg") returned 0 [0091.573] lstrlenA (lpString="*.dwg") returned 5 [0091.573] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewFrame.html", pszSpec="*.max") returned 0 [0091.573] lstrlenA (lpString="*.max") returned 5 [0091.573] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewFrame.html", pszSpec="*.bmp") returned 0 [0091.573] lstrlenA (lpString="*.bmp") returned 5 [0091.573] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewFrame.html", pszSpec="*.gif") returned 0 [0091.573] lstrlenA (lpString="*.gif") returned 5 [0091.573] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewFrame.html", pszSpec="*.png") returned 0 [0091.574] lstrlenA (lpString="*.png") returned 5 [0091.574] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewFrame.html", pszSpec="*.doc") returned 0 [0091.574] lstrlenA (lpString="*.doc") returned 5 [0091.574] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewFrame.html", pszSpec="*.docx") returned 0 [0091.574] lstrlenA (lpString="*.docx") returned 6 [0091.574] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewFrame.html", pszSpec="*.xls") returned 0 [0091.574] lstrlenA (lpString="*.xls") returned 5 [0091.574] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewFrame.html", pszSpec="*.xlsx") returned 0 [0091.574] lstrlenA (lpString="*.xlsx") returned 6 [0091.574] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewFrame.html", pszSpec="*.ppt") returned 0 [0091.574] lstrlenA (lpString="*.ppt") returned 5 [0091.574] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewFrame.html", pszSpec="*.pptx") returned 0 [0091.574] lstrlenA (lpString="*.pptx") returned 6 [0091.574] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewFrame.html", pszSpec="*.txt") returned 0 [0091.574] lstrlenA (lpString="*.txt") returned 5 [0091.574] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewFrame.html", pszSpec="*.pdf") returned 0 [0091.574] lstrlenA (lpString="*.pdf") returned 5 [0091.574] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewFrame.html", pszSpec="*.djvu") returned 0 [0091.574] lstrlenA (lpString="*.djvu") returned 6 [0091.574] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewFrame.html", pszSpec="*.htm") returned 0 [0091.574] lstrlenA (lpString="*.htm") returned 5 [0091.574] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewFrame.html", pszSpec="*.html") returned 1 [0091.574] lstrlenA (lpString="*.html") returned 6 [0091.574] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewFrame.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewFrame.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewFrame.html" [0091.574] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewFrame.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewFrame.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewFrame.html" [0091.574] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewFrame.html", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewFrame.html.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewFrame.html." [0091.574] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewFrame.html.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewFrame.html. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewFrame.html. " [0091.574] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewFrame.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formsviewframe.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0091.575] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xfa1 [0091.575] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x899c7500, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x618eeb70, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x899c7500, dwHighDateTime=0x1c747ea)) returned 1 [0091.575] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0091.575] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0xf47, lpOverlapped=0x0) returned 1 [0091.577] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewFrame.html") returned="FormsViewFrame.html" [0091.577] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0091.577] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0xf47, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0xf47, lpOverlapped=0x0) returned 1 [0091.577] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0091.577] CloseHandle (hObject=0x98) returned 1 [0091.578] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewFrame.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formsviewframe.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewFrame.html. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formsviewframe.html. ")) returned 1 [0091.579] FindNextFileA (in: hFindFile=0x5b7d30, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0091.579] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0091.579] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="FormToolImages.jpg") returned -1 [0091.579] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FormToolImages.jpg") returned 1 [0091.579] lstrcmpiA (lpString1="", lpString2="FormToolImages.jpg") returned -1 [0091.579] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewFrame.html") returned="FormsViewFrame.html" [0091.579] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="FormToolImages.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormToolImages.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormToolImages.jpg" [0091.579] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormToolImages.jpg", pszSpec="*.zip") returned 0 [0091.579] lstrlenA (lpString="*.zip") returned 5 [0091.579] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormToolImages.jpg", pszSpec="*.rar") returned 0 [0091.579] lstrlenA (lpString="*.rar") returned 5 [0091.579] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormToolImages.jpg", pszSpec="*.7z") returned 0 [0091.579] lstrlenA (lpString="*.7z") returned 4 [0091.579] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormToolImages.jpg", pszSpec="*.tar") returned 0 [0091.579] lstrlenA (lpString="*.tar") returned 5 [0091.579] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormToolImages.jpg", pszSpec="*.gzip") returned 0 [0091.579] lstrlenA (lpString="*.gzip") returned 6 [0091.579] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormToolImages.jpg", pszSpec="*.jpg") returned 1 [0091.579] lstrlenA (lpString="*.jpg") returned 5 [0091.579] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormToolImages.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormToolImages.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormToolImages.jpg" [0091.579] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormToolImages.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormToolImages.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormToolImages.jpg" [0091.579] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormToolImages.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormToolImages.jpg.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormToolImages.jpg." [0091.579] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormToolImages.jpg.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormToolImages.jpg. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormToolImages.jpg. " [0091.579] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormToolImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formtoolimages.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0091.580] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1bfb [0091.581] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x899c7500, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x529b4870, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x899c7500, dwHighDateTime=0x1c747ea)) returned 1 [0091.581] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0091.581] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x1ba1, lpOverlapped=0x0) returned 1 [0091.612] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormToolImages.jpg") returned="FormToolImages.jpg" [0091.612] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0091.612] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x1ba1, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x1ba1, lpOverlapped=0x0) returned 1 [0091.612] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0091.612] CloseHandle (hObject=0x98) returned 1 [0091.613] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormToolImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formtoolimages.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormToolImages.jpg. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formtoolimages.jpg. ")) returned 1 [0091.613] FindNextFileA (in: hFindFile=0x5b7d30, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0091.613] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0091.613] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="GrooveFormsMetaData.xml") returned -1 [0091.613] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="GrooveFormsMetaData.xml") returned 1 [0091.613] lstrcmpiA (lpString1="", lpString2="GrooveFormsMetaData.xml") returned -1 [0091.613] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormToolImages.jpg") returned="FormToolImages.jpg" [0091.613] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="GrooveFormsMetaData.xml" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\GrooveFormsMetaData.xml") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\GrooveFormsMetaData.xml" [0091.614] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\GrooveFormsMetaData.xml", pszSpec="*.zip") returned 0 [0091.614] lstrlenA (lpString="*.zip") returned 5 [0091.614] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\GrooveFormsMetaData.xml", pszSpec="*.rar") returned 0 [0091.614] lstrlenA (lpString="*.rar") returned 5 [0091.614] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\GrooveFormsMetaData.xml", pszSpec="*.7z") returned 0 [0091.614] lstrlenA (lpString="*.7z") returned 4 [0091.614] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\GrooveFormsMetaData.xml", pszSpec="*.tar") returned 0 [0091.614] lstrlenA (lpString="*.tar") returned 5 [0091.614] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\GrooveFormsMetaData.xml", pszSpec="*.gzip") returned 0 [0091.614] lstrlenA (lpString="*.gzip") returned 6 [0091.614] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\GrooveFormsMetaData.xml", pszSpec="*.jpg") returned 0 [0091.614] lstrlenA (lpString="*.jpg") returned 5 [0091.614] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\GrooveFormsMetaData.xml", pszSpec="*.jpeg") returned 0 [0091.614] lstrlenA (lpString="*.jpeg") returned 6 [0091.614] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\GrooveFormsMetaData.xml", pszSpec="*.psd") returned 0 [0091.614] lstrlenA (lpString="*.psd") returned 5 [0091.614] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\GrooveFormsMetaData.xml", pszSpec="*.cdr") returned 0 [0091.614] lstrlenA (lpString="*.cdr") returned 5 [0091.614] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\GrooveFormsMetaData.xml", pszSpec="*.dwg") returned 0 [0091.614] lstrlenA (lpString="*.dwg") returned 5 [0091.614] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\GrooveFormsMetaData.xml", pszSpec="*.max") returned 0 [0091.614] lstrlenA (lpString="*.max") returned 5 [0091.614] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\GrooveFormsMetaData.xml", pszSpec="*.bmp") returned 0 [0091.614] lstrlenA (lpString="*.bmp") returned 5 [0091.614] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\GrooveFormsMetaData.xml", pszSpec="*.gif") returned 0 [0091.614] lstrlenA (lpString="*.gif") returned 5 [0091.614] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\GrooveFormsMetaData.xml", pszSpec="*.png") returned 0 [0091.614] lstrlenA (lpString="*.png") returned 5 [0091.614] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\GrooveFormsMetaData.xml", pszSpec="*.doc") returned 0 [0091.614] lstrlenA (lpString="*.doc") returned 5 [0091.614] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\GrooveFormsMetaData.xml", pszSpec="*.docx") returned 0 [0091.614] lstrlenA (lpString="*.docx") returned 6 [0091.614] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\GrooveFormsMetaData.xml", pszSpec="*.xls") returned 0 [0091.614] lstrlenA (lpString="*.xls") returned 5 [0091.614] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\GrooveFormsMetaData.xml", pszSpec="*.xlsx") returned 0 [0091.614] lstrlenA (lpString="*.xlsx") returned 6 [0091.614] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\GrooveFormsMetaData.xml", pszSpec="*.ppt") returned 0 [0091.614] lstrlenA (lpString="*.ppt") returned 5 [0091.614] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\GrooveFormsMetaData.xml", pszSpec="*.pptx") returned 0 [0091.614] lstrlenA (lpString="*.pptx") returned 6 [0091.614] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\GrooveFormsMetaData.xml", pszSpec="*.txt") returned 0 [0091.614] lstrlenA (lpString="*.txt") returned 5 [0091.614] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\GrooveFormsMetaData.xml", pszSpec="*.pdf") returned 0 [0091.614] lstrlenA (lpString="*.pdf") returned 5 [0091.614] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\GrooveFormsMetaData.xml", pszSpec="*.djvu") returned 0 [0091.614] lstrlenA (lpString="*.djvu") returned 6 [0091.615] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\GrooveFormsMetaData.xml", pszSpec="*.htm") returned 0 [0091.615] lstrlenA (lpString="*.htm") returned 5 [0091.615] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\GrooveFormsMetaData.xml", pszSpec="*.html") returned 0 [0091.615] lstrlenA (lpString="*.html") returned 6 [0091.615] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\GrooveFormsMetaData.xml", pszSpec="*.mdb") returned 0 [0091.615] lstrlenA (lpString="*.mdb") returned 5 [0091.615] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\GrooveFormsMetaData.xml", pszSpec="*.cer") returned 0 [0091.615] lstrlenA (lpString="*.cer") returned 5 [0091.615] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\GrooveFormsMetaData.xml", pszSpec="*.p12") returned 0 [0091.615] lstrlenA (lpString="*.p12") returned 5 [0091.615] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\GrooveFormsMetaData.xml", pszSpec="*.pfx") returned 0 [0091.615] lstrlenA (lpString="*.pfx") returned 5 [0091.615] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\GrooveFormsMetaData.xml", pszSpec="*.kwm") returned 0 [0091.615] lstrlenA (lpString="*.kwm") returned 5 [0091.615] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\GrooveFormsMetaData.xml", pszSpec="*.pwm") returned 0 [0091.615] lstrlenA (lpString="*.pwm") returned 5 [0091.615] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\GrooveFormsMetaData.xml", pszSpec="*.1cd") returned 0 [0091.615] lstrlenA (lpString="*.1cd") returned 5 [0091.615] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\GrooveFormsMetaData.xml", pszSpec="*.md") returned 0 [0091.615] lstrlenA (lpString="*.md") returned 4 [0091.615] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\GrooveFormsMetaData.xml", pszSpec="*.mdf") returned 0 [0091.615] lstrlenA (lpString="*.mdf") returned 5 [0091.615] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\GrooveFormsMetaData.xml", pszSpec="*.dbf") returned 0 [0091.615] lstrlenA (lpString="*.dbf") returned 5 [0091.615] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\GrooveFormsMetaData.xml", pszSpec="*.odt") returned 0 [0091.615] lstrlenA (lpString="*.odt") returned 5 [0091.615] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\GrooveFormsMetaData.xml", pszSpec="*.vob") returned 0 [0091.615] lstrlenA (lpString="*.vob") returned 5 [0091.615] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\GrooveFormsMetaData.xml", pszSpec="*.ifo") returned 0 [0091.615] lstrlenA (lpString="*.ifo") returned 5 [0091.615] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\GrooveFormsMetaData.xml", pszSpec="*.lnk") returned 0 [0091.615] lstrlenA (lpString="*.lnk") returned 5 [0091.615] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\GrooveFormsMetaData.xml", pszSpec="*.torrent") returned 0 [0091.615] lstrlenA (lpString="*.torrent") returned 9 [0091.615] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\GrooveFormsMetaData.xml", pszSpec="*.mov") returned 0 [0091.615] lstrlenA (lpString="*.mov") returned 5 [0091.615] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\GrooveFormsMetaData.xml", pszSpec="*.m2v") returned 0 [0091.615] lstrlenA (lpString="*.m2v") returned 5 [0091.615] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\GrooveFormsMetaData.xml", pszSpec="*.3gp") returned 0 [0091.615] lstrlenA (lpString="*.3gp") returned 5 [0091.615] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\GrooveFormsMetaData.xml", pszSpec="*.mpeg") returned 0 [0091.615] lstrlenA (lpString="*.mpeg") returned 6 [0091.615] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\GrooveFormsMetaData.xml", pszSpec="*.mpg") returned 0 [0091.615] lstrlenA (lpString="*.mpg") returned 5 [0091.615] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\GrooveFormsMetaData.xml", pszSpec="*.flv") returned 0 [0091.615] lstrlenA (lpString="*.flv") returned 5 [0091.615] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\GrooveFormsMetaData.xml", pszSpec="*.avi") returned 0 [0091.615] lstrlenA (lpString="*.avi") returned 5 [0091.615] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\GrooveFormsMetaData.xml", pszSpec="*.mp4") returned 0 [0091.615] lstrlenA (lpString="*.mp4") returned 5 [0091.616] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\GrooveFormsMetaData.xml", pszSpec="*.wmv") returned 0 [0091.616] lstrlenA (lpString="*.wmv") returned 5 [0091.616] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\GrooveFormsMetaData.xml", pszSpec="*.divx") returned 0 [0091.616] lstrlenA (lpString="*.divx") returned 6 [0091.616] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\GrooveFormsMetaData.xml", pszSpec="*.mkv") returned 0 [0091.616] lstrlenA (lpString="*.mkv") returned 5 [0091.616] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\GrooveFormsMetaData.xml", pszSpec="*.mp3") returned 0 [0091.616] lstrlenA (lpString="*.mp3") returned 5 [0091.616] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\GrooveFormsMetaData.xml", pszSpec="*.wav") returned 0 [0091.616] lstrlenA (lpString="*.wav") returned 5 [0091.616] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\GrooveFormsMetaData.xml", pszSpec="*.flac") returned 0 [0091.616] lstrlenA (lpString="*.flac") returned 6 [0091.616] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\GrooveFormsMetaData.xml", pszSpec="*.ape") returned 0 [0091.616] lstrlenA (lpString="*.ape") returned 5 [0091.616] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\GrooveFormsMetaData.xml", pszSpec="*.wma") returned 0 [0091.616] lstrlenA (lpString="*.wma") returned 5 [0091.616] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\GrooveFormsMetaData.xml", pszSpec="*.ac3") returned 0 [0091.616] lstrlenA (lpString="*.ac3") returned 5 [0091.616] FindNextFileA (in: hFindFile=0x5b7d30, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0091.616] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0091.616] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="MENUS.JS") returned -1 [0091.616] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MENUS.JS") returned -1 [0091.616] lstrcmpiA (lpString1="", lpString2="MENUS.JS") returned -1 [0091.616] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\GrooveFormsMetaData.xml") returned="GrooveFormsMetaData.xml" [0091.616] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="MENUS.JS" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\MENUS.JS") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\MENUS.JS" [0091.616] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\MENUS.JS", pszSpec="*.zip") returned 0 [0091.616] lstrlenA (lpString="*.zip") returned 5 [0091.616] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\MENUS.JS", pszSpec="*.rar") returned 0 [0091.616] lstrlenA (lpString="*.rar") returned 5 [0091.616] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\MENUS.JS", pszSpec="*.7z") returned 0 [0091.616] lstrlenA (lpString="*.7z") returned 4 [0091.616] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\MENUS.JS", pszSpec="*.tar") returned 0 [0091.616] lstrlenA (lpString="*.tar") returned 5 [0091.616] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\MENUS.JS", pszSpec="*.gzip") returned 0 [0091.616] lstrlenA (lpString="*.gzip") returned 6 [0091.616] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\MENUS.JS", pszSpec="*.jpg") returned 0 [0091.616] lstrlenA (lpString="*.jpg") returned 5 [0091.616] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\MENUS.JS", pszSpec="*.jpeg") returned 0 [0091.616] lstrlenA (lpString="*.jpeg") returned 6 [0091.616] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\MENUS.JS", pszSpec="*.psd") returned 0 [0091.616] lstrlenA (lpString="*.psd") returned 5 [0091.616] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\MENUS.JS", pszSpec="*.cdr") returned 0 [0091.616] lstrlenA (lpString="*.cdr") returned 5 [0091.616] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\MENUS.JS", pszSpec="*.dwg") returned 0 [0091.616] lstrlenA (lpString="*.dwg") returned 5 [0091.616] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\MENUS.JS", pszSpec="*.max") returned 0 [0091.616] lstrlenA (lpString="*.max") returned 5 [0091.617] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\MENUS.JS", pszSpec="*.bmp") returned 0 [0091.617] lstrlenA (lpString="*.bmp") returned 5 [0091.617] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\MENUS.JS", pszSpec="*.gif") returned 0 [0091.617] lstrlenA (lpString="*.gif") returned 5 [0091.617] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\MENUS.JS", pszSpec="*.png") returned 0 [0091.617] lstrlenA (lpString="*.png") returned 5 [0091.617] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\MENUS.JS", pszSpec="*.doc") returned 0 [0091.617] lstrlenA (lpString="*.doc") returned 5 [0091.617] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\MENUS.JS", pszSpec="*.docx") returned 0 [0091.617] lstrlenA (lpString="*.docx") returned 6 [0091.617] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\MENUS.JS", pszSpec="*.xls") returned 0 [0091.617] lstrlenA (lpString="*.xls") returned 5 [0091.617] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\MENUS.JS", pszSpec="*.xlsx") returned 0 [0091.617] lstrlenA (lpString="*.xlsx") returned 6 [0091.617] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\MENUS.JS", pszSpec="*.ppt") returned 0 [0091.617] lstrlenA (lpString="*.ppt") returned 5 [0091.617] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\MENUS.JS", pszSpec="*.pptx") returned 0 [0091.617] lstrlenA (lpString="*.pptx") returned 6 [0091.617] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\MENUS.JS", pszSpec="*.txt") returned 0 [0091.617] lstrlenA (lpString="*.txt") returned 5 [0091.617] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\MENUS.JS", pszSpec="*.pdf") returned 0 [0091.617] lstrlenA (lpString="*.pdf") returned 5 [0091.617] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\MENUS.JS", pszSpec="*.djvu") returned 0 [0091.617] lstrlenA (lpString="*.djvu") returned 6 [0091.617] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\MENUS.JS", pszSpec="*.htm") returned 0 [0091.617] lstrlenA (lpString="*.htm") returned 5 [0091.617] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\MENUS.JS", pszSpec="*.html") returned 0 [0091.617] lstrlenA (lpString="*.html") returned 6 [0091.617] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\MENUS.JS", pszSpec="*.mdb") returned 0 [0091.617] lstrlenA (lpString="*.mdb") returned 5 [0091.617] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\MENUS.JS", pszSpec="*.cer") returned 0 [0091.617] lstrlenA (lpString="*.cer") returned 5 [0091.617] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\MENUS.JS", pszSpec="*.p12") returned 0 [0091.617] lstrlenA (lpString="*.p12") returned 5 [0091.617] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\MENUS.JS", pszSpec="*.pfx") returned 0 [0091.617] lstrlenA (lpString="*.pfx") returned 5 [0091.617] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\MENUS.JS", pszSpec="*.kwm") returned 0 [0091.617] lstrlenA (lpString="*.kwm") returned 5 [0091.617] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\MENUS.JS", pszSpec="*.pwm") returned 0 [0091.617] lstrlenA (lpString="*.pwm") returned 5 [0091.617] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\MENUS.JS", pszSpec="*.1cd") returned 0 [0091.617] lstrlenA (lpString="*.1cd") returned 5 [0091.617] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\MENUS.JS", pszSpec="*.md") returned 0 [0091.617] lstrlenA (lpString="*.md") returned 4 [0091.617] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\MENUS.JS", pszSpec="*.mdf") returned 0 [0091.617] lstrlenA (lpString="*.mdf") returned 5 [0091.617] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\MENUS.JS", pszSpec="*.dbf") returned 0 [0091.617] lstrlenA (lpString="*.dbf") returned 5 [0091.618] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\MENUS.JS", pszSpec="*.odt") returned 0 [0091.618] lstrlenA (lpString="*.odt") returned 5 [0091.618] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\MENUS.JS", pszSpec="*.vob") returned 0 [0091.618] lstrlenA (lpString="*.vob") returned 5 [0091.618] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\MENUS.JS", pszSpec="*.ifo") returned 0 [0091.618] lstrlenA (lpString="*.ifo") returned 5 [0091.618] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\MENUS.JS", pszSpec="*.lnk") returned 0 [0091.618] lstrlenA (lpString="*.lnk") returned 5 [0091.618] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\MENUS.JS", pszSpec="*.torrent") returned 0 [0091.618] lstrlenA (lpString="*.torrent") returned 9 [0091.618] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\MENUS.JS", pszSpec="*.mov") returned 0 [0091.618] lstrlenA (lpString="*.mov") returned 5 [0091.618] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\MENUS.JS", pszSpec="*.m2v") returned 0 [0091.618] lstrlenA (lpString="*.m2v") returned 5 [0091.618] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\MENUS.JS", pszSpec="*.3gp") returned 0 [0091.618] lstrlenA (lpString="*.3gp") returned 5 [0091.618] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\MENUS.JS", pszSpec="*.mpeg") returned 0 [0091.618] lstrlenA (lpString="*.mpeg") returned 6 [0091.618] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\MENUS.JS", pszSpec="*.mpg") returned 0 [0091.618] lstrlenA (lpString="*.mpg") returned 5 [0091.618] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\MENUS.JS", pszSpec="*.flv") returned 0 [0091.618] lstrlenA (lpString="*.flv") returned 5 [0091.618] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\MENUS.JS", pszSpec="*.avi") returned 0 [0091.618] lstrlenA (lpString="*.avi") returned 5 [0091.618] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\MENUS.JS", pszSpec="*.mp4") returned 0 [0091.618] lstrlenA (lpString="*.mp4") returned 5 [0091.618] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\MENUS.JS", pszSpec="*.wmv") returned 0 [0091.618] lstrlenA (lpString="*.wmv") returned 5 [0091.618] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\MENUS.JS", pszSpec="*.divx") returned 0 [0091.618] lstrlenA (lpString="*.divx") returned 6 [0091.618] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\MENUS.JS", pszSpec="*.mkv") returned 0 [0091.618] lstrlenA (lpString="*.mkv") returned 5 [0091.618] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\MENUS.JS", pszSpec="*.mp3") returned 0 [0091.618] lstrlenA (lpString="*.mp3") returned 5 [0091.618] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\MENUS.JS", pszSpec="*.wav") returned 0 [0091.618] lstrlenA (lpString="*.wav") returned 5 [0091.618] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\MENUS.JS", pszSpec="*.flac") returned 0 [0091.618] lstrlenA (lpString="*.flac") returned 6 [0091.618] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\MENUS.JS", pszSpec="*.ape") returned 0 [0091.618] lstrlenA (lpString="*.ape") returned 5 [0091.618] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\MENUS.JS", pszSpec="*.wma") returned 0 [0091.618] lstrlenA (lpString="*.wma") returned 5 [0091.618] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\MENUS.JS", pszSpec="*.ac3") returned 0 [0091.618] lstrlenA (lpString="*.ac3") returned 5 [0091.618] FindNextFileA (in: hFindFile=0x5b7d30, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0091.618] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0091.618] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="menu_arrow.gif") returned -1 [0091.618] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="menu_arrow.gif") returned -1 [0091.618] lstrcmpiA (lpString1="", lpString2="menu_arrow.gif") returned -1 [0091.619] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\MENUS.JS") returned="MENUS.JS" [0091.619] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="menu_arrow.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\menu_arrow.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\menu_arrow.gif" [0091.619] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\menu_arrow.gif", pszSpec="*.zip") returned 0 [0091.619] lstrlenA (lpString="*.zip") returned 5 [0091.619] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\menu_arrow.gif", pszSpec="*.rar") returned 0 [0091.619] lstrlenA (lpString="*.rar") returned 5 [0091.619] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\menu_arrow.gif", pszSpec="*.7z") returned 0 [0091.619] lstrlenA (lpString="*.7z") returned 4 [0091.619] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\menu_arrow.gif", pszSpec="*.tar") returned 0 [0091.619] lstrlenA (lpString="*.tar") returned 5 [0091.619] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\menu_arrow.gif", pszSpec="*.gzip") returned 0 [0091.619] lstrlenA (lpString="*.gzip") returned 6 [0091.619] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\menu_arrow.gif", pszSpec="*.jpg") returned 0 [0091.619] lstrlenA (lpString="*.jpg") returned 5 [0091.619] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\menu_arrow.gif", pszSpec="*.jpeg") returned 0 [0091.619] lstrlenA (lpString="*.jpeg") returned 6 [0091.619] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\menu_arrow.gif", pszSpec="*.psd") returned 0 [0091.619] lstrlenA (lpString="*.psd") returned 5 [0091.619] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\menu_arrow.gif", pszSpec="*.cdr") returned 0 [0091.619] lstrlenA (lpString="*.cdr") returned 5 [0091.619] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\menu_arrow.gif", pszSpec="*.dwg") returned 0 [0091.619] lstrlenA (lpString="*.dwg") returned 5 [0091.619] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\menu_arrow.gif", pszSpec="*.max") returned 0 [0091.619] lstrlenA (lpString="*.max") returned 5 [0091.619] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\menu_arrow.gif", pszSpec="*.bmp") returned 0 [0091.619] lstrlenA (lpString="*.bmp") returned 5 [0091.619] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\menu_arrow.gif", pszSpec="*.gif") returned 1 [0091.619] lstrlenA (lpString="*.gif") returned 5 [0091.619] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\menu_arrow.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\menu_arrow.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\menu_arrow.gif" [0091.619] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\menu_arrow.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\menu_arrow.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\menu_arrow.gif" [0091.619] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\menu_arrow.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\menu_arrow.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\menu_arrow.gif." [0091.619] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\menu_arrow.gif.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\menu_arrow.gif. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\menu_arrow.gif. " [0091.619] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\menu_arrow.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\menu_arrow.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0091.620] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x33a [0091.620] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x899c7500, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5836a590, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x899c7500, dwHighDateTime=0x1c747ea)) returned 1 [0091.620] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0091.620] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x2e0, lpOverlapped=0x0) returned 1 [0091.637] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\menu_arrow.gif") returned="menu_arrow.gif" [0091.637] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0091.637] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x2e0, lpOverlapped=0x0) returned 1 [0091.637] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0091.637] CloseHandle (hObject=0x98) returned 1 [0091.638] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\menu_arrow.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\menu_arrow.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\menu_arrow.gif. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\menu_arrow.gif. ")) returned 1 [0091.639] FindNextFileA (in: hFindFile=0x5b7d30, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0091.639] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0091.639] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="SEARCH.GIF") returned -1 [0091.639] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SEARCH.GIF") returned -1 [0091.639] lstrcmpiA (lpString1="", lpString2="SEARCH.GIF") returned -1 [0091.639] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\menu_arrow.gif") returned="menu_arrow.gif" [0091.639] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="SEARCH.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SEARCH.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SEARCH.GIF" [0091.639] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SEARCH.GIF", pszSpec="*.zip") returned 0 [0091.639] lstrlenA (lpString="*.zip") returned 5 [0091.639] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SEARCH.GIF", pszSpec="*.rar") returned 0 [0091.639] lstrlenA (lpString="*.rar") returned 5 [0091.639] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SEARCH.GIF", pszSpec="*.7z") returned 0 [0091.639] lstrlenA (lpString="*.7z") returned 4 [0091.639] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SEARCH.GIF", pszSpec="*.tar") returned 0 [0091.639] lstrlenA (lpString="*.tar") returned 5 [0091.639] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SEARCH.GIF", pszSpec="*.gzip") returned 0 [0091.639] lstrlenA (lpString="*.gzip") returned 6 [0091.639] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SEARCH.GIF", pszSpec="*.jpg") returned 0 [0091.639] lstrlenA (lpString="*.jpg") returned 5 [0091.639] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SEARCH.GIF", pszSpec="*.jpeg") returned 0 [0091.639] lstrlenA (lpString="*.jpeg") returned 6 [0091.639] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SEARCH.GIF", pszSpec="*.psd") returned 0 [0091.639] lstrlenA (lpString="*.psd") returned 5 [0091.639] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SEARCH.GIF", pszSpec="*.cdr") returned 0 [0091.639] lstrlenA (lpString="*.cdr") returned 5 [0091.639] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SEARCH.GIF", pszSpec="*.dwg") returned 0 [0091.639] lstrlenA (lpString="*.dwg") returned 5 [0091.639] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SEARCH.GIF", pszSpec="*.max") returned 0 [0091.640] lstrlenA (lpString="*.max") returned 5 [0091.640] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SEARCH.GIF", pszSpec="*.bmp") returned 0 [0091.640] lstrlenA (lpString="*.bmp") returned 5 [0091.640] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SEARCH.GIF", pszSpec="*.gif") returned 1 [0091.640] lstrlenA (lpString="*.gif") returned 5 [0091.640] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SEARCH.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SEARCH.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SEARCH.GIF" [0091.640] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SEARCH.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SEARCH.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SEARCH.GIF" [0091.640] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SEARCH.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SEARCH.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SEARCH.GIF." [0091.640] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SEARCH.GIF.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SEARCH.GIF. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SEARCH.GIF. " [0091.640] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SEARCH.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\search.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0091.641] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4af [0091.641] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8acda200, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x6d273e10, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8acda200, dwHighDateTime=0x1c747ea)) returned 1 [0091.641] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0091.641] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x455, lpOverlapped=0x0) returned 1 [0091.680] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SEARCH.GIF") returned="SEARCH.GIF" [0091.680] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0091.680] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x455, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x455, lpOverlapped=0x0) returned 1 [0091.681] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0091.681] CloseHandle (hObject=0x98) returned 1 [0091.682] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SEARCH.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\search.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SEARCH.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\search.gif. ")) returned 1 [0091.683] FindNextFileA (in: hFindFile=0x5b7d30, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0091.683] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0091.683] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="SPACER.GIF") returned -1 [0091.683] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SPACER.GIF") returned -1 [0091.683] lstrcmpiA (lpString1="", lpString2="SPACER.GIF") returned -1 [0091.683] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SEARCH.GIF") returned="SEARCH.GIF" [0091.683] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="SPACER.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SPACER.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SPACER.GIF" [0091.683] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SPACER.GIF", pszSpec="*.zip") returned 0 [0091.683] lstrlenA (lpString="*.zip") returned 5 [0091.683] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SPACER.GIF", pszSpec="*.rar") returned 0 [0091.683] lstrlenA (lpString="*.rar") returned 5 [0091.683] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SPACER.GIF", pszSpec="*.7z") returned 0 [0091.683] lstrlenA (lpString="*.7z") returned 4 [0091.683] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SPACER.GIF", pszSpec="*.tar") returned 0 [0091.683] lstrlenA (lpString="*.tar") returned 5 [0091.683] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SPACER.GIF", pszSpec="*.gzip") returned 0 [0091.683] lstrlenA (lpString="*.gzip") returned 6 [0091.683] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SPACER.GIF", pszSpec="*.jpg") returned 0 [0091.683] lstrlenA (lpString="*.jpg") returned 5 [0091.683] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SPACER.GIF", pszSpec="*.jpeg") returned 0 [0091.683] lstrlenA (lpString="*.jpeg") returned 6 [0091.683] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SPACER.GIF", pszSpec="*.psd") returned 0 [0091.683] lstrlenA (lpString="*.psd") returned 5 [0091.683] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SPACER.GIF", pszSpec="*.cdr") returned 0 [0091.683] lstrlenA (lpString="*.cdr") returned 5 [0091.683] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SPACER.GIF", pszSpec="*.dwg") returned 0 [0091.683] lstrlenA (lpString="*.dwg") returned 5 [0091.683] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SPACER.GIF", pszSpec="*.max") returned 0 [0091.683] lstrlenA (lpString="*.max") returned 5 [0091.683] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SPACER.GIF", pszSpec="*.bmp") returned 0 [0091.683] lstrlenA (lpString="*.bmp") returned 5 [0091.683] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SPACER.GIF", pszSpec="*.gif") returned 1 [0091.683] lstrlenA (lpString="*.gif") returned 5 [0091.683] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SPACER.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SPACER.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SPACER.GIF" [0091.683] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SPACER.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SPACER.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SPACER.GIF" [0091.683] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SPACER.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SPACER.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SPACER.GIF." [0091.683] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SPACER.GIF.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SPACER.GIF. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SPACER.GIF. " [0091.683] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SPACER.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\spacer.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0091.684] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x31 [0091.684] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8acda200, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x6d3a4910, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8acda200, dwHighDateTime=0x1c747ea)) returned 1 [0091.684] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0091.684] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x0, lpOverlapped=0x0) returned 1 [0091.684] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0091.684] CloseHandle (hObject=0x98) returned 1 [0091.684] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SPACER.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\spacer.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SPACER.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\spacer.gif. ")) returned 1 [0091.685] FindNextFileA (in: hFindFile=0x5b7d30, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0091.685] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0091.685] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="SUBMIT.JS") returned -1 [0091.685] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SUBMIT.JS") returned -1 [0091.685] lstrcmpiA (lpString1="", lpString2="SUBMIT.JS") returned -1 [0091.685] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SPACER.GIF") returned="SPACER.GIF" [0091.685] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="SUBMIT.JS" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SUBMIT.JS") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SUBMIT.JS" [0091.685] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SUBMIT.JS", pszSpec="*.zip") returned 0 [0091.685] lstrlenA (lpString="*.zip") returned 5 [0091.685] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SUBMIT.JS", pszSpec="*.rar") returned 0 [0091.685] lstrlenA (lpString="*.rar") returned 5 [0091.685] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SUBMIT.JS", pszSpec="*.7z") returned 0 [0091.685] lstrlenA (lpString="*.7z") returned 4 [0091.685] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SUBMIT.JS", pszSpec="*.tar") returned 0 [0091.685] lstrlenA (lpString="*.tar") returned 5 [0091.685] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SUBMIT.JS", pszSpec="*.gzip") returned 0 [0091.685] lstrlenA (lpString="*.gzip") returned 6 [0091.685] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SUBMIT.JS", pszSpec="*.jpg") returned 0 [0091.685] lstrlenA (lpString="*.jpg") returned 5 [0091.685] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SUBMIT.JS", pszSpec="*.jpeg") returned 0 [0091.685] lstrlenA (lpString="*.jpeg") returned 6 [0091.686] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SUBMIT.JS", pszSpec="*.psd") returned 0 [0091.686] lstrlenA (lpString="*.psd") returned 5 [0091.686] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SUBMIT.JS", pszSpec="*.cdr") returned 0 [0091.686] lstrlenA (lpString="*.cdr") returned 5 [0091.686] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SUBMIT.JS", pszSpec="*.dwg") returned 0 [0091.686] lstrlenA (lpString="*.dwg") returned 5 [0091.686] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SUBMIT.JS", pszSpec="*.max") returned 0 [0091.686] lstrlenA (lpString="*.max") returned 5 [0091.686] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SUBMIT.JS", pszSpec="*.bmp") returned 0 [0091.686] lstrlenA (lpString="*.bmp") returned 5 [0091.686] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SUBMIT.JS", pszSpec="*.gif") returned 0 [0091.686] lstrlenA (lpString="*.gif") returned 5 [0091.686] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SUBMIT.JS", pszSpec="*.png") returned 0 [0091.686] lstrlenA (lpString="*.png") returned 5 [0091.686] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SUBMIT.JS", pszSpec="*.doc") returned 0 [0091.686] lstrlenA (lpString="*.doc") returned 5 [0091.686] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SUBMIT.JS", pszSpec="*.docx") returned 0 [0091.686] lstrlenA (lpString="*.docx") returned 6 [0091.686] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SUBMIT.JS", pszSpec="*.xls") returned 0 [0091.686] lstrlenA (lpString="*.xls") returned 5 [0091.686] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SUBMIT.JS", pszSpec="*.xlsx") returned 0 [0091.686] lstrlenA (lpString="*.xlsx") returned 6 [0091.686] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SUBMIT.JS", pszSpec="*.ppt") returned 0 [0091.686] lstrlenA (lpString="*.ppt") returned 5 [0091.686] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SUBMIT.JS", pszSpec="*.pptx") returned 0 [0091.686] lstrlenA (lpString="*.pptx") returned 6 [0091.686] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SUBMIT.JS", pszSpec="*.txt") returned 0 [0091.686] lstrlenA (lpString="*.txt") returned 5 [0091.686] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SUBMIT.JS", pszSpec="*.pdf") returned 0 [0091.686] lstrlenA (lpString="*.pdf") returned 5 [0091.686] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SUBMIT.JS", pszSpec="*.djvu") returned 0 [0091.686] lstrlenA (lpString="*.djvu") returned 6 [0091.686] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SUBMIT.JS", pszSpec="*.htm") returned 0 [0091.686] lstrlenA (lpString="*.htm") returned 5 [0091.686] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SUBMIT.JS", pszSpec="*.html") returned 0 [0091.686] lstrlenA (lpString="*.html") returned 6 [0091.686] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SUBMIT.JS", pszSpec="*.mdb") returned 0 [0091.686] lstrlenA (lpString="*.mdb") returned 5 [0091.686] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SUBMIT.JS", pszSpec="*.cer") returned 0 [0091.686] lstrlenA (lpString="*.cer") returned 5 [0091.686] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SUBMIT.JS", pszSpec="*.p12") returned 0 [0091.686] lstrlenA (lpString="*.p12") returned 5 [0091.686] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SUBMIT.JS", pszSpec="*.pfx") returned 0 [0091.686] lstrlenA (lpString="*.pfx") returned 5 [0091.686] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SUBMIT.JS", pszSpec="*.kwm") returned 0 [0091.686] lstrlenA (lpString="*.kwm") returned 5 [0091.686] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SUBMIT.JS", pszSpec="*.pwm") returned 0 [0091.686] lstrlenA (lpString="*.pwm") returned 5 [0091.686] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SUBMIT.JS", pszSpec="*.1cd") returned 0 [0091.686] lstrlenA (lpString="*.1cd") returned 5 [0091.686] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SUBMIT.JS", pszSpec="*.md") returned 0 [0091.687] lstrlenA (lpString="*.md") returned 4 [0091.687] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SUBMIT.JS", pszSpec="*.mdf") returned 0 [0091.687] lstrlenA (lpString="*.mdf") returned 5 [0091.687] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SUBMIT.JS", pszSpec="*.dbf") returned 0 [0091.687] lstrlenA (lpString="*.dbf") returned 5 [0091.687] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SUBMIT.JS", pszSpec="*.odt") returned 0 [0091.687] lstrlenA (lpString="*.odt") returned 5 [0091.687] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SUBMIT.JS", pszSpec="*.vob") returned 0 [0091.687] lstrlenA (lpString="*.vob") returned 5 [0091.687] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SUBMIT.JS", pszSpec="*.ifo") returned 0 [0091.687] lstrlenA (lpString="*.ifo") returned 5 [0091.687] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SUBMIT.JS", pszSpec="*.lnk") returned 0 [0091.687] lstrlenA (lpString="*.lnk") returned 5 [0091.687] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SUBMIT.JS", pszSpec="*.torrent") returned 0 [0091.687] lstrlenA (lpString="*.torrent") returned 9 [0091.687] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SUBMIT.JS", pszSpec="*.mov") returned 0 [0091.687] lstrlenA (lpString="*.mov") returned 5 [0091.687] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SUBMIT.JS", pszSpec="*.m2v") returned 0 [0091.687] lstrlenA (lpString="*.m2v") returned 5 [0091.687] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SUBMIT.JS", pszSpec="*.3gp") returned 0 [0091.687] lstrlenA (lpString="*.3gp") returned 5 [0091.687] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SUBMIT.JS", pszSpec="*.mpeg") returned 0 [0091.687] lstrlenA (lpString="*.mpeg") returned 6 [0091.687] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SUBMIT.JS", pszSpec="*.mpg") returned 0 [0091.687] lstrlenA (lpString="*.mpg") returned 5 [0091.687] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SUBMIT.JS", pszSpec="*.flv") returned 0 [0091.687] lstrlenA (lpString="*.flv") returned 5 [0091.687] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SUBMIT.JS", pszSpec="*.avi") returned 0 [0091.687] lstrlenA (lpString="*.avi") returned 5 [0091.687] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SUBMIT.JS", pszSpec="*.mp4") returned 0 [0091.687] lstrlenA (lpString="*.mp4") returned 5 [0091.687] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SUBMIT.JS", pszSpec="*.wmv") returned 0 [0091.687] lstrlenA (lpString="*.wmv") returned 5 [0091.687] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SUBMIT.JS", pszSpec="*.divx") returned 0 [0091.687] lstrlenA (lpString="*.divx") returned 6 [0091.687] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SUBMIT.JS", pszSpec="*.mkv") returned 0 [0091.687] lstrlenA (lpString="*.mkv") returned 5 [0091.687] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SUBMIT.JS", pszSpec="*.mp3") returned 0 [0091.687] lstrlenA (lpString="*.mp3") returned 5 [0091.687] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SUBMIT.JS", pszSpec="*.wav") returned 0 [0091.687] lstrlenA (lpString="*.wav") returned 5 [0091.687] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SUBMIT.JS", pszSpec="*.flac") returned 0 [0091.687] lstrlenA (lpString="*.flac") returned 6 [0091.687] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SUBMIT.JS", pszSpec="*.ape") returned 0 [0091.687] lstrlenA (lpString="*.ape") returned 5 [0091.687] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SUBMIT.JS", pszSpec="*.wma") returned 0 [0091.687] lstrlenA (lpString="*.wma") returned 5 [0091.687] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SUBMIT.JS", pszSpec="*.ac3") returned 0 [0091.687] lstrlenA (lpString="*.ac3") returned 5 [0091.687] FindNextFileA (in: hFindFile=0x5b7d30, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0091.687] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0091.688] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="utilityfunctions.js") returned -1 [0091.688] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="utilityfunctions.js") returned -1 [0091.688] lstrcmpiA (lpString1="", lpString2="utilityfunctions.js") returned -1 [0091.688] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SUBMIT.JS") returned="SUBMIT.JS" [0091.688] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="utilityfunctions.js" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\utilityfunctions.js") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\utilityfunctions.js" [0091.688] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\utilityfunctions.js", pszSpec="*.zip") returned 0 [0091.688] lstrlenA (lpString="*.zip") returned 5 [0091.688] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\utilityfunctions.js", pszSpec="*.rar") returned 0 [0091.688] lstrlenA (lpString="*.rar") returned 5 [0091.688] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\utilityfunctions.js", pszSpec="*.7z") returned 0 [0091.688] lstrlenA (lpString="*.7z") returned 4 [0091.688] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\utilityfunctions.js", pszSpec="*.tar") returned 0 [0091.688] lstrlenA (lpString="*.tar") returned 5 [0091.688] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\utilityfunctions.js", pszSpec="*.gzip") returned 0 [0091.688] lstrlenA (lpString="*.gzip") returned 6 [0091.688] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\utilityfunctions.js", pszSpec="*.jpg") returned 0 [0091.688] lstrlenA (lpString="*.jpg") returned 5 [0091.688] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\utilityfunctions.js", pszSpec="*.jpeg") returned 0 [0091.688] lstrlenA (lpString="*.jpeg") returned 6 [0091.688] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\utilityfunctions.js", pszSpec="*.psd") returned 0 [0091.688] lstrlenA (lpString="*.psd") returned 5 [0091.688] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\utilityfunctions.js", pszSpec="*.cdr") returned 0 [0091.688] lstrlenA (lpString="*.cdr") returned 5 [0091.688] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\utilityfunctions.js", pszSpec="*.dwg") returned 0 [0091.688] lstrlenA (lpString="*.dwg") returned 5 [0091.688] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\utilityfunctions.js", pszSpec="*.max") returned 0 [0091.688] lstrlenA (lpString="*.max") returned 5 [0091.688] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\utilityfunctions.js", pszSpec="*.bmp") returned 0 [0091.688] lstrlenA (lpString="*.bmp") returned 5 [0091.688] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\utilityfunctions.js", pszSpec="*.gif") returned 0 [0091.688] lstrlenA (lpString="*.gif") returned 5 [0091.688] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\utilityfunctions.js", pszSpec="*.png") returned 0 [0091.688] lstrlenA (lpString="*.png") returned 5 [0091.688] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\utilityfunctions.js", pszSpec="*.doc") returned 0 [0091.688] lstrlenA (lpString="*.doc") returned 5 [0091.688] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\utilityfunctions.js", pszSpec="*.docx") returned 0 [0091.688] lstrlenA (lpString="*.docx") returned 6 [0091.688] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\utilityfunctions.js", pszSpec="*.xls") returned 0 [0091.688] lstrlenA (lpString="*.xls") returned 5 [0091.688] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\utilityfunctions.js", pszSpec="*.xlsx") returned 0 [0091.688] lstrlenA (lpString="*.xlsx") returned 6 [0091.688] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\utilityfunctions.js", pszSpec="*.ppt") returned 0 [0091.688] lstrlenA (lpString="*.ppt") returned 5 [0091.688] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\utilityfunctions.js", pszSpec="*.pptx") returned 0 [0091.689] lstrlenA (lpString="*.pptx") returned 6 [0091.689] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\utilityfunctions.js", pszSpec="*.txt") returned 0 [0091.689] lstrlenA (lpString="*.txt") returned 5 [0091.689] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\utilityfunctions.js", pszSpec="*.pdf") returned 0 [0091.689] lstrlenA (lpString="*.pdf") returned 5 [0091.689] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\utilityfunctions.js", pszSpec="*.djvu") returned 0 [0091.689] lstrlenA (lpString="*.djvu") returned 6 [0091.689] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\utilityfunctions.js", pszSpec="*.htm") returned 0 [0091.689] lstrlenA (lpString="*.htm") returned 5 [0091.689] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\utilityfunctions.js", pszSpec="*.html") returned 0 [0091.689] lstrlenA (lpString="*.html") returned 6 [0091.689] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\utilityfunctions.js", pszSpec="*.mdb") returned 0 [0091.689] lstrlenA (lpString="*.mdb") returned 5 [0091.689] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\utilityfunctions.js", pszSpec="*.cer") returned 0 [0091.689] lstrlenA (lpString="*.cer") returned 5 [0091.689] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\utilityfunctions.js", pszSpec="*.p12") returned 0 [0091.689] lstrlenA (lpString="*.p12") returned 5 [0091.689] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\utilityfunctions.js", pszSpec="*.pfx") returned 0 [0091.689] lstrlenA (lpString="*.pfx") returned 5 [0091.689] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\utilityfunctions.js", pszSpec="*.kwm") returned 0 [0091.689] lstrlenA (lpString="*.kwm") returned 5 [0091.689] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\utilityfunctions.js", pszSpec="*.pwm") returned 0 [0091.689] lstrlenA (lpString="*.pwm") returned 5 [0091.689] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\utilityfunctions.js", pszSpec="*.1cd") returned 0 [0091.689] lstrlenA (lpString="*.1cd") returned 5 [0091.689] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\utilityfunctions.js", pszSpec="*.md") returned 0 [0091.689] lstrlenA (lpString="*.md") returned 4 [0091.689] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\utilityfunctions.js", pszSpec="*.mdf") returned 0 [0091.689] lstrlenA (lpString="*.mdf") returned 5 [0091.689] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\utilityfunctions.js", pszSpec="*.dbf") returned 0 [0091.689] lstrlenA (lpString="*.dbf") returned 5 [0091.689] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\utilityfunctions.js", pszSpec="*.odt") returned 0 [0091.689] lstrlenA (lpString="*.odt") returned 5 [0091.689] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\utilityfunctions.js", pszSpec="*.vob") returned 0 [0091.689] lstrlenA (lpString="*.vob") returned 5 [0091.689] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\utilityfunctions.js", pszSpec="*.ifo") returned 0 [0091.689] lstrlenA (lpString="*.ifo") returned 5 [0091.690] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\utilityfunctions.js", pszSpec="*.lnk") returned 0 [0091.690] lstrlenA (lpString="*.lnk") returned 5 [0091.690] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\utilityfunctions.js", pszSpec="*.torrent") returned 0 [0091.690] lstrlenA (lpString="*.torrent") returned 9 [0091.690] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\utilityfunctions.js", pszSpec="*.mov") returned 0 [0091.690] lstrlenA (lpString="*.mov") returned 5 [0091.690] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\utilityfunctions.js", pszSpec="*.m2v") returned 0 [0091.690] lstrlenA (lpString="*.m2v") returned 5 [0091.690] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\utilityfunctions.js", pszSpec="*.3gp") returned 0 [0091.690] lstrlenA (lpString="*.3gp") returned 5 [0091.690] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\utilityfunctions.js", pszSpec="*.mpeg") returned 0 [0091.690] lstrlenA (lpString="*.mpeg") returned 6 [0091.690] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\utilityfunctions.js", pszSpec="*.mpg") returned 0 [0091.690] lstrlenA (lpString="*.mpg") returned 5 [0091.690] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\utilityfunctions.js", pszSpec="*.flv") returned 0 [0091.690] lstrlenA (lpString="*.flv") returned 5 [0091.690] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\utilityfunctions.js", pszSpec="*.avi") returned 0 [0091.690] lstrlenA (lpString="*.avi") returned 5 [0091.690] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\utilityfunctions.js", pszSpec="*.mp4") returned 0 [0091.690] lstrlenA (lpString="*.mp4") returned 5 [0091.690] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\utilityfunctions.js", pszSpec="*.wmv") returned 0 [0091.690] lstrlenA (lpString="*.wmv") returned 5 [0091.690] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\utilityfunctions.js", pszSpec="*.divx") returned 0 [0091.690] lstrlenA (lpString="*.divx") returned 6 [0091.690] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\utilityfunctions.js", pszSpec="*.mkv") returned 0 [0091.690] lstrlenA (lpString="*.mkv") returned 5 [0091.690] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\utilityfunctions.js", pszSpec="*.mp3") returned 0 [0091.690] lstrlenA (lpString="*.mp3") returned 5 [0091.690] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\utilityfunctions.js", pszSpec="*.wav") returned 0 [0091.690] lstrlenA (lpString="*.wav") returned 5 [0091.690] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\utilityfunctions.js", pszSpec="*.flac") returned 0 [0091.690] lstrlenA (lpString="*.flac") returned 6 [0091.690] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\utilityfunctions.js", pszSpec="*.ape") returned 0 [0091.690] lstrlenA (lpString="*.ape") returned 5 [0091.690] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\utilityfunctions.js", pszSpec="*.wma") returned 0 [0091.690] lstrlenA (lpString="*.wma") returned 5 [0091.690] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\utilityfunctions.js", pszSpec="*.ac3") returned 0 [0091.691] lstrlenA (lpString="*.ac3") returned 5 [0091.691] FindNextFileA (in: hFindFile=0x5b7d30, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0091.691] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0091.691] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="validation.js") returned -1 [0091.691] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="validation.js") returned -1 [0091.691] lstrcmpiA (lpString1="", lpString2="validation.js") returned -1 [0091.691] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\utilityfunctions.js") returned="utilityfunctions.js" [0091.691] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="validation.js" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\validation.js") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\validation.js" [0091.691] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\validation.js", pszSpec="*.zip") returned 0 [0091.691] lstrlenA (lpString="*.zip") returned 5 [0091.691] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\validation.js", pszSpec="*.rar") returned 0 [0091.691] lstrlenA (lpString="*.rar") returned 5 [0091.691] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\validation.js", pszSpec="*.7z") returned 0 [0091.691] lstrlenA (lpString="*.7z") returned 4 [0091.691] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\validation.js", pszSpec="*.tar") returned 0 [0091.691] lstrlenA (lpString="*.tar") returned 5 [0091.691] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\validation.js", pszSpec="*.gzip") returned 0 [0091.691] lstrlenA (lpString="*.gzip") returned 6 [0091.691] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\validation.js", pszSpec="*.jpg") returned 0 [0091.691] lstrlenA (lpString="*.jpg") returned 5 [0091.691] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\validation.js", pszSpec="*.jpeg") returned 0 [0091.691] lstrlenA (lpString="*.jpeg") returned 6 [0091.691] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\validation.js", pszSpec="*.psd") returned 0 [0091.691] lstrlenA (lpString="*.psd") returned 5 [0091.691] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\validation.js", pszSpec="*.cdr") returned 0 [0091.691] lstrlenA (lpString="*.cdr") returned 5 [0091.691] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\validation.js", pszSpec="*.dwg") returned 0 [0091.691] lstrlenA (lpString="*.dwg") returned 5 [0091.691] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\validation.js", pszSpec="*.max") returned 0 [0091.691] lstrlenA (lpString="*.max") returned 5 [0091.691] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\validation.js", pszSpec="*.bmp") returned 0 [0091.691] lstrlenA (lpString="*.bmp") returned 5 [0091.691] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\validation.js", pszSpec="*.gif") returned 0 [0091.691] lstrlenA (lpString="*.gif") returned 5 [0091.691] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\validation.js", pszSpec="*.png") returned 0 [0091.691] lstrlenA (lpString="*.png") returned 5 [0091.691] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\validation.js", pszSpec="*.doc") returned 0 [0091.692] lstrlenA (lpString="*.doc") returned 5 [0091.692] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\validation.js", pszSpec="*.docx") returned 0 [0091.692] lstrlenA (lpString="*.docx") returned 6 [0091.692] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\validation.js", pszSpec="*.xls") returned 0 [0091.692] lstrlenA (lpString="*.xls") returned 5 [0091.692] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\validation.js", pszSpec="*.xlsx") returned 0 [0091.692] lstrlenA (lpString="*.xlsx") returned 6 [0091.692] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\validation.js", pszSpec="*.ppt") returned 0 [0091.692] lstrlenA (lpString="*.ppt") returned 5 [0091.692] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\validation.js", pszSpec="*.pptx") returned 0 [0091.692] lstrlenA (lpString="*.pptx") returned 6 [0091.692] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\validation.js", pszSpec="*.txt") returned 0 [0091.692] lstrlenA (lpString="*.txt") returned 5 [0091.692] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\validation.js", pszSpec="*.pdf") returned 0 [0091.692] lstrlenA (lpString="*.pdf") returned 5 [0091.692] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\validation.js", pszSpec="*.djvu") returned 0 [0091.692] lstrlenA (lpString="*.djvu") returned 6 [0091.692] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\validation.js", pszSpec="*.htm") returned 0 [0091.692] lstrlenA (lpString="*.htm") returned 5 [0091.692] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\validation.js", pszSpec="*.html") returned 0 [0091.692] lstrlenA (lpString="*.html") returned 6 [0091.692] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\validation.js", pszSpec="*.mdb") returned 0 [0091.692] lstrlenA (lpString="*.mdb") returned 5 [0091.692] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\validation.js", pszSpec="*.cer") returned 0 [0091.692] lstrlenA (lpString="*.cer") returned 5 [0091.692] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\validation.js", pszSpec="*.p12") returned 0 [0091.692] lstrlenA (lpString="*.p12") returned 5 [0091.692] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\validation.js", pszSpec="*.pfx") returned 0 [0091.692] lstrlenA (lpString="*.pfx") returned 5 [0091.692] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\validation.js", pszSpec="*.kwm") returned 0 [0091.692] lstrlenA (lpString="*.kwm") returned 5 [0091.692] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\validation.js", pszSpec="*.pwm") returned 0 [0091.692] lstrlenA (lpString="*.pwm") returned 5 [0091.692] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\validation.js", pszSpec="*.1cd") returned 0 [0091.692] lstrlenA (lpString="*.1cd") returned 5 [0091.692] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\validation.js", pszSpec="*.md") returned 0 [0091.692] lstrlenA (lpString="*.md") returned 4 [0091.693] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\validation.js", pszSpec="*.mdf") returned 0 [0091.693] lstrlenA (lpString="*.mdf") returned 5 [0091.693] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\validation.js", pszSpec="*.dbf") returned 0 [0091.693] lstrlenA (lpString="*.dbf") returned 5 [0091.693] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\validation.js", pszSpec="*.odt") returned 0 [0091.693] lstrlenA (lpString="*.odt") returned 5 [0091.693] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\validation.js", pszSpec="*.vob") returned 0 [0091.693] lstrlenA (lpString="*.vob") returned 5 [0091.693] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\validation.js", pszSpec="*.ifo") returned 0 [0091.693] lstrlenA (lpString="*.ifo") returned 5 [0091.693] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\validation.js", pszSpec="*.lnk") returned 0 [0091.693] lstrlenA (lpString="*.lnk") returned 5 [0091.693] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\validation.js", pszSpec="*.torrent") returned 0 [0091.693] lstrlenA (lpString="*.torrent") returned 9 [0091.693] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\validation.js", pszSpec="*.mov") returned 0 [0091.693] lstrlenA (lpString="*.mov") returned 5 [0091.693] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\validation.js", pszSpec="*.m2v") returned 0 [0091.693] lstrlenA (lpString="*.m2v") returned 5 [0091.693] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\validation.js", pszSpec="*.3gp") returned 0 [0091.693] lstrlenA (lpString="*.3gp") returned 5 [0091.693] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\validation.js", pszSpec="*.mpeg") returned 0 [0091.693] lstrlenA (lpString="*.mpeg") returned 6 [0091.693] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\validation.js", pszSpec="*.mpg") returned 0 [0091.693] lstrlenA (lpString="*.mpg") returned 5 [0091.693] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\validation.js", pszSpec="*.flv") returned 0 [0091.693] lstrlenA (lpString="*.flv") returned 5 [0091.693] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\validation.js", pszSpec="*.avi") returned 0 [0091.693] lstrlenA (lpString="*.avi") returned 5 [0091.693] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\validation.js", pszSpec="*.mp4") returned 0 [0091.693] lstrlenA (lpString="*.mp4") returned 5 [0091.693] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\validation.js", pszSpec="*.wmv") returned 0 [0091.693] lstrlenA (lpString="*.wmv") returned 5 [0091.693] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\validation.js", pszSpec="*.divx") returned 0 [0091.693] lstrlenA (lpString="*.divx") returned 6 [0091.693] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\validation.js", pszSpec="*.mkv") returned 0 [0091.693] lstrlenA (lpString="*.mkv") returned 5 [0091.693] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\validation.js", pszSpec="*.mp3") returned 0 [0091.694] lstrlenA (lpString="*.mp3") returned 5 [0091.694] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\validation.js", pszSpec="*.wav") returned 0 [0091.694] lstrlenA (lpString="*.wav") returned 5 [0091.694] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\validation.js", pszSpec="*.flac") returned 0 [0091.694] lstrlenA (lpString="*.flac") returned 6 [0091.694] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\validation.js", pszSpec="*.ape") returned 0 [0091.694] lstrlenA (lpString="*.ape") returned 5 [0091.694] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\validation.js", pszSpec="*.wma") returned 0 [0091.694] lstrlenA (lpString="*.wma") returned 5 [0091.694] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\validation.js", pszSpec="*.ac3") returned 0 [0091.694] lstrlenA (lpString="*.ac3") returned 5 [0091.694] FindNextFileA (in: hFindFile=0x5b7d30, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0091.694] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0091.694] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="VIEW.CSS") returned -1 [0091.694] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="VIEW.CSS") returned -1 [0091.694] lstrcmpiA (lpString1="", lpString2="VIEW.CSS") returned -1 [0091.694] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\validation.js") returned="validation.js" [0091.694] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="VIEW.CSS" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.CSS") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.CSS" [0091.694] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.CSS", pszSpec="*.zip") returned 0 [0091.694] lstrlenA (lpString="*.zip") returned 5 [0091.694] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.CSS", pszSpec="*.rar") returned 0 [0091.694] lstrlenA (lpString="*.rar") returned 5 [0091.694] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.CSS", pszSpec="*.7z") returned 0 [0091.694] lstrlenA (lpString="*.7z") returned 4 [0091.694] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.CSS", pszSpec="*.tar") returned 0 [0091.694] lstrlenA (lpString="*.tar") returned 5 [0091.694] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.CSS", pszSpec="*.gzip") returned 0 [0091.694] lstrlenA (lpString="*.gzip") returned 6 [0091.694] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.CSS", pszSpec="*.jpg") returned 0 [0091.694] lstrlenA (lpString="*.jpg") returned 5 [0091.694] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.CSS", pszSpec="*.jpeg") returned 0 [0091.694] lstrlenA (lpString="*.jpeg") returned 6 [0091.694] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.CSS", pszSpec="*.psd") returned 0 [0091.694] lstrlenA (lpString="*.psd") returned 5 [0091.694] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.CSS", pszSpec="*.cdr") returned 0 [0091.694] lstrlenA (lpString="*.cdr") returned 5 [0091.694] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.CSS", pszSpec="*.dwg") returned 0 [0091.695] lstrlenA (lpString="*.dwg") returned 5 [0091.695] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.CSS", pszSpec="*.max") returned 0 [0091.695] lstrlenA (lpString="*.max") returned 5 [0091.695] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.CSS", pszSpec="*.bmp") returned 0 [0091.695] lstrlenA (lpString="*.bmp") returned 5 [0091.695] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.CSS", pszSpec="*.gif") returned 0 [0091.695] lstrlenA (lpString="*.gif") returned 5 [0091.695] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.CSS", pszSpec="*.png") returned 0 [0091.695] lstrlenA (lpString="*.png") returned 5 [0091.695] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.CSS", pszSpec="*.doc") returned 0 [0091.695] lstrlenA (lpString="*.doc") returned 5 [0091.695] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.CSS", pszSpec="*.docx") returned 0 [0091.695] lstrlenA (lpString="*.docx") returned 6 [0091.695] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.CSS", pszSpec="*.xls") returned 0 [0091.695] lstrlenA (lpString="*.xls") returned 5 [0091.695] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.CSS", pszSpec="*.xlsx") returned 0 [0091.695] lstrlenA (lpString="*.xlsx") returned 6 [0091.695] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.CSS", pszSpec="*.ppt") returned 0 [0091.695] lstrlenA (lpString="*.ppt") returned 5 [0091.695] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.CSS", pszSpec="*.pptx") returned 0 [0091.695] lstrlenA (lpString="*.pptx") returned 6 [0091.695] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.CSS", pszSpec="*.txt") returned 0 [0091.695] lstrlenA (lpString="*.txt") returned 5 [0091.695] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.CSS", pszSpec="*.pdf") returned 0 [0091.695] lstrlenA (lpString="*.pdf") returned 5 [0091.695] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.CSS", pszSpec="*.djvu") returned 0 [0091.695] lstrlenA (lpString="*.djvu") returned 6 [0091.695] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.CSS", pszSpec="*.htm") returned 0 [0091.695] lstrlenA (lpString="*.htm") returned 5 [0091.695] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.CSS", pszSpec="*.html") returned 0 [0091.695] lstrlenA (lpString="*.html") returned 6 [0091.695] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.CSS", pszSpec="*.mdb") returned 0 [0091.695] lstrlenA (lpString="*.mdb") returned 5 [0091.695] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.CSS", pszSpec="*.cer") returned 0 [0091.695] lstrlenA (lpString="*.cer") returned 5 [0091.695] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.CSS", pszSpec="*.p12") returned 0 [0091.695] lstrlenA (lpString="*.p12") returned 5 [0091.696] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.CSS", pszSpec="*.pfx") returned 0 [0091.696] lstrlenA (lpString="*.pfx") returned 5 [0091.696] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.CSS", pszSpec="*.kwm") returned 0 [0091.696] lstrlenA (lpString="*.kwm") returned 5 [0091.696] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.CSS", pszSpec="*.pwm") returned 0 [0091.696] lstrlenA (lpString="*.pwm") returned 5 [0091.696] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.CSS", pszSpec="*.1cd") returned 0 [0091.696] lstrlenA (lpString="*.1cd") returned 5 [0091.696] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.CSS", pszSpec="*.md") returned 0 [0091.696] lstrlenA (lpString="*.md") returned 4 [0091.696] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.CSS", pszSpec="*.mdf") returned 0 [0091.696] lstrlenA (lpString="*.mdf") returned 5 [0091.696] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.CSS", pszSpec="*.dbf") returned 0 [0091.696] lstrlenA (lpString="*.dbf") returned 5 [0091.696] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.CSS", pszSpec="*.odt") returned 0 [0091.696] lstrlenA (lpString="*.odt") returned 5 [0091.696] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.CSS", pszSpec="*.vob") returned 0 [0091.696] lstrlenA (lpString="*.vob") returned 5 [0091.696] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.CSS", pszSpec="*.ifo") returned 0 [0091.696] lstrlenA (lpString="*.ifo") returned 5 [0091.696] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.CSS", pszSpec="*.lnk") returned 0 [0091.696] lstrlenA (lpString="*.lnk") returned 5 [0091.696] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.CSS", pszSpec="*.torrent") returned 0 [0091.696] lstrlenA (lpString="*.torrent") returned 9 [0091.696] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.CSS", pszSpec="*.mov") returned 0 [0091.696] lstrlenA (lpString="*.mov") returned 5 [0091.696] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.CSS", pszSpec="*.m2v") returned 0 [0091.696] lstrlenA (lpString="*.m2v") returned 5 [0091.696] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.CSS", pszSpec="*.3gp") returned 0 [0091.696] lstrlenA (lpString="*.3gp") returned 5 [0091.696] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.CSS", pszSpec="*.mpeg") returned 0 [0091.696] lstrlenA (lpString="*.mpeg") returned 6 [0091.696] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.CSS", pszSpec="*.mpg") returned 0 [0091.696] lstrlenA (lpString="*.mpg") returned 5 [0091.696] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.CSS", pszSpec="*.flv") returned 0 [0091.696] lstrlenA (lpString="*.flv") returned 5 [0091.696] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.CSS", pszSpec="*.avi") returned 0 [0091.697] lstrlenA (lpString="*.avi") returned 5 [0091.697] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.CSS", pszSpec="*.mp4") returned 0 [0091.697] lstrlenA (lpString="*.mp4") returned 5 [0091.697] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.CSS", pszSpec="*.wmv") returned 0 [0091.697] lstrlenA (lpString="*.wmv") returned 5 [0091.697] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.CSS", pszSpec="*.divx") returned 0 [0091.697] lstrlenA (lpString="*.divx") returned 6 [0091.697] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.CSS", pszSpec="*.mkv") returned 0 [0091.697] lstrlenA (lpString="*.mkv") returned 5 [0091.697] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.CSS", pszSpec="*.mp3") returned 0 [0091.697] lstrlenA (lpString="*.mp3") returned 5 [0091.697] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.CSS", pszSpec="*.wav") returned 0 [0091.697] lstrlenA (lpString="*.wav") returned 5 [0091.697] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.CSS", pszSpec="*.flac") returned 0 [0091.697] lstrlenA (lpString="*.flac") returned 6 [0091.697] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.CSS", pszSpec="*.ape") returned 0 [0091.697] lstrlenA (lpString="*.ape") returned 5 [0091.697] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.CSS", pszSpec="*.wma") returned 0 [0091.697] lstrlenA (lpString="*.wma") returned 5 [0091.697] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.CSS", pszSpec="*.ac3") returned 0 [0091.697] lstrlenA (lpString="*.ac3") returned 5 [0091.697] FindNextFileA (in: hFindFile=0x5b7d30, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0091.697] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0091.697] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="VIEW.ICO") returned -1 [0091.697] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="VIEW.ICO") returned -1 [0091.697] lstrcmpiA (lpString1="", lpString2="VIEW.ICO") returned -1 [0091.697] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.CSS") returned="VIEW.CSS" [0091.697] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="VIEW.ICO" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.ICO") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.ICO" [0091.697] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.ICO", pszSpec="*.zip") returned 0 [0091.697] lstrlenA (lpString="*.zip") returned 5 [0091.697] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.ICO", pszSpec="*.rar") returned 0 [0091.697] lstrlenA (lpString="*.rar") returned 5 [0091.697] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.ICO", pszSpec="*.7z") returned 0 [0091.697] lstrlenA (lpString="*.7z") returned 4 [0091.697] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.ICO", pszSpec="*.tar") returned 0 [0091.697] lstrlenA (lpString="*.tar") returned 5 [0091.697] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.ICO", pszSpec="*.gzip") returned 0 [0091.697] lstrlenA (lpString="*.gzip") returned 6 [0091.697] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.ICO", pszSpec="*.jpg") returned 0 [0091.697] lstrlenA (lpString="*.jpg") returned 5 [0091.697] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.ICO", pszSpec="*.jpeg") returned 0 [0091.697] lstrlenA (lpString="*.jpeg") returned 6 [0091.697] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.ICO", pszSpec="*.psd") returned 0 [0091.697] lstrlenA (lpString="*.psd") returned 5 [0091.698] FindNextFileA (in: hFindFile=0x5b7d30, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0091.698] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0091.698] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="VIEW.JS") returned -1 [0091.698] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="VIEW.JS") returned -1 [0091.698] lstrcmpiA (lpString1="", lpString2="VIEW.JS") returned -1 [0091.698] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.ICO") returned="VIEW.ICO" [0091.698] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="VIEW.JS" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.JS") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.JS" [0091.698] FindNextFileA (in: hFindFile=0x5b7d30, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0091.698] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0091.698] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="VIEWBY.GIF") returned -1 [0091.698] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="VIEWBY.GIF") returned -1 [0091.698] lstrcmpiA (lpString1="", lpString2="VIEWBY.GIF") returned -1 [0091.698] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.JS") returned="VIEW.JS" [0091.698] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="VIEWBY.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEWBY.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEWBY.GIF" [0091.698] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEWBY.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEWBY.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEWBY.GIF" [0091.698] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEWBY.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEWBY.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEWBY.GIF" [0091.698] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEWBY.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEWBY.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEWBY.GIF." [0091.698] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEWBY.GIF.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEWBY.GIF. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEWBY.GIF. " [0091.698] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEWBY.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\viewby.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0091.699] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x207 [0091.699] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8acda200, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5e490770, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8acda200, dwHighDateTime=0x1c747ea)) returned 1 [0091.699] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0091.699] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x1ad, lpOverlapped=0x0) returned 1 [0091.699] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEWBY.GIF") returned="VIEWBY.GIF" [0091.699] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0091.699] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x1ad, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x1ad, lpOverlapped=0x0) returned 1 [0091.700] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0091.700] CloseHandle (hObject=0x98) returned 1 [0091.700] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEWBY.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\viewby.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEWBY.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\viewby.gif. ")) returned 1 [0091.736] FindNextFileA (in: hFindFile=0x5b7d30, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0091.736] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0091.736] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="viewDblClick.js") returned -1 [0091.736] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="viewDblClick.js") returned -1 [0091.736] lstrcmpiA (lpString1="", lpString2="viewDblClick.js") returned -1 [0091.736] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEWBY.GIF") returned="VIEWBY.GIF" [0091.736] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="viewDblClick.js" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewDblClick.js") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewDblClick.js" [0091.736] FindNextFileA (in: hFindFile=0x5b7d30, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0091.736] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0091.736] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="ViewHeaderPreview.jpg") returned -1 [0091.736] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ViewHeaderPreview.jpg") returned -1 [0091.736] lstrcmpiA (lpString1="", lpString2="ViewHeaderPreview.jpg") returned -1 [0091.736] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewDblClick.js") returned="viewDblClick.js" [0091.736] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="ViewHeaderPreview.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\ViewHeaderPreview.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\ViewHeaderPreview.jpg" [0091.736] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\ViewHeaderPreview.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\ViewHeaderPreview.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\ViewHeaderPreview.jpg" [0091.736] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\ViewHeaderPreview.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\ViewHeaderPreview.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\ViewHeaderPreview.jpg" [0091.736] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\ViewHeaderPreview.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\ViewHeaderPreview.jpg.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\ViewHeaderPreview.jpg." [0091.736] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\ViewHeaderPreview.jpg.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\ViewHeaderPreview.jpg. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\ViewHeaderPreview.jpg. " [0091.736] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\ViewHeaderPreview.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\viewheaderpreview.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0091.737] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xd78 [0091.737] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8acda200, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x706f8370, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8acda200, dwHighDateTime=0x1c747ea)) returned 1 [0091.737] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0091.737] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0xd1e, lpOverlapped=0x0) returned 1 [0091.777] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\ViewHeaderPreview.jpg") returned="ViewHeaderPreview.jpg" [0091.777] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0091.777] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0xd1e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0xd1e, lpOverlapped=0x0) returned 1 [0091.777] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0091.777] CloseHandle (hObject=0x98) returned 1 [0091.778] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\ViewHeaderPreview.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\viewheaderpreview.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\ViewHeaderPreview.jpg. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\viewheaderpreview.jpg. ")) returned 1 [0091.778] FindNextFileA (in: hFindFile=0x5b7d30, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0091.778] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0091.778] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="viewSelectionChanged.js") returned -1 [0091.778] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="viewSelectionChanged.js") returned -1 [0091.779] lstrcmpiA (lpString1="", lpString2="viewSelectionChanged.js") returned -1 [0091.779] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\ViewHeaderPreview.jpg") returned="ViewHeaderPreview.jpg" [0091.779] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", lpString2="viewSelectionChanged.js" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewSelectionChanged.js") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewSelectionChanged.js" [0091.779] FindNextFileA (in: hFindFile=0x5b7d30, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 0 [0091.779] FindClose (in: hFindFile=0x5b7d30 | out: hFindFile=0x5b7d30) returned 1 [0091.779] FindNextFileA (in: hFindFile=0x5b7dd0, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0091.779] lstrcmpA (lpString1=".", lpString2="GrooveForms3") returned -1 [0091.779] lstrcmpA (lpString1="..", lpString2="GrooveForms3") returned -1 [0091.779] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\*.*") returned="*.*" [0091.779] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\", lpString2="GrooveForms3" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3" [0091.779] lstrlenA (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3") returned 82 [0091.779] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\*.*", lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 0x5b7d30 [0091.802] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0091.802] FindNextFileA (in: hFindFile=0x5b7d30, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0091.804] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0091.804] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0091.804] FindNextFileA (in: hFindFile=0x5b7d30, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0091.804] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0091.804] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="ADD.GIF") returned 1 [0091.804] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ADD.GIF") returned 1 [0091.804] lstrcmpiA (lpString1="", lpString2="ADD.GIF") returned -1 [0091.804] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\*.*") returned="*.*" [0091.804] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="ADD.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ADD.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ADD.GIF" [0091.804] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ADD.GIF", pszSpec="*.zip") returned 0 [0091.804] lstrlenA (lpString="*.zip") returned 5 [0091.804] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ADD.GIF", pszSpec="*.rar") returned 0 [0091.804] lstrlenA (lpString="*.rar") returned 5 [0091.804] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ADD.GIF", pszSpec="*.7z") returned 0 [0091.804] lstrlenA (lpString="*.7z") returned 4 [0091.804] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ADD.GIF", pszSpec="*.tar") returned 0 [0091.804] lstrlenA (lpString="*.tar") returned 5 [0091.804] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ADD.GIF", pszSpec="*.gzip") returned 0 [0091.804] lstrlenA (lpString="*.gzip") returned 6 [0091.804] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ADD.GIF", pszSpec="*.jpg") returned 0 [0091.804] lstrlenA (lpString="*.jpg") returned 5 [0091.804] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ADD.GIF", pszSpec="*.jpeg") returned 0 [0091.804] lstrlenA (lpString="*.jpeg") returned 6 [0091.804] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ADD.GIF", pszSpec="*.psd") returned 0 [0091.804] lstrlenA (lpString="*.psd") returned 5 [0091.804] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ADD.GIF", pszSpec="*.cdr") returned 0 [0091.804] lstrlenA (lpString="*.cdr") returned 5 [0091.804] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ADD.GIF", pszSpec="*.dwg") returned 0 [0091.804] lstrlenA (lpString="*.dwg") returned 5 [0091.804] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ADD.GIF", pszSpec="*.max") returned 0 [0091.804] lstrlenA (lpString="*.max") returned 5 [0091.804] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ADD.GIF", pszSpec="*.bmp") returned 0 [0091.804] lstrlenA (lpString="*.bmp") returned 5 [0091.804] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ADD.GIF", pszSpec="*.gif") returned 1 [0091.805] lstrlenA (lpString="*.gif") returned 5 [0091.805] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ADD.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ADD.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ADD.GIF" [0091.805] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ADD.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ADD.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ADD.GIF" [0091.805] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ADD.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ADD.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ADD.GIF." [0091.805] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ADD.GIF.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ADD.GIF. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ADD.GIF. " [0091.805] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ADD.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\add.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0091.820] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x244 [0091.820] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8bfecf00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5eaf6290, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8bfecf00, dwHighDateTime=0x1c747ea)) returned 1 [0091.820] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0091.820] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x1ea, lpOverlapped=0x0) returned 1 [0091.820] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ADD.GIF") returned="ADD.GIF" [0091.820] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0091.821] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x1ea, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x1ea, lpOverlapped=0x0) returned 1 [0091.821] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0091.821] CloseHandle (hObject=0x98) returned 1 [0091.821] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ADD.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\add.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ADD.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\add.gif. ")) returned 1 [0091.822] FindNextFileA (in: hFindFile=0x5b7d30, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0091.822] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0091.822] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="AddToViewArrow.jpg") returned 1 [0091.822] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AddToViewArrow.jpg") returned 1 [0091.823] lstrcmpiA (lpString1="", lpString2="AddToViewArrow.jpg") returned -1 [0091.823] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ADD.GIF") returned="ADD.GIF" [0091.823] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="AddToViewArrow.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrow.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrow.jpg" [0091.823] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrow.jpg", pszSpec="*.zip") returned 0 [0091.823] lstrlenA (lpString="*.zip") returned 5 [0091.823] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrow.jpg", pszSpec="*.rar") returned 0 [0091.823] lstrlenA (lpString="*.rar") returned 5 [0091.823] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrow.jpg", pszSpec="*.7z") returned 0 [0091.823] lstrlenA (lpString="*.7z") returned 4 [0091.823] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrow.jpg", pszSpec="*.tar") returned 0 [0091.823] lstrlenA (lpString="*.tar") returned 5 [0091.823] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrow.jpg", pszSpec="*.gzip") returned 0 [0091.823] lstrlenA (lpString="*.gzip") returned 6 [0091.823] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrow.jpg", pszSpec="*.jpg") returned 1 [0091.823] lstrlenA (lpString="*.jpg") returned 5 [0091.823] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrow.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrow.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrow.jpg" [0091.823] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrow.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrow.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrow.jpg" [0091.823] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrow.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrow.jpg.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrow.jpg." [0091.823] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrow.jpg.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrow.jpg. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrow.jpg. " [0091.823] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrow.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\addtoviewarrow.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0091.836] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xbe8 [0091.836] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8bfecf00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5eaf6290, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8bfecf00, dwHighDateTime=0x1c747ea)) returned 1 [0091.836] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0091.836] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0xb8e, lpOverlapped=0x0) returned 1 [0092.024] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrow.jpg") returned="AddToViewArrow.jpg" [0092.024] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0092.024] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0xb8e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0xb8e, lpOverlapped=0x0) returned 1 [0092.024] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0092.024] CloseHandle (hObject=0x98) returned 1 [0092.024] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrow.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\addtoviewarrow.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrow.jpg. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\addtoviewarrow.jpg. ")) returned 1 [0092.025] FindNextFileA (in: hFindFile=0x5b7d30, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0092.025] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0092.025] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="AddToViewArrowMask.bmp") returned 1 [0092.025] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AddToViewArrowMask.bmp") returned 1 [0092.025] lstrcmpiA (lpString1="", lpString2="AddToViewArrowMask.bmp") returned -1 [0092.025] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrow.jpg") returned="AddToViewArrow.jpg" [0092.025] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="AddToViewArrowMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrowMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrowMask.bmp" [0092.025] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrowMask.bmp", pszSpec="*.zip") returned 0 [0092.025] lstrlenA (lpString="*.zip") returned 5 [0092.025] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrowMask.bmp", pszSpec="*.rar") returned 0 [0092.025] lstrlenA (lpString="*.rar") returned 5 [0092.025] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrowMask.bmp", pszSpec="*.7z") returned 0 [0092.025] lstrlenA (lpString="*.7z") returned 4 [0092.025] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrowMask.bmp", pszSpec="*.tar") returned 0 [0092.025] lstrlenA (lpString="*.tar") returned 5 [0092.025] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrowMask.bmp", pszSpec="*.gzip") returned 0 [0092.025] lstrlenA (lpString="*.gzip") returned 6 [0092.025] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrowMask.bmp", pszSpec="*.jpg") returned 0 [0092.025] lstrlenA (lpString="*.jpg") returned 5 [0092.026] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrowMask.bmp", pszSpec="*.jpeg") returned 0 [0092.026] lstrlenA (lpString="*.jpeg") returned 6 [0092.026] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrowMask.bmp", pszSpec="*.psd") returned 0 [0092.026] lstrlenA (lpString="*.psd") returned 5 [0092.026] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrowMask.bmp", pszSpec="*.cdr") returned 0 [0092.026] lstrlenA (lpString="*.cdr") returned 5 [0092.026] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrowMask.bmp", pszSpec="*.dwg") returned 0 [0092.026] lstrlenA (lpString="*.dwg") returned 5 [0092.026] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrowMask.bmp", pszSpec="*.max") returned 0 [0092.026] lstrlenA (lpString="*.max") returned 5 [0092.026] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrowMask.bmp", pszSpec="*.bmp") returned 1 [0092.026] lstrlenA (lpString="*.bmp") returned 5 [0092.026] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrowMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrowMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrowMask.bmp" [0092.026] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrowMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrowMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrowMask.bmp" [0092.026] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrowMask.bmp", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrowMask.bmp.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrowMask.bmp." [0092.026] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrowMask.bmp.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrowMask.bmp. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrowMask.bmp. " [0092.026] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrowMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\addtoviewarrowmask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0092.026] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x924 [0092.026] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8bfecf00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5127f1f0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8bfecf00, dwHighDateTime=0x1c747ea)) returned 1 [0092.026] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0092.026] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x8ca, lpOverlapped=0x0) returned 1 [0092.041] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrowMask.bmp") returned="AddToViewArrowMask.bmp" [0092.041] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0092.041] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x8ca, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x8ca, lpOverlapped=0x0) returned 1 [0092.041] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0092.041] CloseHandle (hObject=0x98) returned 1 [0092.041] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrowMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\addtoviewarrowmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrowMask.bmp. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\addtoviewarrowmask.bmp. ")) returned 1 [0092.042] FindNextFileA (in: hFindFile=0x5b7d30, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0092.042] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0092.042] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="attention.gif") returned 1 [0092.042] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="attention.gif") returned 1 [0092.042] lstrcmpiA (lpString1="", lpString2="attention.gif") returned -1 [0092.042] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrowMask.bmp") returned="AddToViewArrowMask.bmp" [0092.042] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="attention.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\attention.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\attention.gif" [0092.042] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\attention.gif", pszSpec="*.zip") returned 0 [0092.042] lstrlenA (lpString="*.zip") returned 5 [0092.042] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\attention.gif", pszSpec="*.rar") returned 0 [0092.042] lstrlenA (lpString="*.rar") returned 5 [0092.042] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\attention.gif", pszSpec="*.7z") returned 0 [0092.042] lstrlenA (lpString="*.7z") returned 4 [0092.042] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\attention.gif", pszSpec="*.tar") returned 0 [0092.042] lstrlenA (lpString="*.tar") returned 5 [0092.042] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\attention.gif", pszSpec="*.gzip") returned 0 [0092.042] lstrlenA (lpString="*.gzip") returned 6 [0092.042] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\attention.gif", pszSpec="*.jpg") returned 0 [0092.042] lstrlenA (lpString="*.jpg") returned 5 [0092.042] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\attention.gif", pszSpec="*.jpeg") returned 0 [0092.042] lstrlenA (lpString="*.jpeg") returned 6 [0092.042] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\attention.gif", pszSpec="*.psd") returned 0 [0092.042] lstrlenA (lpString="*.psd") returned 5 [0092.042] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\attention.gif", pszSpec="*.cdr") returned 0 [0092.042] lstrlenA (lpString="*.cdr") returned 5 [0092.042] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\attention.gif", pszSpec="*.dwg") returned 0 [0092.042] lstrlenA (lpString="*.dwg") returned 5 [0092.042] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\attention.gif", pszSpec="*.max") returned 0 [0092.042] lstrlenA (lpString="*.max") returned 5 [0092.043] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\attention.gif", pszSpec="*.bmp") returned 0 [0092.043] lstrlenA (lpString="*.bmp") returned 5 [0092.043] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\attention.gif", pszSpec="*.gif") returned 1 [0092.043] lstrlenA (lpString="*.gif") returned 5 [0092.043] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\attention.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\attention.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\attention.gif" [0092.043] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\attention.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\attention.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\attention.gif" [0092.043] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\attention.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\attention.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\attention.gif." [0092.043] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\attention.gif.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\attention.gif. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\attention.gif. " [0092.043] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\attention.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\attention.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0092.043] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xae8 [0092.043] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8bfecf00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5f409670, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8bfecf00, dwHighDateTime=0x1c747ea)) returned 1 [0092.043] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0092.043] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0xa8e, lpOverlapped=0x0) returned 1 [0092.048] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\attention.gif") returned="attention.gif" [0092.049] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0092.049] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0xa8e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0xa8e, lpOverlapped=0x0) returned 1 [0092.049] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0092.049] CloseHandle (hObject=0x98) returned 1 [0092.049] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\attention.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\attention.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\attention.gif. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\attention.gif. ")) returned 1 [0092.050] FindNextFileA (in: hFindFile=0x5b7d30, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0092.050] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0092.050] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BG_ADOBE.GIF") returned 1 [0092.050] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BG_ADOBE.GIF") returned 1 [0092.050] lstrcmpiA (lpString1="", lpString2="BG_ADOBE.GIF") returned -1 [0092.050] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\attention.gif") returned="attention.gif" [0092.050] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="BG_ADOBE.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\BG_ADOBE.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\BG_ADOBE.GIF" [0092.050] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\BG_ADOBE.GIF", pszSpec="*.zip") returned 0 [0092.050] lstrlenA (lpString="*.zip") returned 5 [0092.050] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\BG_ADOBE.GIF", pszSpec="*.rar") returned 0 [0092.050] lstrlenA (lpString="*.rar") returned 5 [0092.050] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\BG_ADOBE.GIF", pszSpec="*.7z") returned 0 [0092.050] lstrlenA (lpString="*.7z") returned 4 [0092.050] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\BG_ADOBE.GIF", pszSpec="*.tar") returned 0 [0092.050] lstrlenA (lpString="*.tar") returned 5 [0092.050] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\BG_ADOBE.GIF", pszSpec="*.gzip") returned 0 [0092.050] lstrlenA (lpString="*.gzip") returned 6 [0092.050] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\BG_ADOBE.GIF", pszSpec="*.jpg") returned 0 [0092.050] lstrlenA (lpString="*.jpg") returned 5 [0092.050] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\BG_ADOBE.GIF", pszSpec="*.jpeg") returned 0 [0092.050] lstrlenA (lpString="*.jpeg") returned 6 [0092.050] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\BG_ADOBE.GIF", pszSpec="*.psd") returned 0 [0092.050] lstrlenA (lpString="*.psd") returned 5 [0092.050] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\BG_ADOBE.GIF", pszSpec="*.cdr") returned 0 [0092.050] lstrlenA (lpString="*.cdr") returned 5 [0092.050] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\BG_ADOBE.GIF", pszSpec="*.dwg") returned 0 [0092.050] lstrlenA (lpString="*.dwg") returned 5 [0092.050] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\BG_ADOBE.GIF", pszSpec="*.max") returned 0 [0092.050] lstrlenA (lpString="*.max") returned 5 [0092.050] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\BG_ADOBE.GIF", pszSpec="*.bmp") returned 0 [0092.050] lstrlenA (lpString="*.bmp") returned 5 [0092.050] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\BG_ADOBE.GIF", pszSpec="*.gif") returned 1 [0092.050] lstrlenA (lpString="*.gif") returned 5 [0092.050] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\BG_ADOBE.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\BG_ADOBE.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\BG_ADOBE.GIF" [0092.050] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\BG_ADOBE.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\BG_ADOBE.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\BG_ADOBE.GIF" [0092.050] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\BG_ADOBE.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\BG_ADOBE.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\BG_ADOBE.GIF." [0092.050] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\BG_ADOBE.GIF.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\BG_ADOBE.GIF. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\BG_ADOBE.GIF. " [0092.051] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\BG_ADOBE.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_adobe.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0092.051] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x614e [0092.051] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8bfecf00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5f61e9b0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8bfecf00, dwHighDateTime=0x1c747ea)) returned 1 [0092.051] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0092.051] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x60f4, lpOverlapped=0x0) returned 1 [0092.068] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\BG_ADOBE.GIF") returned="BG_ADOBE.GIF" [0092.068] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0092.068] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x60f4, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x60f4, lpOverlapped=0x0) returned 1 [0092.068] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0092.069] CloseHandle (hObject=0x98) returned 1 [0092.069] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\BG_ADOBE.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_adobe.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\BG_ADOBE.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_adobe.gif. ")) returned 1 [0092.070] FindNextFileA (in: hFindFile=0x5b7d30, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0092.070] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0092.070] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="bg_Casual.gif") returned 1 [0092.070] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bg_Casual.gif") returned 1 [0092.070] lstrcmpiA (lpString1="", lpString2="bg_Casual.gif") returned -1 [0092.070] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\BG_ADOBE.GIF") returned="BG_ADOBE.GIF" [0092.070] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="bg_Casual.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Casual.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Casual.gif" [0092.070] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Casual.gif", pszSpec="*.zip") returned 0 [0092.070] lstrlenA (lpString="*.zip") returned 5 [0092.070] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Casual.gif", pszSpec="*.rar") returned 0 [0092.070] lstrlenA (lpString="*.rar") returned 5 [0092.070] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Casual.gif", pszSpec="*.7z") returned 0 [0092.070] lstrlenA (lpString="*.7z") returned 4 [0092.070] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Casual.gif", pszSpec="*.tar") returned 0 [0092.070] lstrlenA (lpString="*.tar") returned 5 [0092.070] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Casual.gif", pszSpec="*.gzip") returned 0 [0092.070] lstrlenA (lpString="*.gzip") returned 6 [0092.070] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Casual.gif", pszSpec="*.jpg") returned 0 [0092.070] lstrlenA (lpString="*.jpg") returned 5 [0092.070] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Casual.gif", pszSpec="*.jpeg") returned 0 [0092.070] lstrlenA (lpString="*.jpeg") returned 6 [0092.070] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Casual.gif", pszSpec="*.psd") returned 0 [0092.070] lstrlenA (lpString="*.psd") returned 5 [0092.070] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Casual.gif", pszSpec="*.cdr") returned 0 [0092.070] lstrlenA (lpString="*.cdr") returned 5 [0092.070] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Casual.gif", pszSpec="*.dwg") returned 0 [0092.070] lstrlenA (lpString="*.dwg") returned 5 [0092.070] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Casual.gif", pszSpec="*.max") returned 0 [0092.070] lstrlenA (lpString="*.max") returned 5 [0092.070] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Casual.gif", pszSpec="*.bmp") returned 0 [0092.070] lstrlenA (lpString="*.bmp") returned 5 [0092.070] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Casual.gif", pszSpec="*.gif") returned 1 [0092.070] lstrlenA (lpString="*.gif") returned 5 [0092.070] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Casual.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Casual.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Casual.gif" [0092.070] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Casual.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Casual.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Casual.gif" [0092.071] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Casual.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Casual.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Casual.gif." [0092.071] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Casual.gif.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Casual.gif. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Casual.gif. " [0092.071] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Casual.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_casual.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0092.071] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x161d [0092.071] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8bfecf00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5f61e9b0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8bfecf00, dwHighDateTime=0x1c747ea)) returned 1 [0092.071] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0092.071] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x15c3, lpOverlapped=0x0) returned 1 [0092.144] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Casual.gif") returned="bg_Casual.gif" [0092.144] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0092.145] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x15c3, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x15c3, lpOverlapped=0x0) returned 1 [0092.145] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0092.145] CloseHandle (hObject=0x98) returned 1 [0092.145] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Casual.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_casual.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Casual.gif. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_casual.gif. ")) returned 1 [0092.146] FindNextFileA (in: hFindFile=0x5b7d30, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0092.146] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0092.146] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="bg_Country.gif") returned 1 [0092.146] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bg_Country.gif") returned 1 [0092.146] lstrcmpiA (lpString1="", lpString2="bg_Country.gif") returned -1 [0092.146] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Casual.gif") returned="bg_Casual.gif" [0092.146] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="bg_Country.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Country.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Country.gif" [0092.146] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Country.gif", pszSpec="*.zip") returned 0 [0092.146] lstrlenA (lpString="*.zip") returned 5 [0092.146] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Country.gif", pszSpec="*.rar") returned 0 [0092.146] lstrlenA (lpString="*.rar") returned 5 [0092.146] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Country.gif", pszSpec="*.7z") returned 0 [0092.146] lstrlenA (lpString="*.7z") returned 4 [0092.146] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Country.gif", pszSpec="*.tar") returned 0 [0092.146] lstrlenA (lpString="*.tar") returned 5 [0092.146] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Country.gif", pszSpec="*.gzip") returned 0 [0092.146] lstrlenA (lpString="*.gzip") returned 6 [0092.146] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Country.gif", pszSpec="*.jpg") returned 0 [0092.146] lstrlenA (lpString="*.jpg") returned 5 [0092.146] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Country.gif", pszSpec="*.jpeg") returned 0 [0092.146] lstrlenA (lpString="*.jpeg") returned 6 [0092.146] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Country.gif", pszSpec="*.psd") returned 0 [0092.146] lstrlenA (lpString="*.psd") returned 5 [0092.146] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Country.gif", pszSpec="*.cdr") returned 0 [0092.146] lstrlenA (lpString="*.cdr") returned 5 [0092.146] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Country.gif", pszSpec="*.dwg") returned 0 [0092.146] lstrlenA (lpString="*.dwg") returned 5 [0092.146] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Country.gif", pszSpec="*.max") returned 0 [0092.146] lstrlenA (lpString="*.max") returned 5 [0092.146] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Country.gif", pszSpec="*.bmp") returned 0 [0092.146] lstrlenA (lpString="*.bmp") returned 5 [0092.146] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Country.gif", pszSpec="*.gif") returned 1 [0092.147] lstrlenA (lpString="*.gif") returned 5 [0092.147] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Country.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Country.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Country.gif" [0092.147] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Country.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Country.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Country.gif" [0092.147] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Country.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Country.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Country.gif." [0092.147] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Country.gif.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Country.gif. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Country.gif. " [0092.147] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Country.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_country.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0092.147] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x7dd3 [0092.147] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8bfecf00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5f644b10, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8bfecf00, dwHighDateTime=0x1c747ea)) returned 1 [0092.147] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0092.147] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x7d79, lpOverlapped=0x0) returned 1 [0092.148] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Country.gif") returned="bg_Country.gif" [0092.148] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0092.148] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x7d79, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x7d79, lpOverlapped=0x0) returned 1 [0092.149] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0092.149] CloseHandle (hObject=0x98) returned 1 [0092.149] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Country.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_country.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Country.gif. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_country.gif. ")) returned 1 [0092.149] FindNextFileA (in: hFindFile=0x5b7d30, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0092.149] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0092.149] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="bg_Earthy.gif") returned 1 [0092.149] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bg_Earthy.gif") returned 1 [0092.149] lstrcmpiA (lpString1="", lpString2="bg_Earthy.gif") returned -1 [0092.149] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Country.gif") returned="bg_Country.gif" [0092.150] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="bg_Earthy.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Earthy.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Earthy.gif" [0092.150] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Earthy.gif", pszSpec="*.zip") returned 0 [0092.150] lstrlenA (lpString="*.zip") returned 5 [0092.150] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Earthy.gif", pszSpec="*.rar") returned 0 [0092.150] lstrlenA (lpString="*.rar") returned 5 [0092.150] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Earthy.gif", pszSpec="*.7z") returned 0 [0092.150] lstrlenA (lpString="*.7z") returned 4 [0092.150] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Earthy.gif", pszSpec="*.tar") returned 0 [0092.150] lstrlenA (lpString="*.tar") returned 5 [0092.150] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Earthy.gif", pszSpec="*.gzip") returned 0 [0092.150] lstrlenA (lpString="*.gzip") returned 6 [0092.150] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Earthy.gif", pszSpec="*.jpg") returned 0 [0092.150] lstrlenA (lpString="*.jpg") returned 5 [0092.150] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Earthy.gif", pszSpec="*.jpeg") returned 0 [0092.150] lstrlenA (lpString="*.jpeg") returned 6 [0092.150] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Earthy.gif", pszSpec="*.psd") returned 0 [0092.150] lstrlenA (lpString="*.psd") returned 5 [0092.150] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Earthy.gif", pszSpec="*.cdr") returned 0 [0092.150] lstrlenA (lpString="*.cdr") returned 5 [0092.150] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Earthy.gif", pszSpec="*.dwg") returned 0 [0092.150] lstrlenA (lpString="*.dwg") returned 5 [0092.150] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Earthy.gif", pszSpec="*.max") returned 0 [0092.150] lstrlenA (lpString="*.max") returned 5 [0092.150] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Earthy.gif", pszSpec="*.bmp") returned 0 [0092.150] lstrlenA (lpString="*.bmp") returned 5 [0092.150] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Earthy.gif", pszSpec="*.gif") returned 1 [0092.150] lstrlenA (lpString="*.gif") returned 5 [0092.150] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Earthy.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Earthy.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Earthy.gif" [0092.150] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Earthy.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Earthy.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Earthy.gif" [0092.150] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Earthy.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Earthy.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Earthy.gif." [0092.150] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Earthy.gif.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Earthy.gif. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Earthy.gif. " [0092.150] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Earthy.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_earthy.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0092.151] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x132a [0092.151] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8bfecf00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5f644b10, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8bfecf00, dwHighDateTime=0x1c747ea)) returned 1 [0092.151] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0092.151] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x12d0, lpOverlapped=0x0) returned 1 [0092.160] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Earthy.gif") returned="bg_Earthy.gif" [0092.160] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0092.160] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x12d0, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x12d0, lpOverlapped=0x0) returned 1 [0092.160] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0092.160] CloseHandle (hObject=0x98) returned 1 [0092.160] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Earthy.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_earthy.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Earthy.gif. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_earthy.gif. ")) returned 1 [0092.161] FindNextFileA (in: hFindFile=0x5b7d30, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0092.161] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0092.161] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="bg_FormsHomePage.gif") returned 1 [0092.161] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bg_FormsHomePage.gif") returned 1 [0092.161] lstrcmpiA (lpString1="", lpString2="bg_FormsHomePage.gif") returned -1 [0092.161] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Earthy.gif") returned="bg_Earthy.gif" [0092.161] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="bg_FormsHomePage.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePage.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePage.gif" [0092.161] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePage.gif", pszSpec="*.zip") returned 0 [0092.161] lstrlenA (lpString="*.zip") returned 5 [0092.161] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePage.gif", pszSpec="*.rar") returned 0 [0092.161] lstrlenA (lpString="*.rar") returned 5 [0092.161] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePage.gif", pszSpec="*.7z") returned 0 [0092.161] lstrlenA (lpString="*.7z") returned 4 [0092.161] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePage.gif", pszSpec="*.tar") returned 0 [0092.161] lstrlenA (lpString="*.tar") returned 5 [0092.161] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePage.gif", pszSpec="*.gzip") returned 0 [0092.161] lstrlenA (lpString="*.gzip") returned 6 [0092.161] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePage.gif", pszSpec="*.jpg") returned 0 [0092.161] lstrlenA (lpString="*.jpg") returned 5 [0092.161] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePage.gif", pszSpec="*.jpeg") returned 0 [0092.161] lstrlenA (lpString="*.jpeg") returned 6 [0092.161] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePage.gif", pszSpec="*.psd") returned 0 [0092.161] lstrlenA (lpString="*.psd") returned 5 [0092.161] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePage.gif", pszSpec="*.cdr") returned 0 [0092.161] lstrlenA (lpString="*.cdr") returned 5 [0092.161] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePage.gif", pszSpec="*.dwg") returned 0 [0092.161] lstrlenA (lpString="*.dwg") returned 5 [0092.161] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePage.gif", pszSpec="*.max") returned 0 [0092.162] lstrlenA (lpString="*.max") returned 5 [0092.162] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePage.gif", pszSpec="*.bmp") returned 0 [0092.162] lstrlenA (lpString="*.bmp") returned 5 [0092.162] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePage.gif", pszSpec="*.gif") returned 1 [0092.162] lstrlenA (lpString="*.gif") returned 5 [0092.162] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePage.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePage.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePage.gif" [0092.162] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePage.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePage.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePage.gif" [0092.162] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePage.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePage.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePage.gif." [0092.162] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePage.gif.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePage.gif. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePage.gif. " [0092.162] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePage.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_formshomepage.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0092.162] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x167bd [0092.162] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8bfecf00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5f644b10, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8bfecf00, dwHighDateTime=0x1c747ea)) returned 1 [0092.162] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0092.162] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x16763, lpOverlapped=0x0) returned 1 [0092.164] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePage.gif") returned="bg_FormsHomePage.gif" [0092.164] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0092.164] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x16763, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x16763, lpOverlapped=0x0) returned 1 [0092.164] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0092.165] CloseHandle (hObject=0x98) returned 1 [0092.165] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePage.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_formshomepage.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePage.gif. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_formshomepage.gif. ")) returned 1 [0092.166] FindNextFileA (in: hFindFile=0x5b7d30, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0092.166] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0092.166] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="bg_FormsHomePageBlank.gif") returned 1 [0092.166] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bg_FormsHomePageBlank.gif") returned 1 [0092.166] lstrcmpiA (lpString1="", lpString2="bg_FormsHomePageBlank.gif") returned -1 [0092.166] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePage.gif") returned="bg_FormsHomePage.gif" [0092.166] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="bg_FormsHomePageBlank.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageBlank.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageBlank.gif" [0092.166] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageBlank.gif", pszSpec="*.zip") returned 0 [0092.166] lstrlenA (lpString="*.zip") returned 5 [0092.166] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageBlank.gif", pszSpec="*.rar") returned 0 [0092.166] lstrlenA (lpString="*.rar") returned 5 [0092.166] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageBlank.gif", pszSpec="*.7z") returned 0 [0092.166] lstrlenA (lpString="*.7z") returned 4 [0092.166] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageBlank.gif", pszSpec="*.tar") returned 0 [0092.167] lstrlenA (lpString="*.tar") returned 5 [0092.167] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageBlank.gif", pszSpec="*.gzip") returned 0 [0092.167] lstrlenA (lpString="*.gzip") returned 6 [0092.167] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageBlank.gif", pszSpec="*.jpg") returned 0 [0092.167] lstrlenA (lpString="*.jpg") returned 5 [0092.167] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageBlank.gif", pszSpec="*.jpeg") returned 0 [0092.167] lstrlenA (lpString="*.jpeg") returned 6 [0092.167] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageBlank.gif", pszSpec="*.psd") returned 0 [0092.167] lstrlenA (lpString="*.psd") returned 5 [0092.167] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageBlank.gif", pszSpec="*.cdr") returned 0 [0092.167] lstrlenA (lpString="*.cdr") returned 5 [0092.167] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageBlank.gif", pszSpec="*.dwg") returned 0 [0092.167] lstrlenA (lpString="*.dwg") returned 5 [0092.167] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageBlank.gif", pszSpec="*.max") returned 0 [0092.167] lstrlenA (lpString="*.max") returned 5 [0092.167] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageBlank.gif", pszSpec="*.bmp") returned 0 [0092.167] lstrlenA (lpString="*.bmp") returned 5 [0092.167] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageBlank.gif", pszSpec="*.gif") returned 1 [0092.167] lstrlenA (lpString="*.gif") returned 5 [0092.167] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageBlank.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageBlank.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageBlank.gif" [0092.167] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageBlank.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageBlank.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageBlank.gif" [0092.167] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageBlank.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageBlank.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageBlank.gif." [0092.167] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageBlank.gif.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageBlank.gif. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageBlank.gif. " [0092.167] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageBlank.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_formshomepageblank.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0092.167] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4ebb [0092.167] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8bfecf00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x519a33f0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8bfecf00, dwHighDateTime=0x1c747ea)) returned 1 [0092.167] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0092.167] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x4e61, lpOverlapped=0x0) returned 1 [0092.178] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageBlank.gif") returned="bg_FormsHomePageBlank.gif" [0092.179] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0092.179] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x4e61, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x4e61, lpOverlapped=0x0) returned 1 [0092.179] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0092.179] CloseHandle (hObject=0x98) returned 1 [0092.179] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageBlank.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_formshomepageblank.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageBlank.gif. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_formshomepageblank.gif. ")) returned 1 [0092.180] FindNextFileA (in: hFindFile=0x5b7d30, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0092.180] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0092.180] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="bg_FormsHomePageSlice.gif") returned 1 [0092.180] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bg_FormsHomePageSlice.gif") returned 1 [0092.180] lstrcmpiA (lpString1="", lpString2="bg_FormsHomePageSlice.gif") returned -1 [0092.180] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageBlank.gif") returned="bg_FormsHomePageBlank.gif" [0092.180] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="bg_FormsHomePageSlice.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageSlice.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageSlice.gif" [0092.180] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageSlice.gif", pszSpec="*.zip") returned 0 [0092.180] lstrlenA (lpString="*.zip") returned 5 [0092.180] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageSlice.gif", pszSpec="*.rar") returned 0 [0092.180] lstrlenA (lpString="*.rar") returned 5 [0092.180] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageSlice.gif", pszSpec="*.7z") returned 0 [0092.180] lstrlenA (lpString="*.7z") returned 4 [0092.180] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageSlice.gif", pszSpec="*.tar") returned 0 [0092.180] lstrlenA (lpString="*.tar") returned 5 [0092.180] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageSlice.gif", pszSpec="*.gzip") returned 0 [0092.180] lstrlenA (lpString="*.gzip") returned 6 [0092.180] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageSlice.gif", pszSpec="*.jpg") returned 0 [0092.180] lstrlenA (lpString="*.jpg") returned 5 [0092.180] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageSlice.gif", pszSpec="*.jpeg") returned 0 [0092.180] lstrlenA (lpString="*.jpeg") returned 6 [0092.181] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageSlice.gif", pszSpec="*.psd") returned 0 [0092.181] lstrlenA (lpString="*.psd") returned 5 [0092.181] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageSlice.gif", pszSpec="*.cdr") returned 0 [0092.181] lstrlenA (lpString="*.cdr") returned 5 [0092.181] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageSlice.gif", pszSpec="*.dwg") returned 0 [0092.181] lstrlenA (lpString="*.dwg") returned 5 [0092.181] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageSlice.gif", pszSpec="*.max") returned 0 [0092.181] lstrlenA (lpString="*.max") returned 5 [0092.181] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageSlice.gif", pszSpec="*.bmp") returned 0 [0092.181] lstrlenA (lpString="*.bmp") returned 5 [0092.181] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageSlice.gif", pszSpec="*.gif") returned 1 [0092.181] lstrlenA (lpString="*.gif") returned 5 [0092.181] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageSlice.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageSlice.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageSlice.gif" [0092.181] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageSlice.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageSlice.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageSlice.gif" [0092.181] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageSlice.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageSlice.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageSlice.gif." [0092.181] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageSlice.gif.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageSlice.gif. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageSlice.gif. " [0092.181] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageSlice.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_formshomepageslice.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0092.181] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x40f [0092.181] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8bfecf00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5f644b10, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8bfecf00, dwHighDateTime=0x1c747ea)) returned 1 [0092.181] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0092.181] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x3b5, lpOverlapped=0x0) returned 1 [0092.183] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageSlice.gif") returned="bg_FormsHomePageSlice.gif" [0092.183] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0092.183] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x3b5, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x3b5, lpOverlapped=0x0) returned 1 [0092.183] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0092.183] CloseHandle (hObject=0x98) returned 1 [0092.183] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageSlice.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_formshomepageslice.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageSlice.gif. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_formshomepageslice.gif. ")) returned 1 [0092.184] FindNextFileA (in: hFindFile=0x5b7d30, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0092.184] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0092.184] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="bg_GreenTea.gif") returned 1 [0092.184] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bg_GreenTea.gif") returned 1 [0092.184] lstrcmpiA (lpString1="", lpString2="bg_GreenTea.gif") returned -1 [0092.184] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageSlice.gif") returned="bg_FormsHomePageSlice.gif" [0092.184] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="bg_GreenTea.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_GreenTea.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_GreenTea.gif" [0092.184] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_GreenTea.gif", pszSpec="*.zip") returned 0 [0092.184] lstrlenA (lpString="*.zip") returned 5 [0092.184] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_GreenTea.gif", pszSpec="*.rar") returned 0 [0092.184] lstrlenA (lpString="*.rar") returned 5 [0092.185] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_GreenTea.gif", pszSpec="*.7z") returned 0 [0092.185] lstrlenA (lpString="*.7z") returned 4 [0092.185] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_GreenTea.gif", pszSpec="*.tar") returned 0 [0092.185] lstrlenA (lpString="*.tar") returned 5 [0092.185] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_GreenTea.gif", pszSpec="*.gzip") returned 0 [0092.185] lstrlenA (lpString="*.gzip") returned 6 [0092.185] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_GreenTea.gif", pszSpec="*.jpg") returned 0 [0092.185] lstrlenA (lpString="*.jpg") returned 5 [0092.185] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_GreenTea.gif", pszSpec="*.jpeg") returned 0 [0092.185] lstrlenA (lpString="*.jpeg") returned 6 [0092.185] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_GreenTea.gif", pszSpec="*.psd") returned 0 [0092.185] lstrlenA (lpString="*.psd") returned 5 [0092.185] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_GreenTea.gif", pszSpec="*.cdr") returned 0 [0092.185] lstrlenA (lpString="*.cdr") returned 5 [0092.185] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_GreenTea.gif", pszSpec="*.dwg") returned 0 [0092.185] lstrlenA (lpString="*.dwg") returned 5 [0092.185] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_GreenTea.gif", pszSpec="*.max") returned 0 [0092.185] lstrlenA (lpString="*.max") returned 5 [0092.185] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_GreenTea.gif", pszSpec="*.bmp") returned 0 [0092.185] lstrlenA (lpString="*.bmp") returned 5 [0092.185] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_GreenTea.gif", pszSpec="*.gif") returned 1 [0092.185] lstrlenA (lpString="*.gif") returned 5 [0092.185] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_GreenTea.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_GreenTea.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_GreenTea.gif" [0092.185] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_GreenTea.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_GreenTea.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_GreenTea.gif" [0092.185] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_GreenTea.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_GreenTea.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_GreenTea.gif." [0092.185] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_GreenTea.gif.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_GreenTea.gif. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_GreenTea.gif. " [0092.185] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_GreenTea.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_greentea.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0092.185] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x5690 [0092.185] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8bfecf00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x519a33f0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8bfecf00, dwHighDateTime=0x1c747ea)) returned 1 [0092.185] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0092.185] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x5636, lpOverlapped=0x0) returned 1 [0092.210] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_GreenTea.gif") returned="bg_GreenTea.gif" [0092.210] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0092.210] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x5636, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x5636, lpOverlapped=0x0) returned 1 [0092.210] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0092.211] CloseHandle (hObject=0x98) returned 1 [0092.211] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_GreenTea.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_greentea.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_GreenTea.gif. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_greentea.gif. ")) returned 1 [0092.213] FindNextFileA (in: hFindFile=0x5b7d30, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0092.213] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0092.213] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="bg_Groove.gif") returned 1 [0092.213] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bg_Groove.gif") returned 1 [0092.213] lstrcmpiA (lpString1="", lpString2="bg_Groove.gif") returned -1 [0092.213] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_GreenTea.gif") returned="bg_GreenTea.gif" [0092.213] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="bg_Groove.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Groove.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Groove.gif" [0092.213] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Groove.gif", pszSpec="*.zip") returned 0 [0092.213] lstrlenA (lpString="*.zip") returned 5 [0092.213] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Groove.gif", pszSpec="*.rar") returned 0 [0092.213] lstrlenA (lpString="*.rar") returned 5 [0092.213] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Groove.gif", pszSpec="*.7z") returned 0 [0092.213] lstrlenA (lpString="*.7z") returned 4 [0092.213] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Groove.gif", pszSpec="*.tar") returned 0 [0092.213] lstrlenA (lpString="*.tar") returned 5 [0092.213] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Groove.gif", pszSpec="*.gzip") returned 0 [0092.213] lstrlenA (lpString="*.gzip") returned 6 [0092.213] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Groove.gif", pszSpec="*.jpg") returned 0 [0092.213] lstrlenA (lpString="*.jpg") returned 5 [0092.213] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Groove.gif", pszSpec="*.jpeg") returned 0 [0092.213] lstrlenA (lpString="*.jpeg") returned 6 [0092.213] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Groove.gif", pszSpec="*.psd") returned 0 [0092.213] lstrlenA (lpString="*.psd") returned 5 [0092.213] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Groove.gif", pszSpec="*.cdr") returned 0 [0092.213] lstrlenA (lpString="*.cdr") returned 5 [0092.213] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Groove.gif", pszSpec="*.dwg") returned 0 [0092.213] lstrlenA (lpString="*.dwg") returned 5 [0092.213] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Groove.gif", pszSpec="*.max") returned 0 [0092.213] lstrlenA (lpString="*.max") returned 5 [0092.213] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Groove.gif", pszSpec="*.bmp") returned 0 [0092.213] lstrlenA (lpString="*.bmp") returned 5 [0092.213] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Groove.gif", pszSpec="*.gif") returned 1 [0092.213] lstrlenA (lpString="*.gif") returned 5 [0092.213] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Groove.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Groove.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Groove.gif" [0092.213] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Groove.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Groove.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Groove.gif" [0092.214] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Groove.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Groove.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Groove.gif." [0092.214] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Groove.gif.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Groove.gif. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Groove.gif. " [0092.214] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Groove.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_groove.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0092.214] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x6a [0092.214] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8bfecf00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x519a33f0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8bfecf00, dwHighDateTime=0x1c747ea)) returned 1 [0092.214] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0092.214] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x10, lpOverlapped=0x0) returned 1 [0092.215] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Groove.gif") returned="bg_Groove.gif" [0092.215] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0092.215] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x10, lpOverlapped=0x0) returned 1 [0092.215] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0092.215] CloseHandle (hObject=0x98) returned 1 [0092.215] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Groove.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_groove.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Groove.gif. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_groove.gif. ")) returned 1 [0092.215] FindNextFileA (in: hFindFile=0x5b7d30, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0092.216] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0092.216] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="bg_LightSpirit.gif") returned 1 [0092.216] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bg_LightSpirit.gif") returned 1 [0092.216] lstrcmpiA (lpString1="", lpString2="bg_LightSpirit.gif") returned -1 [0092.216] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Groove.gif") returned="bg_Groove.gif" [0092.216] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="bg_LightSpirit.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_LightSpirit.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_LightSpirit.gif" [0092.216] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_LightSpirit.gif", pszSpec="*.zip") returned 0 [0092.216] lstrlenA (lpString="*.zip") returned 5 [0092.216] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_LightSpirit.gif", pszSpec="*.rar") returned 0 [0092.216] lstrlenA (lpString="*.rar") returned 5 [0092.216] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_LightSpirit.gif", pszSpec="*.7z") returned 0 [0092.216] lstrlenA (lpString="*.7z") returned 4 [0092.216] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_LightSpirit.gif", pszSpec="*.tar") returned 0 [0092.216] lstrlenA (lpString="*.tar") returned 5 [0092.216] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_LightSpirit.gif", pszSpec="*.gzip") returned 0 [0092.216] lstrlenA (lpString="*.gzip") returned 6 [0092.216] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_LightSpirit.gif", pszSpec="*.jpg") returned 0 [0092.216] lstrlenA (lpString="*.jpg") returned 5 [0092.216] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_LightSpirit.gif", pszSpec="*.jpeg") returned 0 [0092.216] lstrlenA (lpString="*.jpeg") returned 6 [0092.216] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_LightSpirit.gif", pszSpec="*.psd") returned 0 [0092.216] lstrlenA (lpString="*.psd") returned 5 [0092.216] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_LightSpirit.gif", pszSpec="*.cdr") returned 0 [0092.216] lstrlenA (lpString="*.cdr") returned 5 [0092.216] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_LightSpirit.gif", pszSpec="*.dwg") returned 0 [0092.216] lstrlenA (lpString="*.dwg") returned 5 [0092.216] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_LightSpirit.gif", pszSpec="*.max") returned 0 [0092.216] lstrlenA (lpString="*.max") returned 5 [0092.216] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_LightSpirit.gif", pszSpec="*.bmp") returned 0 [0092.216] lstrlenA (lpString="*.bmp") returned 5 [0092.216] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_LightSpirit.gif", pszSpec="*.gif") returned 1 [0092.216] lstrlenA (lpString="*.gif") returned 5 [0092.216] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_LightSpirit.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_LightSpirit.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_LightSpirit.gif" [0092.216] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_LightSpirit.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_LightSpirit.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_LightSpirit.gif" [0092.216] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_LightSpirit.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_LightSpirit.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_LightSpirit.gif." [0092.216] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_LightSpirit.gif.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_LightSpirit.gif. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_LightSpirit.gif. " [0092.216] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_LightSpirit.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_lightspirit.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0092.217] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x21a6 [0092.217] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8d2ffc00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5f644b10, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8d2ffc00, dwHighDateTime=0x1c747ea)) returned 1 [0092.217] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0092.217] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x214c, lpOverlapped=0x0) returned 1 [0092.218] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_LightSpirit.gif") returned="bg_LightSpirit.gif" [0092.218] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0092.218] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x214c, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x214c, lpOverlapped=0x0) returned 1 [0092.218] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0092.218] CloseHandle (hObject=0x98) returned 1 [0092.218] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_LightSpirit.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_lightspirit.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_LightSpirit.gif. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_lightspirit.gif. ")) returned 1 [0092.219] FindNextFileA (in: hFindFile=0x5b7d30, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0092.219] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0092.219] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="bg_OliveGreen.gif") returned 1 [0092.219] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bg_OliveGreen.gif") returned 1 [0092.219] lstrcmpiA (lpString1="", lpString2="bg_OliveGreen.gif") returned -1 [0092.219] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_LightSpirit.gif") returned="bg_LightSpirit.gif" [0092.219] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="bg_OliveGreen.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_OliveGreen.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_OliveGreen.gif" [0092.219] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_OliveGreen.gif", pszSpec="*.zip") returned 0 [0092.219] lstrlenA (lpString="*.zip") returned 5 [0092.219] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_OliveGreen.gif", pszSpec="*.rar") returned 0 [0092.219] lstrlenA (lpString="*.rar") returned 5 [0092.219] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_OliveGreen.gif", pszSpec="*.7z") returned 0 [0092.219] lstrlenA (lpString="*.7z") returned 4 [0092.219] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_OliveGreen.gif", pszSpec="*.tar") returned 0 [0092.219] lstrlenA (lpString="*.tar") returned 5 [0092.219] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_OliveGreen.gif", pszSpec="*.gzip") returned 0 [0092.219] lstrlenA (lpString="*.gzip") returned 6 [0092.219] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_OliveGreen.gif", pszSpec="*.jpg") returned 0 [0092.219] lstrlenA (lpString="*.jpg") returned 5 [0092.219] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_OliveGreen.gif", pszSpec="*.jpeg") returned 0 [0092.219] lstrlenA (lpString="*.jpeg") returned 6 [0092.219] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_OliveGreen.gif", pszSpec="*.psd") returned 0 [0092.219] lstrlenA (lpString="*.psd") returned 5 [0092.219] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_OliveGreen.gif", pszSpec="*.cdr") returned 0 [0092.219] lstrlenA (lpString="*.cdr") returned 5 [0092.219] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_OliveGreen.gif", pszSpec="*.dwg") returned 0 [0092.219] lstrlenA (lpString="*.dwg") returned 5 [0092.219] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_OliveGreen.gif", pszSpec="*.max") returned 0 [0092.219] lstrlenA (lpString="*.max") returned 5 [0092.219] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_OliveGreen.gif", pszSpec="*.bmp") returned 0 [0092.219] lstrlenA (lpString="*.bmp") returned 5 [0092.219] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_OliveGreen.gif", pszSpec="*.gif") returned 1 [0092.219] lstrlenA (lpString="*.gif") returned 5 [0092.219] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_OliveGreen.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_OliveGreen.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_OliveGreen.gif" [0092.219] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_OliveGreen.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_OliveGreen.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_OliveGreen.gif" [0092.219] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_OliveGreen.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_OliveGreen.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_OliveGreen.gif." [0092.219] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_OliveGreen.gif.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_OliveGreen.gif. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_OliveGreen.gif. " [0092.220] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_OliveGreen.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_olivegreen.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0092.220] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3d57 [0092.220] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8d2ffc00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5f66ac70, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8d2ffc00, dwHighDateTime=0x1c747ea)) returned 1 [0092.220] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0092.220] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x3cfd, lpOverlapped=0x0) returned 1 [0092.221] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_OliveGreen.gif") returned="bg_OliveGreen.gif" [0092.221] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0092.221] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x3cfd, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x3cfd, lpOverlapped=0x0) returned 1 [0092.221] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0092.221] CloseHandle (hObject=0x98) returned 1 [0092.222] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_OliveGreen.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_olivegreen.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_OliveGreen.gif. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_olivegreen.gif. ")) returned 1 [0092.222] FindNextFileA (in: hFindFile=0x5b7d30, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0092.222] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0092.222] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="bg_Premium.gif") returned 1 [0092.222] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bg_Premium.gif") returned 1 [0092.222] lstrcmpiA (lpString1="", lpString2="bg_Premium.gif") returned -1 [0092.222] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_OliveGreen.gif") returned="bg_OliveGreen.gif" [0092.223] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="bg_Premium.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Premium.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Premium.gif" [0092.223] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Premium.gif", pszSpec="*.zip") returned 0 [0092.223] lstrlenA (lpString="*.zip") returned 5 [0092.223] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Premium.gif", pszSpec="*.rar") returned 0 [0092.223] lstrlenA (lpString="*.rar") returned 5 [0092.223] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Premium.gif", pszSpec="*.7z") returned 0 [0092.223] lstrlenA (lpString="*.7z") returned 4 [0092.223] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Premium.gif", pszSpec="*.tar") returned 0 [0092.223] lstrlenA (lpString="*.tar") returned 5 [0092.223] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Premium.gif", pszSpec="*.gzip") returned 0 [0092.223] lstrlenA (lpString="*.gzip") returned 6 [0092.223] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Premium.gif", pszSpec="*.jpg") returned 0 [0092.223] lstrlenA (lpString="*.jpg") returned 5 [0092.223] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Premium.gif", pszSpec="*.jpeg") returned 0 [0092.223] lstrlenA (lpString="*.jpeg") returned 6 [0092.223] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Premium.gif", pszSpec="*.psd") returned 0 [0092.223] lstrlenA (lpString="*.psd") returned 5 [0092.223] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Premium.gif", pszSpec="*.cdr") returned 0 [0092.223] lstrlenA (lpString="*.cdr") returned 5 [0092.223] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Premium.gif", pszSpec="*.dwg") returned 0 [0092.223] lstrlenA (lpString="*.dwg") returned 5 [0092.223] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Premium.gif", pszSpec="*.max") returned 0 [0092.223] lstrlenA (lpString="*.max") returned 5 [0092.223] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Premium.gif", pszSpec="*.bmp") returned 0 [0092.223] lstrlenA (lpString="*.bmp") returned 5 [0092.223] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Premium.gif", pszSpec="*.gif") returned 1 [0092.223] lstrlenA (lpString="*.gif") returned 5 [0092.223] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Premium.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Premium.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Premium.gif" [0092.223] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Premium.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Premium.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Premium.gif" [0092.223] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Premium.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Premium.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Premium.gif." [0092.223] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Premium.gif.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Premium.gif. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Premium.gif. " [0092.223] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Premium.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_premium.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0092.223] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1845 [0092.223] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8d2ffc00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5f66ac70, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8d2ffc00, dwHighDateTime=0x1c747ea)) returned 1 [0092.224] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0092.224] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x17eb, lpOverlapped=0x0) returned 1 [0092.225] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Premium.gif") returned="bg_Premium.gif" [0092.225] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0092.225] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x17eb, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x17eb, lpOverlapped=0x0) returned 1 [0092.225] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0092.225] CloseHandle (hObject=0x98) returned 1 [0092.225] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Premium.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_premium.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Premium.gif. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_premium.gif. ")) returned 1 [0092.226] FindNextFileA (in: hFindFile=0x5b7d30, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0092.226] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0092.226] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="bg_SlateBlue.gif") returned 1 [0092.226] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bg_SlateBlue.gif") returned 1 [0092.226] lstrcmpiA (lpString1="", lpString2="bg_SlateBlue.gif") returned -1 [0092.226] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Premium.gif") returned="bg_Premium.gif" [0092.226] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="bg_SlateBlue.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_SlateBlue.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_SlateBlue.gif" [0092.226] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_SlateBlue.gif", pszSpec="*.zip") returned 0 [0092.226] lstrlenA (lpString="*.zip") returned 5 [0092.226] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_SlateBlue.gif", pszSpec="*.rar") returned 0 [0092.226] lstrlenA (lpString="*.rar") returned 5 [0092.226] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_SlateBlue.gif", pszSpec="*.7z") returned 0 [0092.226] lstrlenA (lpString="*.7z") returned 4 [0092.226] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_SlateBlue.gif", pszSpec="*.tar") returned 0 [0092.226] lstrlenA (lpString="*.tar") returned 5 [0092.226] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_SlateBlue.gif", pszSpec="*.gzip") returned 0 [0092.226] lstrlenA (lpString="*.gzip") returned 6 [0092.226] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_SlateBlue.gif", pszSpec="*.jpg") returned 0 [0092.226] lstrlenA (lpString="*.jpg") returned 5 [0092.226] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_SlateBlue.gif", pszSpec="*.jpeg") returned 0 [0092.226] lstrlenA (lpString="*.jpeg") returned 6 [0092.226] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_SlateBlue.gif", pszSpec="*.psd") returned 0 [0092.226] lstrlenA (lpString="*.psd") returned 5 [0092.226] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_SlateBlue.gif", pszSpec="*.cdr") returned 0 [0092.226] lstrlenA (lpString="*.cdr") returned 5 [0092.226] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_SlateBlue.gif", pszSpec="*.dwg") returned 0 [0092.226] lstrlenA (lpString="*.dwg") returned 5 [0092.226] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_SlateBlue.gif", pszSpec="*.max") returned 0 [0092.226] lstrlenA (lpString="*.max") returned 5 [0092.226] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_SlateBlue.gif", pszSpec="*.bmp") returned 0 [0092.226] lstrlenA (lpString="*.bmp") returned 5 [0092.226] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_SlateBlue.gif", pszSpec="*.gif") returned 1 [0092.226] lstrlenA (lpString="*.gif") returned 5 [0092.226] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_SlateBlue.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_SlateBlue.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_SlateBlue.gif" [0092.226] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_SlateBlue.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_SlateBlue.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_SlateBlue.gif" [0092.226] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_SlateBlue.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_SlateBlue.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_SlateBlue.gif." [0092.226] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_SlateBlue.gif.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_SlateBlue.gif. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_SlateBlue.gif. " [0092.226] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_SlateBlue.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_slateblue.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0092.227] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x5141 [0092.227] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8d2ffc00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5f66ac70, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8d2ffc00, dwHighDateTime=0x1c747ea)) returned 1 [0092.227] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0092.227] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x50e7, lpOverlapped=0x0) returned 1 [0092.235] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_SlateBlue.gif") returned="bg_SlateBlue.gif" [0092.235] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0092.235] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x50e7, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x50e7, lpOverlapped=0x0) returned 1 [0092.235] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0092.235] CloseHandle (hObject=0x98) returned 1 [0092.236] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_SlateBlue.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_slateblue.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_SlateBlue.gif. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_slateblue.gif. ")) returned 1 [0092.237] FindNextFileA (in: hFindFile=0x5b7d30, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0092.237] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0092.237] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="bg_TexturedBlue.gif") returned 1 [0092.237] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bg_TexturedBlue.gif") returned 1 [0092.237] lstrcmpiA (lpString1="", lpString2="bg_TexturedBlue.gif") returned -1 [0092.237] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_SlateBlue.gif") returned="bg_SlateBlue.gif" [0092.237] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="bg_TexturedBlue.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_TexturedBlue.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_TexturedBlue.gif" [0092.237] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_TexturedBlue.gif", pszSpec="*.zip") returned 0 [0092.237] lstrlenA (lpString="*.zip") returned 5 [0092.237] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_TexturedBlue.gif", pszSpec="*.rar") returned 0 [0092.237] lstrlenA (lpString="*.rar") returned 5 [0092.237] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_TexturedBlue.gif", pszSpec="*.7z") returned 0 [0092.237] lstrlenA (lpString="*.7z") returned 4 [0092.237] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_TexturedBlue.gif", pszSpec="*.tar") returned 0 [0092.237] lstrlenA (lpString="*.tar") returned 5 [0092.237] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_TexturedBlue.gif", pszSpec="*.gzip") returned 0 [0092.237] lstrlenA (lpString="*.gzip") returned 6 [0092.237] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_TexturedBlue.gif", pszSpec="*.jpg") returned 0 [0092.237] lstrlenA (lpString="*.jpg") returned 5 [0092.237] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_TexturedBlue.gif", pszSpec="*.jpeg") returned 0 [0092.237] lstrlenA (lpString="*.jpeg") returned 6 [0092.237] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_TexturedBlue.gif", pszSpec="*.psd") returned 0 [0092.237] lstrlenA (lpString="*.psd") returned 5 [0092.237] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_TexturedBlue.gif", pszSpec="*.cdr") returned 0 [0092.237] lstrlenA (lpString="*.cdr") returned 5 [0092.237] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_TexturedBlue.gif", pszSpec="*.dwg") returned 0 [0092.237] lstrlenA (lpString="*.dwg") returned 5 [0092.237] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_TexturedBlue.gif", pszSpec="*.max") returned 0 [0092.237] lstrlenA (lpString="*.max") returned 5 [0092.237] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_TexturedBlue.gif", pszSpec="*.bmp") returned 0 [0092.237] lstrlenA (lpString="*.bmp") returned 5 [0092.237] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_TexturedBlue.gif", pszSpec="*.gif") returned 1 [0092.237] lstrlenA (lpString="*.gif") returned 5 [0092.237] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_TexturedBlue.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_TexturedBlue.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_TexturedBlue.gif" [0092.237] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_TexturedBlue.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_TexturedBlue.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_TexturedBlue.gif" [0092.237] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_TexturedBlue.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_TexturedBlue.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_TexturedBlue.gif." [0092.237] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_TexturedBlue.gif.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_TexturedBlue.gif. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_TexturedBlue.gif. " [0092.237] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_TexturedBlue.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_texturedblue.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0092.238] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x193c [0092.238] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8d2ffc00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x519a33f0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8d2ffc00, dwHighDateTime=0x1c747ea)) returned 1 [0092.238] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0092.238] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x18e2, lpOverlapped=0x0) returned 1 [0092.307] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_TexturedBlue.gif") returned="bg_TexturedBlue.gif" [0092.307] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0092.307] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x18e2, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x18e2, lpOverlapped=0x0) returned 1 [0092.308] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0092.308] CloseHandle (hObject=0x98) returned 1 [0092.308] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_TexturedBlue.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_texturedblue.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_TexturedBlue.gif. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_texturedblue.gif. ")) returned 1 [0092.309] FindNextFileA (in: hFindFile=0x5b7d30, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0092.309] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0092.309] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="bg_VelvetRose.gif") returned 1 [0092.309] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bg_VelvetRose.gif") returned 1 [0092.309] lstrcmpiA (lpString1="", lpString2="bg_VelvetRose.gif") returned -1 [0092.309] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_TexturedBlue.gif") returned="bg_TexturedBlue.gif" [0092.309] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="bg_VelvetRose.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_VelvetRose.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_VelvetRose.gif" [0092.309] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_VelvetRose.gif", pszSpec="*.zip") returned 0 [0092.309] lstrlenA (lpString="*.zip") returned 5 [0092.309] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_VelvetRose.gif", pszSpec="*.rar") returned 0 [0092.309] lstrlenA (lpString="*.rar") returned 5 [0092.309] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_VelvetRose.gif", pszSpec="*.7z") returned 0 [0092.309] lstrlenA (lpString="*.7z") returned 4 [0092.309] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_VelvetRose.gif", pszSpec="*.tar") returned 0 [0092.309] lstrlenA (lpString="*.tar") returned 5 [0092.309] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_VelvetRose.gif", pszSpec="*.gzip") returned 0 [0092.309] lstrlenA (lpString="*.gzip") returned 6 [0092.309] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_VelvetRose.gif", pszSpec="*.jpg") returned 0 [0092.309] lstrlenA (lpString="*.jpg") returned 5 [0092.309] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_VelvetRose.gif", pszSpec="*.jpeg") returned 0 [0092.309] lstrlenA (lpString="*.jpeg") returned 6 [0092.309] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_VelvetRose.gif", pszSpec="*.psd") returned 0 [0092.309] lstrlenA (lpString="*.psd") returned 5 [0092.309] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_VelvetRose.gif", pszSpec="*.cdr") returned 0 [0092.309] lstrlenA (lpString="*.cdr") returned 5 [0092.309] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_VelvetRose.gif", pszSpec="*.dwg") returned 0 [0092.309] lstrlenA (lpString="*.dwg") returned 5 [0092.309] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_VelvetRose.gif", pszSpec="*.max") returned 0 [0092.309] lstrlenA (lpString="*.max") returned 5 [0092.309] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_VelvetRose.gif", pszSpec="*.bmp") returned 0 [0092.309] lstrlenA (lpString="*.bmp") returned 5 [0092.309] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_VelvetRose.gif", pszSpec="*.gif") returned 1 [0092.309] lstrlenA (lpString="*.gif") returned 5 [0092.309] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_VelvetRose.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_VelvetRose.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_VelvetRose.gif" [0092.310] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_VelvetRose.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_VelvetRose.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_VelvetRose.gif" [0092.310] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_VelvetRose.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_VelvetRose.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_VelvetRose.gif." [0092.310] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_VelvetRose.gif.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_VelvetRose.gif. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_VelvetRose.gif. " [0092.310] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_VelvetRose.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_velvetrose.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0092.310] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3c64 [0092.310] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8d2ffc00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5f66ac70, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8d2ffc00, dwHighDateTime=0x1c747ea)) returned 1 [0092.310] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0092.310] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x3c0a, lpOverlapped=0x0) returned 1 [0092.312] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_VelvetRose.gif") returned="bg_VelvetRose.gif" [0092.312] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0092.312] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x3c0a, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x3c0a, lpOverlapped=0x0) returned 1 [0092.312] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0092.312] CloseHandle (hObject=0x98) returned 1 [0092.312] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_VelvetRose.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_velvetrose.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_VelvetRose.gif. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_velvetrose.gif. ")) returned 1 [0092.313] FindNextFileA (in: hFindFile=0x5b7d30, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0092.313] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0092.313] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="button_left.gif") returned 1 [0092.313] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="button_left.gif") returned 1 [0092.313] lstrcmpiA (lpString1="", lpString2="button_left.gif") returned -1 [0092.313] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_VelvetRose.gif") returned="bg_VelvetRose.gif" [0092.313] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="button_left.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left.gif" [0092.313] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left.gif", pszSpec="*.zip") returned 0 [0092.313] lstrlenA (lpString="*.zip") returned 5 [0092.313] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left.gif", pszSpec="*.rar") returned 0 [0092.313] lstrlenA (lpString="*.rar") returned 5 [0092.313] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left.gif", pszSpec="*.7z") returned 0 [0092.313] lstrlenA (lpString="*.7z") returned 4 [0092.313] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left.gif", pszSpec="*.tar") returned 0 [0092.313] lstrlenA (lpString="*.tar") returned 5 [0092.313] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left.gif", pszSpec="*.gzip") returned 0 [0092.313] lstrlenA (lpString="*.gzip") returned 6 [0092.313] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left.gif", pszSpec="*.jpg") returned 0 [0092.313] lstrlenA (lpString="*.jpg") returned 5 [0092.313] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left.gif", pszSpec="*.jpeg") returned 0 [0092.313] lstrlenA (lpString="*.jpeg") returned 6 [0092.313] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left.gif", pszSpec="*.psd") returned 0 [0092.313] lstrlenA (lpString="*.psd") returned 5 [0092.313] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left.gif", pszSpec="*.cdr") returned 0 [0092.313] lstrlenA (lpString="*.cdr") returned 5 [0092.313] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left.gif", pszSpec="*.dwg") returned 0 [0092.313] lstrlenA (lpString="*.dwg") returned 5 [0092.313] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left.gif", pszSpec="*.max") returned 0 [0092.313] lstrlenA (lpString="*.max") returned 5 [0092.313] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left.gif", pszSpec="*.bmp") returned 0 [0092.313] lstrlenA (lpString="*.bmp") returned 5 [0092.313] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left.gif", pszSpec="*.gif") returned 1 [0092.313] lstrlenA (lpString="*.gif") returned 5 [0092.313] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left.gif" [0092.313] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left.gif" [0092.313] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left.gif." [0092.313] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left.gif.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left.gif. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left.gif. " [0092.313] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\button_left.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0092.314] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x171 [0092.314] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8d2ffc00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x51b6c470, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8d2ffc00, dwHighDateTime=0x1c747ea)) returned 1 [0092.314] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0092.314] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x117, lpOverlapped=0x0) returned 1 [0092.314] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left.gif") returned="button_left.gif" [0092.315] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0092.315] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x117, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x117, lpOverlapped=0x0) returned 1 [0092.315] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0092.315] CloseHandle (hObject=0x98) returned 1 [0092.315] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\button_left.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left.gif. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\button_left.gif. ")) returned 1 [0092.316] FindNextFileA (in: hFindFile=0x5b7d30, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0092.316] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0092.316] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="button_left_over.gif") returned 1 [0092.316] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="button_left_over.gif") returned 1 [0092.316] lstrcmpiA (lpString1="", lpString2="button_left_over.gif") returned -1 [0092.316] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left.gif") returned="button_left.gif" [0092.316] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="button_left_over.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left_over.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left_over.gif" [0092.316] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left_over.gif", pszSpec="*.zip") returned 0 [0092.316] lstrlenA (lpString="*.zip") returned 5 [0092.316] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left_over.gif", pszSpec="*.rar") returned 0 [0092.316] lstrlenA (lpString="*.rar") returned 5 [0092.316] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left_over.gif", pszSpec="*.7z") returned 0 [0092.316] lstrlenA (lpString="*.7z") returned 4 [0092.316] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left_over.gif", pszSpec="*.tar") returned 0 [0092.316] lstrlenA (lpString="*.tar") returned 5 [0092.316] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left_over.gif", pszSpec="*.gzip") returned 0 [0092.316] lstrlenA (lpString="*.gzip") returned 6 [0092.316] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left_over.gif", pszSpec="*.jpg") returned 0 [0092.316] lstrlenA (lpString="*.jpg") returned 5 [0092.316] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left_over.gif", pszSpec="*.jpeg") returned 0 [0092.316] lstrlenA (lpString="*.jpeg") returned 6 [0092.316] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left_over.gif", pszSpec="*.psd") returned 0 [0092.316] lstrlenA (lpString="*.psd") returned 5 [0092.316] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left_over.gif", pszSpec="*.cdr") returned 0 [0092.316] lstrlenA (lpString="*.cdr") returned 5 [0092.316] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left_over.gif", pszSpec="*.dwg") returned 0 [0092.316] lstrlenA (lpString="*.dwg") returned 5 [0092.316] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left_over.gif", pszSpec="*.max") returned 0 [0092.316] lstrlenA (lpString="*.max") returned 5 [0092.316] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left_over.gif", pszSpec="*.bmp") returned 0 [0092.316] lstrlenA (lpString="*.bmp") returned 5 [0092.316] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left_over.gif", pszSpec="*.gif") returned 1 [0092.316] lstrlenA (lpString="*.gif") returned 5 [0092.316] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left_over.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left_over.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left_over.gif" [0092.317] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left_over.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left_over.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left_over.gif" [0092.317] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left_over.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left_over.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left_over.gif." [0092.317] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left_over.gif.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left_over.gif. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left_over.gif. " [0092.317] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left_over.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\button_left_over.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0092.317] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x176 [0092.317] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8d2ffc00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x51b6c470, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8d2ffc00, dwHighDateTime=0x1c747ea)) returned 1 [0092.317] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0092.317] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x11c, lpOverlapped=0x0) returned 1 [0092.318] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left_over.gif") returned="button_left_over.gif" [0092.318] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0092.318] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x11c, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x11c, lpOverlapped=0x0) returned 1 [0092.318] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0092.318] CloseHandle (hObject=0x98) returned 1 [0092.318] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left_over.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\button_left_over.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left_over.gif. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\button_left_over.gif. ")) returned 1 [0092.319] FindNextFileA (in: hFindFile=0x5b7d30, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0092.319] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0092.319] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="button_mid.gif") returned 1 [0092.319] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="button_mid.gif") returned 1 [0092.319] lstrcmpiA (lpString1="", lpString2="button_mid.gif") returned -1 [0092.319] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left_over.gif") returned="button_left_over.gif" [0092.319] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="button_mid.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid.gif" [0092.319] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid.gif", pszSpec="*.zip") returned 0 [0092.319] lstrlenA (lpString="*.zip") returned 5 [0092.319] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid.gif", pszSpec="*.rar") returned 0 [0092.319] lstrlenA (lpString="*.rar") returned 5 [0092.319] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid.gif", pszSpec="*.7z") returned 0 [0092.319] lstrlenA (lpString="*.7z") returned 4 [0092.319] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid.gif", pszSpec="*.tar") returned 0 [0092.319] lstrlenA (lpString="*.tar") returned 5 [0092.319] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid.gif", pszSpec="*.gzip") returned 0 [0092.319] lstrlenA (lpString="*.gzip") returned 6 [0092.319] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid.gif", pszSpec="*.jpg") returned 0 [0092.319] lstrlenA (lpString="*.jpg") returned 5 [0092.319] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid.gif", pszSpec="*.jpeg") returned 0 [0092.319] lstrlenA (lpString="*.jpeg") returned 6 [0092.319] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid.gif", pszSpec="*.psd") returned 0 [0092.319] lstrlenA (lpString="*.psd") returned 5 [0092.319] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid.gif", pszSpec="*.cdr") returned 0 [0092.319] lstrlenA (lpString="*.cdr") returned 5 [0092.319] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid.gif", pszSpec="*.dwg") returned 0 [0092.319] lstrlenA (lpString="*.dwg") returned 5 [0092.319] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid.gif", pszSpec="*.max") returned 0 [0092.319] lstrlenA (lpString="*.max") returned 5 [0092.319] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid.gif", pszSpec="*.bmp") returned 0 [0092.319] lstrlenA (lpString="*.bmp") returned 5 [0092.319] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid.gif", pszSpec="*.gif") returned 1 [0092.319] lstrlenA (lpString="*.gif") returned 5 [0092.319] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid.gif" [0092.319] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid.gif" [0092.319] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid.gif." [0092.320] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid.gif.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid.gif. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid.gif. " [0092.320] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\button_mid.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0092.320] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb5 [0092.320] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8d2ffc00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x51b6c470, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8d2ffc00, dwHighDateTime=0x1c747ea)) returned 1 [0092.320] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0092.320] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x5b, lpOverlapped=0x0) returned 1 [0092.321] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid.gif") returned="button_mid.gif" [0092.321] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0092.321] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x5b, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x5b, lpOverlapped=0x0) returned 1 [0092.321] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0092.321] CloseHandle (hObject=0x98) returned 1 [0092.321] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\button_mid.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid.gif. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\button_mid.gif. ")) returned 1 [0092.322] FindNextFileA (in: hFindFile=0x5b7d30, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0092.322] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0092.322] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="button_mid_over.gif") returned 1 [0092.322] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="button_mid_over.gif") returned 1 [0092.322] lstrcmpiA (lpString1="", lpString2="button_mid_over.gif") returned -1 [0092.322] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid.gif") returned="button_mid.gif" [0092.322] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="button_mid_over.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid_over.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid_over.gif" [0092.322] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid_over.gif", pszSpec="*.zip") returned 0 [0092.322] lstrlenA (lpString="*.zip") returned 5 [0092.322] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid_over.gif", pszSpec="*.rar") returned 0 [0092.322] lstrlenA (lpString="*.rar") returned 5 [0092.322] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid_over.gif", pszSpec="*.7z") returned 0 [0092.322] lstrlenA (lpString="*.7z") returned 4 [0092.322] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid_over.gif", pszSpec="*.tar") returned 0 [0092.322] lstrlenA (lpString="*.tar") returned 5 [0092.322] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid_over.gif", pszSpec="*.gzip") returned 0 [0092.322] lstrlenA (lpString="*.gzip") returned 6 [0092.322] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid_over.gif", pszSpec="*.jpg") returned 0 [0092.322] lstrlenA (lpString="*.jpg") returned 5 [0092.322] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid_over.gif", pszSpec="*.jpeg") returned 0 [0092.322] lstrlenA (lpString="*.jpeg") returned 6 [0092.322] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid_over.gif", pszSpec="*.psd") returned 0 [0092.322] lstrlenA (lpString="*.psd") returned 5 [0092.322] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid_over.gif", pszSpec="*.cdr") returned 0 [0092.322] lstrlenA (lpString="*.cdr") returned 5 [0092.322] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid_over.gif", pszSpec="*.dwg") returned 0 [0092.322] lstrlenA (lpString="*.dwg") returned 5 [0092.322] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid_over.gif", pszSpec="*.max") returned 0 [0092.322] lstrlenA (lpString="*.max") returned 5 [0092.322] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid_over.gif", pszSpec="*.bmp") returned 0 [0092.322] lstrlenA (lpString="*.bmp") returned 5 [0092.322] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid_over.gif", pszSpec="*.gif") returned 1 [0092.322] lstrlenA (lpString="*.gif") returned 5 [0092.322] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid_over.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid_over.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid_over.gif" [0092.322] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid_over.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid_over.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid_over.gif" [0092.322] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid_over.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid_over.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid_over.gif." [0092.322] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid_over.gif.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid_over.gif. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid_over.gif. " [0092.323] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid_over.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\button_mid_over.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0092.358] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb7 [0092.358] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8d2ffc00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x51b925d0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8d2ffc00, dwHighDateTime=0x1c747ea)) returned 1 [0092.358] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0092.358] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x5d, lpOverlapped=0x0) returned 1 [0092.358] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid_over.gif") returned="button_mid_over.gif" [0092.359] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0092.359] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x5d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x5d, lpOverlapped=0x0) returned 1 [0092.359] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0092.359] CloseHandle (hObject=0x98) returned 1 [0092.359] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid_over.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\button_mid_over.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid_over.gif. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\button_mid_over.gif. ")) returned 1 [0092.360] FindNextFileA (in: hFindFile=0x5b7d30, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0092.360] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0092.360] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="button_right.gif") returned 1 [0092.360] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="button_right.gif") returned 1 [0092.360] lstrcmpiA (lpString1="", lpString2="button_right.gif") returned -1 [0092.360] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid_over.gif") returned="button_mid_over.gif" [0092.360] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="button_right.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right.gif" [0092.360] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right.gif", pszSpec="*.zip") returned 0 [0092.360] lstrlenA (lpString="*.zip") returned 5 [0092.360] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right.gif", pszSpec="*.rar") returned 0 [0092.360] lstrlenA (lpString="*.rar") returned 5 [0092.360] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right.gif", pszSpec="*.7z") returned 0 [0092.360] lstrlenA (lpString="*.7z") returned 4 [0092.360] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right.gif", pszSpec="*.tar") returned 0 [0092.360] lstrlenA (lpString="*.tar") returned 5 [0092.360] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right.gif", pszSpec="*.gzip") returned 0 [0092.360] lstrlenA (lpString="*.gzip") returned 6 [0092.360] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right.gif", pszSpec="*.jpg") returned 0 [0092.360] lstrlenA (lpString="*.jpg") returned 5 [0092.361] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right.gif", pszSpec="*.jpeg") returned 0 [0092.361] lstrlenA (lpString="*.jpeg") returned 6 [0092.361] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right.gif", pszSpec="*.psd") returned 0 [0092.361] lstrlenA (lpString="*.psd") returned 5 [0092.361] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right.gif", pszSpec="*.cdr") returned 0 [0092.361] lstrlenA (lpString="*.cdr") returned 5 [0092.361] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right.gif", pszSpec="*.dwg") returned 0 [0092.361] lstrlenA (lpString="*.dwg") returned 5 [0092.361] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right.gif", pszSpec="*.max") returned 0 [0092.361] lstrlenA (lpString="*.max") returned 5 [0092.361] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right.gif", pszSpec="*.bmp") returned 0 [0092.361] lstrlenA (lpString="*.bmp") returned 5 [0092.361] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right.gif", pszSpec="*.gif") returned 1 [0092.361] lstrlenA (lpString="*.gif") returned 5 [0092.361] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right.gif" [0092.361] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right.gif" [0092.361] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right.gif." [0092.361] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right.gif.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right.gif. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right.gif. " [0092.361] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\button_right.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0092.361] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x171 [0092.361] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8d2ffc00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x51b925d0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8d2ffc00, dwHighDateTime=0x1c747ea)) returned 1 [0092.361] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0092.361] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x117, lpOverlapped=0x0) returned 1 [0092.362] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right.gif") returned="button_right.gif" [0092.362] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0092.362] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x117, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x117, lpOverlapped=0x0) returned 1 [0092.362] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0092.362] CloseHandle (hObject=0x98) returned 1 [0092.363] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\button_right.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right.gif. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\button_right.gif. ")) returned 1 [0092.363] FindNextFileA (in: hFindFile=0x5b7d30, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0092.363] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0092.363] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="button_right_over.gif") returned 1 [0092.363] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="button_right_over.gif") returned 1 [0092.363] lstrcmpiA (lpString1="", lpString2="button_right_over.gif") returned -1 [0092.363] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right.gif") returned="button_right.gif" [0092.363] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="button_right_over.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right_over.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right_over.gif" [0092.363] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right_over.gif", pszSpec="*.zip") returned 0 [0092.363] lstrlenA (lpString="*.zip") returned 5 [0092.363] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right_over.gif", pszSpec="*.rar") returned 0 [0092.363] lstrlenA (lpString="*.rar") returned 5 [0092.363] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right_over.gif", pszSpec="*.7z") returned 0 [0092.363] lstrlenA (lpString="*.7z") returned 4 [0092.363] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right_over.gif", pszSpec="*.tar") returned 0 [0092.363] lstrlenA (lpString="*.tar") returned 5 [0092.363] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right_over.gif", pszSpec="*.gzip") returned 0 [0092.363] lstrlenA (lpString="*.gzip") returned 6 [0092.363] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right_over.gif", pszSpec="*.jpg") returned 0 [0092.363] lstrlenA (lpString="*.jpg") returned 5 [0092.363] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right_over.gif", pszSpec="*.jpeg") returned 0 [0092.363] lstrlenA (lpString="*.jpeg") returned 6 [0092.364] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right_over.gif", pszSpec="*.psd") returned 0 [0092.364] lstrlenA (lpString="*.psd") returned 5 [0092.364] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right_over.gif", pszSpec="*.cdr") returned 0 [0092.364] lstrlenA (lpString="*.cdr") returned 5 [0092.364] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right_over.gif", pszSpec="*.dwg") returned 0 [0092.364] lstrlenA (lpString="*.dwg") returned 5 [0092.364] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right_over.gif", pszSpec="*.max") returned 0 [0092.364] lstrlenA (lpString="*.max") returned 5 [0092.364] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right_over.gif", pszSpec="*.bmp") returned 0 [0092.364] lstrlenA (lpString="*.bmp") returned 5 [0092.364] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right_over.gif", pszSpec="*.gif") returned 1 [0092.364] lstrlenA (lpString="*.gif") returned 5 [0092.364] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right_over.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right_over.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right_over.gif" [0092.364] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right_over.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right_over.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right_over.gif" [0092.364] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right_over.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right_over.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right_over.gif." [0092.364] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right_over.gif.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right_over.gif. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right_over.gif. " [0092.364] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right_over.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\button_right_over.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0092.364] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x244 [0092.364] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8d2ffc00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x51b925d0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8d2ffc00, dwHighDateTime=0x1c747ea)) returned 1 [0092.364] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0092.364] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x1ea, lpOverlapped=0x0) returned 1 [0092.375] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right_over.gif") returned="button_right_over.gif" [0092.375] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0092.375] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x1ea, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x1ea, lpOverlapped=0x0) returned 1 [0092.375] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0092.375] CloseHandle (hObject=0x98) returned 1 [0092.376] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right_over.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\button_right_over.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right_over.gif. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\button_right_over.gif. ")) returned 1 [0092.377] FindNextFileA (in: hFindFile=0x5b7d30, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0092.377] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0092.377] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="CALENDAR.GIF") returned 1 [0092.377] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="CALENDAR.GIF") returned 1 [0092.377] lstrcmpiA (lpString1="", lpString2="CALENDAR.GIF") returned -1 [0092.377] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right_over.gif") returned="button_right_over.gif" [0092.377] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="CALENDAR.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\CALENDAR.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\CALENDAR.GIF" [0092.377] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\CALENDAR.GIF", pszSpec="*.zip") returned 0 [0092.377] lstrlenA (lpString="*.zip") returned 5 [0092.377] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\CALENDAR.GIF", pszSpec="*.rar") returned 0 [0092.377] lstrlenA (lpString="*.rar") returned 5 [0092.377] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\CALENDAR.GIF", pszSpec="*.7z") returned 0 [0092.377] lstrlenA (lpString="*.7z") returned 4 [0092.377] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\CALENDAR.GIF", pszSpec="*.tar") returned 0 [0092.377] lstrlenA (lpString="*.tar") returned 5 [0092.377] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\CALENDAR.GIF", pszSpec="*.gzip") returned 0 [0092.377] lstrlenA (lpString="*.gzip") returned 6 [0092.377] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\CALENDAR.GIF", pszSpec="*.jpg") returned 0 [0092.377] lstrlenA (lpString="*.jpg") returned 5 [0092.377] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\CALENDAR.GIF", pszSpec="*.jpeg") returned 0 [0092.377] lstrlenA (lpString="*.jpeg") returned 6 [0092.378] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\CALENDAR.GIF", pszSpec="*.psd") returned 0 [0092.378] lstrlenA (lpString="*.psd") returned 5 [0092.378] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\CALENDAR.GIF", pszSpec="*.cdr") returned 0 [0092.378] lstrlenA (lpString="*.cdr") returned 5 [0092.378] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\CALENDAR.GIF", pszSpec="*.dwg") returned 0 [0092.378] lstrlenA (lpString="*.dwg") returned 5 [0092.378] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\CALENDAR.GIF", pszSpec="*.max") returned 0 [0092.378] lstrlenA (lpString="*.max") returned 5 [0092.378] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\CALENDAR.GIF", pszSpec="*.bmp") returned 0 [0092.378] lstrlenA (lpString="*.bmp") returned 5 [0092.378] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\CALENDAR.GIF", pszSpec="*.gif") returned 1 [0092.378] lstrlenA (lpString="*.gif") returned 5 [0092.378] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\CALENDAR.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\CALENDAR.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\CALENDAR.GIF" [0092.378] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\CALENDAR.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\CALENDAR.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\CALENDAR.GIF" [0092.378] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\CALENDAR.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\CALENDAR.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\CALENDAR.GIF." [0092.378] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\CALENDAR.GIF.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\CALENDAR.GIF. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\CALENDAR.GIF. " [0092.378] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\CALENDAR.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\calendar.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0092.378] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x383 [0092.378] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8d2ffc00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x60120f70, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8d2ffc00, dwHighDateTime=0x1c747ea)) returned 1 [0092.378] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0092.378] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x329, lpOverlapped=0x0) returned 1 [0092.389] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\CALENDAR.GIF") returned="CALENDAR.GIF" [0092.389] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0092.390] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x329, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x329, lpOverlapped=0x0) returned 1 [0092.390] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0092.390] CloseHandle (hObject=0x98) returned 1 [0092.390] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\CALENDAR.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\calendar.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\CALENDAR.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\calendar.gif. ")) returned 1 [0092.392] FindNextFileA (in: hFindFile=0x5b7d30, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0092.392] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0092.392] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="DELETE.GIF") returned 1 [0092.392] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DELETE.GIF") returned 1 [0092.392] lstrcmpiA (lpString1="", lpString2="DELETE.GIF") returned -1 [0092.392] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\CALENDAR.GIF") returned="CALENDAR.GIF" [0092.392] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="DELETE.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\DELETE.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\DELETE.GIF" [0092.392] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\DELETE.GIF", pszSpec="*.zip") returned 0 [0092.392] lstrlenA (lpString="*.zip") returned 5 [0092.392] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\DELETE.GIF", pszSpec="*.rar") returned 0 [0092.392] lstrlenA (lpString="*.rar") returned 5 [0092.392] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\DELETE.GIF", pszSpec="*.7z") returned 0 [0092.392] lstrlenA (lpString="*.7z") returned 4 [0092.392] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\DELETE.GIF", pszSpec="*.tar") returned 0 [0092.392] lstrlenA (lpString="*.tar") returned 5 [0092.392] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\DELETE.GIF", pszSpec="*.gzip") returned 0 [0092.392] lstrlenA (lpString="*.gzip") returned 6 [0092.392] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\DELETE.GIF", pszSpec="*.jpg") returned 0 [0092.392] lstrlenA (lpString="*.jpg") returned 5 [0092.392] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\DELETE.GIF", pszSpec="*.jpeg") returned 0 [0092.392] lstrlenA (lpString="*.jpeg") returned 6 [0092.392] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\DELETE.GIF", pszSpec="*.psd") returned 0 [0092.392] lstrlenA (lpString="*.psd") returned 5 [0092.392] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\DELETE.GIF", pszSpec="*.cdr") returned 0 [0092.392] lstrlenA (lpString="*.cdr") returned 5 [0092.392] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\DELETE.GIF", pszSpec="*.dwg") returned 0 [0092.392] lstrlenA (lpString="*.dwg") returned 5 [0092.392] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\DELETE.GIF", pszSpec="*.max") returned 0 [0092.392] lstrlenA (lpString="*.max") returned 5 [0092.392] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\DELETE.GIF", pszSpec="*.bmp") returned 0 [0092.392] lstrlenA (lpString="*.bmp") returned 5 [0092.392] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\DELETE.GIF", pszSpec="*.gif") returned 1 [0092.392] lstrlenA (lpString="*.gif") returned 5 [0092.392] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\DELETE.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\DELETE.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\DELETE.GIF" [0092.392] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\DELETE.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\DELETE.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\DELETE.GIF" [0092.393] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\DELETE.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\DELETE.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\DELETE.GIF." [0092.393] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\DELETE.GIF.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\DELETE.GIF. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\DELETE.GIF. " [0092.393] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\DELETE.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\delete.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0092.464] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x271 [0092.464] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8d2ffc00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x60760930, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8d2ffc00, dwHighDateTime=0x1c747ea)) returned 1 [0092.464] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0092.464] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x217, lpOverlapped=0x0) returned 1 [0092.465] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\DELETE.GIF") returned="DELETE.GIF" [0092.465] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0092.465] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x217, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x217, lpOverlapped=0x0) returned 1 [0092.465] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0092.465] CloseHandle (hObject=0x98) returned 1 [0092.466] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\DELETE.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\delete.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\DELETE.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\delete.gif. ")) returned 1 [0092.546] FindNextFileA (in: hFindFile=0x5b7d30, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0092.546] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0092.546] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="ERROR.GIF") returned -1 [0092.546] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ERROR.GIF") returned 1 [0092.546] lstrcmpiA (lpString1="", lpString2="ERROR.GIF") returned -1 [0092.546] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\DELETE.GIF") returned="DELETE.GIF" [0092.546] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="ERROR.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ERROR.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ERROR.GIF" [0092.546] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ERROR.GIF", pszSpec="*.zip") returned 0 [0092.546] lstrlenA (lpString="*.zip") returned 5 [0092.546] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ERROR.GIF", pszSpec="*.rar") returned 0 [0092.546] lstrlenA (lpString="*.rar") returned 5 [0092.546] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ERROR.GIF", pszSpec="*.7z") returned 0 [0092.546] lstrlenA (lpString="*.7z") returned 4 [0092.546] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ERROR.GIF", pszSpec="*.tar") returned 0 [0092.546] lstrlenA (lpString="*.tar") returned 5 [0092.546] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ERROR.GIF", pszSpec="*.gzip") returned 0 [0092.546] lstrlenA (lpString="*.gzip") returned 6 [0092.546] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ERROR.GIF", pszSpec="*.jpg") returned 0 [0092.546] lstrlenA (lpString="*.jpg") returned 5 [0092.546] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ERROR.GIF", pszSpec="*.jpeg") returned 0 [0092.546] lstrlenA (lpString="*.jpeg") returned 6 [0092.546] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ERROR.GIF", pszSpec="*.psd") returned 0 [0092.546] lstrlenA (lpString="*.psd") returned 5 [0092.546] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ERROR.GIF", pszSpec="*.cdr") returned 0 [0092.546] lstrlenA (lpString="*.cdr") returned 5 [0092.546] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ERROR.GIF", pszSpec="*.dwg") returned 0 [0092.546] lstrlenA (lpString="*.dwg") returned 5 [0092.546] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ERROR.GIF", pszSpec="*.max") returned 0 [0092.546] lstrlenA (lpString="*.max") returned 5 [0092.546] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ERROR.GIF", pszSpec="*.bmp") returned 0 [0092.546] lstrlenA (lpString="*.bmp") returned 5 [0092.546] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ERROR.GIF", pszSpec="*.gif") returned 1 [0092.546] lstrlenA (lpString="*.gif") returned 5 [0092.546] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ERROR.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ERROR.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ERROR.GIF" [0092.546] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ERROR.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ERROR.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ERROR.GIF" [0092.546] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ERROR.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ERROR.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ERROR.GIF." [0092.546] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ERROR.GIF.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ERROR.GIF. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ERROR.GIF. " [0092.547] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ERROR.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\error.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0092.547] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x369 [0092.547] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8e612900, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x60975c70, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8e612900, dwHighDateTime=0x1c747ea)) returned 1 [0092.547] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0092.547] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x30f, lpOverlapped=0x0) returned 1 [0092.560] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ERROR.GIF") returned="ERROR.GIF" [0092.560] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0092.560] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x30f, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x30f, lpOverlapped=0x0) returned 1 [0092.560] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0092.560] CloseHandle (hObject=0x98) returned 1 [0092.561] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ERROR.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\error.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ERROR.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\error.gif. ")) returned 1 [0092.562] FindNextFileA (in: hFindFile=0x5b7d30, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0092.562] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0092.562] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="FORM.ICO") returned -1 [0092.562] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FORM.ICO") returned 1 [0092.562] lstrcmpiA (lpString1="", lpString2="FORM.ICO") returned -1 [0092.562] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ERROR.GIF") returned="ERROR.GIF" [0092.562] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="FORM.ICO" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.ICO") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.ICO" [0092.562] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.ICO", pszSpec="*.zip") returned 0 [0092.562] lstrlenA (lpString="*.zip") returned 5 [0092.562] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.ICO", pszSpec="*.rar") returned 0 [0092.562] lstrlenA (lpString="*.rar") returned 5 [0092.562] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.ICO", pszSpec="*.7z") returned 0 [0092.562] lstrlenA (lpString="*.7z") returned 4 [0092.562] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.ICO", pszSpec="*.tar") returned 0 [0092.562] lstrlenA (lpString="*.tar") returned 5 [0092.562] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.ICO", pszSpec="*.gzip") returned 0 [0092.562] lstrlenA (lpString="*.gzip") returned 6 [0092.562] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.ICO", pszSpec="*.jpg") returned 0 [0092.562] lstrlenA (lpString="*.jpg") returned 5 [0092.562] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.ICO", pszSpec="*.jpeg") returned 0 [0092.562] lstrlenA (lpString="*.jpeg") returned 6 [0092.562] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.ICO", pszSpec="*.psd") returned 0 [0092.562] lstrlenA (lpString="*.psd") returned 5 [0092.562] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.ICO", pszSpec="*.cdr") returned 0 [0092.562] lstrlenA (lpString="*.cdr") returned 5 [0092.562] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.ICO", pszSpec="*.dwg") returned 0 [0092.562] lstrlenA (lpString="*.dwg") returned 5 [0092.562] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.ICO", pszSpec="*.max") returned 0 [0092.562] lstrlenA (lpString="*.max") returned 5 [0092.562] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.ICO", pszSpec="*.bmp") returned 0 [0092.562] lstrlenA (lpString="*.bmp") returned 5 [0092.562] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.ICO", pszSpec="*.gif") returned 0 [0092.562] lstrlenA (lpString="*.gif") returned 5 [0092.562] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.ICO", pszSpec="*.png") returned 0 [0092.562] lstrlenA (lpString="*.png") returned 5 [0092.562] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.ICO", pszSpec="*.doc") returned 0 [0092.562] lstrlenA (lpString="*.doc") returned 5 [0092.562] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.ICO", pszSpec="*.docx") returned 0 [0092.562] lstrlenA (lpString="*.docx") returned 6 [0092.563] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.ICO", pszSpec="*.xls") returned 0 [0092.563] lstrlenA (lpString="*.xls") returned 5 [0092.563] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.ICO", pszSpec="*.xlsx") returned 0 [0092.563] lstrlenA (lpString="*.xlsx") returned 6 [0092.563] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.ICO", pszSpec="*.ppt") returned 0 [0092.563] lstrlenA (lpString="*.ppt") returned 5 [0092.563] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.ICO", pszSpec="*.pptx") returned 0 [0092.563] lstrlenA (lpString="*.pptx") returned 6 [0092.563] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.ICO", pszSpec="*.txt") returned 0 [0092.563] lstrlenA (lpString="*.txt") returned 5 [0092.563] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.ICO", pszSpec="*.pdf") returned 0 [0092.563] lstrlenA (lpString="*.pdf") returned 5 [0092.563] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.ICO", pszSpec="*.djvu") returned 0 [0092.563] lstrlenA (lpString="*.djvu") returned 6 [0092.563] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.ICO", pszSpec="*.htm") returned 0 [0092.563] lstrlenA (lpString="*.htm") returned 5 [0092.563] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.ICO", pszSpec="*.html") returned 0 [0092.563] lstrlenA (lpString="*.html") returned 6 [0092.563] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.ICO", pszSpec="*.mdb") returned 0 [0092.563] lstrlenA (lpString="*.mdb") returned 5 [0092.563] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.ICO", pszSpec="*.cer") returned 0 [0092.563] lstrlenA (lpString="*.cer") returned 5 [0092.563] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.ICO", pszSpec="*.p12") returned 0 [0092.563] lstrlenA (lpString="*.p12") returned 5 [0092.563] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.ICO", pszSpec="*.pfx") returned 0 [0092.563] lstrlenA (lpString="*.pfx") returned 5 [0092.563] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.ICO", pszSpec="*.kwm") returned 0 [0092.563] lstrlenA (lpString="*.kwm") returned 5 [0092.563] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.ICO", pszSpec="*.pwm") returned 0 [0092.563] lstrlenA (lpString="*.pwm") returned 5 [0092.563] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.ICO", pszSpec="*.1cd") returned 0 [0092.563] lstrlenA (lpString="*.1cd") returned 5 [0092.563] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.ICO", pszSpec="*.md") returned 0 [0092.563] lstrlenA (lpString="*.md") returned 4 [0092.563] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.ICO", pszSpec="*.mdf") returned 0 [0092.563] lstrlenA (lpString="*.mdf") returned 5 [0092.563] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.ICO", pszSpec="*.dbf") returned 0 [0092.563] lstrlenA (lpString="*.dbf") returned 5 [0092.563] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.ICO", pszSpec="*.odt") returned 0 [0092.563] lstrlenA (lpString="*.odt") returned 5 [0092.563] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.ICO", pszSpec="*.vob") returned 0 [0092.563] lstrlenA (lpString="*.vob") returned 5 [0092.563] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.ICO", pszSpec="*.ifo") returned 0 [0092.563] lstrlenA (lpString="*.ifo") returned 5 [0092.563] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.ICO", pszSpec="*.lnk") returned 0 [0092.563] lstrlenA (lpString="*.lnk") returned 5 [0092.563] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.ICO", pszSpec="*.torrent") returned 0 [0092.563] lstrlenA (lpString="*.torrent") returned 9 [0092.563] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.ICO", pszSpec="*.mov") returned 0 [0092.563] lstrlenA (lpString="*.mov") returned 5 [0092.564] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.ICO", pszSpec="*.m2v") returned 0 [0092.564] lstrlenA (lpString="*.m2v") returned 5 [0092.564] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.ICO", pszSpec="*.3gp") returned 0 [0092.564] lstrlenA (lpString="*.3gp") returned 5 [0092.564] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.ICO", pszSpec="*.mpeg") returned 0 [0092.564] lstrlenA (lpString="*.mpeg") returned 6 [0092.564] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.ICO", pszSpec="*.mpg") returned 0 [0092.564] lstrlenA (lpString="*.mpg") returned 5 [0092.564] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.ICO", pszSpec="*.flv") returned 0 [0092.564] lstrlenA (lpString="*.flv") returned 5 [0092.564] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.ICO", pszSpec="*.avi") returned 0 [0092.564] lstrlenA (lpString="*.avi") returned 5 [0092.564] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.ICO", pszSpec="*.mp4") returned 0 [0092.564] lstrlenA (lpString="*.mp4") returned 5 [0092.564] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.ICO", pszSpec="*.wmv") returned 0 [0092.564] lstrlenA (lpString="*.wmv") returned 5 [0092.564] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.ICO", pszSpec="*.divx") returned 0 [0092.564] lstrlenA (lpString="*.divx") returned 6 [0092.564] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.ICO", pszSpec="*.mkv") returned 0 [0092.564] lstrlenA (lpString="*.mkv") returned 5 [0092.564] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.ICO", pszSpec="*.mp3") returned 0 [0092.564] lstrlenA (lpString="*.mp3") returned 5 [0092.564] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.ICO", pszSpec="*.wav") returned 0 [0092.564] lstrlenA (lpString="*.wav") returned 5 [0092.564] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.ICO", pszSpec="*.flac") returned 0 [0092.564] lstrlenA (lpString="*.flac") returned 6 [0092.564] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.ICO", pszSpec="*.ape") returned 0 [0092.564] lstrlenA (lpString="*.ape") returned 5 [0092.564] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.ICO", pszSpec="*.wma") returned 0 [0092.564] lstrlenA (lpString="*.wma") returned 5 [0092.564] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.ICO", pszSpec="*.ac3") returned 0 [0092.564] lstrlenA (lpString="*.ac3") returned 5 [0092.564] FindNextFileA (in: hFindFile=0x5b7d30, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0092.564] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0092.564] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="FORM.JS") returned -1 [0092.564] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FORM.JS") returned 1 [0092.564] lstrcmpiA (lpString1="", lpString2="FORM.JS") returned -1 [0092.564] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.ICO") returned="FORM.ICO" [0092.564] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="FORM.JS" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.JS") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.JS" [0092.564] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.JS", pszSpec="*.zip") returned 0 [0092.564] lstrlenA (lpString="*.zip") returned 5 [0092.564] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.JS", pszSpec="*.rar") returned 0 [0092.564] lstrlenA (lpString="*.rar") returned 5 [0092.564] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.JS", pszSpec="*.7z") returned 0 [0092.564] lstrlenA (lpString="*.7z") returned 4 [0092.564] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.JS", pszSpec="*.tar") returned 0 [0092.564] lstrlenA (lpString="*.tar") returned 5 [0092.564] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.JS", pszSpec="*.gzip") returned 0 [0092.564] lstrlenA (lpString="*.gzip") returned 6 [0092.564] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.JS", pszSpec="*.jpg") returned 0 [0092.564] lstrlenA (lpString="*.jpg") returned 5 [0092.564] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.JS", pszSpec="*.jpeg") returned 0 [0092.565] lstrlenA (lpString="*.jpeg") returned 6 [0092.565] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.JS", pszSpec="*.psd") returned 0 [0092.565] lstrlenA (lpString="*.psd") returned 5 [0092.565] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.JS", pszSpec="*.cdr") returned 0 [0092.565] lstrlenA (lpString="*.cdr") returned 5 [0092.565] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.JS", pszSpec="*.dwg") returned 0 [0092.565] lstrlenA (lpString="*.dwg") returned 5 [0092.565] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.JS", pszSpec="*.max") returned 0 [0092.565] lstrlenA (lpString="*.max") returned 5 [0092.565] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.JS", pszSpec="*.bmp") returned 0 [0092.565] lstrlenA (lpString="*.bmp") returned 5 [0092.565] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.JS", pszSpec="*.gif") returned 0 [0092.565] lstrlenA (lpString="*.gif") returned 5 [0092.565] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.JS", pszSpec="*.png") returned 0 [0092.565] lstrlenA (lpString="*.png") returned 5 [0092.565] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.JS", pszSpec="*.doc") returned 0 [0092.565] lstrlenA (lpString="*.doc") returned 5 [0092.565] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.JS", pszSpec="*.docx") returned 0 [0092.565] lstrlenA (lpString="*.docx") returned 6 [0092.565] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.JS", pszSpec="*.xls") returned 0 [0092.565] lstrlenA (lpString="*.xls") returned 5 [0092.565] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.JS", pszSpec="*.xlsx") returned 0 [0092.565] lstrlenA (lpString="*.xlsx") returned 6 [0092.565] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.JS", pszSpec="*.ppt") returned 0 [0092.565] lstrlenA (lpString="*.ppt") returned 5 [0092.565] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.JS", pszSpec="*.pptx") returned 0 [0092.565] lstrlenA (lpString="*.pptx") returned 6 [0092.565] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.JS", pszSpec="*.txt") returned 0 [0092.565] lstrlenA (lpString="*.txt") returned 5 [0092.565] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.JS", pszSpec="*.pdf") returned 0 [0092.565] lstrlenA (lpString="*.pdf") returned 5 [0092.565] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.JS", pszSpec="*.djvu") returned 0 [0092.565] lstrlenA (lpString="*.djvu") returned 6 [0092.565] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.JS", pszSpec="*.htm") returned 0 [0092.565] lstrlenA (lpString="*.htm") returned 5 [0092.565] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.JS", pszSpec="*.html") returned 0 [0092.565] lstrlenA (lpString="*.html") returned 6 [0092.565] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.JS", pszSpec="*.mdb") returned 0 [0092.565] lstrlenA (lpString="*.mdb") returned 5 [0092.565] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.JS", pszSpec="*.cer") returned 0 [0092.565] lstrlenA (lpString="*.cer") returned 5 [0092.565] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.JS", pszSpec="*.p12") returned 0 [0092.565] lstrlenA (lpString="*.p12") returned 5 [0092.565] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.JS", pszSpec="*.pfx") returned 0 [0092.565] lstrlenA (lpString="*.pfx") returned 5 [0092.565] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.JS", pszSpec="*.kwm") returned 0 [0092.565] lstrlenA (lpString="*.kwm") returned 5 [0092.565] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.JS", pszSpec="*.pwm") returned 0 [0092.565] lstrlenA (lpString="*.pwm") returned 5 [0092.566] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.JS", pszSpec="*.1cd") returned 0 [0092.566] lstrlenA (lpString="*.1cd") returned 5 [0092.566] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.JS", pszSpec="*.md") returned 0 [0092.566] lstrlenA (lpString="*.md") returned 4 [0092.566] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.JS", pszSpec="*.mdf") returned 0 [0092.566] lstrlenA (lpString="*.mdf") returned 5 [0092.566] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.JS", pszSpec="*.dbf") returned 0 [0092.566] lstrlenA (lpString="*.dbf") returned 5 [0092.566] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.JS", pszSpec="*.odt") returned 0 [0092.566] lstrlenA (lpString="*.odt") returned 5 [0092.566] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.JS", pszSpec="*.vob") returned 0 [0092.566] lstrlenA (lpString="*.vob") returned 5 [0092.566] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.JS", pszSpec="*.ifo") returned 0 [0092.566] lstrlenA (lpString="*.ifo") returned 5 [0092.566] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.JS", pszSpec="*.lnk") returned 0 [0092.566] lstrlenA (lpString="*.lnk") returned 5 [0092.566] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.JS", pszSpec="*.torrent") returned 0 [0092.566] lstrlenA (lpString="*.torrent") returned 9 [0092.566] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.JS", pszSpec="*.mov") returned 0 [0092.566] lstrlenA (lpString="*.mov") returned 5 [0092.566] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.JS", pszSpec="*.m2v") returned 0 [0092.566] lstrlenA (lpString="*.m2v") returned 5 [0092.566] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.JS", pszSpec="*.3gp") returned 0 [0092.566] lstrlenA (lpString="*.3gp") returned 5 [0092.566] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.JS", pszSpec="*.mpeg") returned 0 [0092.566] lstrlenA (lpString="*.mpeg") returned 6 [0092.566] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.JS", pszSpec="*.mpg") returned 0 [0092.566] lstrlenA (lpString="*.mpg") returned 5 [0092.566] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.JS", pszSpec="*.flv") returned 0 [0092.566] lstrlenA (lpString="*.flv") returned 5 [0092.566] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.JS", pszSpec="*.avi") returned 0 [0092.566] lstrlenA (lpString="*.avi") returned 5 [0092.566] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.JS", pszSpec="*.mp4") returned 0 [0092.566] lstrlenA (lpString="*.mp4") returned 5 [0092.566] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.JS", pszSpec="*.wmv") returned 0 [0092.566] lstrlenA (lpString="*.wmv") returned 5 [0092.566] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.JS", pszSpec="*.divx") returned 0 [0092.566] lstrlenA (lpString="*.divx") returned 6 [0092.566] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.JS", pszSpec="*.mkv") returned 0 [0092.566] lstrlenA (lpString="*.mkv") returned 5 [0092.566] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.JS", pszSpec="*.mp3") returned 0 [0092.566] lstrlenA (lpString="*.mp3") returned 5 [0092.566] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.JS", pszSpec="*.wav") returned 0 [0092.566] lstrlenA (lpString="*.wav") returned 5 [0092.566] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.JS", pszSpec="*.flac") returned 0 [0092.566] lstrlenA (lpString="*.flac") returned 6 [0092.566] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.JS", pszSpec="*.ape") returned 0 [0092.566] lstrlenA (lpString="*.ape") returned 5 [0092.566] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.JS", pszSpec="*.wma") returned 0 [0092.566] lstrlenA (lpString="*.wma") returned 5 [0092.567] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.JS", pszSpec="*.ac3") returned 0 [0092.567] lstrlenA (lpString="*.ac3") returned 5 [0092.567] FindNextFileA (in: hFindFile=0x5b7d30, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0092.567] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0092.567] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="FormsBlankPage.html") returned -1 [0092.567] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FormsBlankPage.html") returned 1 [0092.567] lstrcmpiA (lpString1="", lpString2="FormsBlankPage.html") returned -1 [0092.567] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.JS") returned="FORM.JS" [0092.567] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="FormsBlankPage.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBlankPage.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBlankPage.html" [0092.567] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBlankPage.html", pszSpec="*.zip") returned 0 [0092.567] lstrlenA (lpString="*.zip") returned 5 [0092.567] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBlankPage.html", pszSpec="*.rar") returned 0 [0092.567] lstrlenA (lpString="*.rar") returned 5 [0092.567] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBlankPage.html", pszSpec="*.7z") returned 0 [0092.567] lstrlenA (lpString="*.7z") returned 4 [0092.567] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBlankPage.html", pszSpec="*.tar") returned 0 [0092.567] lstrlenA (lpString="*.tar") returned 5 [0092.567] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBlankPage.html", pszSpec="*.gzip") returned 0 [0092.567] lstrlenA (lpString="*.gzip") returned 6 [0092.567] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBlankPage.html", pszSpec="*.jpg") returned 0 [0092.567] lstrlenA (lpString="*.jpg") returned 5 [0092.567] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBlankPage.html", pszSpec="*.jpeg") returned 0 [0092.567] lstrlenA (lpString="*.jpeg") returned 6 [0092.567] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBlankPage.html", pszSpec="*.psd") returned 0 [0092.567] lstrlenA (lpString="*.psd") returned 5 [0092.567] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBlankPage.html", pszSpec="*.cdr") returned 0 [0092.567] lstrlenA (lpString="*.cdr") returned 5 [0092.567] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBlankPage.html", pszSpec="*.dwg") returned 0 [0092.567] lstrlenA (lpString="*.dwg") returned 5 [0092.567] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBlankPage.html", pszSpec="*.max") returned 0 [0092.567] lstrlenA (lpString="*.max") returned 5 [0092.567] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBlankPage.html", pszSpec="*.bmp") returned 0 [0092.567] lstrlenA (lpString="*.bmp") returned 5 [0092.567] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBlankPage.html", pszSpec="*.gif") returned 0 [0092.567] lstrlenA (lpString="*.gif") returned 5 [0092.567] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBlankPage.html", pszSpec="*.png") returned 0 [0092.567] lstrlenA (lpString="*.png") returned 5 [0092.567] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBlankPage.html", pszSpec="*.doc") returned 0 [0092.567] lstrlenA (lpString="*.doc") returned 5 [0092.567] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBlankPage.html", pszSpec="*.docx") returned 0 [0092.567] lstrlenA (lpString="*.docx") returned 6 [0092.567] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBlankPage.html", pszSpec="*.xls") returned 0 [0092.567] lstrlenA (lpString="*.xls") returned 5 [0092.567] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBlankPage.html", pszSpec="*.xlsx") returned 0 [0092.567] lstrlenA (lpString="*.xlsx") returned 6 [0092.567] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBlankPage.html", pszSpec="*.ppt") returned 0 [0092.567] lstrlenA (lpString="*.ppt") returned 5 [0092.567] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBlankPage.html", pszSpec="*.pptx") returned 0 [0092.567] lstrlenA (lpString="*.pptx") returned 6 [0092.567] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBlankPage.html", pszSpec="*.txt") returned 0 [0092.568] lstrlenA (lpString="*.txt") returned 5 [0092.568] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBlankPage.html", pszSpec="*.pdf") returned 0 [0092.568] lstrlenA (lpString="*.pdf") returned 5 [0092.568] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBlankPage.html", pszSpec="*.djvu") returned 0 [0092.568] lstrlenA (lpString="*.djvu") returned 6 [0092.568] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBlankPage.html", pszSpec="*.htm") returned 0 [0092.568] lstrlenA (lpString="*.htm") returned 5 [0092.568] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBlankPage.html", pszSpec="*.html") returned 1 [0092.568] lstrlenA (lpString="*.html") returned 6 [0092.568] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBlankPage.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBlankPage.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBlankPage.html" [0092.568] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBlankPage.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBlankPage.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBlankPage.html" [0092.568] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBlankPage.html", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBlankPage.html.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBlankPage.html." [0092.568] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBlankPage.html.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBlankPage.html. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBlankPage.html. " [0092.568] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBlankPage.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsblankpage.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0092.569] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x45d [0092.569] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8e612900, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x618c8a10, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8e612900, dwHighDateTime=0x1c747ea)) returned 1 [0092.569] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0092.569] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x403, lpOverlapped=0x0) returned 1 [0092.575] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBlankPage.html") returned="FormsBlankPage.html" [0092.575] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0092.575] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x403, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x403, lpOverlapped=0x0) returned 1 [0092.575] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0092.575] CloseHandle (hObject=0x98) returned 1 [0092.576] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBlankPage.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsblankpage.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBlankPage.html. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsblankpage.html. ")) returned 1 [0092.577] FindNextFileA (in: hFindFile=0x5b7d30, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0092.594] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0092.594] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="FormsBrowserUpgrade.html") returned -1 [0092.594] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FormsBrowserUpgrade.html") returned 1 [0092.594] lstrcmpiA (lpString1="", lpString2="FormsBrowserUpgrade.html") returned -1 [0092.594] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBlankPage.html") returned="FormsBlankPage.html" [0092.594] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="FormsBrowserUpgrade.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBrowserUpgrade.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBrowserUpgrade.html" [0092.594] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBrowserUpgrade.html", pszSpec="*.zip") returned 0 [0092.594] lstrlenA (lpString="*.zip") returned 5 [0092.594] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBrowserUpgrade.html", pszSpec="*.rar") returned 0 [0092.594] lstrlenA (lpString="*.rar") returned 5 [0092.594] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBrowserUpgrade.html", pszSpec="*.7z") returned 0 [0092.594] lstrlenA (lpString="*.7z") returned 4 [0092.594] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBrowserUpgrade.html", pszSpec="*.tar") returned 0 [0092.594] lstrlenA (lpString="*.tar") returned 5 [0092.594] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBrowserUpgrade.html", pszSpec="*.gzip") returned 0 [0092.594] lstrlenA (lpString="*.gzip") returned 6 [0092.594] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBrowserUpgrade.html", pszSpec="*.jpg") returned 0 [0092.594] lstrlenA (lpString="*.jpg") returned 5 [0092.594] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBrowserUpgrade.html", pszSpec="*.jpeg") returned 0 [0092.594] lstrlenA (lpString="*.jpeg") returned 6 [0092.594] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBrowserUpgrade.html", pszSpec="*.psd") returned 0 [0092.594] lstrlenA (lpString="*.psd") returned 5 [0092.594] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBrowserUpgrade.html", pszSpec="*.cdr") returned 0 [0092.594] lstrlenA (lpString="*.cdr") returned 5 [0092.594] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBrowserUpgrade.html", pszSpec="*.dwg") returned 0 [0092.594] lstrlenA (lpString="*.dwg") returned 5 [0092.594] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBrowserUpgrade.html", pszSpec="*.max") returned 0 [0092.594] lstrlenA (lpString="*.max") returned 5 [0092.594] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBrowserUpgrade.html", pszSpec="*.bmp") returned 0 [0092.594] lstrlenA (lpString="*.bmp") returned 5 [0092.594] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBrowserUpgrade.html", pszSpec="*.gif") returned 0 [0092.594] lstrlenA (lpString="*.gif") returned 5 [0092.595] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBrowserUpgrade.html", pszSpec="*.png") returned 0 [0092.595] lstrlenA (lpString="*.png") returned 5 [0092.595] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBrowserUpgrade.html", pszSpec="*.doc") returned 0 [0092.595] lstrlenA (lpString="*.doc") returned 5 [0092.595] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBrowserUpgrade.html", pszSpec="*.docx") returned 0 [0092.595] lstrlenA (lpString="*.docx") returned 6 [0092.595] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBrowserUpgrade.html", pszSpec="*.xls") returned 0 [0092.595] lstrlenA (lpString="*.xls") returned 5 [0092.595] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBrowserUpgrade.html", pszSpec="*.xlsx") returned 0 [0092.595] lstrlenA (lpString="*.xlsx") returned 6 [0092.595] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBrowserUpgrade.html", pszSpec="*.ppt") returned 0 [0092.595] lstrlenA (lpString="*.ppt") returned 5 [0092.595] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBrowserUpgrade.html", pszSpec="*.pptx") returned 0 [0092.595] lstrlenA (lpString="*.pptx") returned 6 [0092.595] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBrowserUpgrade.html", pszSpec="*.txt") returned 0 [0092.595] lstrlenA (lpString="*.txt") returned 5 [0092.595] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBrowserUpgrade.html", pszSpec="*.pdf") returned 0 [0092.595] lstrlenA (lpString="*.pdf") returned 5 [0092.595] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBrowserUpgrade.html", pszSpec="*.djvu") returned 0 [0092.595] lstrlenA (lpString="*.djvu") returned 6 [0092.595] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBrowserUpgrade.html", pszSpec="*.htm") returned 0 [0092.595] lstrlenA (lpString="*.htm") returned 5 [0092.595] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBrowserUpgrade.html", pszSpec="*.html") returned 1 [0092.595] lstrlenA (lpString="*.html") returned 6 [0092.595] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBrowserUpgrade.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBrowserUpgrade.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBrowserUpgrade.html" [0092.595] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBrowserUpgrade.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBrowserUpgrade.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBrowserUpgrade.html" [0092.595] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBrowserUpgrade.html", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBrowserUpgrade.html.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBrowserUpgrade.html." [0092.595] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBrowserUpgrade.html.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBrowserUpgrade.html. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBrowserUpgrade.html. " [0092.595] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBrowserUpgrade.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsbrowserupgrade.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0092.596] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x850 [0092.596] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8e612900, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5291c2f0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8e612900, dwHighDateTime=0x1c747ea)) returned 1 [0092.596] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0092.596] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x7f6, lpOverlapped=0x0) returned 1 [0092.604] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBrowserUpgrade.html") returned="FormsBrowserUpgrade.html" [0092.604] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0092.604] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x7f6, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x7f6, lpOverlapped=0x0) returned 1 [0092.605] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0092.605] CloseHandle (hObject=0x98) returned 1 [0092.606] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBrowserUpgrade.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsbrowserupgrade.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBrowserUpgrade.html. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsbrowserupgrade.html. ")) returned 1 [0092.607] FindNextFileA (in: hFindFile=0x5b7d30, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0092.607] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0092.607] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="FormsColorChart.html") returned -1 [0092.607] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FormsColorChart.html") returned 1 [0092.607] lstrcmpiA (lpString1="", lpString2="FormsColorChart.html") returned -1 [0092.607] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBrowserUpgrade.html") returned="FormsBrowserUpgrade.html" [0092.607] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="FormsColorChart.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsColorChart.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsColorChart.html" [0092.607] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsColorChart.html", pszSpec="*.zip") returned 0 [0092.607] lstrlenA (lpString="*.zip") returned 5 [0092.607] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsColorChart.html", pszSpec="*.rar") returned 0 [0092.607] lstrlenA (lpString="*.rar") returned 5 [0092.607] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsColorChart.html", pszSpec="*.7z") returned 0 [0092.607] lstrlenA (lpString="*.7z") returned 4 [0092.607] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsColorChart.html", pszSpec="*.tar") returned 0 [0092.607] lstrlenA (lpString="*.tar") returned 5 [0092.607] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsColorChart.html", pszSpec="*.gzip") returned 0 [0092.607] lstrlenA (lpString="*.gzip") returned 6 [0092.607] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsColorChart.html", pszSpec="*.jpg") returned 0 [0092.607] lstrlenA (lpString="*.jpg") returned 5 [0092.607] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsColorChart.html", pszSpec="*.jpeg") returned 0 [0092.607] lstrlenA (lpString="*.jpeg") returned 6 [0092.607] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsColorChart.html", pszSpec="*.psd") returned 0 [0092.607] lstrlenA (lpString="*.psd") returned 5 [0092.607] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsColorChart.html", pszSpec="*.cdr") returned 0 [0092.608] lstrlenA (lpString="*.cdr") returned 5 [0092.608] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsColorChart.html", pszSpec="*.dwg") returned 0 [0092.608] lstrlenA (lpString="*.dwg") returned 5 [0092.608] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsColorChart.html", pszSpec="*.max") returned 0 [0092.608] lstrlenA (lpString="*.max") returned 5 [0092.608] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsColorChart.html", pszSpec="*.bmp") returned 0 [0092.608] lstrlenA (lpString="*.bmp") returned 5 [0092.608] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsColorChart.html", pszSpec="*.gif") returned 0 [0092.608] lstrlenA (lpString="*.gif") returned 5 [0092.608] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsColorChart.html", pszSpec="*.png") returned 0 [0092.608] lstrlenA (lpString="*.png") returned 5 [0092.608] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsColorChart.html", pszSpec="*.doc") returned 0 [0092.608] lstrlenA (lpString="*.doc") returned 5 [0092.608] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsColorChart.html", pszSpec="*.docx") returned 0 [0092.608] lstrlenA (lpString="*.docx") returned 6 [0092.608] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsColorChart.html", pszSpec="*.xls") returned 0 [0092.608] lstrlenA (lpString="*.xls") returned 5 [0092.608] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsColorChart.html", pszSpec="*.xlsx") returned 0 [0092.608] lstrlenA (lpString="*.xlsx") returned 6 [0092.608] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsColorChart.html", pszSpec="*.ppt") returned 0 [0092.608] lstrlenA (lpString="*.ppt") returned 5 [0092.608] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsColorChart.html", pszSpec="*.pptx") returned 0 [0092.608] lstrlenA (lpString="*.pptx") returned 6 [0092.608] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsColorChart.html", pszSpec="*.txt") returned 0 [0092.608] lstrlenA (lpString="*.txt") returned 5 [0092.608] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsColorChart.html", pszSpec="*.pdf") returned 0 [0092.608] lstrlenA (lpString="*.pdf") returned 5 [0092.608] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsColorChart.html", pszSpec="*.djvu") returned 0 [0092.608] lstrlenA (lpString="*.djvu") returned 6 [0092.608] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsColorChart.html", pszSpec="*.htm") returned 0 [0092.608] lstrlenA (lpString="*.htm") returned 5 [0092.608] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsColorChart.html", pszSpec="*.html") returned 1 [0092.608] lstrlenA (lpString="*.html") returned 6 [0092.608] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsColorChart.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsColorChart.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsColorChart.html" [0092.608] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsColorChart.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsColorChart.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsColorChart.html" [0092.608] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsColorChart.html", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsColorChart.html.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsColorChart.html." [0092.608] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsColorChart.html.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsColorChart.html. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsColorChart.html. " [0092.608] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsColorChart.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formscolorchart.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0092.609] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2ed [0092.609] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8e612900, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5291c2f0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8e612900, dwHighDateTime=0x1c747ea)) returned 1 [0092.609] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0092.609] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x293, lpOverlapped=0x0) returned 1 [0092.610] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsColorChart.html") returned="FormsColorChart.html" [0092.610] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0092.610] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x293, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x293, lpOverlapped=0x0) returned 1 [0092.611] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0092.611] CloseHandle (hObject=0x98) returned 1 [0092.611] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsColorChart.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formscolorchart.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsColorChart.html. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formscolorchart.html. ")) returned 1 [0092.612] FindNextFileA (in: hFindFile=0x5b7d30, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0092.612] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0092.612] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="FormsFormTemplate.html") returned -1 [0092.612] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FormsFormTemplate.html") returned 1 [0092.612] lstrcmpiA (lpString1="", lpString2="FormsFormTemplate.html") returned -1 [0092.612] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsColorChart.html") returned="FormsColorChart.html" [0092.612] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="FormsFormTemplate.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsFormTemplate.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsFormTemplate.html" [0092.612] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsFormTemplate.html", pszSpec="*.zip") returned 0 [0092.612] lstrlenA (lpString="*.zip") returned 5 [0092.612] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsFormTemplate.html", pszSpec="*.rar") returned 0 [0092.612] lstrlenA (lpString="*.rar") returned 5 [0092.612] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsFormTemplate.html", pszSpec="*.7z") returned 0 [0092.612] lstrlenA (lpString="*.7z") returned 4 [0092.612] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsFormTemplate.html", pszSpec="*.tar") returned 0 [0092.612] lstrlenA (lpString="*.tar") returned 5 [0092.612] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsFormTemplate.html", pszSpec="*.gzip") returned 0 [0092.612] lstrlenA (lpString="*.gzip") returned 6 [0092.612] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsFormTemplate.html", pszSpec="*.jpg") returned 0 [0092.613] lstrlenA (lpString="*.jpg") returned 5 [0092.613] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsFormTemplate.html", pszSpec="*.jpeg") returned 0 [0092.613] lstrlenA (lpString="*.jpeg") returned 6 [0092.613] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsFormTemplate.html", pszSpec="*.psd") returned 0 [0092.613] lstrlenA (lpString="*.psd") returned 5 [0092.613] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsFormTemplate.html", pszSpec="*.cdr") returned 0 [0092.613] lstrlenA (lpString="*.cdr") returned 5 [0092.613] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsFormTemplate.html", pszSpec="*.dwg") returned 0 [0092.613] lstrlenA (lpString="*.dwg") returned 5 [0092.613] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsFormTemplate.html", pszSpec="*.max") returned 0 [0092.613] lstrlenA (lpString="*.max") returned 5 [0092.613] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsFormTemplate.html", pszSpec="*.bmp") returned 0 [0092.613] lstrlenA (lpString="*.bmp") returned 5 [0092.613] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsFormTemplate.html", pszSpec="*.gif") returned 0 [0092.613] lstrlenA (lpString="*.gif") returned 5 [0092.613] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsFormTemplate.html", pszSpec="*.png") returned 0 [0092.613] lstrlenA (lpString="*.png") returned 5 [0092.613] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsFormTemplate.html", pszSpec="*.doc") returned 0 [0092.613] lstrlenA (lpString="*.doc") returned 5 [0092.613] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsFormTemplate.html", pszSpec="*.docx") returned 0 [0092.613] lstrlenA (lpString="*.docx") returned 6 [0092.613] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsFormTemplate.html", pszSpec="*.xls") returned 0 [0092.613] lstrlenA (lpString="*.xls") returned 5 [0092.613] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsFormTemplate.html", pszSpec="*.xlsx") returned 0 [0092.613] lstrlenA (lpString="*.xlsx") returned 6 [0092.613] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsFormTemplate.html", pszSpec="*.ppt") returned 0 [0092.613] lstrlenA (lpString="*.ppt") returned 5 [0092.613] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsFormTemplate.html", pszSpec="*.pptx") returned 0 [0092.613] lstrlenA (lpString="*.pptx") returned 6 [0092.613] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsFormTemplate.html", pszSpec="*.txt") returned 0 [0092.613] lstrlenA (lpString="*.txt") returned 5 [0092.613] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsFormTemplate.html", pszSpec="*.pdf") returned 0 [0092.613] lstrlenA (lpString="*.pdf") returned 5 [0092.613] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsFormTemplate.html", pszSpec="*.djvu") returned 0 [0092.613] lstrlenA (lpString="*.djvu") returned 6 [0092.613] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsFormTemplate.html", pszSpec="*.htm") returned 0 [0092.613] lstrlenA (lpString="*.htm") returned 5 [0092.613] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsFormTemplate.html", pszSpec="*.html") returned 1 [0092.613] lstrlenA (lpString="*.html") returned 6 [0092.613] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsFormTemplate.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsFormTemplate.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsFormTemplate.html" [0092.613] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsFormTemplate.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsFormTemplate.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsFormTemplate.html" [0092.613] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsFormTemplate.html", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsFormTemplate.html.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsFormTemplate.html." [0092.613] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsFormTemplate.html.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsFormTemplate.html. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsFormTemplate.html. " [0092.614] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsFormTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsformtemplate.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0092.614] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xc94 [0092.614] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8e612900, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5291c2f0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8e612900, dwHighDateTime=0x1c747ea)) returned 1 [0092.614] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0092.614] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0xc3a, lpOverlapped=0x0) returned 1 [0092.615] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsFormTemplate.html") returned="FormsFormTemplate.html" [0092.615] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0092.615] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0xc3a, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0xc3a, lpOverlapped=0x0) returned 1 [0092.615] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0092.615] CloseHandle (hObject=0x98) returned 1 [0092.616] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsFormTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsformtemplate.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsFormTemplate.html. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsformtemplate.html. ")) returned 1 [0092.616] FindNextFileA (in: hFindFile=0x5b7d30, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0092.616] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0092.616] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="FormsHomePage.html") returned -1 [0092.616] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FormsHomePage.html") returned 1 [0092.616] lstrcmpiA (lpString1="", lpString2="FormsHomePage.html") returned -1 [0092.617] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsFormTemplate.html") returned="FormsFormTemplate.html" [0092.617] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="FormsHomePage.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePage.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePage.html" [0092.617] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePage.html", pszSpec="*.zip") returned 0 [0092.617] lstrlenA (lpString="*.zip") returned 5 [0092.617] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePage.html", pszSpec="*.rar") returned 0 [0092.617] lstrlenA (lpString="*.rar") returned 5 [0092.617] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePage.html", pszSpec="*.7z") returned 0 [0092.617] lstrlenA (lpString="*.7z") returned 4 [0092.617] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePage.html", pszSpec="*.tar") returned 0 [0092.617] lstrlenA (lpString="*.tar") returned 5 [0092.617] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePage.html", pszSpec="*.gzip") returned 0 [0092.617] lstrlenA (lpString="*.gzip") returned 6 [0092.617] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePage.html", pszSpec="*.jpg") returned 0 [0092.617] lstrlenA (lpString="*.jpg") returned 5 [0092.617] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePage.html", pszSpec="*.jpeg") returned 0 [0092.617] lstrlenA (lpString="*.jpeg") returned 6 [0092.617] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePage.html", pszSpec="*.psd") returned 0 [0092.617] lstrlenA (lpString="*.psd") returned 5 [0092.617] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePage.html", pszSpec="*.cdr") returned 0 [0092.617] lstrlenA (lpString="*.cdr") returned 5 [0092.617] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePage.html", pszSpec="*.dwg") returned 0 [0092.617] lstrlenA (lpString="*.dwg") returned 5 [0092.617] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePage.html", pszSpec="*.max") returned 0 [0092.617] lstrlenA (lpString="*.max") returned 5 [0092.617] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePage.html", pszSpec="*.bmp") returned 0 [0092.617] lstrlenA (lpString="*.bmp") returned 5 [0092.617] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePage.html", pszSpec="*.gif") returned 0 [0092.617] lstrlenA (lpString="*.gif") returned 5 [0092.617] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePage.html", pszSpec="*.png") returned 0 [0092.617] lstrlenA (lpString="*.png") returned 5 [0092.617] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePage.html", pszSpec="*.doc") returned 0 [0092.617] lstrlenA (lpString="*.doc") returned 5 [0092.617] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePage.html", pszSpec="*.docx") returned 0 [0092.617] lstrlenA (lpString="*.docx") returned 6 [0092.617] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePage.html", pszSpec="*.xls") returned 0 [0092.617] lstrlenA (lpString="*.xls") returned 5 [0092.617] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePage.html", pszSpec="*.xlsx") returned 0 [0092.617] lstrlenA (lpString="*.xlsx") returned 6 [0092.617] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePage.html", pszSpec="*.ppt") returned 0 [0092.617] lstrlenA (lpString="*.ppt") returned 5 [0092.617] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePage.html", pszSpec="*.pptx") returned 0 [0092.617] lstrlenA (lpString="*.pptx") returned 6 [0092.617] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePage.html", pszSpec="*.txt") returned 0 [0092.617] lstrlenA (lpString="*.txt") returned 5 [0092.618] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePage.html", pszSpec="*.pdf") returned 0 [0092.618] lstrlenA (lpString="*.pdf") returned 5 [0092.618] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePage.html", pszSpec="*.djvu") returned 0 [0092.618] lstrlenA (lpString="*.djvu") returned 6 [0092.618] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePage.html", pszSpec="*.htm") returned 0 [0092.618] lstrlenA (lpString="*.htm") returned 5 [0092.618] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePage.html", pszSpec="*.html") returned 1 [0092.618] lstrlenA (lpString="*.html") returned 6 [0092.618] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePage.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePage.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePage.html" [0092.618] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePage.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePage.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePage.html" [0092.618] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePage.html", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePage.html.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePage.html." [0092.618] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePage.html.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePage.html. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePage.html. " [0092.618] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePage.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formshomepage.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0092.618] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xc7c [0092.618] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8e612900, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x618c8a10, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8e612900, dwHighDateTime=0x1c747ea)) returned 1 [0092.618] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0092.618] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0xc22, lpOverlapped=0x0) returned 1 [0092.676] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePage.html") returned="FormsHomePage.html" [0092.676] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0092.676] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0xc22, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0xc22, lpOverlapped=0x0) returned 1 [0092.676] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0092.676] CloseHandle (hObject=0x98) returned 1 [0092.677] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePage.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formshomepage.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePage.html. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formshomepage.html. ")) returned 1 [0092.678] FindNextFileA (in: hFindFile=0x5b7d30, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0092.678] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0092.678] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="FormsHomePageScript.js") returned -1 [0092.678] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FormsHomePageScript.js") returned 1 [0092.678] lstrcmpiA (lpString1="", lpString2="FormsHomePageScript.js") returned -1 [0092.678] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePage.html") returned="FormsHomePage.html" [0092.678] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="FormsHomePageScript.js" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageScript.js") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageScript.js" [0092.678] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageScript.js", pszSpec="*.zip") returned 0 [0092.678] lstrlenA (lpString="*.zip") returned 5 [0092.678] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageScript.js", pszSpec="*.rar") returned 0 [0092.678] lstrlenA (lpString="*.rar") returned 5 [0092.678] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageScript.js", pszSpec="*.7z") returned 0 [0092.678] lstrlenA (lpString="*.7z") returned 4 [0092.679] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageScript.js", pszSpec="*.tar") returned 0 [0092.679] lstrlenA (lpString="*.tar") returned 5 [0092.679] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageScript.js", pszSpec="*.gzip") returned 0 [0092.679] lstrlenA (lpString="*.gzip") returned 6 [0092.679] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageScript.js", pszSpec="*.jpg") returned 0 [0092.679] lstrlenA (lpString="*.jpg") returned 5 [0092.679] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageScript.js", pszSpec="*.jpeg") returned 0 [0092.679] lstrlenA (lpString="*.jpeg") returned 6 [0092.679] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageScript.js", pszSpec="*.psd") returned 0 [0092.679] lstrlenA (lpString="*.psd") returned 5 [0092.679] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageScript.js", pszSpec="*.cdr") returned 0 [0092.679] lstrlenA (lpString="*.cdr") returned 5 [0092.679] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageScript.js", pszSpec="*.dwg") returned 0 [0092.679] lstrlenA (lpString="*.dwg") returned 5 [0092.679] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageScript.js", pszSpec="*.max") returned 0 [0092.679] lstrlenA (lpString="*.max") returned 5 [0092.679] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageScript.js", pszSpec="*.bmp") returned 0 [0092.679] lstrlenA (lpString="*.bmp") returned 5 [0092.679] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageScript.js", pszSpec="*.gif") returned 0 [0092.679] lstrlenA (lpString="*.gif") returned 5 [0092.679] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageScript.js", pszSpec="*.png") returned 0 [0092.679] lstrlenA (lpString="*.png") returned 5 [0092.679] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageScript.js", pszSpec="*.doc") returned 0 [0092.679] lstrlenA (lpString="*.doc") returned 5 [0092.679] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageScript.js", pszSpec="*.docx") returned 0 [0092.679] lstrlenA (lpString="*.docx") returned 6 [0092.679] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageScript.js", pszSpec="*.xls") returned 0 [0092.679] lstrlenA (lpString="*.xls") returned 5 [0092.679] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageScript.js", pszSpec="*.xlsx") returned 0 [0092.679] lstrlenA (lpString="*.xlsx") returned 6 [0092.679] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageScript.js", pszSpec="*.ppt") returned 0 [0092.679] lstrlenA (lpString="*.ppt") returned 5 [0092.679] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageScript.js", pszSpec="*.pptx") returned 0 [0092.679] lstrlenA (lpString="*.pptx") returned 6 [0092.679] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageScript.js", pszSpec="*.txt") returned 0 [0092.679] lstrlenA (lpString="*.txt") returned 5 [0092.679] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageScript.js", pszSpec="*.pdf") returned 0 [0092.679] lstrlenA (lpString="*.pdf") returned 5 [0092.680] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageScript.js", pszSpec="*.djvu") returned 0 [0092.680] lstrlenA (lpString="*.djvu") returned 6 [0092.680] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageScript.js", pszSpec="*.htm") returned 0 [0092.680] lstrlenA (lpString="*.htm") returned 5 [0092.680] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageScript.js", pszSpec="*.html") returned 0 [0092.680] lstrlenA (lpString="*.html") returned 6 [0092.680] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageScript.js", pszSpec="*.mdb") returned 0 [0092.680] lstrlenA (lpString="*.mdb") returned 5 [0092.680] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageScript.js", pszSpec="*.cer") returned 0 [0092.680] lstrlenA (lpString="*.cer") returned 5 [0092.680] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageScript.js", pszSpec="*.p12") returned 0 [0092.680] lstrlenA (lpString="*.p12") returned 5 [0092.680] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageScript.js", pszSpec="*.pfx") returned 0 [0092.680] lstrlenA (lpString="*.pfx") returned 5 [0092.680] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageScript.js", pszSpec="*.kwm") returned 0 [0092.680] lstrlenA (lpString="*.kwm") returned 5 [0092.680] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageScript.js", pszSpec="*.pwm") returned 0 [0092.680] lstrlenA (lpString="*.pwm") returned 5 [0092.680] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageScript.js", pszSpec="*.1cd") returned 0 [0092.680] lstrlenA (lpString="*.1cd") returned 5 [0092.680] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageScript.js", pszSpec="*.md") returned 0 [0092.680] lstrlenA (lpString="*.md") returned 4 [0092.680] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageScript.js", pszSpec="*.mdf") returned 0 [0092.680] lstrlenA (lpString="*.mdf") returned 5 [0092.680] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageScript.js", pszSpec="*.dbf") returned 0 [0092.680] lstrlenA (lpString="*.dbf") returned 5 [0092.680] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageScript.js", pszSpec="*.odt") returned 0 [0092.680] lstrlenA (lpString="*.odt") returned 5 [0092.680] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageScript.js", pszSpec="*.vob") returned 0 [0092.680] lstrlenA (lpString="*.vob") returned 5 [0092.680] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageScript.js", pszSpec="*.ifo") returned 0 [0092.680] lstrlenA (lpString="*.ifo") returned 5 [0092.680] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageScript.js", pszSpec="*.lnk") returned 0 [0092.680] lstrlenA (lpString="*.lnk") returned 5 [0092.680] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageScript.js", pszSpec="*.torrent") returned 0 [0092.680] lstrlenA (lpString="*.torrent") returned 9 [0092.681] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageScript.js", pszSpec="*.mov") returned 0 [0092.681] lstrlenA (lpString="*.mov") returned 5 [0092.681] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageScript.js", pszSpec="*.m2v") returned 0 [0092.681] lstrlenA (lpString="*.m2v") returned 5 [0092.681] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageScript.js", pszSpec="*.3gp") returned 0 [0092.681] lstrlenA (lpString="*.3gp") returned 5 [0092.681] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageScript.js", pszSpec="*.mpeg") returned 0 [0092.681] lstrlenA (lpString="*.mpeg") returned 6 [0092.681] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageScript.js", pszSpec="*.mpg") returned 0 [0092.681] lstrlenA (lpString="*.mpg") returned 5 [0092.681] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageScript.js", pszSpec="*.flv") returned 0 [0092.681] lstrlenA (lpString="*.flv") returned 5 [0092.681] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageScript.js", pszSpec="*.avi") returned 0 [0092.681] lstrlenA (lpString="*.avi") returned 5 [0092.681] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageScript.js", pszSpec="*.mp4") returned 0 [0092.681] lstrlenA (lpString="*.mp4") returned 5 [0092.681] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageScript.js", pszSpec="*.wmv") returned 0 [0092.681] lstrlenA (lpString="*.wmv") returned 5 [0092.681] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageScript.js", pszSpec="*.divx") returned 0 [0092.681] lstrlenA (lpString="*.divx") returned 6 [0092.681] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageScript.js", pszSpec="*.mkv") returned 0 [0092.681] lstrlenA (lpString="*.mkv") returned 5 [0092.681] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageScript.js", pszSpec="*.mp3") returned 0 [0092.681] lstrlenA (lpString="*.mp3") returned 5 [0092.681] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageScript.js", pszSpec="*.wav") returned 0 [0092.681] lstrlenA (lpString="*.wav") returned 5 [0092.681] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageScript.js", pszSpec="*.flac") returned 0 [0092.681] lstrlenA (lpString="*.flac") returned 6 [0092.681] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageScript.js", pszSpec="*.ape") returned 0 [0092.681] lstrlenA (lpString="*.ape") returned 5 [0092.681] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageScript.js", pszSpec="*.wma") returned 0 [0092.681] lstrlenA (lpString="*.wma") returned 5 [0092.681] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageScript.js", pszSpec="*.ac3") returned 0 [0092.681] lstrlenA (lpString="*.ac3") returned 5 [0092.681] FindNextFileA (in: hFindFile=0x5b7d30, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0092.681] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0092.681] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="FormsHomePageStyle.css") returned -1 [0092.682] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FormsHomePageStyle.css") returned 1 [0092.682] lstrcmpiA (lpString1="", lpString2="FormsHomePageStyle.css") returned -1 [0092.682] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageScript.js") returned="FormsHomePageScript.js" [0092.682] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="FormsHomePageStyle.css" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageStyle.css") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageStyle.css" [0092.682] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageStyle.css", pszSpec="*.zip") returned 0 [0092.682] lstrlenA (lpString="*.zip") returned 5 [0092.682] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageStyle.css", pszSpec="*.rar") returned 0 [0092.682] lstrlenA (lpString="*.rar") returned 5 [0092.682] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageStyle.css", pszSpec="*.7z") returned 0 [0092.682] lstrlenA (lpString="*.7z") returned 4 [0092.682] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageStyle.css", pszSpec="*.tar") returned 0 [0092.682] lstrlenA (lpString="*.tar") returned 5 [0092.682] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageStyle.css", pszSpec="*.gzip") returned 0 [0092.682] lstrlenA (lpString="*.gzip") returned 6 [0092.682] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageStyle.css", pszSpec="*.jpg") returned 0 [0092.682] lstrlenA (lpString="*.jpg") returned 5 [0092.682] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageStyle.css", pszSpec="*.jpeg") returned 0 [0092.682] lstrlenA (lpString="*.jpeg") returned 6 [0092.682] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageStyle.css", pszSpec="*.psd") returned 0 [0092.682] lstrlenA (lpString="*.psd") returned 5 [0092.682] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageStyle.css", pszSpec="*.cdr") returned 0 [0092.682] lstrlenA (lpString="*.cdr") returned 5 [0092.682] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageStyle.css", pszSpec="*.dwg") returned 0 [0092.682] lstrlenA (lpString="*.dwg") returned 5 [0092.682] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageStyle.css", pszSpec="*.max") returned 0 [0092.682] lstrlenA (lpString="*.max") returned 5 [0092.682] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageStyle.css", pszSpec="*.bmp") returned 0 [0092.682] lstrlenA (lpString="*.bmp") returned 5 [0092.682] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageStyle.css", pszSpec="*.gif") returned 0 [0092.682] lstrlenA (lpString="*.gif") returned 5 [0092.682] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageStyle.css", pszSpec="*.png") returned 0 [0092.682] lstrlenA (lpString="*.png") returned 5 [0092.682] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageStyle.css", pszSpec="*.doc") returned 0 [0092.682] lstrlenA (lpString="*.doc") returned 5 [0092.682] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageStyle.css", pszSpec="*.docx") returned 0 [0092.682] lstrlenA (lpString="*.docx") returned 6 [0092.682] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageStyle.css", pszSpec="*.xls") returned 0 [0092.683] lstrlenA (lpString="*.xls") returned 5 [0092.683] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageStyle.css", pszSpec="*.xlsx") returned 0 [0092.683] lstrlenA (lpString="*.xlsx") returned 6 [0092.683] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageStyle.css", pszSpec="*.ppt") returned 0 [0092.683] lstrlenA (lpString="*.ppt") returned 5 [0092.683] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageStyle.css", pszSpec="*.pptx") returned 0 [0092.683] lstrlenA (lpString="*.pptx") returned 6 [0092.683] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageStyle.css", pszSpec="*.txt") returned 0 [0092.683] lstrlenA (lpString="*.txt") returned 5 [0092.683] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageStyle.css", pszSpec="*.pdf") returned 0 [0092.683] lstrlenA (lpString="*.pdf") returned 5 [0092.683] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageStyle.css", pszSpec="*.djvu") returned 0 [0092.683] lstrlenA (lpString="*.djvu") returned 6 [0092.683] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageStyle.css", pszSpec="*.htm") returned 0 [0092.683] lstrlenA (lpString="*.htm") returned 5 [0092.683] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageStyle.css", pszSpec="*.html") returned 0 [0092.683] lstrlenA (lpString="*.html") returned 6 [0092.683] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageStyle.css", pszSpec="*.mdb") returned 0 [0092.683] lstrlenA (lpString="*.mdb") returned 5 [0092.683] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageStyle.css", pszSpec="*.cer") returned 0 [0092.683] lstrlenA (lpString="*.cer") returned 5 [0092.683] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageStyle.css", pszSpec="*.p12") returned 0 [0092.683] lstrlenA (lpString="*.p12") returned 5 [0092.683] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageStyle.css", pszSpec="*.pfx") returned 0 [0092.683] lstrlenA (lpString="*.pfx") returned 5 [0092.683] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageStyle.css", pszSpec="*.kwm") returned 0 [0092.683] lstrlenA (lpString="*.kwm") returned 5 [0092.683] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageStyle.css", pszSpec="*.pwm") returned 0 [0092.683] lstrlenA (lpString="*.pwm") returned 5 [0092.683] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageStyle.css", pszSpec="*.1cd") returned 0 [0092.683] lstrlenA (lpString="*.1cd") returned 5 [0092.683] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageStyle.css", pszSpec="*.md") returned 0 [0092.683] lstrlenA (lpString="*.md") returned 4 [0092.683] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageStyle.css", pszSpec="*.mdf") returned 0 [0092.683] lstrlenA (lpString="*.mdf") returned 5 [0092.683] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageStyle.css", pszSpec="*.dbf") returned 0 [0092.684] lstrlenA (lpString="*.dbf") returned 5 [0092.684] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageStyle.css", pszSpec="*.odt") returned 0 [0092.684] lstrlenA (lpString="*.odt") returned 5 [0092.684] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageStyle.css", pszSpec="*.vob") returned 0 [0092.684] lstrlenA (lpString="*.vob") returned 5 [0092.684] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageStyle.css", pszSpec="*.ifo") returned 0 [0092.684] lstrlenA (lpString="*.ifo") returned 5 [0092.684] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageStyle.css", pszSpec="*.lnk") returned 0 [0092.684] lstrlenA (lpString="*.lnk") returned 5 [0092.684] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageStyle.css", pszSpec="*.torrent") returned 0 [0092.684] lstrlenA (lpString="*.torrent") returned 9 [0092.684] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageStyle.css", pszSpec="*.mov") returned 0 [0092.684] lstrlenA (lpString="*.mov") returned 5 [0092.684] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageStyle.css", pszSpec="*.m2v") returned 0 [0092.684] lstrlenA (lpString="*.m2v") returned 5 [0092.684] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageStyle.css", pszSpec="*.3gp") returned 0 [0092.684] lstrlenA (lpString="*.3gp") returned 5 [0092.684] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageStyle.css", pszSpec="*.mpeg") returned 0 [0092.684] lstrlenA (lpString="*.mpeg") returned 6 [0092.684] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageStyle.css", pszSpec="*.mpg") returned 0 [0092.684] lstrlenA (lpString="*.mpg") returned 5 [0092.684] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageStyle.css", pszSpec="*.flv") returned 0 [0092.684] lstrlenA (lpString="*.flv") returned 5 [0092.684] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageStyle.css", pszSpec="*.avi") returned 0 [0092.684] lstrlenA (lpString="*.avi") returned 5 [0092.684] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageStyle.css", pszSpec="*.mp4") returned 0 [0092.684] lstrlenA (lpString="*.mp4") returned 5 [0092.684] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageStyle.css", pszSpec="*.wmv") returned 0 [0092.684] lstrlenA (lpString="*.wmv") returned 5 [0092.684] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageStyle.css", pszSpec="*.divx") returned 0 [0092.684] lstrlenA (lpString="*.divx") returned 6 [0092.684] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageStyle.css", pszSpec="*.mkv") returned 0 [0092.684] lstrlenA (lpString="*.mkv") returned 5 [0092.684] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageStyle.css", pszSpec="*.mp3") returned 0 [0092.684] lstrlenA (lpString="*.mp3") returned 5 [0092.684] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageStyle.css", pszSpec="*.wav") returned 0 [0092.684] lstrlenA (lpString="*.wav") returned 5 [0092.684] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageStyle.css", pszSpec="*.flac") returned 0 [0092.684] lstrlenA (lpString="*.flac") returned 6 [0092.685] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageStyle.css", pszSpec="*.ape") returned 0 [0092.685] lstrlenA (lpString="*.ape") returned 5 [0092.685] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageStyle.css", pszSpec="*.wma") returned 0 [0092.685] lstrlenA (lpString="*.wma") returned 5 [0092.685] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageStyle.css", pszSpec="*.ac3") returned 0 [0092.685] lstrlenA (lpString="*.ac3") returned 5 [0092.685] FindNextFileA (in: hFindFile=0x5b7d30, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0092.685] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0092.685] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="FormsImageTemplate.html") returned -1 [0092.685] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FormsImageTemplate.html") returned 1 [0092.685] lstrcmpiA (lpString1="", lpString2="FormsImageTemplate.html") returned -1 [0092.685] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageStyle.css") returned="FormsHomePageStyle.css" [0092.685] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="FormsImageTemplate.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsImageTemplate.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsImageTemplate.html" [0092.685] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsImageTemplate.html", pszSpec="*.zip") returned 0 [0092.685] lstrlenA (lpString="*.zip") returned 5 [0092.685] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsImageTemplate.html", pszSpec="*.rar") returned 0 [0092.685] lstrlenA (lpString="*.rar") returned 5 [0092.685] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsImageTemplate.html", pszSpec="*.7z") returned 0 [0092.685] lstrlenA (lpString="*.7z") returned 4 [0092.685] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsImageTemplate.html", pszSpec="*.tar") returned 0 [0092.685] lstrlenA (lpString="*.tar") returned 5 [0092.685] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsImageTemplate.html", pszSpec="*.gzip") returned 0 [0092.685] lstrlenA (lpString="*.gzip") returned 6 [0092.685] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsImageTemplate.html", pszSpec="*.jpg") returned 0 [0092.685] lstrlenA (lpString="*.jpg") returned 5 [0092.685] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsImageTemplate.html", pszSpec="*.jpeg") returned 0 [0092.685] lstrlenA (lpString="*.jpeg") returned 6 [0092.685] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsImageTemplate.html", pszSpec="*.psd") returned 0 [0092.685] lstrlenA (lpString="*.psd") returned 5 [0092.685] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsImageTemplate.html", pszSpec="*.cdr") returned 0 [0092.685] lstrlenA (lpString="*.cdr") returned 5 [0092.685] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsImageTemplate.html", pszSpec="*.dwg") returned 0 [0092.685] lstrlenA (lpString="*.dwg") returned 5 [0092.685] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsImageTemplate.html", pszSpec="*.max") returned 0 [0092.685] lstrlenA (lpString="*.max") returned 5 [0092.686] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsImageTemplate.html", pszSpec="*.bmp") returned 0 [0092.686] lstrlenA (lpString="*.bmp") returned 5 [0092.686] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsImageTemplate.html", pszSpec="*.gif") returned 0 [0092.686] lstrlenA (lpString="*.gif") returned 5 [0092.686] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsImageTemplate.html", pszSpec="*.png") returned 0 [0092.686] lstrlenA (lpString="*.png") returned 5 [0092.686] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsImageTemplate.html", pszSpec="*.doc") returned 0 [0092.686] lstrlenA (lpString="*.doc") returned 5 [0092.686] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsImageTemplate.html", pszSpec="*.docx") returned 0 [0092.686] lstrlenA (lpString="*.docx") returned 6 [0092.686] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsImageTemplate.html", pszSpec="*.xls") returned 0 [0092.686] lstrlenA (lpString="*.xls") returned 5 [0092.686] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsImageTemplate.html", pszSpec="*.xlsx") returned 0 [0092.686] lstrlenA (lpString="*.xlsx") returned 6 [0092.686] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsImageTemplate.html", pszSpec="*.ppt") returned 0 [0092.686] lstrlenA (lpString="*.ppt") returned 5 [0092.686] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsImageTemplate.html", pszSpec="*.pptx") returned 0 [0092.686] lstrlenA (lpString="*.pptx") returned 6 [0092.686] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsImageTemplate.html", pszSpec="*.txt") returned 0 [0092.686] lstrlenA (lpString="*.txt") returned 5 [0092.686] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsImageTemplate.html", pszSpec="*.pdf") returned 0 [0092.686] lstrlenA (lpString="*.pdf") returned 5 [0092.686] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsImageTemplate.html", pszSpec="*.djvu") returned 0 [0092.686] lstrlenA (lpString="*.djvu") returned 6 [0092.686] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsImageTemplate.html", pszSpec="*.htm") returned 0 [0092.686] lstrlenA (lpString="*.htm") returned 5 [0092.686] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsImageTemplate.html", pszSpec="*.html") returned 1 [0092.686] lstrlenA (lpString="*.html") returned 6 [0092.686] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsImageTemplate.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsImageTemplate.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsImageTemplate.html" [0092.686] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsImageTemplate.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsImageTemplate.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsImageTemplate.html" [0092.686] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsImageTemplate.html", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsImageTemplate.html.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsImageTemplate.html." [0092.686] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsImageTemplate.html.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsImageTemplate.html. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsImageTemplate.html. " [0092.686] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsImageTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsimagetemplate.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0092.687] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x7ee [0092.687] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8e612900, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x618eeb70, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8e612900, dwHighDateTime=0x1c747ea)) returned 1 [0092.687] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0092.687] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x794, lpOverlapped=0x0) returned 1 [0092.717] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsImageTemplate.html") returned="FormsImageTemplate.html" [0092.717] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0092.718] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x794, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x794, lpOverlapped=0x0) returned 1 [0092.718] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0092.718] CloseHandle (hObject=0x98) returned 1 [0092.719] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsImageTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsimagetemplate.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsImageTemplate.html. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsimagetemplate.html. ")) returned 1 [0092.720] FindNextFileA (in: hFindFile=0x5b7d30, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0092.720] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0092.720] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="FormsMacroTemplate.html") returned -1 [0092.720] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FormsMacroTemplate.html") returned 1 [0092.720] lstrcmpiA (lpString1="", lpString2="FormsMacroTemplate.html") returned -1 [0092.720] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsImageTemplate.html") returned="FormsImageTemplate.html" [0092.720] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="FormsMacroTemplate.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsMacroTemplate.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsMacroTemplate.html" [0092.720] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsMacroTemplate.html", pszSpec="*.zip") returned 0 [0092.720] lstrlenA (lpString="*.zip") returned 5 [0092.720] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsMacroTemplate.html", pszSpec="*.rar") returned 0 [0092.720] lstrlenA (lpString="*.rar") returned 5 [0092.720] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsMacroTemplate.html", pszSpec="*.7z") returned 0 [0092.720] lstrlenA (lpString="*.7z") returned 4 [0092.720] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsMacroTemplate.html", pszSpec="*.tar") returned 0 [0092.721] lstrlenA (lpString="*.tar") returned 5 [0092.721] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsMacroTemplate.html", pszSpec="*.gzip") returned 0 [0092.721] lstrlenA (lpString="*.gzip") returned 6 [0092.721] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsMacroTemplate.html", pszSpec="*.jpg") returned 0 [0092.721] lstrlenA (lpString="*.jpg") returned 5 [0092.721] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsMacroTemplate.html", pszSpec="*.jpeg") returned 0 [0092.721] lstrlenA (lpString="*.jpeg") returned 6 [0092.721] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsMacroTemplate.html", pszSpec="*.psd") returned 0 [0092.721] lstrlenA (lpString="*.psd") returned 5 [0092.721] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsMacroTemplate.html", pszSpec="*.cdr") returned 0 [0092.721] lstrlenA (lpString="*.cdr") returned 5 [0092.721] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsMacroTemplate.html", pszSpec="*.dwg") returned 0 [0092.721] lstrlenA (lpString="*.dwg") returned 5 [0092.721] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsMacroTemplate.html", pszSpec="*.max") returned 0 [0092.721] lstrlenA (lpString="*.max") returned 5 [0092.721] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsMacroTemplate.html", pszSpec="*.bmp") returned 0 [0092.721] lstrlenA (lpString="*.bmp") returned 5 [0092.721] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsMacroTemplate.html", pszSpec="*.gif") returned 0 [0092.721] lstrlenA (lpString="*.gif") returned 5 [0092.721] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsMacroTemplate.html", pszSpec="*.png") returned 0 [0092.721] lstrlenA (lpString="*.png") returned 5 [0092.721] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsMacroTemplate.html", pszSpec="*.doc") returned 0 [0092.721] lstrlenA (lpString="*.doc") returned 5 [0092.721] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsMacroTemplate.html", pszSpec="*.docx") returned 0 [0092.721] lstrlenA (lpString="*.docx") returned 6 [0092.721] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsMacroTemplate.html", pszSpec="*.xls") returned 0 [0092.721] lstrlenA (lpString="*.xls") returned 5 [0092.721] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsMacroTemplate.html", pszSpec="*.xlsx") returned 0 [0092.721] lstrlenA (lpString="*.xlsx") returned 6 [0092.721] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsMacroTemplate.html", pszSpec="*.ppt") returned 0 [0092.721] lstrlenA (lpString="*.ppt") returned 5 [0092.721] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsMacroTemplate.html", pszSpec="*.pptx") returned 0 [0092.721] lstrlenA (lpString="*.pptx") returned 6 [0092.721] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsMacroTemplate.html", pszSpec="*.txt") returned 0 [0092.721] lstrlenA (lpString="*.txt") returned 5 [0092.721] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsMacroTemplate.html", pszSpec="*.pdf") returned 0 [0092.722] lstrlenA (lpString="*.pdf") returned 5 [0092.722] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsMacroTemplate.html", pszSpec="*.djvu") returned 0 [0092.722] lstrlenA (lpString="*.djvu") returned 6 [0092.722] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsMacroTemplate.html", pszSpec="*.htm") returned 0 [0092.722] lstrlenA (lpString="*.htm") returned 5 [0092.722] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsMacroTemplate.html", pszSpec="*.html") returned 1 [0092.722] lstrlenA (lpString="*.html") returned 6 [0092.722] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsMacroTemplate.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsMacroTemplate.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsMacroTemplate.html" [0092.722] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsMacroTemplate.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsMacroTemplate.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsMacroTemplate.html" [0092.722] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsMacroTemplate.html", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsMacroTemplate.html.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsMacroTemplate.html." [0092.722] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsMacroTemplate.html.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsMacroTemplate.html. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsMacroTemplate.html. " [0092.722] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsMacroTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsmacrotemplate.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0092.722] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x856 [0092.722] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8f925600, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x618eeb70, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8f925600, dwHighDateTime=0x1c747ea)) returned 1 [0092.722] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0092.722] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x7fc, lpOverlapped=0x0) returned 1 [0092.734] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsMacroTemplate.html") returned="FormsMacroTemplate.html" [0092.734] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0092.734] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x7fc, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x7fc, lpOverlapped=0x0) returned 1 [0092.734] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0092.734] CloseHandle (hObject=0x98) returned 1 [0092.735] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsMacroTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsmacrotemplate.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsMacroTemplate.html. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsmacrotemplate.html. ")) returned 1 [0092.736] FindNextFileA (in: hFindFile=0x5b7d30, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0092.736] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0092.736] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="FormsPreviewTemplate.html") returned -1 [0092.736] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FormsPreviewTemplate.html") returned 1 [0092.736] lstrcmpiA (lpString1="", lpString2="FormsPreviewTemplate.html") returned -1 [0092.736] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsMacroTemplate.html") returned="FormsMacroTemplate.html" [0092.736] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="FormsPreviewTemplate.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPreviewTemplate.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPreviewTemplate.html" [0092.736] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPreviewTemplate.html", pszSpec="*.zip") returned 0 [0092.736] lstrlenA (lpString="*.zip") returned 5 [0092.737] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPreviewTemplate.html", pszSpec="*.rar") returned 0 [0092.737] lstrlenA (lpString="*.rar") returned 5 [0092.737] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPreviewTemplate.html", pszSpec="*.7z") returned 0 [0092.737] lstrlenA (lpString="*.7z") returned 4 [0092.737] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPreviewTemplate.html", pszSpec="*.tar") returned 0 [0092.737] lstrlenA (lpString="*.tar") returned 5 [0092.737] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPreviewTemplate.html", pszSpec="*.gzip") returned 0 [0092.737] lstrlenA (lpString="*.gzip") returned 6 [0092.737] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPreviewTemplate.html", pszSpec="*.jpg") returned 0 [0092.737] lstrlenA (lpString="*.jpg") returned 5 [0092.737] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPreviewTemplate.html", pszSpec="*.jpeg") returned 0 [0092.737] lstrlenA (lpString="*.jpeg") returned 6 [0092.737] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPreviewTemplate.html", pszSpec="*.psd") returned 0 [0092.737] lstrlenA (lpString="*.psd") returned 5 [0092.737] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPreviewTemplate.html", pszSpec="*.cdr") returned 0 [0092.737] lstrlenA (lpString="*.cdr") returned 5 [0092.737] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPreviewTemplate.html", pszSpec="*.dwg") returned 0 [0092.737] lstrlenA (lpString="*.dwg") returned 5 [0092.737] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPreviewTemplate.html", pszSpec="*.max") returned 0 [0092.737] lstrlenA (lpString="*.max") returned 5 [0092.737] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPreviewTemplate.html", pszSpec="*.bmp") returned 0 [0092.737] lstrlenA (lpString="*.bmp") returned 5 [0092.737] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPreviewTemplate.html", pszSpec="*.gif") returned 0 [0092.737] lstrlenA (lpString="*.gif") returned 5 [0092.737] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPreviewTemplate.html", pszSpec="*.png") returned 0 [0092.737] lstrlenA (lpString="*.png") returned 5 [0092.737] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPreviewTemplate.html", pszSpec="*.doc") returned 0 [0092.737] lstrlenA (lpString="*.doc") returned 5 [0092.737] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPreviewTemplate.html", pszSpec="*.docx") returned 0 [0092.737] lstrlenA (lpString="*.docx") returned 6 [0092.737] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPreviewTemplate.html", pszSpec="*.xls") returned 0 [0092.737] lstrlenA (lpString="*.xls") returned 5 [0092.737] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPreviewTemplate.html", pszSpec="*.xlsx") returned 0 [0092.737] lstrlenA (lpString="*.xlsx") returned 6 [0092.738] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPreviewTemplate.html", pszSpec="*.ppt") returned 0 [0092.738] lstrlenA (lpString="*.ppt") returned 5 [0092.738] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPreviewTemplate.html", pszSpec="*.pptx") returned 0 [0092.738] lstrlenA (lpString="*.pptx") returned 6 [0092.738] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPreviewTemplate.html", pszSpec="*.txt") returned 0 [0092.738] lstrlenA (lpString="*.txt") returned 5 [0092.738] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPreviewTemplate.html", pszSpec="*.pdf") returned 0 [0092.738] lstrlenA (lpString="*.pdf") returned 5 [0092.738] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPreviewTemplate.html", pszSpec="*.djvu") returned 0 [0092.738] lstrlenA (lpString="*.djvu") returned 6 [0092.738] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPreviewTemplate.html", pszSpec="*.htm") returned 0 [0092.738] lstrlenA (lpString="*.htm") returned 5 [0092.738] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPreviewTemplate.html", pszSpec="*.html") returned 1 [0092.738] lstrlenA (lpString="*.html") returned 6 [0092.738] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPreviewTemplate.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPreviewTemplate.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPreviewTemplate.html" [0092.738] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPreviewTemplate.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPreviewTemplate.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPreviewTemplate.html" [0092.738] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPreviewTemplate.html", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPreviewTemplate.html.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPreviewTemplate.html." [0092.738] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPreviewTemplate.html.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPreviewTemplate.html. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPreviewTemplate.html. " [0092.738] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPreviewTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formspreviewtemplate.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0092.739] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x46fe [0092.739] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8f925600, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x529685b0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8f925600, dwHighDateTime=0x1c747ea)) returned 1 [0092.739] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0092.739] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x46a4, lpOverlapped=0x0) returned 1 [0092.763] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPreviewTemplate.html") returned="FormsPreviewTemplate.html" [0092.763] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0092.763] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x46a4, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x46a4, lpOverlapped=0x0) returned 1 [0092.763] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0092.763] CloseHandle (hObject=0x98) returned 1 [0092.764] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPreviewTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formspreviewtemplate.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPreviewTemplate.html. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formspreviewtemplate.html. ")) returned 1 [0092.766] FindNextFileA (in: hFindFile=0x5b7d30, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0092.766] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0092.766] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="FormsPrintTemplate.html") returned -1 [0092.766] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FormsPrintTemplate.html") returned 1 [0092.766] lstrcmpiA (lpString1="", lpString2="FormsPrintTemplate.html") returned -1 [0092.766] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPreviewTemplate.html") returned="FormsPreviewTemplate.html" [0092.766] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="FormsPrintTemplate.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPrintTemplate.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPrintTemplate.html" [0092.766] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPrintTemplate.html", pszSpec="*.zip") returned 0 [0092.766] lstrlenA (lpString="*.zip") returned 5 [0092.766] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPrintTemplate.html", pszSpec="*.rar") returned 0 [0092.766] lstrlenA (lpString="*.rar") returned 5 [0092.766] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPrintTemplate.html", pszSpec="*.7z") returned 0 [0092.766] lstrlenA (lpString="*.7z") returned 4 [0092.766] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPrintTemplate.html", pszSpec="*.tar") returned 0 [0092.766] lstrlenA (lpString="*.tar") returned 5 [0092.766] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPrintTemplate.html", pszSpec="*.gzip") returned 0 [0092.766] lstrlenA (lpString="*.gzip") returned 6 [0092.766] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPrintTemplate.html", pszSpec="*.jpg") returned 0 [0092.766] lstrlenA (lpString="*.jpg") returned 5 [0092.766] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPrintTemplate.html", pszSpec="*.jpeg") returned 0 [0092.766] lstrlenA (lpString="*.jpeg") returned 6 [0092.766] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPrintTemplate.html", pszSpec="*.psd") returned 0 [0092.766] lstrlenA (lpString="*.psd") returned 5 [0092.766] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPrintTemplate.html", pszSpec="*.cdr") returned 0 [0092.766] lstrlenA (lpString="*.cdr") returned 5 [0092.767] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPrintTemplate.html", pszSpec="*.dwg") returned 0 [0092.767] lstrlenA (lpString="*.dwg") returned 5 [0092.767] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPrintTemplate.html", pszSpec="*.max") returned 0 [0092.767] lstrlenA (lpString="*.max") returned 5 [0092.767] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPrintTemplate.html", pszSpec="*.bmp") returned 0 [0092.767] lstrlenA (lpString="*.bmp") returned 5 [0092.767] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPrintTemplate.html", pszSpec="*.gif") returned 0 [0092.767] lstrlenA (lpString="*.gif") returned 5 [0092.767] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPrintTemplate.html", pszSpec="*.png") returned 0 [0092.767] lstrlenA (lpString="*.png") returned 5 [0092.767] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPrintTemplate.html", pszSpec="*.doc") returned 0 [0092.767] lstrlenA (lpString="*.doc") returned 5 [0092.767] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPrintTemplate.html", pszSpec="*.docx") returned 0 [0092.767] lstrlenA (lpString="*.docx") returned 6 [0092.767] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPrintTemplate.html", pszSpec="*.xls") returned 0 [0092.767] lstrlenA (lpString="*.xls") returned 5 [0092.767] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPrintTemplate.html", pszSpec="*.xlsx") returned 0 [0092.767] lstrlenA (lpString="*.xlsx") returned 6 [0092.767] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPrintTemplate.html", pszSpec="*.ppt") returned 0 [0092.767] lstrlenA (lpString="*.ppt") returned 5 [0092.767] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPrintTemplate.html", pszSpec="*.pptx") returned 0 [0092.767] lstrlenA (lpString="*.pptx") returned 6 [0092.767] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPrintTemplate.html", pszSpec="*.txt") returned 0 [0092.767] lstrlenA (lpString="*.txt") returned 5 [0092.767] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPrintTemplate.html", pszSpec="*.pdf") returned 0 [0092.767] lstrlenA (lpString="*.pdf") returned 5 [0092.767] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPrintTemplate.html", pszSpec="*.djvu") returned 0 [0092.767] lstrlenA (lpString="*.djvu") returned 6 [0092.767] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPrintTemplate.html", pszSpec="*.htm") returned 0 [0092.767] lstrlenA (lpString="*.htm") returned 5 [0092.767] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPrintTemplate.html", pszSpec="*.html") returned 1 [0092.767] lstrlenA (lpString="*.html") returned 6 [0092.767] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPrintTemplate.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPrintTemplate.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPrintTemplate.html" [0092.767] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPrintTemplate.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPrintTemplate.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPrintTemplate.html" [0092.767] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPrintTemplate.html", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPrintTemplate.html.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPrintTemplate.html." [0092.768] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPrintTemplate.html.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPrintTemplate.html. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPrintTemplate.html. " [0092.768] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPrintTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsprinttemplate.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0092.768] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x612 [0092.768] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8f925600, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5298e710, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8f925600, dwHighDateTime=0x1c747ea)) returned 1 [0092.768] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0092.768] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x5b8, lpOverlapped=0x0) returned 1 [0092.782] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPrintTemplate.html") returned="FormsPrintTemplate.html" [0092.782] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0092.782] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x5b8, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x5b8, lpOverlapped=0x0) returned 1 [0092.782] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0092.782] CloseHandle (hObject=0x98) returned 1 [0092.783] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPrintTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsprinttemplate.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPrintTemplate.html. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsprinttemplate.html. ")) returned 1 [0092.784] FindNextFileA (in: hFindFile=0x5b7d30, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0092.784] lstrcmpA (lpString1=".", lpString2="FormsStyles") returned -1 [0092.784] lstrcmpA (lpString1="..", lpString2="FormsStyles") returned -1 [0092.784] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPrintTemplate.html") returned="FormsPrintTemplate.html" [0092.784] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="FormsStyles" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles" [0092.784] lstrlenA (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles") returned 94 [0092.784] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\*.*", lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 0x5b7d70 [0092.786] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0092.786] FindNextFileA (in: hFindFile=0x5b7d70, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0092.787] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0092.787] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0092.787] FindNextFileA (in: hFindFile=0x5b7d70, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0092.787] PeekMessageA (in: lpMsg=0xaece4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaece4) returned 0 [0092.787] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Adobe.css") returned 1 [0092.787] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Adobe.css") returned 1 [0092.787] lstrcmpiA (lpString1="", lpString2="Adobe.css") returned -1 [0092.787] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\*.*") returned="*.*" [0092.787] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\", lpString2="Adobe.css" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Adobe.css") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Adobe.css" [0092.787] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Adobe.css", pszSpec="*.zip") returned 0 [0092.787] lstrlenA (lpString="*.zip") returned 5 [0092.787] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Adobe.css", pszSpec="*.rar") returned 0 [0092.787] lstrlenA (lpString="*.rar") returned 5 [0092.787] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Adobe.css", pszSpec="*.7z") returned 0 [0092.787] lstrlenA (lpString="*.7z") returned 4 [0092.787] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Adobe.css", pszSpec="*.tar") returned 0 [0092.787] lstrlenA (lpString="*.tar") returned 5 [0092.787] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Adobe.css", pszSpec="*.gzip") returned 0 [0092.787] lstrlenA (lpString="*.gzip") returned 6 [0092.787] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Adobe.css", pszSpec="*.jpg") returned 0 [0092.787] lstrlenA (lpString="*.jpg") returned 5 [0092.787] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Adobe.css", pszSpec="*.jpeg") returned 0 [0092.787] lstrlenA (lpString="*.jpeg") returned 6 [0092.787] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Adobe.css", pszSpec="*.psd") returned 0 [0092.787] lstrlenA (lpString="*.psd") returned 5 [0092.787] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Adobe.css", pszSpec="*.cdr") returned 0 [0092.787] lstrlenA (lpString="*.cdr") returned 5 [0092.787] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Adobe.css", pszSpec="*.dwg") returned 0 [0092.787] lstrlenA (lpString="*.dwg") returned 5 [0092.787] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Adobe.css", pszSpec="*.max") returned 0 [0092.787] lstrlenA (lpString="*.max") returned 5 [0092.787] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Adobe.css", pszSpec="*.bmp") returned 0 [0092.788] lstrlenA (lpString="*.bmp") returned 5 [0092.788] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Adobe.css", pszSpec="*.gif") returned 0 [0092.788] lstrlenA (lpString="*.gif") returned 5 [0092.788] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Adobe.css", pszSpec="*.png") returned 0 [0092.788] lstrlenA (lpString="*.png") returned 5 [0092.788] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Adobe.css", pszSpec="*.doc") returned 0 [0092.788] lstrlenA (lpString="*.doc") returned 5 [0092.788] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Adobe.css", pszSpec="*.docx") returned 0 [0092.788] lstrlenA (lpString="*.docx") returned 6 [0092.788] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Adobe.css", pszSpec="*.xls") returned 0 [0092.788] lstrlenA (lpString="*.xls") returned 5 [0092.788] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Adobe.css", pszSpec="*.xlsx") returned 0 [0092.788] lstrlenA (lpString="*.xlsx") returned 6 [0092.788] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Adobe.css", pszSpec="*.ppt") returned 0 [0092.788] lstrlenA (lpString="*.ppt") returned 5 [0092.788] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Adobe.css", pszSpec="*.pptx") returned 0 [0092.788] lstrlenA (lpString="*.pptx") returned 6 [0092.788] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Adobe.css", pszSpec="*.txt") returned 0 [0092.788] lstrlenA (lpString="*.txt") returned 5 [0092.788] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Adobe.css", pszSpec="*.pdf") returned 0 [0092.788] lstrlenA (lpString="*.pdf") returned 5 [0092.788] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Adobe.css", pszSpec="*.djvu") returned 0 [0092.788] lstrlenA (lpString="*.djvu") returned 6 [0092.788] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Adobe.css", pszSpec="*.htm") returned 0 [0092.788] lstrlenA (lpString="*.htm") returned 5 [0092.788] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Adobe.css", pszSpec="*.html") returned 0 [0092.788] lstrlenA (lpString="*.html") returned 6 [0092.788] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Adobe.css", pszSpec="*.mdb") returned 0 [0092.788] lstrlenA (lpString="*.mdb") returned 5 [0092.788] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Adobe.css", pszSpec="*.cer") returned 0 [0092.788] lstrlenA (lpString="*.cer") returned 5 [0092.788] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Adobe.css", pszSpec="*.p12") returned 0 [0092.788] lstrlenA (lpString="*.p12") returned 5 [0092.788] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Adobe.css", pszSpec="*.pfx") returned 0 [0092.788] lstrlenA (lpString="*.pfx") returned 5 [0092.788] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Adobe.css", pszSpec="*.kwm") returned 0 [0092.789] lstrlenA (lpString="*.kwm") returned 5 [0092.789] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Adobe.css", pszSpec="*.pwm") returned 0 [0092.789] lstrlenA (lpString="*.pwm") returned 5 [0092.789] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Adobe.css", pszSpec="*.1cd") returned 0 [0092.789] lstrlenA (lpString="*.1cd") returned 5 [0092.789] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Adobe.css", pszSpec="*.md") returned 0 [0092.789] lstrlenA (lpString="*.md") returned 4 [0092.789] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Adobe.css", pszSpec="*.mdf") returned 0 [0092.789] lstrlenA (lpString="*.mdf") returned 5 [0092.789] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Adobe.css", pszSpec="*.dbf") returned 0 [0092.789] lstrlenA (lpString="*.dbf") returned 5 [0092.789] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Adobe.css", pszSpec="*.odt") returned 0 [0092.789] lstrlenA (lpString="*.odt") returned 5 [0092.789] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Adobe.css", pszSpec="*.vob") returned 0 [0092.789] lstrlenA (lpString="*.vob") returned 5 [0092.789] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Adobe.css", pszSpec="*.ifo") returned 0 [0092.789] lstrlenA (lpString="*.ifo") returned 5 [0092.789] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Adobe.css", pszSpec="*.lnk") returned 0 [0092.789] lstrlenA (lpString="*.lnk") returned 5 [0092.789] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Adobe.css", pszSpec="*.torrent") returned 0 [0092.789] lstrlenA (lpString="*.torrent") returned 9 [0092.789] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Adobe.css", pszSpec="*.mov") returned 0 [0092.789] lstrlenA (lpString="*.mov") returned 5 [0092.789] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Adobe.css", pszSpec="*.m2v") returned 0 [0092.789] lstrlenA (lpString="*.m2v") returned 5 [0092.789] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Adobe.css", pszSpec="*.3gp") returned 0 [0092.789] lstrlenA (lpString="*.3gp") returned 5 [0092.789] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Adobe.css", pszSpec="*.mpeg") returned 0 [0092.789] lstrlenA (lpString="*.mpeg") returned 6 [0092.789] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Adobe.css", pszSpec="*.mpg") returned 0 [0092.789] lstrlenA (lpString="*.mpg") returned 5 [0092.789] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Adobe.css", pszSpec="*.flv") returned 0 [0092.789] lstrlenA (lpString="*.flv") returned 5 [0092.789] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Adobe.css", pszSpec="*.avi") returned 0 [0092.790] lstrlenA (lpString="*.avi") returned 5 [0092.790] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Adobe.css", pszSpec="*.mp4") returned 0 [0092.790] lstrlenA (lpString="*.mp4") returned 5 [0092.790] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Adobe.css", pszSpec="*.wmv") returned 0 [0092.790] lstrlenA (lpString="*.wmv") returned 5 [0092.790] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Adobe.css", pszSpec="*.divx") returned 0 [0092.790] lstrlenA (lpString="*.divx") returned 6 [0092.790] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Adobe.css", pszSpec="*.mkv") returned 0 [0092.790] lstrlenA (lpString="*.mkv") returned 5 [0092.790] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Adobe.css", pszSpec="*.mp3") returned 0 [0092.790] lstrlenA (lpString="*.mp3") returned 5 [0092.790] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Adobe.css", pszSpec="*.wav") returned 0 [0092.790] lstrlenA (lpString="*.wav") returned 5 [0092.790] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Adobe.css", pszSpec="*.flac") returned 0 [0092.790] lstrlenA (lpString="*.flac") returned 6 [0092.790] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Adobe.css", pszSpec="*.ape") returned 0 [0092.790] lstrlenA (lpString="*.ape") returned 5 [0092.790] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Adobe.css", pszSpec="*.wma") returned 0 [0092.790] lstrlenA (lpString="*.wma") returned 5 [0092.790] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Adobe.css", pszSpec="*.ac3") returned 0 [0092.790] lstrlenA (lpString="*.ac3") returned 5 [0092.790] FindNextFileA (in: hFindFile=0x5b7d70, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0092.790] lstrcmpA (lpString1=".", lpString2="Americana") returned -1 [0092.790] lstrcmpA (lpString1="..", lpString2="Americana") returned -1 [0092.790] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Adobe.css") returned="Adobe.css" [0092.790] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\", lpString2="Americana" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana" [0092.790] lstrlenA (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana") returned 104 [0092.790] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\*.*", lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 0x5c4240 [0092.791] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0092.791] FindNextFileA (in: hFindFile=0x5c4240, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 1 [0092.791] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0092.791] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0092.791] FindNextFileA (in: hFindFile=0x5c4240, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 1 [0092.791] PeekMessageA (in: lpMsg=0xaeb94, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaeb94) returned 0 [0092.791] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="TAB_OFF.GIF") returned -1 [0092.791] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TAB_OFF.GIF") returned -1 [0092.791] lstrcmpiA (lpString1="", lpString2="TAB_OFF.GIF") returned -1 [0092.791] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\*.*") returned="*.*" [0092.791] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\", lpString2="TAB_OFF.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_OFF.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_OFF.GIF" [0092.792] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_OFF.GIF", pszSpec="*.zip") returned 0 [0092.792] lstrlenA (lpString="*.zip") returned 5 [0092.792] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_OFF.GIF", pszSpec="*.rar") returned 0 [0092.792] lstrlenA (lpString="*.rar") returned 5 [0092.792] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_OFF.GIF", pszSpec="*.7z") returned 0 [0092.792] lstrlenA (lpString="*.7z") returned 4 [0092.792] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_OFF.GIF", pszSpec="*.tar") returned 0 [0092.792] lstrlenA (lpString="*.tar") returned 5 [0092.792] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_OFF.GIF", pszSpec="*.gzip") returned 0 [0092.792] lstrlenA (lpString="*.gzip") returned 6 [0092.792] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_OFF.GIF", pszSpec="*.jpg") returned 0 [0092.792] lstrlenA (lpString="*.jpg") returned 5 [0092.792] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_OFF.GIF", pszSpec="*.jpeg") returned 0 [0092.792] lstrlenA (lpString="*.jpeg") returned 6 [0092.792] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_OFF.GIF", pszSpec="*.psd") returned 0 [0092.792] lstrlenA (lpString="*.psd") returned 5 [0092.792] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_OFF.GIF", pszSpec="*.cdr") returned 0 [0092.792] lstrlenA (lpString="*.cdr") returned 5 [0092.792] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_OFF.GIF", pszSpec="*.dwg") returned 0 [0092.792] lstrlenA (lpString="*.dwg") returned 5 [0092.792] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_OFF.GIF", pszSpec="*.max") returned 0 [0092.792] lstrlenA (lpString="*.max") returned 5 [0092.792] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_OFF.GIF", pszSpec="*.bmp") returned 0 [0092.792] lstrlenA (lpString="*.bmp") returned 5 [0092.792] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_OFF.GIF", pszSpec="*.gif") returned 1 [0092.792] lstrlenA (lpString="*.gif") returned 5 [0092.792] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_OFF.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_OFF.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_OFF.GIF" [0092.792] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_OFF.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_OFF.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_OFF.GIF" [0092.792] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_OFF.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_OFF.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_OFF.GIF." [0092.792] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_OFF.GIF.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_OFF.GIF. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_OFF.GIF. " [0092.792] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\americana\\tab_off.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0 [0092.793] GetFileSize (in: hFile=0xa0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x155 [0092.793] GetFileTime (in: hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8f925600, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x528d0030, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8f925600, dwHighDateTime=0x1c747ea)) returned 1 [0092.793] SetFilePointer (in: hFile=0xa0, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0092.793] ReadFile (in: hFile=0xa0, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0xfb, lpOverlapped=0x0) returned 1 [0092.794] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_OFF.GIF") returned="TAB_OFF.GIF" [0092.794] SetFilePointer (in: hFile=0xa0, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0092.794] WriteFile (in: hFile=0xa0, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0xfb, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0xfb, lpOverlapped=0x0) returned 1 [0092.794] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0092.794] CloseHandle (hObject=0xa0) returned 1 [0092.796] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\americana\\tab_off.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_OFF.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\americana\\tab_off.gif. ")) returned 1 [0092.797] FindNextFileA (in: hFindFile=0x5c4240, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 1 [0092.797] PeekMessageA (in: lpMsg=0xaeb94, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaeb94) returned 0 [0092.797] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="TAB_ON.GIF") returned -1 [0092.797] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TAB_ON.GIF") returned -1 [0092.797] lstrcmpiA (lpString1="", lpString2="TAB_ON.GIF") returned -1 [0092.797] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_OFF.GIF") returned="TAB_OFF.GIF" [0092.797] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\", lpString2="TAB_ON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_ON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_ON.GIF" [0092.797] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_ON.GIF", pszSpec="*.zip") returned 0 [0092.798] lstrlenA (lpString="*.zip") returned 5 [0092.798] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_ON.GIF", pszSpec="*.rar") returned 0 [0092.798] lstrlenA (lpString="*.rar") returned 5 [0092.798] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_ON.GIF", pszSpec="*.7z") returned 0 [0092.798] lstrlenA (lpString="*.7z") returned 4 [0092.798] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_ON.GIF", pszSpec="*.tar") returned 0 [0092.798] lstrlenA (lpString="*.tar") returned 5 [0092.798] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_ON.GIF", pszSpec="*.gzip") returned 0 [0092.798] lstrlenA (lpString="*.gzip") returned 6 [0092.798] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_ON.GIF", pszSpec="*.jpg") returned 0 [0092.798] lstrlenA (lpString="*.jpg") returned 5 [0092.798] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_ON.GIF", pszSpec="*.jpeg") returned 0 [0092.798] lstrlenA (lpString="*.jpeg") returned 6 [0092.798] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_ON.GIF", pszSpec="*.psd") returned 0 [0092.798] lstrlenA (lpString="*.psd") returned 5 [0092.798] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_ON.GIF", pszSpec="*.cdr") returned 0 [0092.798] lstrlenA (lpString="*.cdr") returned 5 [0092.798] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_ON.GIF", pszSpec="*.dwg") returned 0 [0092.798] lstrlenA (lpString="*.dwg") returned 5 [0092.798] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_ON.GIF", pszSpec="*.max") returned 0 [0092.798] lstrlenA (lpString="*.max") returned 5 [0092.798] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_ON.GIF", pszSpec="*.bmp") returned 0 [0092.798] lstrlenA (lpString="*.bmp") returned 5 [0092.798] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_ON.GIF", pszSpec="*.gif") returned 1 [0092.798] lstrlenA (lpString="*.gif") returned 5 [0092.798] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_ON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_ON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_ON.GIF" [0092.798] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_ON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_ON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_ON.GIF" [0092.798] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_ON.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_ON.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_ON.GIF." [0092.798] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_ON.GIF.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_ON.GIF. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_ON.GIF. " [0092.798] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\americana\\tab_on.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0 [0092.799] GetFileSize (in: hFile=0xa0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xde [0092.800] GetFileTime (in: hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8f925600, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x618a28b0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8f925600, dwHighDateTime=0x1c747ea)) returned 1 [0092.800] SetFilePointer (in: hFile=0xa0, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0092.800] ReadFile (in: hFile=0xa0, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x84, lpOverlapped=0x0) returned 1 [0092.800] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_ON.GIF") returned="TAB_ON.GIF" [0092.800] SetFilePointer (in: hFile=0xa0, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0092.800] WriteFile (in: hFile=0xa0, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x84, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x84, lpOverlapped=0x0) returned 1 [0092.800] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0092.800] CloseHandle (hObject=0xa0) returned 1 [0092.801] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\americana\\tab_on.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_ON.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\americana\\tab_on.gif. ")) returned 1 [0092.802] FindNextFileA (in: hFindFile=0x5c4240, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 0 [0092.802] FindClose (in: hFindFile=0x5c4240 | out: hFindFile=0x5c4240) returned 1 [0092.803] FindNextFileA (in: hFindFile=0x5b7d70, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0092.803] PeekMessageA (in: lpMsg=0xaece4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaece4) returned 0 [0092.803] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Americana.css") returned 1 [0092.803] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Americana.css") returned 1 [0092.803] lstrcmpiA (lpString1="", lpString2="Americana.css") returned -1 [0092.803] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\*.*") returned="*.*" [0092.803] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\", lpString2="Americana.css" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana.css") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana.css" [0092.803] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana.css", pszSpec="*.zip") returned 0 [0092.803] lstrlenA (lpString="*.zip") returned 5 [0092.803] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana.css", pszSpec="*.rar") returned 0 [0092.803] lstrlenA (lpString="*.rar") returned 5 [0092.803] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana.css", pszSpec="*.7z") returned 0 [0092.803] lstrlenA (lpString="*.7z") returned 4 [0092.803] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana.css", pszSpec="*.tar") returned 0 [0092.803] lstrlenA (lpString="*.tar") returned 5 [0092.803] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana.css", pszSpec="*.gzip") returned 0 [0092.803] lstrlenA (lpString="*.gzip") returned 6 [0092.803] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana.css", pszSpec="*.jpg") returned 0 [0092.803] lstrlenA (lpString="*.jpg") returned 5 [0092.803] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana.css", pszSpec="*.jpeg") returned 0 [0092.803] lstrlenA (lpString="*.jpeg") returned 6 [0092.803] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana.css", pszSpec="*.psd") returned 0 [0092.803] lstrlenA (lpString="*.psd") returned 5 [0092.803] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana.css", pszSpec="*.cdr") returned 0 [0092.803] lstrlenA (lpString="*.cdr") returned 5 [0092.803] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana.css", pszSpec="*.dwg") returned 0 [0092.803] lstrlenA (lpString="*.dwg") returned 5 [0092.803] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana.css", pszSpec="*.max") returned 0 [0092.803] lstrlenA (lpString="*.max") returned 5 [0092.803] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana.css", pszSpec="*.bmp") returned 0 [0092.803] lstrlenA (lpString="*.bmp") returned 5 [0092.803] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana.css", pszSpec="*.gif") returned 0 [0092.803] lstrlenA (lpString="*.gif") returned 5 [0092.803] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana.css", pszSpec="*.png") returned 0 [0092.803] lstrlenA (lpString="*.png") returned 5 [0092.803] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana.css", pszSpec="*.doc") returned 0 [0092.803] lstrlenA (lpString="*.doc") returned 5 [0092.803] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana.css", pszSpec="*.docx") returned 0 [0092.803] lstrlenA (lpString="*.docx") returned 6 [0092.804] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana.css", pszSpec="*.xls") returned 0 [0092.804] lstrlenA (lpString="*.xls") returned 5 [0092.804] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana.css", pszSpec="*.xlsx") returned 0 [0092.804] lstrlenA (lpString="*.xlsx") returned 6 [0092.804] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana.css", pszSpec="*.ppt") returned 0 [0092.804] lstrlenA (lpString="*.ppt") returned 5 [0092.804] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana.css", pszSpec="*.pptx") returned 0 [0092.804] lstrlenA (lpString="*.pptx") returned 6 [0092.804] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana.css", pszSpec="*.txt") returned 0 [0092.804] lstrlenA (lpString="*.txt") returned 5 [0092.804] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana.css", pszSpec="*.pdf") returned 0 [0092.804] lstrlenA (lpString="*.pdf") returned 5 [0092.804] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana.css", pszSpec="*.djvu") returned 0 [0092.804] lstrlenA (lpString="*.djvu") returned 6 [0092.804] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana.css", pszSpec="*.htm") returned 0 [0092.804] lstrlenA (lpString="*.htm") returned 5 [0092.804] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana.css", pszSpec="*.html") returned 0 [0092.804] lstrlenA (lpString="*.html") returned 6 [0092.804] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana.css", pszSpec="*.mdb") returned 0 [0092.804] lstrlenA (lpString="*.mdb") returned 5 [0092.804] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana.css", pszSpec="*.cer") returned 0 [0092.804] lstrlenA (lpString="*.cer") returned 5 [0092.804] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana.css", pszSpec="*.p12") returned 0 [0092.804] lstrlenA (lpString="*.p12") returned 5 [0092.804] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana.css", pszSpec="*.pfx") returned 0 [0092.804] lstrlenA (lpString="*.pfx") returned 5 [0092.804] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana.css", pszSpec="*.kwm") returned 0 [0092.804] lstrlenA (lpString="*.kwm") returned 5 [0092.804] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana.css", pszSpec="*.pwm") returned 0 [0092.804] lstrlenA (lpString="*.pwm") returned 5 [0092.804] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana.css", pszSpec="*.1cd") returned 0 [0092.804] lstrlenA (lpString="*.1cd") returned 5 [0092.804] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana.css", pszSpec="*.md") returned 0 [0092.804] lstrlenA (lpString="*.md") returned 4 [0092.804] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana.css", pszSpec="*.mdf") returned 0 [0092.804] lstrlenA (lpString="*.mdf") returned 5 [0092.804] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana.css", pszSpec="*.dbf") returned 0 [0092.804] lstrlenA (lpString="*.dbf") returned 5 [0092.804] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana.css", pszSpec="*.odt") returned 0 [0092.804] lstrlenA (lpString="*.odt") returned 5 [0092.804] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana.css", pszSpec="*.vob") returned 0 [0092.804] lstrlenA (lpString="*.vob") returned 5 [0092.804] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana.css", pszSpec="*.ifo") returned 0 [0092.804] lstrlenA (lpString="*.ifo") returned 5 [0092.804] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana.css", pszSpec="*.lnk") returned 0 [0092.804] lstrlenA (lpString="*.lnk") returned 5 [0092.804] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana.css", pszSpec="*.torrent") returned 0 [0092.804] lstrlenA (lpString="*.torrent") returned 9 [0092.805] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana.css", pszSpec="*.mov") returned 0 [0092.805] lstrlenA (lpString="*.mov") returned 5 [0092.805] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana.css", pszSpec="*.m2v") returned 0 [0092.805] lstrlenA (lpString="*.m2v") returned 5 [0092.805] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana.css", pszSpec="*.3gp") returned 0 [0092.805] lstrlenA (lpString="*.3gp") returned 5 [0092.805] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana.css", pszSpec="*.mpeg") returned 0 [0092.805] lstrlenA (lpString="*.mpeg") returned 6 [0092.805] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana.css", pszSpec="*.mpg") returned 0 [0092.805] lstrlenA (lpString="*.mpg") returned 5 [0092.805] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana.css", pszSpec="*.flv") returned 0 [0092.805] lstrlenA (lpString="*.flv") returned 5 [0092.805] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana.css", pszSpec="*.avi") returned 0 [0092.805] lstrlenA (lpString="*.avi") returned 5 [0092.805] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana.css", pszSpec="*.mp4") returned 0 [0092.805] lstrlenA (lpString="*.mp4") returned 5 [0092.805] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana.css", pszSpec="*.wmv") returned 0 [0092.805] lstrlenA (lpString="*.wmv") returned 5 [0092.805] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana.css", pszSpec="*.divx") returned 0 [0092.805] lstrlenA (lpString="*.divx") returned 6 [0092.805] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana.css", pszSpec="*.mkv") returned 0 [0092.805] lstrlenA (lpString="*.mkv") returned 5 [0092.805] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana.css", pszSpec="*.mp3") returned 0 [0092.805] lstrlenA (lpString="*.mp3") returned 5 [0092.805] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana.css", pszSpec="*.wav") returned 0 [0092.805] lstrlenA (lpString="*.wav") returned 5 [0092.805] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana.css", pszSpec="*.flac") returned 0 [0092.805] lstrlenA (lpString="*.flac") returned 6 [0092.805] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana.css", pszSpec="*.ape") returned 0 [0092.805] lstrlenA (lpString="*.ape") returned 5 [0092.805] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana.css", pszSpec="*.wma") returned 0 [0092.805] lstrlenA (lpString="*.wma") returned 5 [0092.805] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana.css", pszSpec="*.ac3") returned 0 [0092.805] lstrlenA (lpString="*.ac3") returned 5 [0092.805] FindNextFileA (in: hFindFile=0x5b7d70, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0092.805] lstrcmpA (lpString1=".", lpString2="BabyBlue") returned -1 [0092.805] lstrcmpA (lpString1="..", lpString2="BabyBlue") returned -1 [0092.805] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana.css") returned="Americana.css" [0092.805] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\", lpString2="BabyBlue" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue" [0092.805] lstrlenA (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue") returned 103 [0092.805] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\*.*", lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 0x5c4238 [0092.806] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0092.806] FindNextFileA (in: hFindFile=0x5c4238, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 1 [0092.806] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0092.806] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0092.806] FindNextFileA (in: hFindFile=0x5c4238, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 1 [0092.806] PeekMessageA (in: lpMsg=0xaeb94, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaeb94) returned 0 [0092.806] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BUTTON.GIF") returned 1 [0092.806] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BUTTON.GIF") returned 1 [0092.806] lstrcmpiA (lpString1="", lpString2="BUTTON.GIF") returned -1 [0092.806] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\*.*") returned="*.*" [0092.806] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\", lpString2="BUTTON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\BUTTON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\BUTTON.GIF" [0092.806] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\BUTTON.GIF", pszSpec="*.zip") returned 0 [0092.806] lstrlenA (lpString="*.zip") returned 5 [0092.807] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\BUTTON.GIF", pszSpec="*.rar") returned 0 [0092.807] lstrlenA (lpString="*.rar") returned 5 [0092.807] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\BUTTON.GIF", pszSpec="*.7z") returned 0 [0092.807] lstrlenA (lpString="*.7z") returned 4 [0092.807] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\BUTTON.GIF", pszSpec="*.tar") returned 0 [0092.807] lstrlenA (lpString="*.tar") returned 5 [0092.807] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\BUTTON.GIF", pszSpec="*.gzip") returned 0 [0092.807] lstrlenA (lpString="*.gzip") returned 6 [0092.807] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\BUTTON.GIF", pszSpec="*.jpg") returned 0 [0092.807] lstrlenA (lpString="*.jpg") returned 5 [0092.807] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\BUTTON.GIF", pszSpec="*.jpeg") returned 0 [0092.807] lstrlenA (lpString="*.jpeg") returned 6 [0092.807] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\BUTTON.GIF", pszSpec="*.psd") returned 0 [0092.807] lstrlenA (lpString="*.psd") returned 5 [0092.807] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\BUTTON.GIF", pszSpec="*.cdr") returned 0 [0092.807] lstrlenA (lpString="*.cdr") returned 5 [0092.807] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\BUTTON.GIF", pszSpec="*.dwg") returned 0 [0092.807] lstrlenA (lpString="*.dwg") returned 5 [0092.807] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\BUTTON.GIF", pszSpec="*.max") returned 0 [0092.807] lstrlenA (lpString="*.max") returned 5 [0092.807] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\BUTTON.GIF", pszSpec="*.bmp") returned 0 [0092.807] lstrlenA (lpString="*.bmp") returned 5 [0092.807] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\BUTTON.GIF", pszSpec="*.gif") returned 1 [0092.807] lstrlenA (lpString="*.gif") returned 5 [0092.807] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\BUTTON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\BUTTON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\BUTTON.GIF" [0092.807] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\BUTTON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\BUTTON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\BUTTON.GIF" [0092.807] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\BUTTON.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\BUTTON.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\BUTTON.GIF." [0092.807] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\BUTTON.GIF.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\BUTTON.GIF. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\BUTTON.GIF. " [0092.807] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\BUTTON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\babyblue\\button.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0 [0092.808] GetFileSize (in: hFile=0xa0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb9 [0092.808] GetFileTime (in: hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8f925600, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x528d0030, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8f925600, dwHighDateTime=0x1c747ea)) returned 1 [0092.808] SetFilePointer (in: hFile=0xa0, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0092.808] ReadFile (in: hFile=0xa0, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x5f, lpOverlapped=0x0) returned 1 [0092.808] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\BUTTON.GIF") returned="BUTTON.GIF" [0092.808] SetFilePointer (in: hFile=0xa0, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0092.808] WriteFile (in: hFile=0xa0, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x5f, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x5f, lpOverlapped=0x0) returned 1 [0092.808] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0092.809] CloseHandle (hObject=0xa0) returned 1 [0092.809] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\BUTTON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\babyblue\\button.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\BUTTON.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\babyblue\\button.gif. ")) returned 1 [0092.810] FindNextFileA (in: hFindFile=0x5c4238, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 1 [0092.810] PeekMessageA (in: lpMsg=0xaeb94, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaeb94) returned 0 [0092.810] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="HEADER.GIF") returned -1 [0092.810] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="HEADER.GIF") returned 1 [0092.810] lstrcmpiA (lpString1="", lpString2="HEADER.GIF") returned -1 [0092.810] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\BUTTON.GIF") returned="BUTTON.GIF" [0092.810] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\", lpString2="HEADER.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\HEADER.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\HEADER.GIF" [0092.810] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\HEADER.GIF", pszSpec="*.zip") returned 0 [0092.810] lstrlenA (lpString="*.zip") returned 5 [0092.810] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\HEADER.GIF", pszSpec="*.rar") returned 0 [0092.810] lstrlenA (lpString="*.rar") returned 5 [0092.810] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\HEADER.GIF", pszSpec="*.7z") returned 0 [0092.810] lstrlenA (lpString="*.7z") returned 4 [0092.810] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\HEADER.GIF", pszSpec="*.tar") returned 0 [0092.810] lstrlenA (lpString="*.tar") returned 5 [0092.810] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\HEADER.GIF", pszSpec="*.gzip") returned 0 [0092.810] lstrlenA (lpString="*.gzip") returned 6 [0092.810] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\HEADER.GIF", pszSpec="*.jpg") returned 0 [0092.810] lstrlenA (lpString="*.jpg") returned 5 [0092.810] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\HEADER.GIF", pszSpec="*.jpeg") returned 0 [0092.810] lstrlenA (lpString="*.jpeg") returned 6 [0092.810] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\HEADER.GIF", pszSpec="*.psd") returned 0 [0092.810] lstrlenA (lpString="*.psd") returned 5 [0092.810] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\HEADER.GIF", pszSpec="*.cdr") returned 0 [0092.811] lstrlenA (lpString="*.cdr") returned 5 [0092.811] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\HEADER.GIF", pszSpec="*.dwg") returned 0 [0092.811] lstrlenA (lpString="*.dwg") returned 5 [0092.811] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\HEADER.GIF", pszSpec="*.max") returned 0 [0092.811] lstrlenA (lpString="*.max") returned 5 [0092.811] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\HEADER.GIF", pszSpec="*.bmp") returned 0 [0092.811] lstrlenA (lpString="*.bmp") returned 5 [0092.811] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\HEADER.GIF", pszSpec="*.gif") returned 1 [0092.811] lstrlenA (lpString="*.gif") returned 5 [0092.811] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\HEADER.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\HEADER.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\HEADER.GIF" [0092.811] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\HEADER.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\HEADER.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\HEADER.GIF" [0092.811] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\HEADER.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\HEADER.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\HEADER.GIF." [0092.811] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\HEADER.GIF.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\HEADER.GIF. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\HEADER.GIF. " [0092.811] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\HEADER.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\babyblue\\header.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0 [0092.811] GetFileSize (in: hFile=0xa0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xff [0092.811] GetFileTime (in: hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8f925600, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x618a28b0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8f925600, dwHighDateTime=0x1c747ea)) returned 1 [0092.811] SetFilePointer (in: hFile=0xa0, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0092.811] ReadFile (in: hFile=0xa0, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0xa5, lpOverlapped=0x0) returned 1 [0092.812] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\HEADER.GIF") returned="HEADER.GIF" [0092.812] SetFilePointer (in: hFile=0xa0, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0092.812] WriteFile (in: hFile=0xa0, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0xa5, lpOverlapped=0x0) returned 1 [0092.812] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0092.812] CloseHandle (hObject=0xa0) returned 1 [0092.813] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\HEADER.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\babyblue\\header.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\HEADER.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\babyblue\\header.gif. ")) returned 1 [0092.814] FindNextFileA (in: hFindFile=0x5c4238, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 1 [0092.814] PeekMessageA (in: lpMsg=0xaeb94, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaeb94) returned 0 [0092.814] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="TAB_OFF.GIF") returned -1 [0092.814] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TAB_OFF.GIF") returned -1 [0092.814] lstrcmpiA (lpString1="", lpString2="TAB_OFF.GIF") returned -1 [0092.814] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\HEADER.GIF") returned="HEADER.GIF" [0092.814] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\", lpString2="TAB_OFF.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_OFF.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_OFF.GIF" [0092.814] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_OFF.GIF", pszSpec="*.zip") returned 0 [0092.814] lstrlenA (lpString="*.zip") returned 5 [0092.814] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_OFF.GIF", pszSpec="*.rar") returned 0 [0092.814] lstrlenA (lpString="*.rar") returned 5 [0092.814] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_OFF.GIF", pszSpec="*.7z") returned 0 [0092.814] lstrlenA (lpString="*.7z") returned 4 [0092.814] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_OFF.GIF", pszSpec="*.tar") returned 0 [0092.814] lstrlenA (lpString="*.tar") returned 5 [0092.814] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_OFF.GIF", pszSpec="*.gzip") returned 0 [0092.814] lstrlenA (lpString="*.gzip") returned 6 [0092.814] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_OFF.GIF", pszSpec="*.jpg") returned 0 [0092.814] lstrlenA (lpString="*.jpg") returned 5 [0092.814] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_OFF.GIF", pszSpec="*.jpeg") returned 0 [0092.814] lstrlenA (lpString="*.jpeg") returned 6 [0092.814] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_OFF.GIF", pszSpec="*.psd") returned 0 [0092.814] lstrlenA (lpString="*.psd") returned 5 [0092.814] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_OFF.GIF", pszSpec="*.cdr") returned 0 [0092.814] lstrlenA (lpString="*.cdr") returned 5 [0092.814] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_OFF.GIF", pszSpec="*.dwg") returned 0 [0092.814] lstrlenA (lpString="*.dwg") returned 5 [0092.814] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_OFF.GIF", pszSpec="*.max") returned 0 [0092.814] lstrlenA (lpString="*.max") returned 5 [0092.814] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_OFF.GIF", pszSpec="*.bmp") returned 0 [0092.814] lstrlenA (lpString="*.bmp") returned 5 [0092.814] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_OFF.GIF", pszSpec="*.gif") returned 1 [0092.814] lstrlenA (lpString="*.gif") returned 5 [0092.814] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_OFF.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_OFF.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_OFF.GIF" [0092.814] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_OFF.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_OFF.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_OFF.GIF" [0092.814] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_OFF.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_OFF.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_OFF.GIF." [0092.814] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_OFF.GIF.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_OFF.GIF. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_OFF.GIF. " [0092.814] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\babyblue\\tab_off.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0 [0092.815] GetFileSize (in: hFile=0xa0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x155 [0092.815] GetFileTime (in: hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8f925600, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x618a28b0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8f925600, dwHighDateTime=0x1c747ea)) returned 1 [0092.815] SetFilePointer (in: hFile=0xa0, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0092.815] ReadFile (in: hFile=0xa0, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0xfb, lpOverlapped=0x0) returned 1 [0092.815] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_OFF.GIF") returned="TAB_OFF.GIF" [0092.815] SetFilePointer (in: hFile=0xa0, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0092.815] WriteFile (in: hFile=0xa0, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0xfb, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0xfb, lpOverlapped=0x0) returned 1 [0092.816] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0092.816] CloseHandle (hObject=0xa0) returned 1 [0092.816] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\babyblue\\tab_off.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_OFF.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\babyblue\\tab_off.gif. ")) returned 1 [0092.818] FindNextFileA (in: hFindFile=0x5c4238, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 1 [0092.818] PeekMessageA (in: lpMsg=0xaeb94, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaeb94) returned 0 [0092.818] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="TAB_ON.GIF") returned -1 [0092.818] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TAB_ON.GIF") returned -1 [0092.818] lstrcmpiA (lpString1="", lpString2="TAB_ON.GIF") returned -1 [0092.818] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_OFF.GIF") returned="TAB_OFF.GIF" [0092.818] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\", lpString2="TAB_ON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_ON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_ON.GIF" [0092.818] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_ON.GIF", pszSpec="*.zip") returned 0 [0092.818] lstrlenA (lpString="*.zip") returned 5 [0092.818] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_ON.GIF", pszSpec="*.rar") returned 0 [0092.818] lstrlenA (lpString="*.rar") returned 5 [0092.818] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_ON.GIF", pszSpec="*.7z") returned 0 [0092.818] lstrlenA (lpString="*.7z") returned 4 [0092.818] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_ON.GIF", pszSpec="*.tar") returned 0 [0092.818] lstrlenA (lpString="*.tar") returned 5 [0092.818] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_ON.GIF", pszSpec="*.gzip") returned 0 [0092.818] lstrlenA (lpString="*.gzip") returned 6 [0092.818] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_ON.GIF", pszSpec="*.jpg") returned 0 [0092.818] lstrlenA (lpString="*.jpg") returned 5 [0092.818] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_ON.GIF", pszSpec="*.jpeg") returned 0 [0092.818] lstrlenA (lpString="*.jpeg") returned 6 [0092.818] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_ON.GIF", pszSpec="*.psd") returned 0 [0092.818] lstrlenA (lpString="*.psd") returned 5 [0092.818] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_ON.GIF", pszSpec="*.cdr") returned 0 [0092.818] lstrlenA (lpString="*.cdr") returned 5 [0092.818] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_ON.GIF", pszSpec="*.dwg") returned 0 [0092.818] lstrlenA (lpString="*.dwg") returned 5 [0092.818] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_ON.GIF", pszSpec="*.max") returned 0 [0092.818] lstrlenA (lpString="*.max") returned 5 [0092.818] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_ON.GIF", pszSpec="*.bmp") returned 0 [0092.818] lstrlenA (lpString="*.bmp") returned 5 [0092.818] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_ON.GIF", pszSpec="*.gif") returned 1 [0092.818] lstrlenA (lpString="*.gif") returned 5 [0092.818] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_ON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_ON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_ON.GIF" [0092.818] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_ON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_ON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_ON.GIF" [0092.818] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_ON.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_ON.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_ON.GIF." [0092.818] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_ON.GIF.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_ON.GIF. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_ON.GIF. " [0092.818] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\babyblue\\tab_on.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0 [0092.819] GetFileSize (in: hFile=0xa0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xde [0092.819] GetFileTime (in: hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8f925600, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x528f6190, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8f925600, dwHighDateTime=0x1c747ea)) returned 1 [0092.819] SetFilePointer (in: hFile=0xa0, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0092.819] ReadFile (in: hFile=0xa0, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x84, lpOverlapped=0x0) returned 1 [0092.819] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_ON.GIF") returned="TAB_ON.GIF" [0092.819] SetFilePointer (in: hFile=0xa0, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0092.819] WriteFile (in: hFile=0xa0, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x84, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x84, lpOverlapped=0x0) returned 1 [0092.820] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0092.820] CloseHandle (hObject=0xa0) returned 1 [0092.820] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\babyblue\\tab_on.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_ON.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\babyblue\\tab_on.gif. ")) returned 1 [0092.820] FindNextFileA (in: hFindFile=0x5c4238, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 0 [0092.820] FindClose (in: hFindFile=0x5c4238 | out: hFindFile=0x5c4238) returned 1 [0092.821] FindNextFileA (in: hFindFile=0x5b7d70, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0092.821] PeekMessageA (in: lpMsg=0xaece4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaece4) returned 0 [0092.821] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BabyBlue.css") returned 1 [0092.821] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BabyBlue.css") returned 1 [0092.821] lstrcmpiA (lpString1="", lpString2="BabyBlue.css") returned -1 [0092.821] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\*.*") returned="*.*" [0092.821] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\", lpString2="BabyBlue.css" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue.css") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue.css" [0092.821] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue.css", pszSpec="*.zip") returned 0 [0092.821] lstrlenA (lpString="*.zip") returned 5 [0092.821] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue.css", pszSpec="*.rar") returned 0 [0092.821] lstrlenA (lpString="*.rar") returned 5 [0092.821] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue.css", pszSpec="*.7z") returned 0 [0092.821] lstrlenA (lpString="*.7z") returned 4 [0092.821] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue.css", pszSpec="*.tar") returned 0 [0092.821] lstrlenA (lpString="*.tar") returned 5 [0092.821] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue.css", pszSpec="*.gzip") returned 0 [0092.821] lstrlenA (lpString="*.gzip") returned 6 [0092.821] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue.css", pszSpec="*.jpg") returned 0 [0092.821] lstrlenA (lpString="*.jpg") returned 5 [0092.821] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue.css", pszSpec="*.jpeg") returned 0 [0092.821] lstrlenA (lpString="*.jpeg") returned 6 [0092.821] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue.css", pszSpec="*.psd") returned 0 [0092.821] lstrlenA (lpString="*.psd") returned 5 [0092.821] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue.css", pszSpec="*.cdr") returned 0 [0092.821] lstrlenA (lpString="*.cdr") returned 5 [0092.821] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue.css", pszSpec="*.dwg") returned 0 [0092.821] lstrlenA (lpString="*.dwg") returned 5 [0092.821] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue.css", pszSpec="*.max") returned 0 [0092.821] lstrlenA (lpString="*.max") returned 5 [0092.821] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue.css", pszSpec="*.bmp") returned 0 [0092.821] lstrlenA (lpString="*.bmp") returned 5 [0092.821] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue.css", pszSpec="*.gif") returned 0 [0092.821] lstrlenA (lpString="*.gif") returned 5 [0092.821] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue.css", pszSpec="*.png") returned 0 [0092.821] lstrlenA (lpString="*.png") returned 5 [0092.821] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue.css", pszSpec="*.doc") returned 0 [0092.821] lstrlenA (lpString="*.doc") returned 5 [0092.822] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue.css", pszSpec="*.docx") returned 0 [0092.822] lstrlenA (lpString="*.docx") returned 6 [0092.822] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue.css", pszSpec="*.xls") returned 0 [0092.822] lstrlenA (lpString="*.xls") returned 5 [0092.822] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue.css", pszSpec="*.xlsx") returned 0 [0092.822] lstrlenA (lpString="*.xlsx") returned 6 [0092.822] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue.css", pszSpec="*.ppt") returned 0 [0092.822] lstrlenA (lpString="*.ppt") returned 5 [0092.822] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue.css", pszSpec="*.pptx") returned 0 [0092.822] lstrlenA (lpString="*.pptx") returned 6 [0092.822] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue.css", pszSpec="*.txt") returned 0 [0092.822] lstrlenA (lpString="*.txt") returned 5 [0092.822] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue.css", pszSpec="*.pdf") returned 0 [0092.822] lstrlenA (lpString="*.pdf") returned 5 [0092.822] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue.css", pszSpec="*.djvu") returned 0 [0092.822] lstrlenA (lpString="*.djvu") returned 6 [0092.822] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue.css", pszSpec="*.htm") returned 0 [0092.822] lstrlenA (lpString="*.htm") returned 5 [0092.822] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue.css", pszSpec="*.html") returned 0 [0092.822] lstrlenA (lpString="*.html") returned 6 [0092.822] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue.css", pszSpec="*.mdb") returned 0 [0092.822] lstrlenA (lpString="*.mdb") returned 5 [0092.822] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue.css", pszSpec="*.cer") returned 0 [0092.822] lstrlenA (lpString="*.cer") returned 5 [0092.822] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue.css", pszSpec="*.p12") returned 0 [0092.822] lstrlenA (lpString="*.p12") returned 5 [0092.822] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue.css", pszSpec="*.pfx") returned 0 [0092.822] lstrlenA (lpString="*.pfx") returned 5 [0092.822] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue.css", pszSpec="*.kwm") returned 0 [0092.822] lstrlenA (lpString="*.kwm") returned 5 [0092.822] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue.css", pszSpec="*.pwm") returned 0 [0092.822] lstrlenA (lpString="*.pwm") returned 5 [0092.822] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue.css", pszSpec="*.1cd") returned 0 [0092.822] lstrlenA (lpString="*.1cd") returned 5 [0092.822] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue.css", pszSpec="*.md") returned 0 [0092.822] lstrlenA (lpString="*.md") returned 4 [0092.822] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue.css", pszSpec="*.mdf") returned 0 [0092.822] lstrlenA (lpString="*.mdf") returned 5 [0092.822] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue.css", pszSpec="*.dbf") returned 0 [0092.822] lstrlenA (lpString="*.dbf") returned 5 [0092.822] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue.css", pszSpec="*.odt") returned 0 [0092.822] lstrlenA (lpString="*.odt") returned 5 [0092.822] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue.css", pszSpec="*.vob") returned 0 [0092.822] lstrlenA (lpString="*.vob") returned 5 [0092.822] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue.css", pszSpec="*.ifo") returned 0 [0092.822] lstrlenA (lpString="*.ifo") returned 5 [0092.822] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue.css", pszSpec="*.lnk") returned 0 [0092.822] lstrlenA (lpString="*.lnk") returned 5 [0092.822] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue.css", pszSpec="*.torrent") returned 0 [0092.823] lstrlenA (lpString="*.torrent") returned 9 [0092.823] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue.css", pszSpec="*.mov") returned 0 [0092.823] lstrlenA (lpString="*.mov") returned 5 [0092.823] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue.css", pszSpec="*.m2v") returned 0 [0092.823] lstrlenA (lpString="*.m2v") returned 5 [0092.823] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue.css", pszSpec="*.3gp") returned 0 [0092.823] lstrlenA (lpString="*.3gp") returned 5 [0092.823] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue.css", pszSpec="*.mpeg") returned 0 [0092.823] lstrlenA (lpString="*.mpeg") returned 6 [0092.823] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue.css", pszSpec="*.mpg") returned 0 [0092.823] lstrlenA (lpString="*.mpg") returned 5 [0092.823] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue.css", pszSpec="*.flv") returned 0 [0092.823] lstrlenA (lpString="*.flv") returned 5 [0092.823] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue.css", pszSpec="*.avi") returned 0 [0092.823] lstrlenA (lpString="*.avi") returned 5 [0092.823] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue.css", pszSpec="*.mp4") returned 0 [0092.823] lstrlenA (lpString="*.mp4") returned 5 [0092.823] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue.css", pszSpec="*.wmv") returned 0 [0092.823] lstrlenA (lpString="*.wmv") returned 5 [0092.823] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue.css", pszSpec="*.divx") returned 0 [0092.823] lstrlenA (lpString="*.divx") returned 6 [0092.823] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue.css", pszSpec="*.mkv") returned 0 [0092.823] lstrlenA (lpString="*.mkv") returned 5 [0092.823] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue.css", pszSpec="*.mp3") returned 0 [0092.823] lstrlenA (lpString="*.mp3") returned 5 [0092.823] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue.css", pszSpec="*.wav") returned 0 [0092.823] lstrlenA (lpString="*.wav") returned 5 [0092.823] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue.css", pszSpec="*.flac") returned 0 [0092.823] lstrlenA (lpString="*.flac") returned 6 [0092.823] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue.css", pszSpec="*.ape") returned 0 [0092.823] lstrlenA (lpString="*.ape") returned 5 [0092.823] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue.css", pszSpec="*.wma") returned 0 [0092.823] lstrlenA (lpString="*.wma") returned 5 [0092.823] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue.css", pszSpec="*.ac3") returned 0 [0092.823] lstrlenA (lpString="*.ac3") returned 5 [0092.823] FindNextFileA (in: hFindFile=0x5b7d70, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0092.823] lstrcmpA (lpString1=".", lpString2="Biscay") returned -1 [0092.823] lstrcmpA (lpString1="..", lpString2="Biscay") returned -1 [0092.823] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue.css") returned="BabyBlue.css" [0092.823] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\", lpString2="Biscay" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay" [0092.823] lstrlenA (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay") returned 101 [0092.823] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\*.*", lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 0x5c4238 [0092.828] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0092.828] FindNextFileA (in: hFindFile=0x5c4238, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 1 [0092.828] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0092.828] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0092.828] FindNextFileA (in: hFindFile=0x5c4238, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 1 [0092.828] PeekMessageA (in: lpMsg=0xaeb94, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaeb94) returned 0 [0092.828] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="TAB_OFF.GIF") returned -1 [0092.828] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TAB_OFF.GIF") returned -1 [0092.828] lstrcmpiA (lpString1="", lpString2="TAB_OFF.GIF") returned -1 [0092.828] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\*.*") returned="*.*" [0092.828] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\", lpString2="TAB_OFF.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_OFF.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_OFF.GIF" [0092.828] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_OFF.GIF", pszSpec="*.zip") returned 0 [0092.828] lstrlenA (lpString="*.zip") returned 5 [0092.828] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_OFF.GIF", pszSpec="*.rar") returned 0 [0092.828] lstrlenA (lpString="*.rar") returned 5 [0092.828] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_OFF.GIF", pszSpec="*.7z") returned 0 [0092.828] lstrlenA (lpString="*.7z") returned 4 [0092.828] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_OFF.GIF", pszSpec="*.tar") returned 0 [0092.828] lstrlenA (lpString="*.tar") returned 5 [0092.828] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_OFF.GIF", pszSpec="*.gzip") returned 0 [0092.828] lstrlenA (lpString="*.gzip") returned 6 [0092.828] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_OFF.GIF", pszSpec="*.jpg") returned 0 [0092.828] lstrlenA (lpString="*.jpg") returned 5 [0092.828] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_OFF.GIF", pszSpec="*.jpeg") returned 0 [0092.828] lstrlenA (lpString="*.jpeg") returned 6 [0092.828] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_OFF.GIF", pszSpec="*.psd") returned 0 [0092.828] lstrlenA (lpString="*.psd") returned 5 [0092.828] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_OFF.GIF", pszSpec="*.cdr") returned 0 [0092.828] lstrlenA (lpString="*.cdr") returned 5 [0092.828] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_OFF.GIF", pszSpec="*.dwg") returned 0 [0092.828] lstrlenA (lpString="*.dwg") returned 5 [0092.828] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_OFF.GIF", pszSpec="*.max") returned 0 [0092.828] lstrlenA (lpString="*.max") returned 5 [0092.828] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_OFF.GIF", pszSpec="*.bmp") returned 0 [0092.828] lstrlenA (lpString="*.bmp") returned 5 [0092.828] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_OFF.GIF", pszSpec="*.gif") returned 1 [0092.828] lstrlenA (lpString="*.gif") returned 5 [0092.828] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_OFF.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_OFF.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_OFF.GIF" [0092.828] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_OFF.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_OFF.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_OFF.GIF" [0092.828] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_OFF.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_OFF.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_OFF.GIF." [0092.828] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_OFF.GIF.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_OFF.GIF. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_OFF.GIF. " [0092.828] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\biscay\\tab_off.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0 [0092.829] GetFileSize (in: hFile=0xa0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x155 [0092.829] GetFileTime (in: hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x90c38300, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x528f6190, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x90c38300, dwHighDateTime=0x1c747ea)) returned 1 [0092.829] SetFilePointer (in: hFile=0xa0, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0092.829] ReadFile (in: hFile=0xa0, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0xfb, lpOverlapped=0x0) returned 1 [0092.830] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_OFF.GIF") returned="TAB_OFF.GIF" [0092.830] SetFilePointer (in: hFile=0xa0, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0092.830] WriteFile (in: hFile=0xa0, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0xfb, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0xfb, lpOverlapped=0x0) returned 1 [0092.830] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0092.830] CloseHandle (hObject=0xa0) returned 1 [0092.830] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\biscay\\tab_off.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_OFF.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\biscay\\tab_off.gif. ")) returned 1 [0092.831] FindNextFileA (in: hFindFile=0x5c4238, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 1 [0092.831] PeekMessageA (in: lpMsg=0xaeb94, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaeb94) returned 0 [0092.831] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="TAB_ON.GIF") returned -1 [0092.831] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TAB_ON.GIF") returned -1 [0092.831] lstrcmpiA (lpString1="", lpString2="TAB_ON.GIF") returned -1 [0092.831] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_OFF.GIF") returned="TAB_OFF.GIF" [0092.831] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\", lpString2="TAB_ON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_ON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_ON.GIF" [0092.831] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_ON.GIF", pszSpec="*.zip") returned 0 [0092.831] lstrlenA (lpString="*.zip") returned 5 [0092.831] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_ON.GIF", pszSpec="*.rar") returned 0 [0092.831] lstrlenA (lpString="*.rar") returned 5 [0092.831] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_ON.GIF", pszSpec="*.7z") returned 0 [0092.831] lstrlenA (lpString="*.7z") returned 4 [0092.831] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_ON.GIF", pszSpec="*.tar") returned 0 [0092.831] lstrlenA (lpString="*.tar") returned 5 [0092.831] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_ON.GIF", pszSpec="*.gzip") returned 0 [0092.831] lstrlenA (lpString="*.gzip") returned 6 [0092.831] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_ON.GIF", pszSpec="*.jpg") returned 0 [0092.831] lstrlenA (lpString="*.jpg") returned 5 [0092.831] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_ON.GIF", pszSpec="*.jpeg") returned 0 [0092.831] lstrlenA (lpString="*.jpeg") returned 6 [0092.831] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_ON.GIF", pszSpec="*.psd") returned 0 [0092.831] lstrlenA (lpString="*.psd") returned 5 [0092.831] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_ON.GIF", pszSpec="*.cdr") returned 0 [0092.831] lstrlenA (lpString="*.cdr") returned 5 [0092.831] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_ON.GIF", pszSpec="*.dwg") returned 0 [0092.831] lstrlenA (lpString="*.dwg") returned 5 [0092.831] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_ON.GIF", pszSpec="*.max") returned 0 [0092.831] lstrlenA (lpString="*.max") returned 5 [0092.831] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_ON.GIF", pszSpec="*.bmp") returned 0 [0092.831] lstrlenA (lpString="*.bmp") returned 5 [0092.831] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_ON.GIF", pszSpec="*.gif") returned 1 [0092.831] lstrlenA (lpString="*.gif") returned 5 [0092.831] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_ON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_ON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_ON.GIF" [0092.831] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_ON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_ON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_ON.GIF" [0092.831] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_ON.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_ON.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_ON.GIF." [0092.831] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_ON.GIF.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_ON.GIF. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_ON.GIF. " [0092.831] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\biscay\\tab_on.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0 [0092.832] GetFileSize (in: hFile=0xa0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xde [0092.832] GetFileTime (in: hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x90c38300, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x618a28b0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x90c38300, dwHighDateTime=0x1c747ea)) returned 1 [0092.832] SetFilePointer (in: hFile=0xa0, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0092.832] ReadFile (in: hFile=0xa0, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x84, lpOverlapped=0x0) returned 1 [0092.832] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_ON.GIF") returned="TAB_ON.GIF" [0092.832] SetFilePointer (in: hFile=0xa0, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0092.833] WriteFile (in: hFile=0xa0, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x84, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x84, lpOverlapped=0x0) returned 1 [0092.833] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0092.833] CloseHandle (hObject=0xa0) returned 1 [0092.833] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\biscay\\tab_on.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_ON.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\biscay\\tab_on.gif. ")) returned 1 [0092.833] FindNextFileA (in: hFindFile=0x5c4238, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 0 [0092.833] FindClose (in: hFindFile=0x5c4238 | out: hFindFile=0x5c4238) returned 1 [0092.834] FindNextFileA (in: hFindFile=0x5b7d70, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0092.834] PeekMessageA (in: lpMsg=0xaece4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaece4) returned 0 [0092.834] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Biscay.css") returned 1 [0092.834] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Biscay.css") returned 1 [0092.834] lstrcmpiA (lpString1="", lpString2="Biscay.css") returned -1 [0092.834] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\*.*") returned="*.*" [0092.834] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\", lpString2="Biscay.css" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay.css") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay.css" [0092.834] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay.css", pszSpec="*.zip") returned 0 [0092.834] lstrlenA (lpString="*.zip") returned 5 [0092.834] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay.css", pszSpec="*.rar") returned 0 [0092.834] lstrlenA (lpString="*.rar") returned 5 [0092.834] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay.css", pszSpec="*.7z") returned 0 [0092.834] lstrlenA (lpString="*.7z") returned 4 [0092.834] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay.css", pszSpec="*.tar") returned 0 [0092.834] lstrlenA (lpString="*.tar") returned 5 [0092.834] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay.css", pszSpec="*.gzip") returned 0 [0092.834] lstrlenA (lpString="*.gzip") returned 6 [0092.834] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay.css", pszSpec="*.jpg") returned 0 [0092.834] lstrlenA (lpString="*.jpg") returned 5 [0092.834] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay.css", pszSpec="*.jpeg") returned 0 [0092.834] lstrlenA (lpString="*.jpeg") returned 6 [0092.834] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay.css", pszSpec="*.psd") returned 0 [0092.834] lstrlenA (lpString="*.psd") returned 5 [0092.834] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay.css", pszSpec="*.cdr") returned 0 [0092.834] lstrlenA (lpString="*.cdr") returned 5 [0092.834] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay.css", pszSpec="*.dwg") returned 0 [0092.834] lstrlenA (lpString="*.dwg") returned 5 [0092.834] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay.css", pszSpec="*.max") returned 0 [0092.834] lstrlenA (lpString="*.max") returned 5 [0092.834] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay.css", pszSpec="*.bmp") returned 0 [0092.834] lstrlenA (lpString="*.bmp") returned 5 [0092.834] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay.css", pszSpec="*.gif") returned 0 [0092.834] lstrlenA (lpString="*.gif") returned 5 [0092.834] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay.css", pszSpec="*.png") returned 0 [0092.834] lstrlenA (lpString="*.png") returned 5 [0092.834] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay.css", pszSpec="*.doc") returned 0 [0092.834] lstrlenA (lpString="*.doc") returned 5 [0092.834] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay.css", pszSpec="*.docx") returned 0 [0092.834] lstrlenA (lpString="*.docx") returned 6 [0092.834] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay.css", pszSpec="*.xls") returned 0 [0092.834] lstrlenA (lpString="*.xls") returned 5 [0092.835] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay.css", pszSpec="*.xlsx") returned 0 [0092.835] lstrlenA (lpString="*.xlsx") returned 6 [0092.835] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay.css", pszSpec="*.ppt") returned 0 [0092.835] lstrlenA (lpString="*.ppt") returned 5 [0092.835] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay.css", pszSpec="*.pptx") returned 0 [0092.835] lstrlenA (lpString="*.pptx") returned 6 [0092.835] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay.css", pszSpec="*.txt") returned 0 [0092.835] lstrlenA (lpString="*.txt") returned 5 [0092.835] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay.css", pszSpec="*.pdf") returned 0 [0092.835] lstrlenA (lpString="*.pdf") returned 5 [0092.835] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay.css", pszSpec="*.djvu") returned 0 [0092.835] lstrlenA (lpString="*.djvu") returned 6 [0092.835] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay.css", pszSpec="*.htm") returned 0 [0092.835] lstrlenA (lpString="*.htm") returned 5 [0092.835] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay.css", pszSpec="*.html") returned 0 [0092.835] lstrlenA (lpString="*.html") returned 6 [0092.835] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay.css", pszSpec="*.mdb") returned 0 [0092.835] lstrlenA (lpString="*.mdb") returned 5 [0092.835] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay.css", pszSpec="*.cer") returned 0 [0092.835] lstrlenA (lpString="*.cer") returned 5 [0092.835] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay.css", pszSpec="*.p12") returned 0 [0092.835] lstrlenA (lpString="*.p12") returned 5 [0092.835] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay.css", pszSpec="*.pfx") returned 0 [0092.835] lstrlenA (lpString="*.pfx") returned 5 [0092.835] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay.css", pszSpec="*.kwm") returned 0 [0092.835] lstrlenA (lpString="*.kwm") returned 5 [0092.835] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay.css", pszSpec="*.pwm") returned 0 [0092.835] lstrlenA (lpString="*.pwm") returned 5 [0092.835] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay.css", pszSpec="*.1cd") returned 0 [0092.835] lstrlenA (lpString="*.1cd") returned 5 [0092.835] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay.css", pszSpec="*.md") returned 0 [0092.835] lstrlenA (lpString="*.md") returned 4 [0092.835] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay.css", pszSpec="*.mdf") returned 0 [0092.835] lstrlenA (lpString="*.mdf") returned 5 [0092.835] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay.css", pszSpec="*.dbf") returned 0 [0092.835] lstrlenA (lpString="*.dbf") returned 5 [0092.835] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay.css", pszSpec="*.odt") returned 0 [0092.835] lstrlenA (lpString="*.odt") returned 5 [0092.835] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay.css", pszSpec="*.vob") returned 0 [0092.835] lstrlenA (lpString="*.vob") returned 5 [0092.835] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay.css", pszSpec="*.ifo") returned 0 [0092.835] lstrlenA (lpString="*.ifo") returned 5 [0092.835] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay.css", pszSpec="*.lnk") returned 0 [0092.835] lstrlenA (lpString="*.lnk") returned 5 [0092.835] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay.css", pszSpec="*.torrent") returned 0 [0092.835] lstrlenA (lpString="*.torrent") returned 9 [0092.835] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay.css", pszSpec="*.mov") returned 0 [0092.835] lstrlenA (lpString="*.mov") returned 5 [0092.835] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay.css", pszSpec="*.m2v") returned 0 [0092.835] lstrlenA (lpString="*.m2v") returned 5 [0092.836] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay.css", pszSpec="*.3gp") returned 0 [0092.836] lstrlenA (lpString="*.3gp") returned 5 [0092.836] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay.css", pszSpec="*.mpeg") returned 0 [0092.836] lstrlenA (lpString="*.mpeg") returned 6 [0092.836] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay.css", pszSpec="*.mpg") returned 0 [0092.836] lstrlenA (lpString="*.mpg") returned 5 [0092.836] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay.css", pszSpec="*.flv") returned 0 [0092.836] lstrlenA (lpString="*.flv") returned 5 [0092.836] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay.css", pszSpec="*.avi") returned 0 [0092.836] lstrlenA (lpString="*.avi") returned 5 [0092.836] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay.css", pszSpec="*.mp4") returned 0 [0092.836] lstrlenA (lpString="*.mp4") returned 5 [0092.836] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay.css", pszSpec="*.wmv") returned 0 [0092.836] lstrlenA (lpString="*.wmv") returned 5 [0092.836] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay.css", pszSpec="*.divx") returned 0 [0092.836] lstrlenA (lpString="*.divx") returned 6 [0092.836] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay.css", pszSpec="*.mkv") returned 0 [0092.836] lstrlenA (lpString="*.mkv") returned 5 [0092.836] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay.css", pszSpec="*.mp3") returned 0 [0092.836] lstrlenA (lpString="*.mp3") returned 5 [0092.836] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay.css", pszSpec="*.wav") returned 0 [0092.836] lstrlenA (lpString="*.wav") returned 5 [0092.836] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay.css", pszSpec="*.flac") returned 0 [0092.836] lstrlenA (lpString="*.flac") returned 6 [0092.836] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay.css", pszSpec="*.ape") returned 0 [0092.836] lstrlenA (lpString="*.ape") returned 5 [0092.836] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay.css", pszSpec="*.wma") returned 0 [0092.836] lstrlenA (lpString="*.wma") returned 5 [0092.836] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay.css", pszSpec="*.ac3") returned 0 [0092.836] lstrlenA (lpString="*.ac3") returned 5 [0092.836] FindNextFileA (in: hFindFile=0x5b7d70, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0092.836] lstrcmpA (lpString1=".", lpString2="BrightOrange") returned -1 [0092.836] lstrcmpA (lpString1="..", lpString2="BrightOrange") returned -1 [0092.836] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay.css") returned="Biscay.css" [0092.836] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\", lpString2="BrightOrange" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange" [0092.836] lstrlenA (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange") returned 107 [0092.836] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\*.*", lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 0x5e4278 [0092.837] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0092.837] FindNextFileA (in: hFindFile=0x5e4278, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 1 [0092.837] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0092.837] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0092.837] FindNextFileA (in: hFindFile=0x5e4278, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 1 [0092.837] PeekMessageA (in: lpMsg=0xaeb94, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaeb94) returned 0 [0092.837] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="background.gif") returned 1 [0092.837] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="background.gif") returned 1 [0092.837] lstrcmpiA (lpString1="", lpString2="background.gif") returned -1 [0092.837] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\*.*") returned="*.*" [0092.837] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\", lpString2="background.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\background.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\background.gif" [0092.837] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\background.gif", pszSpec="*.zip") returned 0 [0092.837] lstrlenA (lpString="*.zip") returned 5 [0092.837] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\background.gif", pszSpec="*.rar") returned 0 [0092.837] lstrlenA (lpString="*.rar") returned 5 [0092.837] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\background.gif", pszSpec="*.7z") returned 0 [0092.837] lstrlenA (lpString="*.7z") returned 4 [0092.837] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\background.gif", pszSpec="*.tar") returned 0 [0092.837] lstrlenA (lpString="*.tar") returned 5 [0092.837] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\background.gif", pszSpec="*.gzip") returned 0 [0092.837] lstrlenA (lpString="*.gzip") returned 6 [0092.837] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\background.gif", pszSpec="*.jpg") returned 0 [0092.837] lstrlenA (lpString="*.jpg") returned 5 [0092.837] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\background.gif", pszSpec="*.jpeg") returned 0 [0092.837] lstrlenA (lpString="*.jpeg") returned 6 [0092.837] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\background.gif", pszSpec="*.psd") returned 0 [0092.837] lstrlenA (lpString="*.psd") returned 5 [0092.837] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\background.gif", pszSpec="*.cdr") returned 0 [0092.837] lstrlenA (lpString="*.cdr") returned 5 [0092.837] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\background.gif", pszSpec="*.dwg") returned 0 [0092.837] lstrlenA (lpString="*.dwg") returned 5 [0092.837] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\background.gif", pszSpec="*.max") returned 0 [0092.837] lstrlenA (lpString="*.max") returned 5 [0092.837] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\background.gif", pszSpec="*.bmp") returned 0 [0092.837] lstrlenA (lpString="*.bmp") returned 5 [0092.837] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\background.gif", pszSpec="*.gif") returned 1 [0092.837] lstrlenA (lpString="*.gif") returned 5 [0092.838] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\background.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\background.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\background.gif" [0092.838] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\background.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\background.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\background.gif" [0092.838] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\background.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\background.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\background.gif." [0092.838] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\background.gif.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\background.gif. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\background.gif. " [0092.838] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\background.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\brightorange\\background.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0 [0092.838] GetFileSize (in: hFile=0xa0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x143 [0092.838] GetFileTime (in: hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x90c38300, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x528f6190, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x90c38300, dwHighDateTime=0x1c747ea)) returned 1 [0092.838] SetFilePointer (in: hFile=0xa0, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0092.838] ReadFile (in: hFile=0xa0, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0xe9, lpOverlapped=0x0) returned 1 [0092.839] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\background.gif") returned="background.gif" [0092.839] SetFilePointer (in: hFile=0xa0, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0092.839] WriteFile (in: hFile=0xa0, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0xe9, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0xe9, lpOverlapped=0x0) returned 1 [0092.839] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0092.839] CloseHandle (hObject=0xa0) returned 1 [0092.840] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\background.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\brightorange\\background.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\background.gif. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\brightorange\\background.gif. ")) returned 1 [0092.840] FindNextFileA (in: hFindFile=0x5e4278, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 1 [0092.840] PeekMessageA (in: lpMsg=0xaeb94, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaeb94) returned 0 [0092.840] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="button.gif") returned 1 [0092.840] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="button.gif") returned 1 [0092.840] lstrcmpiA (lpString1="", lpString2="button.gif") returned -1 [0092.840] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\background.gif") returned="background.gif" [0092.840] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\", lpString2="button.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\button.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\button.gif" [0092.841] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\button.gif", pszSpec="*.zip") returned 0 [0092.841] lstrlenA (lpString="*.zip") returned 5 [0092.841] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\button.gif", pszSpec="*.rar") returned 0 [0092.841] lstrlenA (lpString="*.rar") returned 5 [0092.841] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\button.gif", pszSpec="*.7z") returned 0 [0092.841] lstrlenA (lpString="*.7z") returned 4 [0092.841] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\button.gif", pszSpec="*.tar") returned 0 [0092.841] lstrlenA (lpString="*.tar") returned 5 [0092.841] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\button.gif", pszSpec="*.gzip") returned 0 [0092.841] lstrlenA (lpString="*.gzip") returned 6 [0092.841] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\button.gif", pszSpec="*.jpg") returned 0 [0092.841] lstrlenA (lpString="*.jpg") returned 5 [0092.841] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\button.gif", pszSpec="*.jpeg") returned 0 [0092.841] lstrlenA (lpString="*.jpeg") returned 6 [0092.841] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\button.gif", pszSpec="*.psd") returned 0 [0092.841] lstrlenA (lpString="*.psd") returned 5 [0092.841] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\button.gif", pszSpec="*.cdr") returned 0 [0092.841] lstrlenA (lpString="*.cdr") returned 5 [0092.841] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\button.gif", pszSpec="*.dwg") returned 0 [0092.841] lstrlenA (lpString="*.dwg") returned 5 [0092.841] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\button.gif", pszSpec="*.max") returned 0 [0092.841] lstrlenA (lpString="*.max") returned 5 [0092.841] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\button.gif", pszSpec="*.bmp") returned 0 [0092.841] lstrlenA (lpString="*.bmp") returned 5 [0092.841] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\button.gif", pszSpec="*.gif") returned 1 [0092.841] lstrlenA (lpString="*.gif") returned 5 [0092.841] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\button.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\button.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\button.gif" [0092.841] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\button.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\button.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\button.gif" [0092.841] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\button.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\button.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\button.gif." [0092.841] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\button.gif.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\button.gif. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\button.gif. " [0092.841] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\button.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\brightorange\\button.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0 [0092.841] GetFileSize (in: hFile=0xa0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb9 [0092.841] GetFileTime (in: hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x90c38300, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x618a28b0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x90c38300, dwHighDateTime=0x1c747ea)) returned 1 [0092.842] SetFilePointer (in: hFile=0xa0, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0092.842] ReadFile (in: hFile=0xa0, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x5f, lpOverlapped=0x0) returned 1 [0092.842] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\button.gif") returned="button.gif" [0092.842] SetFilePointer (in: hFile=0xa0, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0092.842] WriteFile (in: hFile=0xa0, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x5f, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x5f, lpOverlapped=0x0) returned 1 [0092.842] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0092.842] CloseHandle (hObject=0xa0) returned 1 [0092.843] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\button.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\brightorange\\button.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\button.gif. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\brightorange\\button.gif. ")) returned 1 [0092.869] FindNextFileA (in: hFindFile=0x5e4278, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 1 [0092.869] PeekMessageA (in: lpMsg=0xaeb94, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaeb94) returned 0 [0092.869] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="tab_off.gif") returned -1 [0092.869] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="tab_off.gif") returned -1 [0092.869] lstrcmpiA (lpString1="", lpString2="tab_off.gif") returned -1 [0092.869] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\button.gif") returned="button.gif" [0092.869] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\", lpString2="tab_off.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_off.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_off.gif" [0092.869] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_off.gif", pszSpec="*.zip") returned 0 [0092.869] lstrlenA (lpString="*.zip") returned 5 [0092.869] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_off.gif", pszSpec="*.rar") returned 0 [0092.869] lstrlenA (lpString="*.rar") returned 5 [0092.869] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_off.gif", pszSpec="*.7z") returned 0 [0092.869] lstrlenA (lpString="*.7z") returned 4 [0092.869] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_off.gif", pszSpec="*.tar") returned 0 [0092.869] lstrlenA (lpString="*.tar") returned 5 [0092.869] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_off.gif", pszSpec="*.gzip") returned 0 [0092.869] lstrlenA (lpString="*.gzip") returned 6 [0092.869] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_off.gif", pszSpec="*.jpg") returned 0 [0092.869] lstrlenA (lpString="*.jpg") returned 5 [0092.869] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_off.gif", pszSpec="*.jpeg") returned 0 [0092.869] lstrlenA (lpString="*.jpeg") returned 6 [0092.869] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_off.gif", pszSpec="*.psd") returned 0 [0092.869] lstrlenA (lpString="*.psd") returned 5 [0092.869] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_off.gif", pszSpec="*.cdr") returned 0 [0092.869] lstrlenA (lpString="*.cdr") returned 5 [0092.869] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_off.gif", pszSpec="*.dwg") returned 0 [0092.869] lstrlenA (lpString="*.dwg") returned 5 [0092.869] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_off.gif", pszSpec="*.max") returned 0 [0092.869] lstrlenA (lpString="*.max") returned 5 [0092.869] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_off.gif", pszSpec="*.bmp") returned 0 [0092.869] lstrlenA (lpString="*.bmp") returned 5 [0092.869] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_off.gif", pszSpec="*.gif") returned 1 [0092.869] lstrlenA (lpString="*.gif") returned 5 [0092.869] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_off.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_off.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_off.gif" [0092.869] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_off.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_off.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_off.gif" [0092.870] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_off.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_off.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_off.gif." [0092.870] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_off.gif.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_off.gif. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_off.gif. " [0092.870] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_off.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\brightorange\\tab_off.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0 [0092.876] GetFileSize (in: hFile=0xa0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x155 [0092.876] GetFileTime (in: hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x90c38300, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x528f6190, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x90c38300, dwHighDateTime=0x1c747ea)) returned 1 [0092.876] SetFilePointer (in: hFile=0xa0, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0092.876] ReadFile (in: hFile=0xa0, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0xfb, lpOverlapped=0x0) returned 1 [0092.877] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_off.gif") returned="tab_off.gif" [0092.877] SetFilePointer (in: hFile=0xa0, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0092.877] WriteFile (in: hFile=0xa0, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0xfb, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0xfb, lpOverlapped=0x0) returned 1 [0092.877] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0092.878] CloseHandle (hObject=0xa0) returned 1 [0092.879] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_off.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\brightorange\\tab_off.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_off.gif. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\brightorange\\tab_off.gif. ")) returned 1 [0092.880] FindNextFileA (in: hFindFile=0x5e4278, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 1 [0092.880] PeekMessageA (in: lpMsg=0xaeb94, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaeb94) returned 0 [0092.880] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="tab_on.gif") returned -1 [0092.880] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="tab_on.gif") returned -1 [0092.880] lstrcmpiA (lpString1="", lpString2="tab_on.gif") returned -1 [0092.880] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_off.gif") returned="tab_off.gif" [0092.880] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\", lpString2="tab_on.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_on.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_on.gif" [0092.880] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_on.gif", pszSpec="*.zip") returned 0 [0092.880] lstrlenA (lpString="*.zip") returned 5 [0092.880] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_on.gif", pszSpec="*.rar") returned 0 [0092.880] lstrlenA (lpString="*.rar") returned 5 [0092.880] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_on.gif", pszSpec="*.7z") returned 0 [0092.880] lstrlenA (lpString="*.7z") returned 4 [0092.880] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_on.gif", pszSpec="*.tar") returned 0 [0092.880] lstrlenA (lpString="*.tar") returned 5 [0092.880] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_on.gif", pszSpec="*.gzip") returned 0 [0092.880] lstrlenA (lpString="*.gzip") returned 6 [0092.880] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_on.gif", pszSpec="*.jpg") returned 0 [0092.880] lstrlenA (lpString="*.jpg") returned 5 [0092.880] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_on.gif", pszSpec="*.jpeg") returned 0 [0092.880] lstrlenA (lpString="*.jpeg") returned 6 [0092.880] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_on.gif", pszSpec="*.psd") returned 0 [0092.880] lstrlenA (lpString="*.psd") returned 5 [0092.880] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_on.gif", pszSpec="*.cdr") returned 0 [0092.880] lstrlenA (lpString="*.cdr") returned 5 [0092.880] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_on.gif", pszSpec="*.dwg") returned 0 [0092.880] lstrlenA (lpString="*.dwg") returned 5 [0092.880] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_on.gif", pszSpec="*.max") returned 0 [0092.880] lstrlenA (lpString="*.max") returned 5 [0092.880] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_on.gif", pszSpec="*.bmp") returned 0 [0092.880] lstrlenA (lpString="*.bmp") returned 5 [0092.880] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_on.gif", pszSpec="*.gif") returned 1 [0092.880] lstrlenA (lpString="*.gif") returned 5 [0092.880] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_on.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_on.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_on.gif" [0092.881] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_on.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_on.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_on.gif" [0092.881] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_on.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_on.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_on.gif." [0092.881] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_on.gif.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_on.gif. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_on.gif. " [0092.881] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_on.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\brightorange\\tab_on.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0 [0092.881] GetFileSize (in: hFile=0xa0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xde [0092.881] GetFileTime (in: hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x90c38300, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x618a28b0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x90c38300, dwHighDateTime=0x1c747ea)) returned 1 [0092.881] SetFilePointer (in: hFile=0xa0, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0092.881] ReadFile (in: hFile=0xa0, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x84, lpOverlapped=0x0) returned 1 [0092.882] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_on.gif") returned="tab_on.gif" [0092.882] SetFilePointer (in: hFile=0xa0, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0092.882] WriteFile (in: hFile=0xa0, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x84, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x84, lpOverlapped=0x0) returned 1 [0092.882] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0092.882] CloseHandle (hObject=0xa0) returned 1 [0092.882] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_on.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\brightorange\\tab_on.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_on.gif. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\brightorange\\tab_on.gif. ")) returned 1 [0092.883] FindNextFileA (in: hFindFile=0x5e4278, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 0 [0092.883] FindClose (in: hFindFile=0x5e4278 | out: hFindFile=0x5e4278) returned 1 [0092.883] FindNextFileA (in: hFindFile=0x5b7d70, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0092.884] PeekMessageA (in: lpMsg=0xaece4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaece4) returned 0 [0092.884] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BrightOrange.css") returned 1 [0092.884] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BrightOrange.css") returned 1 [0092.884] lstrcmpiA (lpString1="", lpString2="BrightOrange.css") returned -1 [0092.884] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\*.*") returned="*.*" [0092.884] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\", lpString2="BrightOrange.css" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange.css") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange.css" [0092.884] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange.css", pszSpec="*.zip") returned 0 [0092.884] lstrlenA (lpString="*.zip") returned 5 [0092.884] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange.css", pszSpec="*.rar") returned 0 [0092.884] lstrlenA (lpString="*.rar") returned 5 [0092.884] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange.css", pszSpec="*.7z") returned 0 [0092.884] lstrlenA (lpString="*.7z") returned 4 [0092.884] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange.css", pszSpec="*.tar") returned 0 [0092.884] lstrlenA (lpString="*.tar") returned 5 [0092.884] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange.css", pszSpec="*.gzip") returned 0 [0092.884] lstrlenA (lpString="*.gzip") returned 6 [0092.884] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange.css", pszSpec="*.jpg") returned 0 [0092.884] lstrlenA (lpString="*.jpg") returned 5 [0092.884] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange.css", pszSpec="*.jpeg") returned 0 [0092.884] lstrlenA (lpString="*.jpeg") returned 6 [0092.884] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange.css", pszSpec="*.psd") returned 0 [0092.884] lstrlenA (lpString="*.psd") returned 5 [0092.884] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange.css", pszSpec="*.cdr") returned 0 [0092.884] lstrlenA (lpString="*.cdr") returned 5 [0092.884] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange.css", pszSpec="*.dwg") returned 0 [0092.884] lstrlenA (lpString="*.dwg") returned 5 [0092.884] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange.css", pszSpec="*.max") returned 0 [0092.884] lstrlenA (lpString="*.max") returned 5 [0092.884] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange.css", pszSpec="*.bmp") returned 0 [0092.884] lstrlenA (lpString="*.bmp") returned 5 [0092.884] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange.css", pszSpec="*.gif") returned 0 [0092.884] lstrlenA (lpString="*.gif") returned 5 [0092.884] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange.css", pszSpec="*.png") returned 0 [0092.884] lstrlenA (lpString="*.png") returned 5 [0092.884] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange.css", pszSpec="*.doc") returned 0 [0092.884] lstrlenA (lpString="*.doc") returned 5 [0092.884] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange.css", pszSpec="*.docx") returned 0 [0092.884] lstrlenA (lpString="*.docx") returned 6 [0092.884] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange.css", pszSpec="*.xls") returned 0 [0092.884] lstrlenA (lpString="*.xls") returned 5 [0092.884] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange.css", pszSpec="*.xlsx") returned 0 [0092.884] lstrlenA (lpString="*.xlsx") returned 6 [0092.884] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange.css", pszSpec="*.ppt") returned 0 [0092.885] lstrlenA (lpString="*.ppt") returned 5 [0092.885] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange.css", pszSpec="*.pptx") returned 0 [0092.885] lstrlenA (lpString="*.pptx") returned 6 [0092.885] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange.css", pszSpec="*.txt") returned 0 [0092.885] lstrlenA (lpString="*.txt") returned 5 [0092.885] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange.css", pszSpec="*.pdf") returned 0 [0092.885] lstrlenA (lpString="*.pdf") returned 5 [0092.885] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange.css", pszSpec="*.djvu") returned 0 [0092.885] lstrlenA (lpString="*.djvu") returned 6 [0092.885] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange.css", pszSpec="*.htm") returned 0 [0092.885] lstrlenA (lpString="*.htm") returned 5 [0092.885] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange.css", pszSpec="*.html") returned 0 [0092.885] lstrlenA (lpString="*.html") returned 6 [0092.885] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange.css", pszSpec="*.mdb") returned 0 [0092.885] lstrlenA (lpString="*.mdb") returned 5 [0092.885] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange.css", pszSpec="*.cer") returned 0 [0092.885] lstrlenA (lpString="*.cer") returned 5 [0092.885] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange.css", pszSpec="*.p12") returned 0 [0092.885] lstrlenA (lpString="*.p12") returned 5 [0092.885] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange.css", pszSpec="*.pfx") returned 0 [0092.885] lstrlenA (lpString="*.pfx") returned 5 [0092.885] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange.css", pszSpec="*.kwm") returned 0 [0092.885] lstrlenA (lpString="*.kwm") returned 5 [0092.885] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange.css", pszSpec="*.pwm") returned 0 [0092.885] lstrlenA (lpString="*.pwm") returned 5 [0092.885] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange.css", pszSpec="*.1cd") returned 0 [0092.885] lstrlenA (lpString="*.1cd") returned 5 [0092.885] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange.css", pszSpec="*.md") returned 0 [0092.885] lstrlenA (lpString="*.md") returned 4 [0092.885] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange.css", pszSpec="*.mdf") returned 0 [0092.885] lstrlenA (lpString="*.mdf") returned 5 [0092.885] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange.css", pszSpec="*.dbf") returned 0 [0092.885] lstrlenA (lpString="*.dbf") returned 5 [0092.885] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange.css", pszSpec="*.odt") returned 0 [0092.885] lstrlenA (lpString="*.odt") returned 5 [0092.885] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange.css", pszSpec="*.vob") returned 0 [0092.885] lstrlenA (lpString="*.vob") returned 5 [0092.885] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange.css", pszSpec="*.ifo") returned 0 [0092.885] lstrlenA (lpString="*.ifo") returned 5 [0092.885] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange.css", pszSpec="*.lnk") returned 0 [0092.886] lstrlenA (lpString="*.lnk") returned 5 [0092.886] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange.css", pszSpec="*.torrent") returned 0 [0092.886] lstrlenA (lpString="*.torrent") returned 9 [0092.886] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange.css", pszSpec="*.mov") returned 0 [0092.886] lstrlenA (lpString="*.mov") returned 5 [0092.886] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange.css", pszSpec="*.m2v") returned 0 [0092.886] lstrlenA (lpString="*.m2v") returned 5 [0092.886] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange.css", pszSpec="*.3gp") returned 0 [0092.886] lstrlenA (lpString="*.3gp") returned 5 [0092.886] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange.css", pszSpec="*.mpeg") returned 0 [0092.886] lstrlenA (lpString="*.mpeg") returned 6 [0092.886] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange.css", pszSpec="*.mpg") returned 0 [0092.886] lstrlenA (lpString="*.mpg") returned 5 [0092.886] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange.css", pszSpec="*.flv") returned 0 [0092.886] lstrlenA (lpString="*.flv") returned 5 [0092.886] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange.css", pszSpec="*.avi") returned 0 [0092.886] lstrlenA (lpString="*.avi") returned 5 [0092.886] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange.css", pszSpec="*.mp4") returned 0 [0092.886] lstrlenA (lpString="*.mp4") returned 5 [0092.886] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange.css", pszSpec="*.wmv") returned 0 [0092.886] lstrlenA (lpString="*.wmv") returned 5 [0092.886] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange.css", pszSpec="*.divx") returned 0 [0092.886] lstrlenA (lpString="*.divx") returned 6 [0092.886] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange.css", pszSpec="*.mkv") returned 0 [0092.886] lstrlenA (lpString="*.mkv") returned 5 [0092.886] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange.css", pszSpec="*.mp3") returned 0 [0092.886] lstrlenA (lpString="*.mp3") returned 5 [0092.886] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange.css", pszSpec="*.wav") returned 0 [0092.886] lstrlenA (lpString="*.wav") returned 5 [0092.886] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange.css", pszSpec="*.flac") returned 0 [0092.886] lstrlenA (lpString="*.flac") returned 6 [0092.886] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange.css", pszSpec="*.ape") returned 0 [0092.886] lstrlenA (lpString="*.ape") returned 5 [0092.886] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange.css", pszSpec="*.wma") returned 0 [0092.886] lstrlenA (lpString="*.wma") returned 5 [0092.886] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange.css", pszSpec="*.ac3") returned 0 [0092.886] lstrlenA (lpString="*.ac3") returned 5 [0092.886] FindNextFileA (in: hFindFile=0x5b7d70, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0092.886] lstrcmpA (lpString1=".", lpString2="BrightYellow") returned -1 [0092.886] lstrcmpA (lpString1="..", lpString2="BrightYellow") returned -1 [0092.886] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange.css") returned="BrightOrange.css" [0092.886] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\", lpString2="BrightYellow" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow" [0092.887] lstrlenA (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow") returned 107 [0092.887] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\*.*", lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 0x5e4278 [0092.887] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0092.887] FindNextFileA (in: hFindFile=0x5e4278, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 1 [0092.887] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0092.887] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0092.887] FindNextFileA (in: hFindFile=0x5e4278, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 1 [0092.887] PeekMessageA (in: lpMsg=0xaeb94, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaeb94) returned 0 [0092.887] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="HEADER.GIF") returned -1 [0092.887] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="HEADER.GIF") returned 1 [0092.887] lstrcmpiA (lpString1="", lpString2="HEADER.GIF") returned -1 [0092.887] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\*.*") returned="*.*" [0092.887] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\", lpString2="HEADER.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\HEADER.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\HEADER.GIF" [0092.887] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\HEADER.GIF", pszSpec="*.zip") returned 0 [0092.887] lstrlenA (lpString="*.zip") returned 5 [0092.887] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\HEADER.GIF", pszSpec="*.rar") returned 0 [0092.887] lstrlenA (lpString="*.rar") returned 5 [0092.887] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\HEADER.GIF", pszSpec="*.7z") returned 0 [0092.887] lstrlenA (lpString="*.7z") returned 4 [0092.887] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\HEADER.GIF", pszSpec="*.tar") returned 0 [0092.887] lstrlenA (lpString="*.tar") returned 5 [0092.887] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\HEADER.GIF", pszSpec="*.gzip") returned 0 [0092.887] lstrlenA (lpString="*.gzip") returned 6 [0092.887] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\HEADER.GIF", pszSpec="*.jpg") returned 0 [0092.887] lstrlenA (lpString="*.jpg") returned 5 [0092.887] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\HEADER.GIF", pszSpec="*.jpeg") returned 0 [0092.887] lstrlenA (lpString="*.jpeg") returned 6 [0092.887] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\HEADER.GIF", pszSpec="*.psd") returned 0 [0092.887] lstrlenA (lpString="*.psd") returned 5 [0092.887] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\HEADER.GIF", pszSpec="*.cdr") returned 0 [0092.887] lstrlenA (lpString="*.cdr") returned 5 [0092.887] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\HEADER.GIF", pszSpec="*.dwg") returned 0 [0092.887] lstrlenA (lpString="*.dwg") returned 5 [0092.887] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\HEADER.GIF", pszSpec="*.max") returned 0 [0092.887] lstrlenA (lpString="*.max") returned 5 [0092.887] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\HEADER.GIF", pszSpec="*.bmp") returned 0 [0092.888] lstrlenA (lpString="*.bmp") returned 5 [0092.888] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\HEADER.GIF", pszSpec="*.gif") returned 1 [0092.888] lstrlenA (lpString="*.gif") returned 5 [0092.888] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\HEADER.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\HEADER.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\HEADER.GIF" [0092.888] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\HEADER.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\HEADER.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\HEADER.GIF" [0092.888] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\HEADER.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\HEADER.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\HEADER.GIF." [0092.888] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\HEADER.GIF.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\HEADER.GIF. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\HEADER.GIF. " [0092.888] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\HEADER.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\brightyellow\\header.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0 [0092.889] GetFileSize (in: hFile=0xa0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x16f [0092.889] GetFileTime (in: hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x90c38300, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x618a28b0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x90c38300, dwHighDateTime=0x1c747ea)) returned 1 [0092.889] SetFilePointer (in: hFile=0xa0, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0092.889] ReadFile (in: hFile=0xa0, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x115, lpOverlapped=0x0) returned 1 [0092.890] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\HEADER.GIF") returned="HEADER.GIF" [0092.890] SetFilePointer (in: hFile=0xa0, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0092.890] WriteFile (in: hFile=0xa0, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x115, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x115, lpOverlapped=0x0) returned 1 [0092.890] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0092.890] CloseHandle (hObject=0xa0) returned 1 [0092.891] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\HEADER.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\brightyellow\\header.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\HEADER.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\brightyellow\\header.gif. ")) returned 1 [0092.891] FindNextFileA (in: hFindFile=0x5e4278, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 1 [0092.891] PeekMessageA (in: lpMsg=0xaeb94, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaeb94) returned 0 [0092.891] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="TAB_OFF.GIF") returned -1 [0092.892] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TAB_OFF.GIF") returned -1 [0092.892] lstrcmpiA (lpString1="", lpString2="TAB_OFF.GIF") returned -1 [0092.892] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\HEADER.GIF") returned="HEADER.GIF" [0092.892] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\", lpString2="TAB_OFF.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_OFF.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_OFF.GIF" [0092.892] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_OFF.GIF", pszSpec="*.zip") returned 0 [0092.892] lstrlenA (lpString="*.zip") returned 5 [0092.892] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_OFF.GIF", pszSpec="*.rar") returned 0 [0092.892] lstrlenA (lpString="*.rar") returned 5 [0092.892] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_OFF.GIF", pszSpec="*.7z") returned 0 [0092.892] lstrlenA (lpString="*.7z") returned 4 [0092.892] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_OFF.GIF", pszSpec="*.tar") returned 0 [0092.892] lstrlenA (lpString="*.tar") returned 5 [0092.892] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_OFF.GIF", pszSpec="*.gzip") returned 0 [0092.892] lstrlenA (lpString="*.gzip") returned 6 [0092.892] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_OFF.GIF", pszSpec="*.jpg") returned 0 [0092.892] lstrlenA (lpString="*.jpg") returned 5 [0092.892] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_OFF.GIF", pszSpec="*.jpeg") returned 0 [0092.892] lstrlenA (lpString="*.jpeg") returned 6 [0092.892] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_OFF.GIF", pszSpec="*.psd") returned 0 [0092.892] lstrlenA (lpString="*.psd") returned 5 [0092.892] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_OFF.GIF", pszSpec="*.cdr") returned 0 [0092.892] lstrlenA (lpString="*.cdr") returned 5 [0092.892] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_OFF.GIF", pszSpec="*.dwg") returned 0 [0092.892] lstrlenA (lpString="*.dwg") returned 5 [0092.892] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_OFF.GIF", pszSpec="*.max") returned 0 [0092.892] lstrlenA (lpString="*.max") returned 5 [0092.892] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_OFF.GIF", pszSpec="*.bmp") returned 0 [0092.892] lstrlenA (lpString="*.bmp") returned 5 [0092.892] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_OFF.GIF", pszSpec="*.gif") returned 1 [0092.892] lstrlenA (lpString="*.gif") returned 5 [0092.892] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_OFF.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_OFF.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_OFF.GIF" [0092.892] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_OFF.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_OFF.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_OFF.GIF" [0092.892] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_OFF.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_OFF.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_OFF.GIF." [0092.892] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_OFF.GIF.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_OFF.GIF. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_OFF.GIF. " [0092.892] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\brightyellow\\tab_off.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0 [0092.893] GetFileSize (in: hFile=0xa0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x155 [0092.893] GetFileTime (in: hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x90c38300, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x528f6190, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x90c38300, dwHighDateTime=0x1c747ea)) returned 1 [0092.893] SetFilePointer (in: hFile=0xa0, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0092.893] ReadFile (in: hFile=0xa0, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0xfb, lpOverlapped=0x0) returned 1 [0092.893] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_OFF.GIF") returned="TAB_OFF.GIF" [0092.893] SetFilePointer (in: hFile=0xa0, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0092.894] WriteFile (in: hFile=0xa0, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0xfb, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0xfb, lpOverlapped=0x0) returned 1 [0092.894] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0092.894] CloseHandle (hObject=0xa0) returned 1 [0092.894] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\brightyellow\\tab_off.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_OFF.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\brightyellow\\tab_off.gif. ")) returned 1 [0092.894] FindNextFileA (in: hFindFile=0x5e4278, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 1 [0092.894] PeekMessageA (in: lpMsg=0xaeb94, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaeb94) returned 0 [0092.894] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="TAB_ON.GIF") returned -1 [0092.894] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TAB_ON.GIF") returned -1 [0092.895] lstrcmpiA (lpString1="", lpString2="TAB_ON.GIF") returned -1 [0092.895] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_OFF.GIF") returned="TAB_OFF.GIF" [0092.895] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\", lpString2="TAB_ON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_ON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_ON.GIF" [0092.895] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_ON.GIF", pszSpec="*.zip") returned 0 [0092.895] lstrlenA (lpString="*.zip") returned 5 [0092.895] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_ON.GIF", pszSpec="*.rar") returned 0 [0092.895] lstrlenA (lpString="*.rar") returned 5 [0092.895] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_ON.GIF", pszSpec="*.7z") returned 0 [0092.895] lstrlenA (lpString="*.7z") returned 4 [0092.895] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_ON.GIF", pszSpec="*.tar") returned 0 [0092.895] lstrlenA (lpString="*.tar") returned 5 [0092.895] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_ON.GIF", pszSpec="*.gzip") returned 0 [0092.895] lstrlenA (lpString="*.gzip") returned 6 [0092.895] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_ON.GIF", pszSpec="*.jpg") returned 0 [0092.895] lstrlenA (lpString="*.jpg") returned 5 [0092.895] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_ON.GIF", pszSpec="*.jpeg") returned 0 [0092.895] lstrlenA (lpString="*.jpeg") returned 6 [0092.895] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_ON.GIF", pszSpec="*.psd") returned 0 [0092.895] lstrlenA (lpString="*.psd") returned 5 [0092.895] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_ON.GIF", pszSpec="*.cdr") returned 0 [0092.895] lstrlenA (lpString="*.cdr") returned 5 [0092.895] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_ON.GIF", pszSpec="*.dwg") returned 0 [0092.895] lstrlenA (lpString="*.dwg") returned 5 [0092.895] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_ON.GIF", pszSpec="*.max") returned 0 [0092.895] lstrlenA (lpString="*.max") returned 5 [0092.895] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_ON.GIF", pszSpec="*.bmp") returned 0 [0092.895] lstrlenA (lpString="*.bmp") returned 5 [0092.895] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_ON.GIF", pszSpec="*.gif") returned 1 [0092.895] lstrlenA (lpString="*.gif") returned 5 [0092.895] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_ON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_ON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_ON.GIF" [0092.895] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_ON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_ON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_ON.GIF" [0092.895] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_ON.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_ON.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_ON.GIF." [0092.895] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_ON.GIF.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_ON.GIF. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_ON.GIF. " [0092.895] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\brightyellow\\tab_on.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0 [0092.896] GetFileSize (in: hFile=0xa0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xde [0092.896] GetFileTime (in: hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x90c38300, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x528f6190, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x90c38300, dwHighDateTime=0x1c747ea)) returned 1 [0092.896] SetFilePointer (in: hFile=0xa0, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0092.896] ReadFile (in: hFile=0xa0, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x84, lpOverlapped=0x0) returned 1 [0092.896] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_ON.GIF") returned="TAB_ON.GIF" [0092.896] SetFilePointer (in: hFile=0xa0, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0092.896] WriteFile (in: hFile=0xa0, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x84, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x84, lpOverlapped=0x0) returned 1 [0092.896] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0092.897] CloseHandle (hObject=0xa0) returned 1 [0092.897] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\brightyellow\\tab_on.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_ON.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\brightyellow\\tab_on.gif. ")) returned 1 [0092.924] FindNextFileA (in: hFindFile=0x5e4278, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 0 [0092.924] FindClose (in: hFindFile=0x5e4278 | out: hFindFile=0x5e4278) returned 1 [0092.924] FindNextFileA (in: hFindFile=0x5b7d70, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0092.924] PeekMessageA (in: lpMsg=0xaece4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaece4) returned 0 [0092.924] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BrightYellow.css") returned 1 [0092.924] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BrightYellow.css") returned 1 [0092.924] lstrcmpiA (lpString1="", lpString2="BrightYellow.css") returned -1 [0092.924] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\*.*") returned="*.*" [0092.924] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\", lpString2="BrightYellow.css" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow.css") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow.css" [0092.924] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow.css", pszSpec="*.zip") returned 0 [0092.924] lstrlenA (lpString="*.zip") returned 5 [0092.924] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow.css", pszSpec="*.rar") returned 0 [0092.924] lstrlenA (lpString="*.rar") returned 5 [0092.924] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow.css", pszSpec="*.7z") returned 0 [0092.924] lstrlenA (lpString="*.7z") returned 4 [0092.924] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow.css", pszSpec="*.tar") returned 0 [0092.924] lstrlenA (lpString="*.tar") returned 5 [0092.924] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow.css", pszSpec="*.gzip") returned 0 [0092.924] lstrlenA (lpString="*.gzip") returned 6 [0092.924] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow.css", pszSpec="*.jpg") returned 0 [0092.924] lstrlenA (lpString="*.jpg") returned 5 [0092.924] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow.css", pszSpec="*.jpeg") returned 0 [0092.924] lstrlenA (lpString="*.jpeg") returned 6 [0092.924] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow.css", pszSpec="*.psd") returned 0 [0092.924] lstrlenA (lpString="*.psd") returned 5 [0092.924] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow.css", pszSpec="*.cdr") returned 0 [0092.924] lstrlenA (lpString="*.cdr") returned 5 [0092.924] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow.css", pszSpec="*.dwg") returned 0 [0092.924] lstrlenA (lpString="*.dwg") returned 5 [0092.924] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow.css", pszSpec="*.max") returned 0 [0092.924] lstrlenA (lpString="*.max") returned 5 [0092.925] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow.css", pszSpec="*.bmp") returned 0 [0092.925] lstrlenA (lpString="*.bmp") returned 5 [0092.925] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow.css", pszSpec="*.gif") returned 0 [0092.925] lstrlenA (lpString="*.gif") returned 5 [0092.925] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow.css", pszSpec="*.png") returned 0 [0092.925] lstrlenA (lpString="*.png") returned 5 [0092.925] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow.css", pszSpec="*.doc") returned 0 [0092.925] lstrlenA (lpString="*.doc") returned 5 [0092.925] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow.css", pszSpec="*.docx") returned 0 [0092.925] lstrlenA (lpString="*.docx") returned 6 [0092.925] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow.css", pszSpec="*.xls") returned 0 [0092.925] lstrlenA (lpString="*.xls") returned 5 [0092.925] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow.css", pszSpec="*.xlsx") returned 0 [0092.925] lstrlenA (lpString="*.xlsx") returned 6 [0092.925] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow.css", pszSpec="*.ppt") returned 0 [0092.925] lstrlenA (lpString="*.ppt") returned 5 [0092.925] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow.css", pszSpec="*.pptx") returned 0 [0092.925] lstrlenA (lpString="*.pptx") returned 6 [0092.925] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow.css", pszSpec="*.txt") returned 0 [0092.925] lstrlenA (lpString="*.txt") returned 5 [0092.925] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow.css", pszSpec="*.pdf") returned 0 [0092.925] lstrlenA (lpString="*.pdf") returned 5 [0092.925] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow.css", pszSpec="*.djvu") returned 0 [0092.925] lstrlenA (lpString="*.djvu") returned 6 [0092.925] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow.css", pszSpec="*.htm") returned 0 [0092.925] lstrlenA (lpString="*.htm") returned 5 [0092.925] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow.css", pszSpec="*.html") returned 0 [0092.925] lstrlenA (lpString="*.html") returned 6 [0092.925] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow.css", pszSpec="*.mdb") returned 0 [0092.925] lstrlenA (lpString="*.mdb") returned 5 [0092.925] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow.css", pszSpec="*.cer") returned 0 [0092.925] lstrlenA (lpString="*.cer") returned 5 [0092.925] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow.css", pszSpec="*.p12") returned 0 [0092.925] lstrlenA (lpString="*.p12") returned 5 [0092.925] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow.css", pszSpec="*.pfx") returned 0 [0092.925] lstrlenA (lpString="*.pfx") returned 5 [0092.925] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow.css", pszSpec="*.kwm") returned 0 [0092.925] lstrlenA (lpString="*.kwm") returned 5 [0092.925] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow.css", pszSpec="*.pwm") returned 0 [0092.925] lstrlenA (lpString="*.pwm") returned 5 [0092.925] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow.css", pszSpec="*.1cd") returned 0 [0092.926] lstrlenA (lpString="*.1cd") returned 5 [0092.926] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow.css", pszSpec="*.md") returned 0 [0092.926] lstrlenA (lpString="*.md") returned 4 [0092.926] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow.css", pszSpec="*.mdf") returned 0 [0092.926] lstrlenA (lpString="*.mdf") returned 5 [0092.926] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow.css", pszSpec="*.dbf") returned 0 [0092.926] lstrlenA (lpString="*.dbf") returned 5 [0092.926] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow.css", pszSpec="*.odt") returned 0 [0092.926] lstrlenA (lpString="*.odt") returned 5 [0092.926] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow.css", pszSpec="*.vob") returned 0 [0092.926] lstrlenA (lpString="*.vob") returned 5 [0092.926] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow.css", pszSpec="*.ifo") returned 0 [0092.926] lstrlenA (lpString="*.ifo") returned 5 [0092.926] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow.css", pszSpec="*.lnk") returned 0 [0092.926] lstrlenA (lpString="*.lnk") returned 5 [0092.926] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow.css", pszSpec="*.torrent") returned 0 [0092.926] lstrlenA (lpString="*.torrent") returned 9 [0092.926] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow.css", pszSpec="*.mov") returned 0 [0092.926] lstrlenA (lpString="*.mov") returned 5 [0092.926] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow.css", pszSpec="*.m2v") returned 0 [0092.926] lstrlenA (lpString="*.m2v") returned 5 [0092.926] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow.css", pszSpec="*.3gp") returned 0 [0092.926] lstrlenA (lpString="*.3gp") returned 5 [0092.926] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow.css", pszSpec="*.mpeg") returned 0 [0092.926] lstrlenA (lpString="*.mpeg") returned 6 [0092.926] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow.css", pszSpec="*.mpg") returned 0 [0092.926] lstrlenA (lpString="*.mpg") returned 5 [0092.926] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow.css", pszSpec="*.flv") returned 0 [0092.926] lstrlenA (lpString="*.flv") returned 5 [0092.926] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow.css", pszSpec="*.avi") returned 0 [0092.926] lstrlenA (lpString="*.avi") returned 5 [0092.926] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow.css", pszSpec="*.mp4") returned 0 [0092.926] lstrlenA (lpString="*.mp4") returned 5 [0092.926] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow.css", pszSpec="*.wmv") returned 0 [0092.926] lstrlenA (lpString="*.wmv") returned 5 [0092.926] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow.css", pszSpec="*.divx") returned 0 [0092.926] lstrlenA (lpString="*.divx") returned 6 [0092.926] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow.css", pszSpec="*.mkv") returned 0 [0092.926] lstrlenA (lpString="*.mkv") returned 5 [0092.926] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow.css", pszSpec="*.mp3") returned 0 [0092.926] lstrlenA (lpString="*.mp3") returned 5 [0092.926] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow.css", pszSpec="*.wav") returned 0 [0092.927] lstrlenA (lpString="*.wav") returned 5 [0092.927] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow.css", pszSpec="*.flac") returned 0 [0092.927] lstrlenA (lpString="*.flac") returned 6 [0092.927] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow.css", pszSpec="*.ape") returned 0 [0092.927] lstrlenA (lpString="*.ape") returned 5 [0092.927] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow.css", pszSpec="*.wma") returned 0 [0092.927] lstrlenA (lpString="*.wma") returned 5 [0092.927] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow.css", pszSpec="*.ac3") returned 0 [0092.927] lstrlenA (lpString="*.ac3") returned 5 [0092.927] FindNextFileA (in: hFindFile=0x5b7d70, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0092.927] PeekMessageA (in: lpMsg=0xaece4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaece4) returned 0 [0092.927] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Casual.css") returned 1 [0092.927] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Casual.css") returned 1 [0092.927] lstrcmpiA (lpString1="", lpString2="Casual.css") returned -1 [0092.927] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow.css") returned="BrightYellow.css" [0092.927] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\", lpString2="Casual.css" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Casual.css") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Casual.css" [0092.927] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Casual.css", pszSpec="*.zip") returned 0 [0092.927] lstrlenA (lpString="*.zip") returned 5 [0092.927] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Casual.css", pszSpec="*.rar") returned 0 [0092.927] lstrlenA (lpString="*.rar") returned 5 [0092.927] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Casual.css", pszSpec="*.7z") returned 0 [0092.927] lstrlenA (lpString="*.7z") returned 4 [0092.927] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Casual.css", pszSpec="*.tar") returned 0 [0092.927] lstrlenA (lpString="*.tar") returned 5 [0092.927] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Casual.css", pszSpec="*.gzip") returned 0 [0092.927] lstrlenA (lpString="*.gzip") returned 6 [0092.927] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Casual.css", pszSpec="*.jpg") returned 0 [0092.927] lstrlenA (lpString="*.jpg") returned 5 [0092.927] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Casual.css", pszSpec="*.jpeg") returned 0 [0092.927] lstrlenA (lpString="*.jpeg") returned 6 [0092.927] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Casual.css", pszSpec="*.psd") returned 0 [0092.927] lstrlenA (lpString="*.psd") returned 5 [0092.927] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Casual.css", pszSpec="*.cdr") returned 0 [0092.927] lstrlenA (lpString="*.cdr") returned 5 [0092.927] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Casual.css", pszSpec="*.dwg") returned 0 [0092.927] lstrlenA (lpString="*.dwg") returned 5 [0092.927] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Casual.css", pszSpec="*.max") returned 0 [0092.927] lstrlenA (lpString="*.max") returned 5 [0092.927] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Casual.css", pszSpec="*.bmp") returned 0 [0092.927] lstrlenA (lpString="*.bmp") returned 5 [0092.927] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Casual.css", pszSpec="*.gif") returned 0 [0092.927] lstrlenA (lpString="*.gif") returned 5 [0092.927] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Casual.css", pszSpec="*.png") returned 0 [0092.927] lstrlenA (lpString="*.png") returned 5 [0092.928] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Casual.css", pszSpec="*.doc") returned 0 [0092.928] lstrlenA (lpString="*.doc") returned 5 [0092.928] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Casual.css", pszSpec="*.docx") returned 0 [0092.928] lstrlenA (lpString="*.docx") returned 6 [0092.928] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Casual.css", pszSpec="*.xls") returned 0 [0092.928] lstrlenA (lpString="*.xls") returned 5 [0092.928] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Casual.css", pszSpec="*.xlsx") returned 0 [0092.928] lstrlenA (lpString="*.xlsx") returned 6 [0092.928] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Casual.css", pszSpec="*.ppt") returned 0 [0092.928] lstrlenA (lpString="*.ppt") returned 5 [0092.928] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Casual.css", pszSpec="*.pptx") returned 0 [0092.928] lstrlenA (lpString="*.pptx") returned 6 [0092.928] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Casual.css", pszSpec="*.txt") returned 0 [0092.928] lstrlenA (lpString="*.txt") returned 5 [0092.928] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Casual.css", pszSpec="*.pdf") returned 0 [0092.928] lstrlenA (lpString="*.pdf") returned 5 [0092.928] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Casual.css", pszSpec="*.djvu") returned 0 [0092.928] lstrlenA (lpString="*.djvu") returned 6 [0092.928] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Casual.css", pszSpec="*.htm") returned 0 [0092.928] lstrlenA (lpString="*.htm") returned 5 [0092.928] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Casual.css", pszSpec="*.html") returned 0 [0092.928] lstrlenA (lpString="*.html") returned 6 [0092.928] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Casual.css", pszSpec="*.mdb") returned 0 [0092.928] lstrlenA (lpString="*.mdb") returned 5 [0092.928] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Casual.css", pszSpec="*.cer") returned 0 [0092.928] lstrlenA (lpString="*.cer") returned 5 [0092.928] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Casual.css", pszSpec="*.p12") returned 0 [0092.928] lstrlenA (lpString="*.p12") returned 5 [0092.928] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Casual.css", pszSpec="*.pfx") returned 0 [0092.928] lstrlenA (lpString="*.pfx") returned 5 [0092.928] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Casual.css", pszSpec="*.kwm") returned 0 [0092.928] lstrlenA (lpString="*.kwm") returned 5 [0092.928] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Casual.css", pszSpec="*.pwm") returned 0 [0092.928] lstrlenA (lpString="*.pwm") returned 5 [0092.928] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Casual.css", pszSpec="*.1cd") returned 0 [0092.928] lstrlenA (lpString="*.1cd") returned 5 [0092.928] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Casual.css", pszSpec="*.md") returned 0 [0092.928] lstrlenA (lpString="*.md") returned 4 [0092.928] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Casual.css", pszSpec="*.mdf") returned 0 [0092.928] lstrlenA (lpString="*.mdf") returned 5 [0092.928] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Casual.css", pszSpec="*.dbf") returned 0 [0092.928] lstrlenA (lpString="*.dbf") returned 5 [0092.928] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Casual.css", pszSpec="*.odt") returned 0 [0092.928] lstrlenA (lpString="*.odt") returned 5 [0092.928] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Casual.css", pszSpec="*.vob") returned 0 [0092.929] lstrlenA (lpString="*.vob") returned 5 [0092.929] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Casual.css", pszSpec="*.ifo") returned 0 [0092.929] lstrlenA (lpString="*.ifo") returned 5 [0092.929] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Casual.css", pszSpec="*.lnk") returned 0 [0092.929] lstrlenA (lpString="*.lnk") returned 5 [0092.929] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Casual.css", pszSpec="*.torrent") returned 0 [0092.929] lstrlenA (lpString="*.torrent") returned 9 [0092.929] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Casual.css", pszSpec="*.mov") returned 0 [0092.929] lstrlenA (lpString="*.mov") returned 5 [0092.929] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Casual.css", pszSpec="*.m2v") returned 0 [0092.929] lstrlenA (lpString="*.m2v") returned 5 [0092.929] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Casual.css", pszSpec="*.3gp") returned 0 [0092.929] lstrlenA (lpString="*.3gp") returned 5 [0092.929] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Casual.css", pszSpec="*.mpeg") returned 0 [0092.929] lstrlenA (lpString="*.mpeg") returned 6 [0092.929] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Casual.css", pszSpec="*.mpg") returned 0 [0092.929] lstrlenA (lpString="*.mpg") returned 5 [0092.929] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Casual.css", pszSpec="*.flv") returned 0 [0092.929] lstrlenA (lpString="*.flv") returned 5 [0092.929] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Casual.css", pszSpec="*.avi") returned 0 [0092.929] lstrlenA (lpString="*.avi") returned 5 [0092.929] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Casual.css", pszSpec="*.mp4") returned 0 [0092.929] lstrlenA (lpString="*.mp4") returned 5 [0092.929] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Casual.css", pszSpec="*.wmv") returned 0 [0092.929] lstrlenA (lpString="*.wmv") returned 5 [0092.929] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Casual.css", pszSpec="*.divx") returned 0 [0092.929] lstrlenA (lpString="*.divx") returned 6 [0092.929] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Casual.css", pszSpec="*.mkv") returned 0 [0092.929] lstrlenA (lpString="*.mkv") returned 5 [0092.929] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Casual.css", pszSpec="*.mp3") returned 0 [0092.929] lstrlenA (lpString="*.mp3") returned 5 [0092.929] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Casual.css", pszSpec="*.wav") returned 0 [0092.929] lstrlenA (lpString="*.wav") returned 5 [0092.929] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Casual.css", pszSpec="*.flac") returned 0 [0092.929] lstrlenA (lpString="*.flac") returned 6 [0092.929] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Casual.css", pszSpec="*.ape") returned 0 [0092.929] lstrlenA (lpString="*.ape") returned 5 [0092.929] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Casual.css", pszSpec="*.wma") returned 0 [0092.929] lstrlenA (lpString="*.wma") returned 5 [0092.929] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Casual.css", pszSpec="*.ac3") returned 0 [0092.929] lstrlenA (lpString="*.ac3") returned 5 [0092.929] FindNextFileA (in: hFindFile=0x5b7d70, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0092.929] PeekMessageA (in: lpMsg=0xaece4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaece4) returned 0 [0092.929] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Country.css") returned 1 [0092.929] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Country.css") returned 1 [0092.929] lstrcmpiA (lpString1="", lpString2="Country.css") returned -1 [0092.929] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Casual.css") returned="Casual.css" [0092.929] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\", lpString2="Country.css" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Country.css") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Country.css" [0092.929] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Country.css", pszSpec="*.zip") returned 0 [0092.930] lstrlenA (lpString="*.zip") returned 5 [0092.930] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Country.css", pszSpec="*.rar") returned 0 [0092.930] lstrlenA (lpString="*.rar") returned 5 [0092.930] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Country.css", pszSpec="*.7z") returned 0 [0092.930] lstrlenA (lpString="*.7z") returned 4 [0092.930] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Country.css", pszSpec="*.tar") returned 0 [0092.930] lstrlenA (lpString="*.tar") returned 5 [0092.930] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Country.css", pszSpec="*.gzip") returned 0 [0092.930] lstrlenA (lpString="*.gzip") returned 6 [0092.930] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Country.css", pszSpec="*.jpg") returned 0 [0092.930] lstrlenA (lpString="*.jpg") returned 5 [0092.930] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Country.css", pszSpec="*.jpeg") returned 0 [0092.930] lstrlenA (lpString="*.jpeg") returned 6 [0092.930] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Country.css", pszSpec="*.psd") returned 0 [0092.930] lstrlenA (lpString="*.psd") returned 5 [0092.930] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Country.css", pszSpec="*.cdr") returned 0 [0092.930] lstrlenA (lpString="*.cdr") returned 5 [0092.930] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Country.css", pszSpec="*.dwg") returned 0 [0092.930] lstrlenA (lpString="*.dwg") returned 5 [0092.930] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Country.css", pszSpec="*.max") returned 0 [0092.930] lstrlenA (lpString="*.max") returned 5 [0092.930] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Country.css", pszSpec="*.bmp") returned 0 [0092.930] lstrlenA (lpString="*.bmp") returned 5 [0092.930] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Country.css", pszSpec="*.gif") returned 0 [0092.930] lstrlenA (lpString="*.gif") returned 5 [0092.930] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Country.css", pszSpec="*.png") returned 0 [0092.930] lstrlenA (lpString="*.png") returned 5 [0092.930] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Country.css", pszSpec="*.doc") returned 0 [0092.930] lstrlenA (lpString="*.doc") returned 5 [0092.930] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Country.css", pszSpec="*.docx") returned 0 [0092.930] lstrlenA (lpString="*.docx") returned 6 [0092.930] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Country.css", pszSpec="*.xls") returned 0 [0092.930] lstrlenA (lpString="*.xls") returned 5 [0092.930] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Country.css", pszSpec="*.xlsx") returned 0 [0092.930] lstrlenA (lpString="*.xlsx") returned 6 [0092.930] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Country.css", pszSpec="*.ppt") returned 0 [0092.930] lstrlenA (lpString="*.ppt") returned 5 [0092.930] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Country.css", pszSpec="*.pptx") returned 0 [0092.930] lstrlenA (lpString="*.pptx") returned 6 [0092.930] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Country.css", pszSpec="*.txt") returned 0 [0092.930] lstrlenA (lpString="*.txt") returned 5 [0092.930] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Country.css", pszSpec="*.pdf") returned 0 [0092.930] lstrlenA (lpString="*.pdf") returned 5 [0092.930] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Country.css", pszSpec="*.djvu") returned 0 [0092.930] lstrlenA (lpString="*.djvu") returned 6 [0092.930] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Country.css", pszSpec="*.htm") returned 0 [0092.931] lstrlenA (lpString="*.htm") returned 5 [0092.931] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Country.css", pszSpec="*.html") returned 0 [0092.931] lstrlenA (lpString="*.html") returned 6 [0092.931] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Country.css", pszSpec="*.mdb") returned 0 [0092.931] lstrlenA (lpString="*.mdb") returned 5 [0092.931] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Country.css", pszSpec="*.cer") returned 0 [0092.931] lstrlenA (lpString="*.cer") returned 5 [0092.931] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Country.css", pszSpec="*.p12") returned 0 [0092.931] lstrlenA (lpString="*.p12") returned 5 [0092.931] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Country.css", pszSpec="*.pfx") returned 0 [0092.931] lstrlenA (lpString="*.pfx") returned 5 [0092.931] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Country.css", pszSpec="*.kwm") returned 0 [0092.931] lstrlenA (lpString="*.kwm") returned 5 [0092.931] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Country.css", pszSpec="*.pwm") returned 0 [0092.931] lstrlenA (lpString="*.pwm") returned 5 [0092.931] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Country.css", pszSpec="*.1cd") returned 0 [0092.931] lstrlenA (lpString="*.1cd") returned 5 [0092.931] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Country.css", pszSpec="*.md") returned 0 [0092.931] lstrlenA (lpString="*.md") returned 4 [0092.931] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Country.css", pszSpec="*.mdf") returned 0 [0092.931] lstrlenA (lpString="*.mdf") returned 5 [0092.931] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Country.css", pszSpec="*.dbf") returned 0 [0092.931] lstrlenA (lpString="*.dbf") returned 5 [0092.931] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Country.css", pszSpec="*.odt") returned 0 [0092.931] lstrlenA (lpString="*.odt") returned 5 [0092.931] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Country.css", pszSpec="*.vob") returned 0 [0092.931] lstrlenA (lpString="*.vob") returned 5 [0092.931] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Country.css", pszSpec="*.ifo") returned 0 [0092.931] lstrlenA (lpString="*.ifo") returned 5 [0092.931] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Country.css", pszSpec="*.lnk") returned 0 [0092.931] lstrlenA (lpString="*.lnk") returned 5 [0092.931] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Country.css", pszSpec="*.torrent") returned 0 [0092.931] lstrlenA (lpString="*.torrent") returned 9 [0092.931] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Country.css", pszSpec="*.mov") returned 0 [0092.931] lstrlenA (lpString="*.mov") returned 5 [0092.931] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Country.css", pszSpec="*.m2v") returned 0 [0092.931] lstrlenA (lpString="*.m2v") returned 5 [0092.931] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Country.css", pszSpec="*.3gp") returned 0 [0092.931] lstrlenA (lpString="*.3gp") returned 5 [0092.931] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Country.css", pszSpec="*.mpeg") returned 0 [0092.931] lstrlenA (lpString="*.mpeg") returned 6 [0092.931] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Country.css", pszSpec="*.mpg") returned 0 [0092.931] lstrlenA (lpString="*.mpg") returned 5 [0092.931] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Country.css", pszSpec="*.flv") returned 0 [0092.931] lstrlenA (lpString="*.flv") returned 5 [0092.931] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Country.css", pszSpec="*.avi") returned 0 [0092.931] lstrlenA (lpString="*.avi") returned 5 [0092.931] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Country.css", pszSpec="*.mp4") returned 0 [0092.931] lstrlenA (lpString="*.mp4") returned 5 [0092.931] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Country.css", pszSpec="*.wmv") returned 0 [0092.932] lstrlenA (lpString="*.wmv") returned 5 [0092.932] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Country.css", pszSpec="*.divx") returned 0 [0092.932] lstrlenA (lpString="*.divx") returned 6 [0092.932] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Country.css", pszSpec="*.mkv") returned 0 [0092.932] lstrlenA (lpString="*.mkv") returned 5 [0092.932] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Country.css", pszSpec="*.mp3") returned 0 [0092.932] lstrlenA (lpString="*.mp3") returned 5 [0092.932] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Country.css", pszSpec="*.wav") returned 0 [0092.932] lstrlenA (lpString="*.wav") returned 5 [0092.932] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Country.css", pszSpec="*.flac") returned 0 [0092.932] lstrlenA (lpString="*.flac") returned 6 [0092.932] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Country.css", pszSpec="*.ape") returned 0 [0092.932] lstrlenA (lpString="*.ape") returned 5 [0092.932] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Country.css", pszSpec="*.wma") returned 0 [0092.932] lstrlenA (lpString="*.wma") returned 5 [0092.932] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Country.css", pszSpec="*.ac3") returned 0 [0092.932] lstrlenA (lpString="*.ac3") returned 5 [0092.932] FindNextFileA (in: hFindFile=0x5b7d70, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0092.932] lstrcmpA (lpString1=".", lpString2="Desert") returned -1 [0092.932] lstrcmpA (lpString1="..", lpString2="Desert") returned -1 [0092.932] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Country.css") returned="Country.css" [0092.932] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\", lpString2="Desert" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert" [0092.932] lstrlenA (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert") returned 101 [0092.932] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\*.*", lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 0x5c4238 [0092.933] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0092.933] FindNextFileA (in: hFindFile=0x5c4238, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 1 [0092.933] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0092.933] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0092.933] FindNextFileA (in: hFindFile=0x5c4238, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 1 [0092.933] PeekMessageA (in: lpMsg=0xaeb94, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaeb94) returned 0 [0092.933] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="HEADER.GIF") returned -1 [0092.933] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="HEADER.GIF") returned 1 [0092.933] lstrcmpiA (lpString1="", lpString2="HEADER.GIF") returned -1 [0092.933] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\*.*") returned="*.*" [0092.933] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\", lpString2="HEADER.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\HEADER.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\HEADER.GIF" [0092.933] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\HEADER.GIF", pszSpec="*.zip") returned 0 [0092.933] lstrlenA (lpString="*.zip") returned 5 [0092.933] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\HEADER.GIF", pszSpec="*.rar") returned 0 [0092.933] lstrlenA (lpString="*.rar") returned 5 [0092.933] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\HEADER.GIF", pszSpec="*.7z") returned 0 [0092.933] lstrlenA (lpString="*.7z") returned 4 [0092.934] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\HEADER.GIF", pszSpec="*.tar") returned 0 [0092.934] lstrlenA (lpString="*.tar") returned 5 [0092.934] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\HEADER.GIF", pszSpec="*.gzip") returned 0 [0092.934] lstrlenA (lpString="*.gzip") returned 6 [0092.934] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\HEADER.GIF", pszSpec="*.jpg") returned 0 [0092.934] lstrlenA (lpString="*.jpg") returned 5 [0092.934] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\HEADER.GIF", pszSpec="*.jpeg") returned 0 [0092.934] lstrlenA (lpString="*.jpeg") returned 6 [0092.934] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\HEADER.GIF", pszSpec="*.psd") returned 0 [0092.934] lstrlenA (lpString="*.psd") returned 5 [0092.934] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\HEADER.GIF", pszSpec="*.cdr") returned 0 [0092.934] lstrlenA (lpString="*.cdr") returned 5 [0092.934] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\HEADER.GIF", pszSpec="*.dwg") returned 0 [0092.934] lstrlenA (lpString="*.dwg") returned 5 [0092.934] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\HEADER.GIF", pszSpec="*.max") returned 0 [0092.934] lstrlenA (lpString="*.max") returned 5 [0092.934] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\HEADER.GIF", pszSpec="*.bmp") returned 0 [0092.934] lstrlenA (lpString="*.bmp") returned 5 [0092.934] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\HEADER.GIF", pszSpec="*.gif") returned 1 [0092.934] lstrlenA (lpString="*.gif") returned 5 [0092.934] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\HEADER.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\HEADER.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\HEADER.GIF" [0092.934] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\HEADER.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\HEADER.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\HEADER.GIF" [0092.934] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\HEADER.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\HEADER.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\HEADER.GIF." [0092.934] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\HEADER.GIF.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\HEADER.GIF. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\HEADER.GIF. " [0092.934] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\HEADER.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\desert\\header.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0 [0092.935] GetFileSize (in: hFile=0xa0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x94 [0092.935] GetFileTime (in: hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x91f4b000, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x618a28b0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x91f4b000, dwHighDateTime=0x1c747ea)) returned 1 [0092.935] SetFilePointer (in: hFile=0xa0, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0092.935] ReadFile (in: hFile=0xa0, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x3a, lpOverlapped=0x0) returned 1 [0092.935] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\HEADER.GIF") returned="HEADER.GIF" [0092.935] SetFilePointer (in: hFile=0xa0, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0092.935] WriteFile (in: hFile=0xa0, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x3a, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x3a, lpOverlapped=0x0) returned 1 [0092.935] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0092.936] CloseHandle (hObject=0xa0) returned 1 [0092.936] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\HEADER.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\desert\\header.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\HEADER.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\desert\\header.gif. ")) returned 1 [0092.937] FindNextFileA (in: hFindFile=0x5c4238, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 1 [0092.937] PeekMessageA (in: lpMsg=0xaeb94, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaeb94) returned 0 [0092.937] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="TAB_OFF.GIF") returned -1 [0092.937] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TAB_OFF.GIF") returned -1 [0092.937] lstrcmpiA (lpString1="", lpString2="TAB_OFF.GIF") returned -1 [0092.937] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\HEADER.GIF") returned="HEADER.GIF" [0092.937] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\", lpString2="TAB_OFF.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_OFF.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_OFF.GIF" [0092.937] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_OFF.GIF", pszSpec="*.zip") returned 0 [0092.937] lstrlenA (lpString="*.zip") returned 5 [0092.937] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_OFF.GIF", pszSpec="*.rar") returned 0 [0092.937] lstrlenA (lpString="*.rar") returned 5 [0092.937] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_OFF.GIF", pszSpec="*.7z") returned 0 [0092.937] lstrlenA (lpString="*.7z") returned 4 [0092.937] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_OFF.GIF", pszSpec="*.tar") returned 0 [0092.937] lstrlenA (lpString="*.tar") returned 5 [0092.937] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_OFF.GIF", pszSpec="*.gzip") returned 0 [0092.937] lstrlenA (lpString="*.gzip") returned 6 [0092.937] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_OFF.GIF", pszSpec="*.jpg") returned 0 [0092.937] lstrlenA (lpString="*.jpg") returned 5 [0092.937] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_OFF.GIF", pszSpec="*.jpeg") returned 0 [0092.937] lstrlenA (lpString="*.jpeg") returned 6 [0092.937] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_OFF.GIF", pszSpec="*.psd") returned 0 [0092.937] lstrlenA (lpString="*.psd") returned 5 [0092.938] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_OFF.GIF", pszSpec="*.cdr") returned 0 [0092.938] lstrlenA (lpString="*.cdr") returned 5 [0092.938] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_OFF.GIF", pszSpec="*.dwg") returned 0 [0092.938] lstrlenA (lpString="*.dwg") returned 5 [0092.938] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_OFF.GIF", pszSpec="*.max") returned 0 [0092.938] lstrlenA (lpString="*.max") returned 5 [0092.938] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_OFF.GIF", pszSpec="*.bmp") returned 0 [0092.938] lstrlenA (lpString="*.bmp") returned 5 [0092.938] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_OFF.GIF", pszSpec="*.gif") returned 1 [0092.938] lstrlenA (lpString="*.gif") returned 5 [0092.938] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_OFF.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_OFF.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_OFF.GIF" [0092.938] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_OFF.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_OFF.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_OFF.GIF" [0092.938] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_OFF.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_OFF.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_OFF.GIF." [0092.938] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_OFF.GIF.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_OFF.GIF. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_OFF.GIF. " [0092.938] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\desert\\tab_off.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0 [0092.938] GetFileSize (in: hFile=0xa0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1f0 [0092.938] GetFileTime (in: hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x91f4b000, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x528f6190, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x91f4b000, dwHighDateTime=0x1c747ea)) returned 1 [0092.938] SetFilePointer (in: hFile=0xa0, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0092.938] ReadFile (in: hFile=0xa0, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x196, lpOverlapped=0x0) returned 1 [0092.939] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_OFF.GIF") returned="TAB_OFF.GIF" [0092.939] SetFilePointer (in: hFile=0xa0, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0092.939] WriteFile (in: hFile=0xa0, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x196, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x196, lpOverlapped=0x0) returned 1 [0092.939] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0092.939] CloseHandle (hObject=0xa0) returned 1 [0092.940] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\desert\\tab_off.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_OFF.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\desert\\tab_off.gif. ")) returned 1 [0092.940] FindNextFileA (in: hFindFile=0x5c4238, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 1 [0092.940] PeekMessageA (in: lpMsg=0xaeb94, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaeb94) returned 0 [0092.940] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="TAB_ON.GIF") returned -1 [0092.940] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TAB_ON.GIF") returned -1 [0092.940] lstrcmpiA (lpString1="", lpString2="TAB_ON.GIF") returned -1 [0092.940] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_OFF.GIF") returned="TAB_OFF.GIF" [0092.940] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\", lpString2="TAB_ON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_ON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_ON.GIF" [0092.940] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_ON.GIF", pszSpec="*.zip") returned 0 [0092.940] lstrlenA (lpString="*.zip") returned 5 [0092.940] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_ON.GIF", pszSpec="*.rar") returned 0 [0092.940] lstrlenA (lpString="*.rar") returned 5 [0092.940] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_ON.GIF", pszSpec="*.7z") returned 0 [0092.941] lstrlenA (lpString="*.7z") returned 4 [0092.941] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_ON.GIF", pszSpec="*.tar") returned 0 [0092.941] lstrlenA (lpString="*.tar") returned 5 [0092.941] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_ON.GIF", pszSpec="*.gzip") returned 0 [0092.941] lstrlenA (lpString="*.gzip") returned 6 [0092.941] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_ON.GIF", pszSpec="*.jpg") returned 0 [0092.941] lstrlenA (lpString="*.jpg") returned 5 [0092.941] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_ON.GIF", pszSpec="*.jpeg") returned 0 [0092.941] lstrlenA (lpString="*.jpeg") returned 6 [0092.941] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_ON.GIF", pszSpec="*.psd") returned 0 [0092.941] lstrlenA (lpString="*.psd") returned 5 [0092.941] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_ON.GIF", pszSpec="*.cdr") returned 0 [0092.941] lstrlenA (lpString="*.cdr") returned 5 [0092.941] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_ON.GIF", pszSpec="*.dwg") returned 0 [0092.941] lstrlenA (lpString="*.dwg") returned 5 [0092.941] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_ON.GIF", pszSpec="*.max") returned 0 [0092.941] lstrlenA (lpString="*.max") returned 5 [0092.941] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_ON.GIF", pszSpec="*.bmp") returned 0 [0092.941] lstrlenA (lpString="*.bmp") returned 5 [0092.941] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_ON.GIF", pszSpec="*.gif") returned 1 [0092.941] lstrlenA (lpString="*.gif") returned 5 [0092.941] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_ON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_ON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_ON.GIF" [0092.941] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_ON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_ON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_ON.GIF" [0092.941] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_ON.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_ON.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_ON.GIF." [0092.941] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_ON.GIF.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_ON.GIF. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_ON.GIF. " [0092.941] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\desert\\tab_on.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0 [0092.941] GetFileSize (in: hFile=0xa0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x401 [0092.941] GetFileTime (in: hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x91f4b000, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x618a28b0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x91f4b000, dwHighDateTime=0x1c747ea)) returned 1 [0092.941] SetFilePointer (in: hFile=0xa0, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0092.941] ReadFile (in: hFile=0xa0, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x3a7, lpOverlapped=0x0) returned 1 [0092.959] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_ON.GIF") returned="TAB_ON.GIF" [0092.959] SetFilePointer (in: hFile=0xa0, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0092.959] WriteFile (in: hFile=0xa0, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x3a7, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x3a7, lpOverlapped=0x0) returned 1 [0092.959] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0092.959] CloseHandle (hObject=0xa0) returned 1 [0092.960] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\desert\\tab_on.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_ON.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\desert\\tab_on.gif. ")) returned 1 [0092.961] FindNextFileA (in: hFindFile=0x5c4238, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 0 [0092.961] FindClose (in: hFindFile=0x5c4238 | out: hFindFile=0x5c4238) returned 1 [0092.961] FindNextFileA (in: hFindFile=0x5b7d70, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0092.961] PeekMessageA (in: lpMsg=0xaece4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaece4) returned 0 [0092.961] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Desert.css") returned 1 [0092.961] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Desert.css") returned 1 [0092.961] lstrcmpiA (lpString1="", lpString2="Desert.css") returned -1 [0092.961] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\*.*") returned="*.*" [0092.961] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\", lpString2="Desert.css" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert.css") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert.css" [0092.961] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert.css", pszSpec="*.zip") returned 0 [0092.961] lstrlenA (lpString="*.zip") returned 5 [0092.961] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert.css", pszSpec="*.rar") returned 0 [0092.962] lstrlenA (lpString="*.rar") returned 5 [0092.962] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert.css", pszSpec="*.7z") returned 0 [0092.962] lstrlenA (lpString="*.7z") returned 4 [0092.962] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert.css", pszSpec="*.tar") returned 0 [0092.962] lstrlenA (lpString="*.tar") returned 5 [0092.962] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert.css", pszSpec="*.gzip") returned 0 [0092.962] lstrlenA (lpString="*.gzip") returned 6 [0092.962] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert.css", pszSpec="*.jpg") returned 0 [0092.962] lstrlenA (lpString="*.jpg") returned 5 [0092.962] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert.css", pszSpec="*.jpeg") returned 0 [0092.962] lstrlenA (lpString="*.jpeg") returned 6 [0092.962] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert.css", pszSpec="*.psd") returned 0 [0092.962] lstrlenA (lpString="*.psd") returned 5 [0092.962] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert.css", pszSpec="*.cdr") returned 0 [0092.962] lstrlenA (lpString="*.cdr") returned 5 [0092.962] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert.css", pszSpec="*.dwg") returned 0 [0092.962] lstrlenA (lpString="*.dwg") returned 5 [0092.962] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert.css", pszSpec="*.max") returned 0 [0092.962] lstrlenA (lpString="*.max") returned 5 [0092.962] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert.css", pszSpec="*.bmp") returned 0 [0092.962] lstrlenA (lpString="*.bmp") returned 5 [0092.962] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert.css", pszSpec="*.gif") returned 0 [0092.962] lstrlenA (lpString="*.gif") returned 5 [0092.962] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert.css", pszSpec="*.png") returned 0 [0092.962] lstrlenA (lpString="*.png") returned 5 [0092.962] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert.css", pszSpec="*.doc") returned 0 [0092.962] lstrlenA (lpString="*.doc") returned 5 [0092.962] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert.css", pszSpec="*.docx") returned 0 [0092.962] lstrlenA (lpString="*.docx") returned 6 [0092.962] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert.css", pszSpec="*.xls") returned 0 [0092.962] lstrlenA (lpString="*.xls") returned 5 [0092.962] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert.css", pszSpec="*.xlsx") returned 0 [0092.962] lstrlenA (lpString="*.xlsx") returned 6 [0092.962] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert.css", pszSpec="*.ppt") returned 0 [0092.962] lstrlenA (lpString="*.ppt") returned 5 [0092.962] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert.css", pszSpec="*.pptx") returned 0 [0092.962] lstrlenA (lpString="*.pptx") returned 6 [0092.962] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert.css", pszSpec="*.txt") returned 0 [0092.962] lstrlenA (lpString="*.txt") returned 5 [0092.962] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert.css", pszSpec="*.pdf") returned 0 [0092.962] lstrlenA (lpString="*.pdf") returned 5 [0092.962] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert.css", pszSpec="*.djvu") returned 0 [0092.962] lstrlenA (lpString="*.djvu") returned 6 [0092.962] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert.css", pszSpec="*.htm") returned 0 [0092.962] lstrlenA (lpString="*.htm") returned 5 [0092.962] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert.css", pszSpec="*.html") returned 0 [0092.962] lstrlenA (lpString="*.html") returned 6 [0092.962] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert.css", pszSpec="*.mdb") returned 0 [0092.962] lstrlenA (lpString="*.mdb") returned 5 [0092.962] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert.css", pszSpec="*.cer") returned 0 [0092.962] lstrlenA (lpString="*.cer") returned 5 [0092.963] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert.css", pszSpec="*.p12") returned 0 [0092.963] lstrlenA (lpString="*.p12") returned 5 [0092.963] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert.css", pszSpec="*.pfx") returned 0 [0092.963] lstrlenA (lpString="*.pfx") returned 5 [0092.963] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert.css", pszSpec="*.kwm") returned 0 [0092.963] lstrlenA (lpString="*.kwm") returned 5 [0092.963] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert.css", pszSpec="*.pwm") returned 0 [0092.963] lstrlenA (lpString="*.pwm") returned 5 [0092.963] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert.css", pszSpec="*.1cd") returned 0 [0092.963] lstrlenA (lpString="*.1cd") returned 5 [0092.963] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert.css", pszSpec="*.md") returned 0 [0092.963] lstrlenA (lpString="*.md") returned 4 [0092.963] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert.css", pszSpec="*.mdf") returned 0 [0092.963] lstrlenA (lpString="*.mdf") returned 5 [0092.963] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert.css", pszSpec="*.dbf") returned 0 [0092.963] lstrlenA (lpString="*.dbf") returned 5 [0092.963] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert.css", pszSpec="*.odt") returned 0 [0092.963] lstrlenA (lpString="*.odt") returned 5 [0092.963] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert.css", pszSpec="*.vob") returned 0 [0092.963] lstrlenA (lpString="*.vob") returned 5 [0092.963] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert.css", pszSpec="*.ifo") returned 0 [0092.963] lstrlenA (lpString="*.ifo") returned 5 [0092.963] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert.css", pszSpec="*.lnk") returned 0 [0092.963] lstrlenA (lpString="*.lnk") returned 5 [0092.963] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert.css", pszSpec="*.torrent") returned 0 [0092.963] lstrlenA (lpString="*.torrent") returned 9 [0092.963] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert.css", pszSpec="*.mov") returned 0 [0092.963] lstrlenA (lpString="*.mov") returned 5 [0092.963] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert.css", pszSpec="*.m2v") returned 0 [0092.963] lstrlenA (lpString="*.m2v") returned 5 [0092.963] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert.css", pszSpec="*.3gp") returned 0 [0092.963] lstrlenA (lpString="*.3gp") returned 5 [0092.963] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert.css", pszSpec="*.mpeg") returned 0 [0092.963] lstrlenA (lpString="*.mpeg") returned 6 [0092.963] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert.css", pszSpec="*.mpg") returned 0 [0092.963] lstrlenA (lpString="*.mpg") returned 5 [0092.963] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert.css", pszSpec="*.flv") returned 0 [0092.963] lstrlenA (lpString="*.flv") returned 5 [0092.963] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert.css", pszSpec="*.avi") returned 0 [0092.963] lstrlenA (lpString="*.avi") returned 5 [0092.963] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert.css", pszSpec="*.mp4") returned 0 [0092.963] lstrlenA (lpString="*.mp4") returned 5 [0092.963] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert.css", pszSpec="*.wmv") returned 0 [0092.963] lstrlenA (lpString="*.wmv") returned 5 [0092.963] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert.css", pszSpec="*.divx") returned 0 [0092.963] lstrlenA (lpString="*.divx") returned 6 [0092.963] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert.css", pszSpec="*.mkv") returned 0 [0092.963] lstrlenA (lpString="*.mkv") returned 5 [0092.963] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert.css", pszSpec="*.mp3") returned 0 [0092.964] lstrlenA (lpString="*.mp3") returned 5 [0092.964] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert.css", pszSpec="*.wav") returned 0 [0092.964] lstrlenA (lpString="*.wav") returned 5 [0092.964] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert.css", pszSpec="*.flac") returned 0 [0092.964] lstrlenA (lpString="*.flac") returned 6 [0092.964] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert.css", pszSpec="*.ape") returned 0 [0092.964] lstrlenA (lpString="*.ape") returned 5 [0092.964] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert.css", pszSpec="*.wma") returned 0 [0092.964] lstrlenA (lpString="*.wma") returned 5 [0092.964] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert.css", pszSpec="*.ac3") returned 0 [0092.964] lstrlenA (lpString="*.ac3") returned 5 [0092.964] FindNextFileA (in: hFindFile=0x5b7d70, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0092.964] PeekMessageA (in: lpMsg=0xaece4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaece4) returned 0 [0092.964] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Earthy.css") returned -1 [0092.964] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Earthy.css") returned 1 [0092.964] lstrcmpiA (lpString1="", lpString2="Earthy.css") returned -1 [0092.964] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert.css") returned="Desert.css" [0092.964] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\", lpString2="Earthy.css" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Earthy.css") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Earthy.css" [0092.964] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Earthy.css", pszSpec="*.zip") returned 0 [0092.964] lstrlenA (lpString="*.zip") returned 5 [0092.964] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Earthy.css", pszSpec="*.rar") returned 0 [0092.964] lstrlenA (lpString="*.rar") returned 5 [0092.964] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Earthy.css", pszSpec="*.7z") returned 0 [0092.964] lstrlenA (lpString="*.7z") returned 4 [0092.964] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Earthy.css", pszSpec="*.tar") returned 0 [0092.964] lstrlenA (lpString="*.tar") returned 5 [0092.964] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Earthy.css", pszSpec="*.gzip") returned 0 [0092.964] lstrlenA (lpString="*.gzip") returned 6 [0092.964] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Earthy.css", pszSpec="*.jpg") returned 0 [0092.964] lstrlenA (lpString="*.jpg") returned 5 [0092.964] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Earthy.css", pszSpec="*.jpeg") returned 0 [0092.964] lstrlenA (lpString="*.jpeg") returned 6 [0092.964] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Earthy.css", pszSpec="*.psd") returned 0 [0092.964] lstrlenA (lpString="*.psd") returned 5 [0092.964] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Earthy.css", pszSpec="*.cdr") returned 0 [0092.964] lstrlenA (lpString="*.cdr") returned 5 [0092.964] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Earthy.css", pszSpec="*.dwg") returned 0 [0092.964] lstrlenA (lpString="*.dwg") returned 5 [0092.964] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Earthy.css", pszSpec="*.max") returned 0 [0092.964] lstrlenA (lpString="*.max") returned 5 [0092.964] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Earthy.css", pszSpec="*.bmp") returned 0 [0092.964] lstrlenA (lpString="*.bmp") returned 5 [0092.964] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Earthy.css", pszSpec="*.gif") returned 0 [0092.965] lstrlenA (lpString="*.gif") returned 5 [0092.965] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Earthy.css", pszSpec="*.png") returned 0 [0092.965] lstrlenA (lpString="*.png") returned 5 [0092.965] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Earthy.css", pszSpec="*.doc") returned 0 [0092.965] lstrlenA (lpString="*.doc") returned 5 [0092.965] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Earthy.css", pszSpec="*.docx") returned 0 [0092.965] lstrlenA (lpString="*.docx") returned 6 [0092.965] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Earthy.css", pszSpec="*.xls") returned 0 [0092.965] lstrlenA (lpString="*.xls") returned 5 [0092.965] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Earthy.css", pszSpec="*.xlsx") returned 0 [0092.965] lstrlenA (lpString="*.xlsx") returned 6 [0092.965] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Earthy.css", pszSpec="*.ppt") returned 0 [0092.965] lstrlenA (lpString="*.ppt") returned 5 [0092.965] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Earthy.css", pszSpec="*.pptx") returned 0 [0092.965] lstrlenA (lpString="*.pptx") returned 6 [0092.965] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Earthy.css", pszSpec="*.txt") returned 0 [0092.965] lstrlenA (lpString="*.txt") returned 5 [0092.965] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Earthy.css", pszSpec="*.pdf") returned 0 [0092.965] lstrlenA (lpString="*.pdf") returned 5 [0092.965] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Earthy.css", pszSpec="*.djvu") returned 0 [0092.965] lstrlenA (lpString="*.djvu") returned 6 [0092.965] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Earthy.css", pszSpec="*.htm") returned 0 [0092.965] lstrlenA (lpString="*.htm") returned 5 [0092.965] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Earthy.css", pszSpec="*.html") returned 0 [0092.965] lstrlenA (lpString="*.html") returned 6 [0092.965] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Earthy.css", pszSpec="*.mdb") returned 0 [0092.965] lstrlenA (lpString="*.mdb") returned 5 [0092.965] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Earthy.css", pszSpec="*.cer") returned 0 [0092.965] lstrlenA (lpString="*.cer") returned 5 [0092.965] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Earthy.css", pszSpec="*.p12") returned 0 [0092.965] lstrlenA (lpString="*.p12") returned 5 [0092.965] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Earthy.css", pszSpec="*.pfx") returned 0 [0092.965] lstrlenA (lpString="*.pfx") returned 5 [0092.965] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Earthy.css", pszSpec="*.kwm") returned 0 [0092.965] lstrlenA (lpString="*.kwm") returned 5 [0092.965] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Earthy.css", pszSpec="*.pwm") returned 0 [0092.965] lstrlenA (lpString="*.pwm") returned 5 [0092.965] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Earthy.css", pszSpec="*.1cd") returned 0 [0092.965] lstrlenA (lpString="*.1cd") returned 5 [0092.965] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Earthy.css", pszSpec="*.md") returned 0 [0092.965] lstrlenA (lpString="*.md") returned 4 [0092.965] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Earthy.css", pszSpec="*.mdf") returned 0 [0092.965] lstrlenA (lpString="*.mdf") returned 5 [0092.965] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Earthy.css", pszSpec="*.dbf") returned 0 [0092.965] lstrlenA (lpString="*.dbf") returned 5 [0092.966] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Earthy.css", pszSpec="*.odt") returned 0 [0092.966] lstrlenA (lpString="*.odt") returned 5 [0092.966] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Earthy.css", pszSpec="*.vob") returned 0 [0092.966] lstrlenA (lpString="*.vob") returned 5 [0092.966] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Earthy.css", pszSpec="*.ifo") returned 0 [0092.966] lstrlenA (lpString="*.ifo") returned 5 [0092.966] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Earthy.css", pszSpec="*.lnk") returned 0 [0092.966] lstrlenA (lpString="*.lnk") returned 5 [0092.966] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Earthy.css", pszSpec="*.torrent") returned 0 [0092.966] lstrlenA (lpString="*.torrent") returned 9 [0092.966] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Earthy.css", pszSpec="*.mov") returned 0 [0092.966] lstrlenA (lpString="*.mov") returned 5 [0092.966] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Earthy.css", pszSpec="*.m2v") returned 0 [0092.966] lstrlenA (lpString="*.m2v") returned 5 [0092.966] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Earthy.css", pszSpec="*.3gp") returned 0 [0092.966] lstrlenA (lpString="*.3gp") returned 5 [0092.966] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Earthy.css", pszSpec="*.mpeg") returned 0 [0092.966] lstrlenA (lpString="*.mpeg") returned 6 [0092.966] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Earthy.css", pszSpec="*.mpg") returned 0 [0092.966] lstrlenA (lpString="*.mpg") returned 5 [0092.966] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Earthy.css", pszSpec="*.flv") returned 0 [0092.966] lstrlenA (lpString="*.flv") returned 5 [0092.966] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Earthy.css", pszSpec="*.avi") returned 0 [0092.966] lstrlenA (lpString="*.avi") returned 5 [0092.966] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Earthy.css", pszSpec="*.mp4") returned 0 [0092.966] lstrlenA (lpString="*.mp4") returned 5 [0092.966] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Earthy.css", pszSpec="*.wmv") returned 0 [0092.966] lstrlenA (lpString="*.wmv") returned 5 [0092.966] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Earthy.css", pszSpec="*.divx") returned 0 [0092.966] lstrlenA (lpString="*.divx") returned 6 [0092.966] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Earthy.css", pszSpec="*.mkv") returned 0 [0092.966] lstrlenA (lpString="*.mkv") returned 5 [0092.966] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Earthy.css", pszSpec="*.mp3") returned 0 [0092.966] lstrlenA (lpString="*.mp3") returned 5 [0092.966] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Earthy.css", pszSpec="*.wav") returned 0 [0092.966] lstrlenA (lpString="*.wav") returned 5 [0092.966] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Earthy.css", pszSpec="*.flac") returned 0 [0092.966] lstrlenA (lpString="*.flac") returned 6 [0092.966] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Earthy.css", pszSpec="*.ape") returned 0 [0092.966] lstrlenA (lpString="*.ape") returned 5 [0092.966] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Earthy.css", pszSpec="*.wma") returned 0 [0092.966] lstrlenA (lpString="*.wma") returned 5 [0092.966] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Earthy.css", pszSpec="*.ac3") returned 0 [0092.966] lstrlenA (lpString="*.ac3") returned 5 [0092.967] FindNextFileA (in: hFindFile=0x5b7d70, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0092.967] lstrcmpA (lpString1=".", lpString2="GrayCheck") returned -1 [0092.967] lstrcmpA (lpString1="..", lpString2="GrayCheck") returned -1 [0092.967] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Earthy.css") returned="Earthy.css" [0092.967] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\", lpString2="GrayCheck" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck" [0092.967] lstrlenA (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck") returned 104 [0092.967] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\*.*", lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 0x5e4278 [0092.967] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0092.967] FindNextFileA (in: hFindFile=0x5e4278, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 1 [0092.967] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0092.967] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0092.967] FindNextFileA (in: hFindFile=0x5e4278, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 1 [0092.967] PeekMessageA (in: lpMsg=0xaeb94, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaeb94) returned 0 [0092.967] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="HEADER.GIF") returned -1 [0092.967] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="HEADER.GIF") returned 1 [0092.967] lstrcmpiA (lpString1="", lpString2="HEADER.GIF") returned -1 [0092.967] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\*.*") returned="*.*" [0092.967] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\", lpString2="HEADER.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\HEADER.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\HEADER.GIF" [0092.967] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\HEADER.GIF", pszSpec="*.zip") returned 0 [0092.967] lstrlenA (lpString="*.zip") returned 5 [0092.967] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\HEADER.GIF", pszSpec="*.rar") returned 0 [0092.967] lstrlenA (lpString="*.rar") returned 5 [0092.967] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\HEADER.GIF", pszSpec="*.7z") returned 0 [0092.967] lstrlenA (lpString="*.7z") returned 4 [0092.967] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\HEADER.GIF", pszSpec="*.tar") returned 0 [0092.967] lstrlenA (lpString="*.tar") returned 5 [0092.967] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\HEADER.GIF", pszSpec="*.gzip") returned 0 [0092.967] lstrlenA (lpString="*.gzip") returned 6 [0092.967] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\HEADER.GIF", pszSpec="*.jpg") returned 0 [0092.967] lstrlenA (lpString="*.jpg") returned 5 [0092.967] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\HEADER.GIF", pszSpec="*.jpeg") returned 0 [0092.967] lstrlenA (lpString="*.jpeg") returned 6 [0092.967] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\HEADER.GIF", pszSpec="*.psd") returned 0 [0092.967] lstrlenA (lpString="*.psd") returned 5 [0092.967] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\HEADER.GIF", pszSpec="*.cdr") returned 0 [0092.968] lstrlenA (lpString="*.cdr") returned 5 [0092.968] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\HEADER.GIF", pszSpec="*.dwg") returned 0 [0092.968] lstrlenA (lpString="*.dwg") returned 5 [0092.968] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\HEADER.GIF", pszSpec="*.max") returned 0 [0092.968] lstrlenA (lpString="*.max") returned 5 [0092.968] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\HEADER.GIF", pszSpec="*.bmp") returned 0 [0092.968] lstrlenA (lpString="*.bmp") returned 5 [0092.968] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\HEADER.GIF", pszSpec="*.gif") returned 1 [0092.968] lstrlenA (lpString="*.gif") returned 5 [0092.968] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\HEADER.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\HEADER.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\HEADER.GIF" [0092.968] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\HEADER.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\HEADER.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\HEADER.GIF" [0092.968] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\HEADER.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\HEADER.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\HEADER.GIF." [0092.968] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\HEADER.GIF.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\HEADER.GIF. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\HEADER.GIF. " [0092.968] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\HEADER.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\graycheck\\header.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0 [0092.968] GetFileSize (in: hFile=0xa0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1b8 [0092.968] GetFileTime (in: hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x91f4b000, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x528f6190, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x91f4b000, dwHighDateTime=0x1c747ea)) returned 1 [0092.968] SetFilePointer (in: hFile=0xa0, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0092.968] ReadFile (in: hFile=0xa0, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x15e, lpOverlapped=0x0) returned 1 [0092.969] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\HEADER.GIF") returned="HEADER.GIF" [0092.969] SetFilePointer (in: hFile=0xa0, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0092.969] WriteFile (in: hFile=0xa0, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x15e, lpOverlapped=0x0) returned 1 [0092.969] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0092.969] CloseHandle (hObject=0xa0) returned 1 [0092.970] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\HEADER.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\graycheck\\header.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\HEADER.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\graycheck\\header.gif. ")) returned 1 [0092.971] FindNextFileA (in: hFindFile=0x5e4278, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 1 [0092.971] PeekMessageA (in: lpMsg=0xaeb94, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaeb94) returned 0 [0092.971] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="TAB_OFF.GIF") returned -1 [0092.971] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TAB_OFF.GIF") returned -1 [0092.971] lstrcmpiA (lpString1="", lpString2="TAB_OFF.GIF") returned -1 [0092.971] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\HEADER.GIF") returned="HEADER.GIF" [0092.971] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\", lpString2="TAB_OFF.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_OFF.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_OFF.GIF" [0092.971] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_OFF.GIF", pszSpec="*.zip") returned 0 [0092.971] lstrlenA (lpString="*.zip") returned 5 [0092.971] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_OFF.GIF", pszSpec="*.rar") returned 0 [0092.971] lstrlenA (lpString="*.rar") returned 5 [0092.971] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_OFF.GIF", pszSpec="*.7z") returned 0 [0092.971] lstrlenA (lpString="*.7z") returned 4 [0092.971] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_OFF.GIF", pszSpec="*.tar") returned 0 [0092.971] lstrlenA (lpString="*.tar") returned 5 [0092.971] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_OFF.GIF", pszSpec="*.gzip") returned 0 [0092.971] lstrlenA (lpString="*.gzip") returned 6 [0092.971] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_OFF.GIF", pszSpec="*.jpg") returned 0 [0092.971] lstrlenA (lpString="*.jpg") returned 5 [0092.971] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_OFF.GIF", pszSpec="*.jpeg") returned 0 [0092.971] lstrlenA (lpString="*.jpeg") returned 6 [0092.971] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_OFF.GIF", pszSpec="*.psd") returned 0 [0092.971] lstrlenA (lpString="*.psd") returned 5 [0092.971] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_OFF.GIF", pszSpec="*.cdr") returned 0 [0092.972] lstrlenA (lpString="*.cdr") returned 5 [0092.972] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_OFF.GIF", pszSpec="*.dwg") returned 0 [0092.972] lstrlenA (lpString="*.dwg") returned 5 [0092.972] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_OFF.GIF", pszSpec="*.max") returned 0 [0092.972] lstrlenA (lpString="*.max") returned 5 [0092.972] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_OFF.GIF", pszSpec="*.bmp") returned 0 [0092.972] lstrlenA (lpString="*.bmp") returned 5 [0092.972] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_OFF.GIF", pszSpec="*.gif") returned 1 [0092.972] lstrlenA (lpString="*.gif") returned 5 [0092.972] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_OFF.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_OFF.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_OFF.GIF" [0092.972] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_OFF.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_OFF.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_OFF.GIF" [0092.972] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_OFF.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_OFF.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_OFF.GIF." [0092.972] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_OFF.GIF.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_OFF.GIF. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_OFF.GIF. " [0092.972] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\graycheck\\tab_off.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0 [0092.973] GetFileSize (in: hFile=0xa0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x155 [0092.973] GetFileTime (in: hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x91f4b000, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x528f6190, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x91f4b000, dwHighDateTime=0x1c747ea)) returned 1 [0092.973] SetFilePointer (in: hFile=0xa0, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0092.973] ReadFile (in: hFile=0xa0, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0xfb, lpOverlapped=0x0) returned 1 [0092.973] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_OFF.GIF") returned="TAB_OFF.GIF" [0092.973] SetFilePointer (in: hFile=0xa0, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0092.973] WriteFile (in: hFile=0xa0, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0xfb, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0xfb, lpOverlapped=0x0) returned 1 [0092.974] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0092.974] CloseHandle (hObject=0xa0) returned 1 [0092.974] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\graycheck\\tab_off.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_OFF.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\graycheck\\tab_off.gif. ")) returned 1 [0092.974] FindNextFileA (in: hFindFile=0x5e4278, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 1 [0092.974] PeekMessageA (in: lpMsg=0xaeb94, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaeb94) returned 0 [0092.975] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="TAB_ON.GIF") returned -1 [0092.975] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TAB_ON.GIF") returned -1 [0092.975] lstrcmpiA (lpString1="", lpString2="TAB_ON.GIF") returned -1 [0092.975] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_OFF.GIF") returned="TAB_OFF.GIF" [0092.975] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\", lpString2="TAB_ON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_ON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_ON.GIF" [0092.975] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_ON.GIF", pszSpec="*.zip") returned 0 [0092.975] lstrlenA (lpString="*.zip") returned 5 [0092.975] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_ON.GIF", pszSpec="*.rar") returned 0 [0092.975] lstrlenA (lpString="*.rar") returned 5 [0092.975] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_ON.GIF", pszSpec="*.7z") returned 0 [0092.975] lstrlenA (lpString="*.7z") returned 4 [0092.975] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_ON.GIF", pszSpec="*.tar") returned 0 [0092.975] lstrlenA (lpString="*.tar") returned 5 [0092.975] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_ON.GIF", pszSpec="*.gzip") returned 0 [0092.975] lstrlenA (lpString="*.gzip") returned 6 [0092.975] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_ON.GIF", pszSpec="*.jpg") returned 0 [0092.975] lstrlenA (lpString="*.jpg") returned 5 [0092.975] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_ON.GIF", pszSpec="*.jpeg") returned 0 [0092.975] lstrlenA (lpString="*.jpeg") returned 6 [0092.975] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_ON.GIF", pszSpec="*.psd") returned 0 [0092.975] lstrlenA (lpString="*.psd") returned 5 [0092.975] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_ON.GIF", pszSpec="*.cdr") returned 0 [0092.975] lstrlenA (lpString="*.cdr") returned 5 [0092.975] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_ON.GIF", pszSpec="*.dwg") returned 0 [0092.975] lstrlenA (lpString="*.dwg") returned 5 [0092.975] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_ON.GIF", pszSpec="*.max") returned 0 [0092.975] lstrlenA (lpString="*.max") returned 5 [0092.975] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_ON.GIF", pszSpec="*.bmp") returned 0 [0092.975] lstrlenA (lpString="*.bmp") returned 5 [0092.975] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_ON.GIF", pszSpec="*.gif") returned 1 [0092.975] lstrlenA (lpString="*.gif") returned 5 [0092.975] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_ON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_ON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_ON.GIF" [0092.975] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_ON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_ON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_ON.GIF" [0092.975] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_ON.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_ON.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_ON.GIF." [0092.975] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_ON.GIF.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_ON.GIF. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_ON.GIF. " [0092.975] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\graycheck\\tab_on.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0 [0092.976] GetFileSize (in: hFile=0xa0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xde [0092.976] GetFileTime (in: hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x91f4b000, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x618a28b0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x91f4b000, dwHighDateTime=0x1c747ea)) returned 1 [0092.976] SetFilePointer (in: hFile=0xa0, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0092.976] ReadFile (in: hFile=0xa0, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x84, lpOverlapped=0x0) returned 1 [0092.976] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_ON.GIF") returned="TAB_ON.GIF" [0092.976] SetFilePointer (in: hFile=0xa0, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0092.976] WriteFile (in: hFile=0xa0, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x84, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x84, lpOverlapped=0x0) returned 1 [0092.977] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0092.977] CloseHandle (hObject=0xa0) returned 1 [0092.977] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\graycheck\\tab_on.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_ON.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\graycheck\\tab_on.gif. ")) returned 1 [0093.003] FindNextFileA (in: hFindFile=0x5e4278, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 0 [0093.003] FindClose (in: hFindFile=0x5e4278 | out: hFindFile=0x5e4278) returned 1 [0093.003] FindNextFileA (in: hFindFile=0x5b7d70, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0093.003] PeekMessageA (in: lpMsg=0xaece4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaece4) returned 0 [0093.003] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="GrayCheck.css") returned -1 [0093.003] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="GrayCheck.css") returned 1 [0093.003] lstrcmpiA (lpString1="", lpString2="GrayCheck.css") returned -1 [0093.003] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\*.*") returned="*.*" [0093.003] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\", lpString2="GrayCheck.css" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck.css") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck.css" [0093.003] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck.css", pszSpec="*.zip") returned 0 [0093.003] lstrlenA (lpString="*.zip") returned 5 [0093.003] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck.css", pszSpec="*.rar") returned 0 [0093.003] lstrlenA (lpString="*.rar") returned 5 [0093.003] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck.css", pszSpec="*.7z") returned 0 [0093.003] lstrlenA (lpString="*.7z") returned 4 [0093.003] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck.css", pszSpec="*.tar") returned 0 [0093.003] lstrlenA (lpString="*.tar") returned 5 [0093.003] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck.css", pszSpec="*.gzip") returned 0 [0093.003] lstrlenA (lpString="*.gzip") returned 6 [0093.003] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck.css", pszSpec="*.jpg") returned 0 [0093.003] lstrlenA (lpString="*.jpg") returned 5 [0093.003] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck.css", pszSpec="*.jpeg") returned 0 [0093.003] lstrlenA (lpString="*.jpeg") returned 6 [0093.003] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck.css", pszSpec="*.psd") returned 0 [0093.003] lstrlenA (lpString="*.psd") returned 5 [0093.003] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck.css", pszSpec="*.cdr") returned 0 [0093.003] lstrlenA (lpString="*.cdr") returned 5 [0093.004] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck.css", pszSpec="*.dwg") returned 0 [0093.004] lstrlenA (lpString="*.dwg") returned 5 [0093.004] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck.css", pszSpec="*.max") returned 0 [0093.004] lstrlenA (lpString="*.max") returned 5 [0093.004] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck.css", pszSpec="*.bmp") returned 0 [0093.004] lstrlenA (lpString="*.bmp") returned 5 [0093.004] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck.css", pszSpec="*.gif") returned 0 [0093.004] lstrlenA (lpString="*.gif") returned 5 [0093.004] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck.css", pszSpec="*.png") returned 0 [0093.004] lstrlenA (lpString="*.png") returned 5 [0093.004] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck.css", pszSpec="*.doc") returned 0 [0093.004] lstrlenA (lpString="*.doc") returned 5 [0093.004] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck.css", pszSpec="*.docx") returned 0 [0093.004] lstrlenA (lpString="*.docx") returned 6 [0093.004] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck.css", pszSpec="*.xls") returned 0 [0093.004] lstrlenA (lpString="*.xls") returned 5 [0093.004] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck.css", pszSpec="*.xlsx") returned 0 [0093.004] lstrlenA (lpString="*.xlsx") returned 6 [0093.004] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck.css", pszSpec="*.ppt") returned 0 [0093.004] lstrlenA (lpString="*.ppt") returned 5 [0093.004] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck.css", pszSpec="*.pptx") returned 0 [0093.004] lstrlenA (lpString="*.pptx") returned 6 [0093.004] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck.css", pszSpec="*.txt") returned 0 [0093.004] lstrlenA (lpString="*.txt") returned 5 [0093.004] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck.css", pszSpec="*.pdf") returned 0 [0093.004] lstrlenA (lpString="*.pdf") returned 5 [0093.004] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck.css", pszSpec="*.djvu") returned 0 [0093.004] lstrlenA (lpString="*.djvu") returned 6 [0093.004] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck.css", pszSpec="*.htm") returned 0 [0093.004] lstrlenA (lpString="*.htm") returned 5 [0093.004] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck.css", pszSpec="*.html") returned 0 [0093.004] lstrlenA (lpString="*.html") returned 6 [0093.004] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck.css", pszSpec="*.mdb") returned 0 [0093.004] lstrlenA (lpString="*.mdb") returned 5 [0093.004] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck.css", pszSpec="*.cer") returned 0 [0093.004] lstrlenA (lpString="*.cer") returned 5 [0093.004] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck.css", pszSpec="*.p12") returned 0 [0093.004] lstrlenA (lpString="*.p12") returned 5 [0093.004] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck.css", pszSpec="*.pfx") returned 0 [0093.004] lstrlenA (lpString="*.pfx") returned 5 [0093.004] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck.css", pszSpec="*.kwm") returned 0 [0093.004] lstrlenA (lpString="*.kwm") returned 5 [0093.004] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck.css", pszSpec="*.pwm") returned 0 [0093.005] lstrlenA (lpString="*.pwm") returned 5 [0093.005] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck.css", pszSpec="*.1cd") returned 0 [0093.005] lstrlenA (lpString="*.1cd") returned 5 [0093.005] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck.css", pszSpec="*.md") returned 0 [0093.005] lstrlenA (lpString="*.md") returned 4 [0093.005] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck.css", pszSpec="*.mdf") returned 0 [0093.005] lstrlenA (lpString="*.mdf") returned 5 [0093.005] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck.css", pszSpec="*.dbf") returned 0 [0093.005] lstrlenA (lpString="*.dbf") returned 5 [0093.005] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck.css", pszSpec="*.odt") returned 0 [0093.005] lstrlenA (lpString="*.odt") returned 5 [0093.005] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck.css", pszSpec="*.vob") returned 0 [0093.005] lstrlenA (lpString="*.vob") returned 5 [0093.005] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck.css", pszSpec="*.ifo") returned 0 [0093.005] lstrlenA (lpString="*.ifo") returned 5 [0093.005] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck.css", pszSpec="*.lnk") returned 0 [0093.005] lstrlenA (lpString="*.lnk") returned 5 [0093.005] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck.css", pszSpec="*.torrent") returned 0 [0093.005] lstrlenA (lpString="*.torrent") returned 9 [0093.005] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck.css", pszSpec="*.mov") returned 0 [0093.005] lstrlenA (lpString="*.mov") returned 5 [0093.005] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck.css", pszSpec="*.m2v") returned 0 [0093.005] lstrlenA (lpString="*.m2v") returned 5 [0093.005] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck.css", pszSpec="*.3gp") returned 0 [0093.005] lstrlenA (lpString="*.3gp") returned 5 [0093.005] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck.css", pszSpec="*.mpeg") returned 0 [0093.005] lstrlenA (lpString="*.mpeg") returned 6 [0093.005] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck.css", pszSpec="*.mpg") returned 0 [0093.005] lstrlenA (lpString="*.mpg") returned 5 [0093.005] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck.css", pszSpec="*.flv") returned 0 [0093.005] lstrlenA (lpString="*.flv") returned 5 [0093.005] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck.css", pszSpec="*.avi") returned 0 [0093.005] lstrlenA (lpString="*.avi") returned 5 [0093.005] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck.css", pszSpec="*.mp4") returned 0 [0093.005] lstrlenA (lpString="*.mp4") returned 5 [0093.005] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck.css", pszSpec="*.wmv") returned 0 [0093.005] lstrlenA (lpString="*.wmv") returned 5 [0093.005] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck.css", pszSpec="*.divx") returned 0 [0093.005] lstrlenA (lpString="*.divx") returned 6 [0093.005] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck.css", pszSpec="*.mkv") returned 0 [0093.005] lstrlenA (lpString="*.mkv") returned 5 [0093.005] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck.css", pszSpec="*.mp3") returned 0 [0093.006] lstrlenA (lpString="*.mp3") returned 5 [0093.006] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck.css", pszSpec="*.wav") returned 0 [0093.006] lstrlenA (lpString="*.wav") returned 5 [0093.006] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck.css", pszSpec="*.flac") returned 0 [0093.006] lstrlenA (lpString="*.flac") returned 6 [0093.006] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck.css", pszSpec="*.ape") returned 0 [0093.006] lstrlenA (lpString="*.ape") returned 5 [0093.006] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck.css", pszSpec="*.wma") returned 0 [0093.006] lstrlenA (lpString="*.wma") returned 5 [0093.006] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck.css", pszSpec="*.ac3") returned 0 [0093.006] lstrlenA (lpString="*.ac3") returned 5 [0093.006] FindNextFileA (in: hFindFile=0x5b7d70, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0093.006] PeekMessageA (in: lpMsg=0xaece4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaece4) returned 0 [0093.006] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="GreenTea.css") returned -1 [0093.006] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="GreenTea.css") returned 1 [0093.006] lstrcmpiA (lpString1="", lpString2="GreenTea.css") returned -1 [0093.006] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck.css") returned="GrayCheck.css" [0093.006] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\", lpString2="GreenTea.css" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GreenTea.css") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GreenTea.css" [0093.006] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GreenTea.css", pszSpec="*.zip") returned 0 [0093.006] lstrlenA (lpString="*.zip") returned 5 [0093.006] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GreenTea.css", pszSpec="*.rar") returned 0 [0093.006] lstrlenA (lpString="*.rar") returned 5 [0093.006] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GreenTea.css", pszSpec="*.7z") returned 0 [0093.006] lstrlenA (lpString="*.7z") returned 4 [0093.006] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GreenTea.css", pszSpec="*.tar") returned 0 [0093.006] lstrlenA (lpString="*.tar") returned 5 [0093.006] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GreenTea.css", pszSpec="*.gzip") returned 0 [0093.006] lstrlenA (lpString="*.gzip") returned 6 [0093.006] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GreenTea.css", pszSpec="*.jpg") returned 0 [0093.006] lstrlenA (lpString="*.jpg") returned 5 [0093.006] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GreenTea.css", pszSpec="*.jpeg") returned 0 [0093.006] lstrlenA (lpString="*.jpeg") returned 6 [0093.006] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GreenTea.css", pszSpec="*.psd") returned 0 [0093.006] lstrlenA (lpString="*.psd") returned 5 [0093.006] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GreenTea.css", pszSpec="*.cdr") returned 0 [0093.006] lstrlenA (lpString="*.cdr") returned 5 [0093.006] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GreenTea.css", pszSpec="*.dwg") returned 0 [0093.006] lstrlenA (lpString="*.dwg") returned 5 [0093.006] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GreenTea.css", pszSpec="*.max") returned 0 [0093.006] lstrlenA (lpString="*.max") returned 5 [0093.006] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GreenTea.css", pszSpec="*.bmp") returned 0 [0093.006] lstrlenA (lpString="*.bmp") returned 5 [0093.006] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GreenTea.css", pszSpec="*.gif") returned 0 [0093.006] lstrlenA (lpString="*.gif") returned 5 [0093.007] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GreenTea.css", pszSpec="*.png") returned 0 [0093.007] lstrlenA (lpString="*.png") returned 5 [0093.007] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GreenTea.css", pszSpec="*.doc") returned 0 [0093.007] lstrlenA (lpString="*.doc") returned 5 [0093.007] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GreenTea.css", pszSpec="*.docx") returned 0 [0093.007] lstrlenA (lpString="*.docx") returned 6 [0093.007] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GreenTea.css", pszSpec="*.xls") returned 0 [0093.007] lstrlenA (lpString="*.xls") returned 5 [0093.007] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GreenTea.css", pszSpec="*.xlsx") returned 0 [0093.007] lstrlenA (lpString="*.xlsx") returned 6 [0093.007] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GreenTea.css", pszSpec="*.ppt") returned 0 [0093.007] lstrlenA (lpString="*.ppt") returned 5 [0093.007] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GreenTea.css", pszSpec="*.pptx") returned 0 [0093.007] lstrlenA (lpString="*.pptx") returned 6 [0093.007] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GreenTea.css", pszSpec="*.txt") returned 0 [0093.007] lstrlenA (lpString="*.txt") returned 5 [0093.007] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GreenTea.css", pszSpec="*.pdf") returned 0 [0093.007] lstrlenA (lpString="*.pdf") returned 5 [0093.007] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GreenTea.css", pszSpec="*.djvu") returned 0 [0093.007] lstrlenA (lpString="*.djvu") returned 6 [0093.007] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GreenTea.css", pszSpec="*.htm") returned 0 [0093.007] lstrlenA (lpString="*.htm") returned 5 [0093.007] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GreenTea.css", pszSpec="*.html") returned 0 [0093.007] lstrlenA (lpString="*.html") returned 6 [0093.007] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GreenTea.css", pszSpec="*.mdb") returned 0 [0093.007] lstrlenA (lpString="*.mdb") returned 5 [0093.007] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GreenTea.css", pszSpec="*.cer") returned 0 [0093.007] lstrlenA (lpString="*.cer") returned 5 [0093.007] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GreenTea.css", pszSpec="*.p12") returned 0 [0093.007] lstrlenA (lpString="*.p12") returned 5 [0093.007] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GreenTea.css", pszSpec="*.pfx") returned 0 [0093.007] lstrlenA (lpString="*.pfx") returned 5 [0093.007] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GreenTea.css", pszSpec="*.kwm") returned 0 [0093.007] lstrlenA (lpString="*.kwm") returned 5 [0093.007] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GreenTea.css", pszSpec="*.pwm") returned 0 [0093.007] lstrlenA (lpString="*.pwm") returned 5 [0093.007] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GreenTea.css", pszSpec="*.1cd") returned 0 [0093.007] lstrlenA (lpString="*.1cd") returned 5 [0093.007] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GreenTea.css", pszSpec="*.md") returned 0 [0093.007] lstrlenA (lpString="*.md") returned 4 [0093.007] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GreenTea.css", pszSpec="*.mdf") returned 0 [0093.007] lstrlenA (lpString="*.mdf") returned 5 [0093.007] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GreenTea.css", pszSpec="*.dbf") returned 0 [0093.008] lstrlenA (lpString="*.dbf") returned 5 [0093.008] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GreenTea.css", pszSpec="*.odt") returned 0 [0093.008] lstrlenA (lpString="*.odt") returned 5 [0093.008] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GreenTea.css", pszSpec="*.vob") returned 0 [0093.008] lstrlenA (lpString="*.vob") returned 5 [0093.008] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GreenTea.css", pszSpec="*.ifo") returned 0 [0093.008] lstrlenA (lpString="*.ifo") returned 5 [0093.008] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GreenTea.css", pszSpec="*.lnk") returned 0 [0093.008] lstrlenA (lpString="*.lnk") returned 5 [0093.008] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GreenTea.css", pszSpec="*.torrent") returned 0 [0093.008] lstrlenA (lpString="*.torrent") returned 9 [0093.008] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GreenTea.css", pszSpec="*.mov") returned 0 [0093.008] lstrlenA (lpString="*.mov") returned 5 [0093.008] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GreenTea.css", pszSpec="*.m2v") returned 0 [0093.008] lstrlenA (lpString="*.m2v") returned 5 [0093.008] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GreenTea.css", pszSpec="*.3gp") returned 0 [0093.008] lstrlenA (lpString="*.3gp") returned 5 [0093.008] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GreenTea.css", pszSpec="*.mpeg") returned 0 [0093.008] lstrlenA (lpString="*.mpeg") returned 6 [0093.008] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GreenTea.css", pszSpec="*.mpg") returned 0 [0093.008] lstrlenA (lpString="*.mpg") returned 5 [0093.008] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GreenTea.css", pszSpec="*.flv") returned 0 [0093.008] lstrlenA (lpString="*.flv") returned 5 [0093.008] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GreenTea.css", pszSpec="*.avi") returned 0 [0093.008] lstrlenA (lpString="*.avi") returned 5 [0093.008] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GreenTea.css", pszSpec="*.mp4") returned 0 [0093.008] lstrlenA (lpString="*.mp4") returned 5 [0093.008] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GreenTea.css", pszSpec="*.wmv") returned 0 [0093.008] lstrlenA (lpString="*.wmv") returned 5 [0093.008] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GreenTea.css", pszSpec="*.divx") returned 0 [0093.008] lstrlenA (lpString="*.divx") returned 6 [0093.008] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GreenTea.css", pszSpec="*.mkv") returned 0 [0093.008] lstrlenA (lpString="*.mkv") returned 5 [0093.008] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GreenTea.css", pszSpec="*.mp3") returned 0 [0093.008] lstrlenA (lpString="*.mp3") returned 5 [0093.008] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GreenTea.css", pszSpec="*.wav") returned 0 [0093.008] lstrlenA (lpString="*.wav") returned 5 [0093.008] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GreenTea.css", pszSpec="*.flac") returned 0 [0093.009] lstrlenA (lpString="*.flac") returned 6 [0093.009] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GreenTea.css", pszSpec="*.ape") returned 0 [0093.009] lstrlenA (lpString="*.ape") returned 5 [0093.009] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GreenTea.css", pszSpec="*.wma") returned 0 [0093.009] lstrlenA (lpString="*.wma") returned 5 [0093.009] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GreenTea.css", pszSpec="*.ac3") returned 0 [0093.009] lstrlenA (lpString="*.ac3") returned 5 [0093.009] FindNextFileA (in: hFindFile=0x5b7d70, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0093.009] PeekMessageA (in: lpMsg=0xaece4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaece4) returned 0 [0093.009] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="LightSpirit.css") returned -1 [0093.009] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="LightSpirit.css") returned -1 [0093.009] lstrcmpiA (lpString1="", lpString2="LightSpirit.css") returned -1 [0093.009] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GreenTea.css") returned="GreenTea.css" [0093.009] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\", lpString2="LightSpirit.css" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\LightSpirit.css") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\LightSpirit.css" [0093.009] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\LightSpirit.css", pszSpec="*.zip") returned 0 [0093.009] lstrlenA (lpString="*.zip") returned 5 [0093.009] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\LightSpirit.css", pszSpec="*.rar") returned 0 [0093.009] lstrlenA (lpString="*.rar") returned 5 [0093.009] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\LightSpirit.css", pszSpec="*.7z") returned 0 [0093.009] lstrlenA (lpString="*.7z") returned 4 [0093.009] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\LightSpirit.css", pszSpec="*.tar") returned 0 [0093.009] lstrlenA (lpString="*.tar") returned 5 [0093.009] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\LightSpirit.css", pszSpec="*.gzip") returned 0 [0093.009] lstrlenA (lpString="*.gzip") returned 6 [0093.009] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\LightSpirit.css", pszSpec="*.jpg") returned 0 [0093.009] lstrlenA (lpString="*.jpg") returned 5 [0093.009] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\LightSpirit.css", pszSpec="*.jpeg") returned 0 [0093.009] lstrlenA (lpString="*.jpeg") returned 6 [0093.009] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\LightSpirit.css", pszSpec="*.psd") returned 0 [0093.009] lstrlenA (lpString="*.psd") returned 5 [0093.009] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\LightSpirit.css", pszSpec="*.cdr") returned 0 [0093.009] lstrlenA (lpString="*.cdr") returned 5 [0093.009] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\LightSpirit.css", pszSpec="*.dwg") returned 0 [0093.009] lstrlenA (lpString="*.dwg") returned 5 [0093.009] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\LightSpirit.css", pszSpec="*.max") returned 0 [0093.009] lstrlenA (lpString="*.max") returned 5 [0093.009] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\LightSpirit.css", pszSpec="*.bmp") returned 0 [0093.009] lstrlenA (lpString="*.bmp") returned 5 [0093.009] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\LightSpirit.css", pszSpec="*.gif") returned 0 [0093.009] lstrlenA (lpString="*.gif") returned 5 [0093.009] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\LightSpirit.css", pszSpec="*.png") returned 0 [0093.009] lstrlenA (lpString="*.png") returned 5 [0093.010] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\LightSpirit.css", pszSpec="*.doc") returned 0 [0093.010] lstrlenA (lpString="*.doc") returned 5 [0093.010] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\LightSpirit.css", pszSpec="*.docx") returned 0 [0093.010] lstrlenA (lpString="*.docx") returned 6 [0093.010] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\LightSpirit.css", pszSpec="*.xls") returned 0 [0093.010] lstrlenA (lpString="*.xls") returned 5 [0093.010] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\LightSpirit.css", pszSpec="*.xlsx") returned 0 [0093.010] lstrlenA (lpString="*.xlsx") returned 6 [0093.010] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\LightSpirit.css", pszSpec="*.ppt") returned 0 [0093.010] lstrlenA (lpString="*.ppt") returned 5 [0093.010] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\LightSpirit.css", pszSpec="*.pptx") returned 0 [0093.010] lstrlenA (lpString="*.pptx") returned 6 [0093.010] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\LightSpirit.css", pszSpec="*.txt") returned 0 [0093.010] lstrlenA (lpString="*.txt") returned 5 [0093.010] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\LightSpirit.css", pszSpec="*.pdf") returned 0 [0093.010] lstrlenA (lpString="*.pdf") returned 5 [0093.010] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\LightSpirit.css", pszSpec="*.djvu") returned 0 [0093.010] lstrlenA (lpString="*.djvu") returned 6 [0093.010] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\LightSpirit.css", pszSpec="*.htm") returned 0 [0093.010] lstrlenA (lpString="*.htm") returned 5 [0093.010] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\LightSpirit.css", pszSpec="*.html") returned 0 [0093.010] lstrlenA (lpString="*.html") returned 6 [0093.010] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\LightSpirit.css", pszSpec="*.mdb") returned 0 [0093.010] lstrlenA (lpString="*.mdb") returned 5 [0093.010] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\LightSpirit.css", pszSpec="*.cer") returned 0 [0093.010] lstrlenA (lpString="*.cer") returned 5 [0093.010] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\LightSpirit.css", pszSpec="*.p12") returned 0 [0093.010] lstrlenA (lpString="*.p12") returned 5 [0093.010] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\LightSpirit.css", pszSpec="*.pfx") returned 0 [0093.010] lstrlenA (lpString="*.pfx") returned 5 [0093.010] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\LightSpirit.css", pszSpec="*.kwm") returned 0 [0093.010] lstrlenA (lpString="*.kwm") returned 5 [0093.010] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\LightSpirit.css", pszSpec="*.pwm") returned 0 [0093.010] lstrlenA (lpString="*.pwm") returned 5 [0093.010] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\LightSpirit.css", pszSpec="*.1cd") returned 0 [0093.010] lstrlenA (lpString="*.1cd") returned 5 [0093.010] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\LightSpirit.css", pszSpec="*.md") returned 0 [0093.010] lstrlenA (lpString="*.md") returned 4 [0093.010] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\LightSpirit.css", pszSpec="*.mdf") returned 0 [0093.010] lstrlenA (lpString="*.mdf") returned 5 [0093.011] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\LightSpirit.css", pszSpec="*.dbf") returned 0 [0093.011] lstrlenA (lpString="*.dbf") returned 5 [0093.011] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\LightSpirit.css", pszSpec="*.odt") returned 0 [0093.011] lstrlenA (lpString="*.odt") returned 5 [0093.011] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\LightSpirit.css", pszSpec="*.vob") returned 0 [0093.011] lstrlenA (lpString="*.vob") returned 5 [0093.011] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\LightSpirit.css", pszSpec="*.ifo") returned 0 [0093.011] lstrlenA (lpString="*.ifo") returned 5 [0093.011] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\LightSpirit.css", pszSpec="*.lnk") returned 0 [0093.011] lstrlenA (lpString="*.lnk") returned 5 [0093.011] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\LightSpirit.css", pszSpec="*.torrent") returned 0 [0093.011] lstrlenA (lpString="*.torrent") returned 9 [0093.011] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\LightSpirit.css", pszSpec="*.mov") returned 0 [0093.011] lstrlenA (lpString="*.mov") returned 5 [0093.011] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\LightSpirit.css", pszSpec="*.m2v") returned 0 [0093.011] lstrlenA (lpString="*.m2v") returned 5 [0093.011] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\LightSpirit.css", pszSpec="*.3gp") returned 0 [0093.011] lstrlenA (lpString="*.3gp") returned 5 [0093.011] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\LightSpirit.css", pszSpec="*.mpeg") returned 0 [0093.011] lstrlenA (lpString="*.mpeg") returned 6 [0093.011] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\LightSpirit.css", pszSpec="*.mpg") returned 0 [0093.011] lstrlenA (lpString="*.mpg") returned 5 [0093.011] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\LightSpirit.css", pszSpec="*.flv") returned 0 [0093.011] lstrlenA (lpString="*.flv") returned 5 [0093.011] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\LightSpirit.css", pszSpec="*.avi") returned 0 [0093.011] lstrlenA (lpString="*.avi") returned 5 [0093.011] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\LightSpirit.css", pszSpec="*.mp4") returned 0 [0093.011] lstrlenA (lpString="*.mp4") returned 5 [0093.011] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\LightSpirit.css", pszSpec="*.wmv") returned 0 [0093.011] lstrlenA (lpString="*.wmv") returned 5 [0093.011] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\LightSpirit.css", pszSpec="*.divx") returned 0 [0093.011] lstrlenA (lpString="*.divx") returned 6 [0093.011] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\LightSpirit.css", pszSpec="*.mkv") returned 0 [0093.011] lstrlenA (lpString="*.mkv") returned 5 [0093.011] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\LightSpirit.css", pszSpec="*.mp3") returned 0 [0093.011] lstrlenA (lpString="*.mp3") returned 5 [0093.011] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\LightSpirit.css", pszSpec="*.wav") returned 0 [0093.011] lstrlenA (lpString="*.wav") returned 5 [0093.011] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\LightSpirit.css", pszSpec="*.flac") returned 0 [0093.011] lstrlenA (lpString="*.flac") returned 6 [0093.011] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\LightSpirit.css", pszSpec="*.ape") returned 0 [0093.011] lstrlenA (lpString="*.ape") returned 5 [0093.011] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\LightSpirit.css", pszSpec="*.wma") returned 0 [0093.011] lstrlenA (lpString="*.wma") returned 5 [0093.012] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\LightSpirit.css", pszSpec="*.ac3") returned 0 [0093.012] lstrlenA (lpString="*.ac3") returned 5 [0093.012] FindNextFileA (in: hFindFile=0x5b7d70, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0093.012] lstrcmpA (lpString1=".", lpString2="Lime") returned -1 [0093.012] lstrcmpA (lpString1="..", lpString2="Lime") returned -1 [0093.012] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\LightSpirit.css") returned="LightSpirit.css" [0093.012] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\", lpString2="Lime" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime" [0093.012] lstrlenA (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime") returned 99 [0093.012] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\*.*", lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 0x5c4230 [0093.012] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0093.012] FindNextFileA (in: hFindFile=0x5c4230, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 1 [0093.012] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0093.012] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0093.012] FindNextFileA (in: hFindFile=0x5c4230, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 1 [0093.012] PeekMessageA (in: lpMsg=0xaeb94, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaeb94) returned 0 [0093.012] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="TAB_OFF.GIF") returned -1 [0093.012] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TAB_OFF.GIF") returned -1 [0093.012] lstrcmpiA (lpString1="", lpString2="TAB_OFF.GIF") returned -1 [0093.012] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\*.*") returned="*.*" [0093.012] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\", lpString2="TAB_OFF.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_OFF.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_OFF.GIF" [0093.012] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_OFF.GIF", pszSpec="*.zip") returned 0 [0093.012] lstrlenA (lpString="*.zip") returned 5 [0093.012] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_OFF.GIF", pszSpec="*.rar") returned 0 [0093.012] lstrlenA (lpString="*.rar") returned 5 [0093.012] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_OFF.GIF", pszSpec="*.7z") returned 0 [0093.012] lstrlenA (lpString="*.7z") returned 4 [0093.012] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_OFF.GIF", pszSpec="*.tar") returned 0 [0093.012] lstrlenA (lpString="*.tar") returned 5 [0093.012] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_OFF.GIF", pszSpec="*.gzip") returned 0 [0093.012] lstrlenA (lpString="*.gzip") returned 6 [0093.012] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_OFF.GIF", pszSpec="*.jpg") returned 0 [0093.012] lstrlenA (lpString="*.jpg") returned 5 [0093.013] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_OFF.GIF", pszSpec="*.jpeg") returned 0 [0093.013] lstrlenA (lpString="*.jpeg") returned 6 [0093.013] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_OFF.GIF", pszSpec="*.psd") returned 0 [0093.013] lstrlenA (lpString="*.psd") returned 5 [0093.013] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_OFF.GIF", pszSpec="*.cdr") returned 0 [0093.013] lstrlenA (lpString="*.cdr") returned 5 [0093.013] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_OFF.GIF", pszSpec="*.dwg") returned 0 [0093.013] lstrlenA (lpString="*.dwg") returned 5 [0093.013] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_OFF.GIF", pszSpec="*.max") returned 0 [0093.013] lstrlenA (lpString="*.max") returned 5 [0093.013] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_OFF.GIF", pszSpec="*.bmp") returned 0 [0093.013] lstrlenA (lpString="*.bmp") returned 5 [0093.013] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_OFF.GIF", pszSpec="*.gif") returned 1 [0093.013] lstrlenA (lpString="*.gif") returned 5 [0093.013] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_OFF.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_OFF.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_OFF.GIF" [0093.013] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_OFF.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_OFF.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_OFF.GIF" [0093.013] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_OFF.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_OFF.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_OFF.GIF." [0093.013] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_OFF.GIF.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_OFF.GIF. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_OFF.GIF. " [0093.013] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\lime\\tab_off.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0 [0093.014] GetFileSize (in: hFile=0xa0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1ce [0093.014] GetFileTime (in: hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x91f4b000, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x618a28b0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x91f4b000, dwHighDateTime=0x1c747ea)) returned 1 [0093.014] SetFilePointer (in: hFile=0xa0, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0093.014] ReadFile (in: hFile=0xa0, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x174, lpOverlapped=0x0) returned 1 [0093.015] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_OFF.GIF") returned="TAB_OFF.GIF" [0093.015] SetFilePointer (in: hFile=0xa0, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0093.015] WriteFile (in: hFile=0xa0, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x174, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x174, lpOverlapped=0x0) returned 1 [0093.015] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0093.015] CloseHandle (hObject=0xa0) returned 1 [0093.016] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\lime\\tab_off.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_OFF.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\lime\\tab_off.gif. ")) returned 1 [0093.017] FindNextFileA (in: hFindFile=0x5c4230, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 1 [0093.017] PeekMessageA (in: lpMsg=0xaeb94, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaeb94) returned 0 [0093.017] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="TAB_ON.GIF") returned -1 [0093.017] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TAB_ON.GIF") returned -1 [0093.018] lstrcmpiA (lpString1="", lpString2="TAB_ON.GIF") returned -1 [0093.018] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_OFF.GIF") returned="TAB_OFF.GIF" [0093.018] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\", lpString2="TAB_ON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_ON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_ON.GIF" [0093.018] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_ON.GIF", pszSpec="*.zip") returned 0 [0093.018] lstrlenA (lpString="*.zip") returned 5 [0093.018] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_ON.GIF", pszSpec="*.rar") returned 0 [0093.018] lstrlenA (lpString="*.rar") returned 5 [0093.018] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_ON.GIF", pszSpec="*.7z") returned 0 [0093.018] lstrlenA (lpString="*.7z") returned 4 [0093.018] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_ON.GIF", pszSpec="*.tar") returned 0 [0093.018] lstrlenA (lpString="*.tar") returned 5 [0093.018] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_ON.GIF", pszSpec="*.gzip") returned 0 [0093.018] lstrlenA (lpString="*.gzip") returned 6 [0093.018] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_ON.GIF", pszSpec="*.jpg") returned 0 [0093.018] lstrlenA (lpString="*.jpg") returned 5 [0093.018] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_ON.GIF", pszSpec="*.jpeg") returned 0 [0093.018] lstrlenA (lpString="*.jpeg") returned 6 [0093.018] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_ON.GIF", pszSpec="*.psd") returned 0 [0093.018] lstrlenA (lpString="*.psd") returned 5 [0093.018] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_ON.GIF", pszSpec="*.cdr") returned 0 [0093.018] lstrlenA (lpString="*.cdr") returned 5 [0093.018] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_ON.GIF", pszSpec="*.dwg") returned 0 [0093.018] lstrlenA (lpString="*.dwg") returned 5 [0093.018] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_ON.GIF", pszSpec="*.max") returned 0 [0093.018] lstrlenA (lpString="*.max") returned 5 [0093.018] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_ON.GIF", pszSpec="*.bmp") returned 0 [0093.018] lstrlenA (lpString="*.bmp") returned 5 [0093.018] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_ON.GIF", pszSpec="*.gif") returned 1 [0093.018] lstrlenA (lpString="*.gif") returned 5 [0093.018] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_ON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_ON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_ON.GIF" [0093.018] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_ON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_ON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_ON.GIF" [0093.018] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_ON.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_ON.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_ON.GIF." [0093.018] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_ON.GIF.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_ON.GIF. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_ON.GIF. " [0093.018] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\lime\\tab_on.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0 [0093.019] GetFileSize (in: hFile=0xa0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x10b [0093.019] GetFileTime (in: hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9325dd00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x528f6190, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9325dd00, dwHighDateTime=0x1c747ea)) returned 1 [0093.019] SetFilePointer (in: hFile=0xa0, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0093.019] ReadFile (in: hFile=0xa0, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0xb1, lpOverlapped=0x0) returned 1 [0093.020] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_ON.GIF") returned="TAB_ON.GIF" [0093.020] SetFilePointer (in: hFile=0xa0, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0093.020] WriteFile (in: hFile=0xa0, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0xb1, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0xb1, lpOverlapped=0x0) returned 1 [0093.020] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0093.020] CloseHandle (hObject=0xa0) returned 1 [0093.020] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\lime\\tab_on.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_ON.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\lime\\tab_on.gif. ")) returned 1 [0093.021] FindNextFileA (in: hFindFile=0x5c4230, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 0 [0093.021] FindClose (in: hFindFile=0x5c4230 | out: hFindFile=0x5c4230) returned 1 [0093.021] FindNextFileA (in: hFindFile=0x5b7d70, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0093.021] PeekMessageA (in: lpMsg=0xaece4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaece4) returned 0 [0093.021] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Lime.css") returned -1 [0093.021] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Lime.css") returned -1 [0093.021] lstrcmpiA (lpString1="", lpString2="Lime.css") returned -1 [0093.021] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\*.*") returned="*.*" [0093.021] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\", lpString2="Lime.css" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime.css") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime.css" [0093.021] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime.css", pszSpec="*.zip") returned 0 [0093.021] lstrlenA (lpString="*.zip") returned 5 [0093.021] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime.css", pszSpec="*.rar") returned 0 [0093.021] lstrlenA (lpString="*.rar") returned 5 [0093.021] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime.css", pszSpec="*.7z") returned 0 [0093.021] lstrlenA (lpString="*.7z") returned 4 [0093.021] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime.css", pszSpec="*.tar") returned 0 [0093.021] lstrlenA (lpString="*.tar") returned 5 [0093.022] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime.css", pszSpec="*.gzip") returned 0 [0093.022] lstrlenA (lpString="*.gzip") returned 6 [0093.022] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime.css", pszSpec="*.jpg") returned 0 [0093.022] lstrlenA (lpString="*.jpg") returned 5 [0093.022] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime.css", pszSpec="*.jpeg") returned 0 [0093.022] lstrlenA (lpString="*.jpeg") returned 6 [0093.022] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime.css", pszSpec="*.psd") returned 0 [0093.022] lstrlenA (lpString="*.psd") returned 5 [0093.022] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime.css", pszSpec="*.cdr") returned 0 [0093.022] lstrlenA (lpString="*.cdr") returned 5 [0093.022] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime.css", pszSpec="*.dwg") returned 0 [0093.022] lstrlenA (lpString="*.dwg") returned 5 [0093.022] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime.css", pszSpec="*.max") returned 0 [0093.022] lstrlenA (lpString="*.max") returned 5 [0093.022] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime.css", pszSpec="*.bmp") returned 0 [0093.022] lstrlenA (lpString="*.bmp") returned 5 [0093.022] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime.css", pszSpec="*.gif") returned 0 [0093.022] lstrlenA (lpString="*.gif") returned 5 [0093.022] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime.css", pszSpec="*.png") returned 0 [0093.022] lstrlenA (lpString="*.png") returned 5 [0093.022] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime.css", pszSpec="*.doc") returned 0 [0093.022] lstrlenA (lpString="*.doc") returned 5 [0093.022] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime.css", pszSpec="*.docx") returned 0 [0093.022] lstrlenA (lpString="*.docx") returned 6 [0093.022] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime.css", pszSpec="*.xls") returned 0 [0093.022] lstrlenA (lpString="*.xls") returned 5 [0093.022] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime.css", pszSpec="*.xlsx") returned 0 [0093.022] lstrlenA (lpString="*.xlsx") returned 6 [0093.022] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime.css", pszSpec="*.ppt") returned 0 [0093.022] lstrlenA (lpString="*.ppt") returned 5 [0093.022] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime.css", pszSpec="*.pptx") returned 0 [0093.022] lstrlenA (lpString="*.pptx") returned 6 [0093.022] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime.css", pszSpec="*.txt") returned 0 [0093.022] lstrlenA (lpString="*.txt") returned 5 [0093.022] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime.css", pszSpec="*.pdf") returned 0 [0093.022] lstrlenA (lpString="*.pdf") returned 5 [0093.022] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime.css", pszSpec="*.djvu") returned 0 [0093.022] lstrlenA (lpString="*.djvu") returned 6 [0093.022] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime.css", pszSpec="*.htm") returned 0 [0093.022] lstrlenA (lpString="*.htm") returned 5 [0093.022] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime.css", pszSpec="*.html") returned 0 [0093.022] lstrlenA (lpString="*.html") returned 6 [0093.022] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime.css", pszSpec="*.mdb") returned 0 [0093.022] lstrlenA (lpString="*.mdb") returned 5 [0093.022] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime.css", pszSpec="*.cer") returned 0 [0093.022] lstrlenA (lpString="*.cer") returned 5 [0093.022] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime.css", pszSpec="*.p12") returned 0 [0093.022] lstrlenA (lpString="*.p12") returned 5 [0093.022] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime.css", pszSpec="*.pfx") returned 0 [0093.023] lstrlenA (lpString="*.pfx") returned 5 [0093.023] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime.css", pszSpec="*.kwm") returned 0 [0093.023] lstrlenA (lpString="*.kwm") returned 5 [0093.023] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime.css", pszSpec="*.pwm") returned 0 [0093.023] lstrlenA (lpString="*.pwm") returned 5 [0093.023] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime.css", pszSpec="*.1cd") returned 0 [0093.023] lstrlenA (lpString="*.1cd") returned 5 [0093.023] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime.css", pszSpec="*.md") returned 0 [0093.023] lstrlenA (lpString="*.md") returned 4 [0093.023] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime.css", pszSpec="*.mdf") returned 0 [0093.023] lstrlenA (lpString="*.mdf") returned 5 [0093.023] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime.css", pszSpec="*.dbf") returned 0 [0093.023] lstrlenA (lpString="*.dbf") returned 5 [0093.023] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime.css", pszSpec="*.odt") returned 0 [0093.023] lstrlenA (lpString="*.odt") returned 5 [0093.023] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime.css", pszSpec="*.vob") returned 0 [0093.023] lstrlenA (lpString="*.vob") returned 5 [0093.023] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime.css", pszSpec="*.ifo") returned 0 [0093.023] lstrlenA (lpString="*.ifo") returned 5 [0093.023] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime.css", pszSpec="*.lnk") returned 0 [0093.023] lstrlenA (lpString="*.lnk") returned 5 [0093.023] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime.css", pszSpec="*.torrent") returned 0 [0093.023] lstrlenA (lpString="*.torrent") returned 9 [0093.023] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime.css", pszSpec="*.mov") returned 0 [0093.023] lstrlenA (lpString="*.mov") returned 5 [0093.023] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime.css", pszSpec="*.m2v") returned 0 [0093.023] lstrlenA (lpString="*.m2v") returned 5 [0093.023] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime.css", pszSpec="*.3gp") returned 0 [0093.023] lstrlenA (lpString="*.3gp") returned 5 [0093.023] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime.css", pszSpec="*.mpeg") returned 0 [0093.023] lstrlenA (lpString="*.mpeg") returned 6 [0093.023] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime.css", pszSpec="*.mpg") returned 0 [0093.023] lstrlenA (lpString="*.mpg") returned 5 [0093.023] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime.css", pszSpec="*.flv") returned 0 [0093.023] lstrlenA (lpString="*.flv") returned 5 [0093.023] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime.css", pszSpec="*.avi") returned 0 [0093.023] lstrlenA (lpString="*.avi") returned 5 [0093.023] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime.css", pszSpec="*.mp4") returned 0 [0093.023] lstrlenA (lpString="*.mp4") returned 5 [0093.023] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime.css", pszSpec="*.wmv") returned 0 [0093.023] lstrlenA (lpString="*.wmv") returned 5 [0093.023] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime.css", pszSpec="*.divx") returned 0 [0093.023] lstrlenA (lpString="*.divx") returned 6 [0093.023] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime.css", pszSpec="*.mkv") returned 0 [0093.023] lstrlenA (lpString="*.mkv") returned 5 [0093.023] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime.css", pszSpec="*.mp3") returned 0 [0093.023] lstrlenA (lpString="*.mp3") returned 5 [0093.023] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime.css", pszSpec="*.wav") returned 0 [0093.024] lstrlenA (lpString="*.wav") returned 5 [0093.024] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime.css", pszSpec="*.flac") returned 0 [0093.024] lstrlenA (lpString="*.flac") returned 6 [0093.024] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime.css", pszSpec="*.ape") returned 0 [0093.024] lstrlenA (lpString="*.ape") returned 5 [0093.024] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime.css", pszSpec="*.wma") returned 0 [0093.024] lstrlenA (lpString="*.wma") returned 5 [0093.024] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime.css", pszSpec="*.ac3") returned 0 [0093.024] lstrlenA (lpString="*.ac3") returned 5 [0093.024] FindNextFileA (in: hFindFile=0x5b7d70, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0093.024] PeekMessageA (in: lpMsg=0xaece4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaece4) returned 0 [0093.024] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Maroon.css") returned -1 [0093.024] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Maroon.css") returned -1 [0093.024] lstrcmpiA (lpString1="", lpString2="Maroon.css") returned -1 [0093.024] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime.css") returned="Lime.css" [0093.024] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\", lpString2="Maroon.css" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Maroon.css") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Maroon.css" [0093.024] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Maroon.css", pszSpec="*.zip") returned 0 [0093.024] lstrlenA (lpString="*.zip") returned 5 [0093.024] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Maroon.css", pszSpec="*.rar") returned 0 [0093.024] lstrlenA (lpString="*.rar") returned 5 [0093.024] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Maroon.css", pszSpec="*.7z") returned 0 [0093.024] lstrlenA (lpString="*.7z") returned 4 [0093.024] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Maroon.css", pszSpec="*.tar") returned 0 [0093.024] lstrlenA (lpString="*.tar") returned 5 [0093.024] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Maroon.css", pszSpec="*.gzip") returned 0 [0093.024] lstrlenA (lpString="*.gzip") returned 6 [0093.024] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Maroon.css", pszSpec="*.jpg") returned 0 [0093.024] lstrlenA (lpString="*.jpg") returned 5 [0093.024] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Maroon.css", pszSpec="*.jpeg") returned 0 [0093.024] lstrlenA (lpString="*.jpeg") returned 6 [0093.024] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Maroon.css", pszSpec="*.psd") returned 0 [0093.024] lstrlenA (lpString="*.psd") returned 5 [0093.024] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Maroon.css", pszSpec="*.cdr") returned 0 [0093.024] lstrlenA (lpString="*.cdr") returned 5 [0093.024] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Maroon.css", pszSpec="*.dwg") returned 0 [0093.024] lstrlenA (lpString="*.dwg") returned 5 [0093.024] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Maroon.css", pszSpec="*.max") returned 0 [0093.024] lstrlenA (lpString="*.max") returned 5 [0093.024] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Maroon.css", pszSpec="*.bmp") returned 0 [0093.024] lstrlenA (lpString="*.bmp") returned 5 [0093.024] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Maroon.css", pszSpec="*.gif") returned 0 [0093.024] lstrlenA (lpString="*.gif") returned 5 [0093.024] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Maroon.css", pszSpec="*.png") returned 0 [0093.024] lstrlenA (lpString="*.png") returned 5 [0093.024] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Maroon.css", pszSpec="*.doc") returned 0 [0093.024] lstrlenA (lpString="*.doc") returned 5 [0093.024] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Maroon.css", pszSpec="*.docx") returned 0 [0093.025] lstrlenA (lpString="*.docx") returned 6 [0093.025] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Maroon.css", pszSpec="*.xls") returned 0 [0093.025] lstrlenA (lpString="*.xls") returned 5 [0093.025] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Maroon.css", pszSpec="*.xlsx") returned 0 [0093.025] lstrlenA (lpString="*.xlsx") returned 6 [0093.025] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Maroon.css", pszSpec="*.ppt") returned 0 [0093.025] lstrlenA (lpString="*.ppt") returned 5 [0093.025] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Maroon.css", pszSpec="*.pptx") returned 0 [0093.025] lstrlenA (lpString="*.pptx") returned 6 [0093.025] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Maroon.css", pszSpec="*.txt") returned 0 [0093.025] lstrlenA (lpString="*.txt") returned 5 [0093.025] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Maroon.css", pszSpec="*.pdf") returned 0 [0093.025] lstrlenA (lpString="*.pdf") returned 5 [0093.025] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Maroon.css", pszSpec="*.djvu") returned 0 [0093.025] lstrlenA (lpString="*.djvu") returned 6 [0093.025] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Maroon.css", pszSpec="*.htm") returned 0 [0093.025] lstrlenA (lpString="*.htm") returned 5 [0093.025] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Maroon.css", pszSpec="*.html") returned 0 [0093.025] lstrlenA (lpString="*.html") returned 6 [0093.025] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Maroon.css", pszSpec="*.mdb") returned 0 [0093.025] lstrlenA (lpString="*.mdb") returned 5 [0093.025] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Maroon.css", pszSpec="*.cer") returned 0 [0093.025] lstrlenA (lpString="*.cer") returned 5 [0093.025] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Maroon.css", pszSpec="*.p12") returned 0 [0093.025] lstrlenA (lpString="*.p12") returned 5 [0093.025] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Maroon.css", pszSpec="*.pfx") returned 0 [0093.025] lstrlenA (lpString="*.pfx") returned 5 [0093.025] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Maroon.css", pszSpec="*.kwm") returned 0 [0093.025] lstrlenA (lpString="*.kwm") returned 5 [0093.025] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Maroon.css", pszSpec="*.pwm") returned 0 [0093.025] lstrlenA (lpString="*.pwm") returned 5 [0093.025] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Maroon.css", pszSpec="*.1cd") returned 0 [0093.025] lstrlenA (lpString="*.1cd") returned 5 [0093.025] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Maroon.css", pszSpec="*.md") returned 0 [0093.025] lstrlenA (lpString="*.md") returned 4 [0093.025] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Maroon.css", pszSpec="*.mdf") returned 0 [0093.025] lstrlenA (lpString="*.mdf") returned 5 [0093.025] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Maroon.css", pszSpec="*.dbf") returned 0 [0093.025] lstrlenA (lpString="*.dbf") returned 5 [0093.025] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Maroon.css", pszSpec="*.odt") returned 0 [0093.025] lstrlenA (lpString="*.odt") returned 5 [0093.025] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Maroon.css", pszSpec="*.vob") returned 0 [0093.025] lstrlenA (lpString="*.vob") returned 5 [0093.025] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Maroon.css", pszSpec="*.ifo") returned 0 [0093.025] lstrlenA (lpString="*.ifo") returned 5 [0093.025] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Maroon.css", pszSpec="*.lnk") returned 0 [0093.025] lstrlenA (lpString="*.lnk") returned 5 [0093.025] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Maroon.css", pszSpec="*.torrent") returned 0 [0093.025] lstrlenA (lpString="*.torrent") returned 9 [0093.025] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Maroon.css", pszSpec="*.mov") returned 0 [0093.026] lstrlenA (lpString="*.mov") returned 5 [0093.026] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Maroon.css", pszSpec="*.m2v") returned 0 [0093.026] lstrlenA (lpString="*.m2v") returned 5 [0093.026] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Maroon.css", pszSpec="*.3gp") returned 0 [0093.026] lstrlenA (lpString="*.3gp") returned 5 [0093.026] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Maroon.css", pszSpec="*.mpeg") returned 0 [0093.026] lstrlenA (lpString="*.mpeg") returned 6 [0093.026] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Maroon.css", pszSpec="*.mpg") returned 0 [0093.026] lstrlenA (lpString="*.mpg") returned 5 [0093.026] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Maroon.css", pszSpec="*.flv") returned 0 [0093.026] lstrlenA (lpString="*.flv") returned 5 [0093.026] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Maroon.css", pszSpec="*.avi") returned 0 [0093.026] lstrlenA (lpString="*.avi") returned 5 [0093.026] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Maroon.css", pszSpec="*.mp4") returned 0 [0093.026] lstrlenA (lpString="*.mp4") returned 5 [0093.026] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Maroon.css", pszSpec="*.wmv") returned 0 [0093.026] lstrlenA (lpString="*.wmv") returned 5 [0093.026] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Maroon.css", pszSpec="*.divx") returned 0 [0093.026] lstrlenA (lpString="*.divx") returned 6 [0093.026] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Maroon.css", pszSpec="*.mkv") returned 0 [0093.026] lstrlenA (lpString="*.mkv") returned 5 [0093.026] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Maroon.css", pszSpec="*.mp3") returned 0 [0093.026] lstrlenA (lpString="*.mp3") returned 5 [0093.026] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Maroon.css", pszSpec="*.wav") returned 0 [0093.026] lstrlenA (lpString="*.wav") returned 5 [0093.026] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Maroon.css", pszSpec="*.flac") returned 0 [0093.026] lstrlenA (lpString="*.flac") returned 6 [0093.026] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Maroon.css", pszSpec="*.ape") returned 0 [0093.026] lstrlenA (lpString="*.ape") returned 5 [0093.026] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Maroon.css", pszSpec="*.wma") returned 0 [0093.026] lstrlenA (lpString="*.wma") returned 5 [0093.026] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Maroon.css", pszSpec="*.ac3") returned 0 [0093.026] lstrlenA (lpString="*.ac3") returned 5 [0093.026] FindNextFileA (in: hFindFile=0x5b7d70, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0093.026] lstrcmpA (lpString1=".", lpString2="Oasis") returned -1 [0093.026] lstrcmpA (lpString1="..", lpString2="Oasis") returned -1 [0093.026] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Maroon.css") returned="Maroon.css" [0093.026] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\", lpString2="Oasis" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis" [0093.026] lstrlenA (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis") returned 100 [0093.026] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\*.*", lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 0x5c4238 [0093.026] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0093.027] FindNextFileA (in: hFindFile=0x5c4238, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 1 [0093.027] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0093.027] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0093.027] FindNextFileA (in: hFindFile=0x5c4238, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 1 [0093.027] PeekMessageA (in: lpMsg=0xaeb94, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaeb94) returned 0 [0093.027] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="HEADER.GIF") returned -1 [0093.027] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="HEADER.GIF") returned 1 [0093.027] lstrcmpiA (lpString1="", lpString2="HEADER.GIF") returned -1 [0093.027] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\*.*") returned="*.*" [0093.027] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\", lpString2="HEADER.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\HEADER.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\HEADER.GIF" [0093.027] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\HEADER.GIF", pszSpec="*.zip") returned 0 [0093.027] lstrlenA (lpString="*.zip") returned 5 [0093.027] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\HEADER.GIF", pszSpec="*.rar") returned 0 [0093.027] lstrlenA (lpString="*.rar") returned 5 [0093.027] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\HEADER.GIF", pszSpec="*.7z") returned 0 [0093.027] lstrlenA (lpString="*.7z") returned 4 [0093.027] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\HEADER.GIF", pszSpec="*.tar") returned 0 [0093.027] lstrlenA (lpString="*.tar") returned 5 [0093.027] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\HEADER.GIF", pszSpec="*.gzip") returned 0 [0093.027] lstrlenA (lpString="*.gzip") returned 6 [0093.027] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\HEADER.GIF", pszSpec="*.jpg") returned 0 [0093.027] lstrlenA (lpString="*.jpg") returned 5 [0093.027] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\HEADER.GIF", pszSpec="*.jpeg") returned 0 [0093.027] lstrlenA (lpString="*.jpeg") returned 6 [0093.027] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\HEADER.GIF", pszSpec="*.psd") returned 0 [0093.027] lstrlenA (lpString="*.psd") returned 5 [0093.027] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\HEADER.GIF", pszSpec="*.cdr") returned 0 [0093.027] lstrlenA (lpString="*.cdr") returned 5 [0093.027] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\HEADER.GIF", pszSpec="*.dwg") returned 0 [0093.027] lstrlenA (lpString="*.dwg") returned 5 [0093.027] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\HEADER.GIF", pszSpec="*.max") returned 0 [0093.027] lstrlenA (lpString="*.max") returned 5 [0093.027] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\HEADER.GIF", pszSpec="*.bmp") returned 0 [0093.027] lstrlenA (lpString="*.bmp") returned 5 [0093.027] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\HEADER.GIF", pszSpec="*.gif") returned 1 [0093.027] lstrlenA (lpString="*.gif") returned 5 [0093.027] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\HEADER.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\HEADER.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\HEADER.GIF" [0093.027] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\HEADER.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\HEADER.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\HEADER.GIF" [0093.027] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\HEADER.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\HEADER.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\HEADER.GIF." [0093.027] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\HEADER.GIF.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\HEADER.GIF. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\HEADER.GIF. " [0093.028] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\HEADER.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\oasis\\header.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0 [0093.028] GetFileSize (in: hFile=0xa0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x86c [0093.029] GetFileTime (in: hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9325dd00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x528f6190, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9325dd00, dwHighDateTime=0x1c747ea)) returned 1 [0093.029] SetFilePointer (in: hFile=0xa0, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0093.029] ReadFile (in: hFile=0xa0, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x812, lpOverlapped=0x0) returned 1 [0093.030] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\HEADER.GIF") returned="HEADER.GIF" [0093.030] SetFilePointer (in: hFile=0xa0, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0093.030] WriteFile (in: hFile=0xa0, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x812, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x812, lpOverlapped=0x0) returned 1 [0093.030] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0093.030] CloseHandle (hObject=0xa0) returned 1 [0093.031] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\HEADER.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\oasis\\header.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\HEADER.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\oasis\\header.gif. ")) returned 1 [0093.031] FindNextFileA (in: hFindFile=0x5c4238, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 1 [0093.031] PeekMessageA (in: lpMsg=0xaeb94, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaeb94) returned 0 [0093.032] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="TAB_OFF.GIF") returned -1 [0093.032] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TAB_OFF.GIF") returned -1 [0093.032] lstrcmpiA (lpString1="", lpString2="TAB_OFF.GIF") returned -1 [0093.032] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\HEADER.GIF") returned="HEADER.GIF" [0093.032] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\", lpString2="TAB_OFF.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_OFF.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_OFF.GIF" [0093.032] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_OFF.GIF", pszSpec="*.zip") returned 0 [0093.032] lstrlenA (lpString="*.zip") returned 5 [0093.032] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_OFF.GIF", pszSpec="*.rar") returned 0 [0093.032] lstrlenA (lpString="*.rar") returned 5 [0093.032] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_OFF.GIF", pszSpec="*.7z") returned 0 [0093.032] lstrlenA (lpString="*.7z") returned 4 [0093.032] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_OFF.GIF", pszSpec="*.tar") returned 0 [0093.032] lstrlenA (lpString="*.tar") returned 5 [0093.032] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_OFF.GIF", pszSpec="*.gzip") returned 0 [0093.032] lstrlenA (lpString="*.gzip") returned 6 [0093.032] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_OFF.GIF", pszSpec="*.jpg") returned 0 [0093.032] lstrlenA (lpString="*.jpg") returned 5 [0093.032] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_OFF.GIF", pszSpec="*.jpeg") returned 0 [0093.032] lstrlenA (lpString="*.jpeg") returned 6 [0093.032] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_OFF.GIF", pszSpec="*.psd") returned 0 [0093.032] lstrlenA (lpString="*.psd") returned 5 [0093.032] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_OFF.GIF", pszSpec="*.cdr") returned 0 [0093.032] lstrlenA (lpString="*.cdr") returned 5 [0093.032] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_OFF.GIF", pszSpec="*.dwg") returned 0 [0093.032] lstrlenA (lpString="*.dwg") returned 5 [0093.032] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_OFF.GIF", pszSpec="*.max") returned 0 [0093.032] lstrlenA (lpString="*.max") returned 5 [0093.032] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_OFF.GIF", pszSpec="*.bmp") returned 0 [0093.032] lstrlenA (lpString="*.bmp") returned 5 [0093.032] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_OFF.GIF", pszSpec="*.gif") returned 1 [0093.032] lstrlenA (lpString="*.gif") returned 5 [0093.032] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_OFF.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_OFF.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_OFF.GIF" [0093.032] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_OFF.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_OFF.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_OFF.GIF" [0093.032] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_OFF.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_OFF.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_OFF.GIF." [0093.032] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_OFF.GIF.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_OFF.GIF. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_OFF.GIF. " [0093.032] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\oasis\\tab_off.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0 [0093.033] GetFileSize (in: hFile=0xa0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1f0 [0093.033] GetFileTime (in: hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9325dd00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x618a28b0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9325dd00, dwHighDateTime=0x1c747ea)) returned 1 [0093.033] SetFilePointer (in: hFile=0xa0, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0093.033] ReadFile (in: hFile=0xa0, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x196, lpOverlapped=0x0) returned 1 [0093.033] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_OFF.GIF") returned="TAB_OFF.GIF" [0093.033] SetFilePointer (in: hFile=0xa0, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0093.033] WriteFile (in: hFile=0xa0, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x196, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x196, lpOverlapped=0x0) returned 1 [0093.033] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0093.034] CloseHandle (hObject=0xa0) returned 1 [0093.034] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\oasis\\tab_off.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_OFF.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\oasis\\tab_off.gif. ")) returned 1 [0093.034] FindNextFileA (in: hFindFile=0x5c4238, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 1 [0093.034] PeekMessageA (in: lpMsg=0xaeb94, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaeb94) returned 0 [0093.034] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="TAB_ON.GIF") returned -1 [0093.034] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TAB_ON.GIF") returned -1 [0093.034] lstrcmpiA (lpString1="", lpString2="TAB_ON.GIF") returned -1 [0093.034] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_OFF.GIF") returned="TAB_OFF.GIF" [0093.035] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\", lpString2="TAB_ON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_ON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_ON.GIF" [0093.035] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_ON.GIF", pszSpec="*.zip") returned 0 [0093.035] lstrlenA (lpString="*.zip") returned 5 [0093.035] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_ON.GIF", pszSpec="*.rar") returned 0 [0093.035] lstrlenA (lpString="*.rar") returned 5 [0093.035] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_ON.GIF", pszSpec="*.7z") returned 0 [0093.035] lstrlenA (lpString="*.7z") returned 4 [0093.035] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_ON.GIF", pszSpec="*.tar") returned 0 [0093.035] lstrlenA (lpString="*.tar") returned 5 [0093.035] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_ON.GIF", pszSpec="*.gzip") returned 0 [0093.035] lstrlenA (lpString="*.gzip") returned 6 [0093.035] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_ON.GIF", pszSpec="*.jpg") returned 0 [0093.035] lstrlenA (lpString="*.jpg") returned 5 [0093.035] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_ON.GIF", pszSpec="*.jpeg") returned 0 [0093.035] lstrlenA (lpString="*.jpeg") returned 6 [0093.035] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_ON.GIF", pszSpec="*.psd") returned 0 [0093.035] lstrlenA (lpString="*.psd") returned 5 [0093.035] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_ON.GIF", pszSpec="*.cdr") returned 0 [0093.035] lstrlenA (lpString="*.cdr") returned 5 [0093.035] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_ON.GIF", pszSpec="*.dwg") returned 0 [0093.035] lstrlenA (lpString="*.dwg") returned 5 [0093.035] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_ON.GIF", pszSpec="*.max") returned 0 [0093.035] lstrlenA (lpString="*.max") returned 5 [0093.035] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_ON.GIF", pszSpec="*.bmp") returned 0 [0093.035] lstrlenA (lpString="*.bmp") returned 5 [0093.035] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_ON.GIF", pszSpec="*.gif") returned 1 [0093.035] lstrlenA (lpString="*.gif") returned 5 [0093.035] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_ON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_ON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_ON.GIF" [0093.035] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_ON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_ON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_ON.GIF" [0093.035] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_ON.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_ON.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_ON.GIF." [0093.035] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_ON.GIF.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_ON.GIF. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_ON.GIF. " [0093.035] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\oasis\\tab_on.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0 [0093.035] GetFileSize (in: hFile=0xa0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x401 [0093.035] GetFileTime (in: hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9325dd00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x618a28b0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9325dd00, dwHighDateTime=0x1c747ea)) returned 1 [0093.035] SetFilePointer (in: hFile=0xa0, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0093.036] ReadFile (in: hFile=0xa0, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x3a7, lpOverlapped=0x0) returned 1 [0093.037] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_ON.GIF") returned="TAB_ON.GIF" [0093.037] SetFilePointer (in: hFile=0xa0, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0093.037] WriteFile (in: hFile=0xa0, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x3a7, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x3a7, lpOverlapped=0x0) returned 1 [0093.037] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0093.037] CloseHandle (hObject=0xa0) returned 1 [0093.037] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\oasis\\tab_on.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_ON.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\oasis\\tab_on.gif. ")) returned 1 [0093.038] FindNextFileA (in: hFindFile=0x5c4238, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 0 [0093.038] FindClose (in: hFindFile=0x5c4238 | out: hFindFile=0x5c4238) returned 1 [0093.038] FindNextFileA (in: hFindFile=0x5b7d70, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0093.038] PeekMessageA (in: lpMsg=0xaece4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaece4) returned 0 [0093.038] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Oasis.css") returned -1 [0093.038] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Oasis.css") returned -1 [0093.038] lstrcmpiA (lpString1="", lpString2="Oasis.css") returned -1 [0093.038] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\*.*") returned="*.*" [0093.038] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\", lpString2="Oasis.css" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis.css") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis.css" [0093.038] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis.css", pszSpec="*.zip") returned 0 [0093.038] lstrlenA (lpString="*.zip") returned 5 [0093.038] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis.css", pszSpec="*.rar") returned 0 [0093.038] lstrlenA (lpString="*.rar") returned 5 [0093.038] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis.css", pszSpec="*.7z") returned 0 [0093.038] lstrlenA (lpString="*.7z") returned 4 [0093.038] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis.css", pszSpec="*.tar") returned 0 [0093.038] lstrlenA (lpString="*.tar") returned 5 [0093.038] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis.css", pszSpec="*.gzip") returned 0 [0093.038] lstrlenA (lpString="*.gzip") returned 6 [0093.038] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis.css", pszSpec="*.jpg") returned 0 [0093.038] lstrlenA (lpString="*.jpg") returned 5 [0093.038] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis.css", pszSpec="*.jpeg") returned 0 [0093.039] lstrlenA (lpString="*.jpeg") returned 6 [0093.039] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis.css", pszSpec="*.psd") returned 0 [0093.039] lstrlenA (lpString="*.psd") returned 5 [0093.039] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis.css", pszSpec="*.cdr") returned 0 [0093.039] lstrlenA (lpString="*.cdr") returned 5 [0093.039] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis.css", pszSpec="*.dwg") returned 0 [0093.039] lstrlenA (lpString="*.dwg") returned 5 [0093.039] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis.css", pszSpec="*.max") returned 0 [0093.039] lstrlenA (lpString="*.max") returned 5 [0093.039] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis.css", pszSpec="*.bmp") returned 0 [0093.039] lstrlenA (lpString="*.bmp") returned 5 [0093.039] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis.css", pszSpec="*.gif") returned 0 [0093.039] lstrlenA (lpString="*.gif") returned 5 [0093.039] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis.css", pszSpec="*.png") returned 0 [0093.039] lstrlenA (lpString="*.png") returned 5 [0093.039] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis.css", pszSpec="*.doc") returned 0 [0093.039] lstrlenA (lpString="*.doc") returned 5 [0093.039] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis.css", pszSpec="*.docx") returned 0 [0093.039] lstrlenA (lpString="*.docx") returned 6 [0093.039] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis.css", pszSpec="*.xls") returned 0 [0093.039] lstrlenA (lpString="*.xls") returned 5 [0093.039] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis.css", pszSpec="*.xlsx") returned 0 [0093.039] lstrlenA (lpString="*.xlsx") returned 6 [0093.039] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis.css", pszSpec="*.ppt") returned 0 [0093.039] lstrlenA (lpString="*.ppt") returned 5 [0093.039] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis.css", pszSpec="*.pptx") returned 0 [0093.039] lstrlenA (lpString="*.pptx") returned 6 [0093.039] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis.css", pszSpec="*.txt") returned 0 [0093.039] lstrlenA (lpString="*.txt") returned 5 [0093.039] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis.css", pszSpec="*.pdf") returned 0 [0093.039] lstrlenA (lpString="*.pdf") returned 5 [0093.039] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis.css", pszSpec="*.djvu") returned 0 [0093.039] lstrlenA (lpString="*.djvu") returned 6 [0093.039] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis.css", pszSpec="*.htm") returned 0 [0093.039] lstrlenA (lpString="*.htm") returned 5 [0093.039] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis.css", pszSpec="*.html") returned 0 [0093.039] lstrlenA (lpString="*.html") returned 6 [0093.039] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis.css", pszSpec="*.mdb") returned 0 [0093.040] lstrlenA (lpString="*.mdb") returned 5 [0093.040] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis.css", pszSpec="*.cer") returned 0 [0093.040] lstrlenA (lpString="*.cer") returned 5 [0093.040] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis.css", pszSpec="*.p12") returned 0 [0093.040] lstrlenA (lpString="*.p12") returned 5 [0093.040] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis.css", pszSpec="*.pfx") returned 0 [0093.040] lstrlenA (lpString="*.pfx") returned 5 [0093.040] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis.css", pszSpec="*.kwm") returned 0 [0093.040] lstrlenA (lpString="*.kwm") returned 5 [0093.040] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis.css", pszSpec="*.pwm") returned 0 [0093.040] lstrlenA (lpString="*.pwm") returned 5 [0093.040] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis.css", pszSpec="*.1cd") returned 0 [0093.040] lstrlenA (lpString="*.1cd") returned 5 [0093.040] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis.css", pszSpec="*.md") returned 0 [0093.040] lstrlenA (lpString="*.md") returned 4 [0093.040] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis.css", pszSpec="*.mdf") returned 0 [0093.040] lstrlenA (lpString="*.mdf") returned 5 [0093.040] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis.css", pszSpec="*.dbf") returned 0 [0093.040] lstrlenA (lpString="*.dbf") returned 5 [0093.040] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis.css", pszSpec="*.odt") returned 0 [0093.040] lstrlenA (lpString="*.odt") returned 5 [0093.040] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis.css", pszSpec="*.vob") returned 0 [0093.040] lstrlenA (lpString="*.vob") returned 5 [0093.040] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis.css", pszSpec="*.ifo") returned 0 [0093.040] lstrlenA (lpString="*.ifo") returned 5 [0093.040] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis.css", pszSpec="*.lnk") returned 0 [0093.040] lstrlenA (lpString="*.lnk") returned 5 [0093.041] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis.css", pszSpec="*.torrent") returned 0 [0093.041] lstrlenA (lpString="*.torrent") returned 9 [0093.041] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis.css", pszSpec="*.mov") returned 0 [0093.041] lstrlenA (lpString="*.mov") returned 5 [0093.041] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis.css", pszSpec="*.m2v") returned 0 [0093.041] lstrlenA (lpString="*.m2v") returned 5 [0093.041] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis.css", pszSpec="*.3gp") returned 0 [0093.041] lstrlenA (lpString="*.3gp") returned 5 [0093.041] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis.css", pszSpec="*.mpeg") returned 0 [0093.041] lstrlenA (lpString="*.mpeg") returned 6 [0093.041] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis.css", pszSpec="*.mpg") returned 0 [0093.041] lstrlenA (lpString="*.mpg") returned 5 [0093.041] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis.css", pszSpec="*.flv") returned 0 [0093.041] lstrlenA (lpString="*.flv") returned 5 [0093.041] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis.css", pszSpec="*.avi") returned 0 [0093.041] lstrlenA (lpString="*.avi") returned 5 [0093.041] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis.css", pszSpec="*.mp4") returned 0 [0093.041] lstrlenA (lpString="*.mp4") returned 5 [0093.041] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis.css", pszSpec="*.wmv") returned 0 [0093.041] lstrlenA (lpString="*.wmv") returned 5 [0093.041] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis.css", pszSpec="*.divx") returned 0 [0093.041] lstrlenA (lpString="*.divx") returned 6 [0093.041] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis.css", pszSpec="*.mkv") returned 0 [0093.041] lstrlenA (lpString="*.mkv") returned 5 [0093.041] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis.css", pszSpec="*.mp3") returned 0 [0093.041] lstrlenA (lpString="*.mp3") returned 5 [0093.041] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis.css", pszSpec="*.wav") returned 0 [0093.041] lstrlenA (lpString="*.wav") returned 5 [0093.041] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis.css", pszSpec="*.flac") returned 0 [0093.041] lstrlenA (lpString="*.flac") returned 6 [0093.041] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis.css", pszSpec="*.ape") returned 0 [0093.041] lstrlenA (lpString="*.ape") returned 5 [0093.041] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis.css", pszSpec="*.wma") returned 0 [0093.041] lstrlenA (lpString="*.wma") returned 5 [0093.041] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis.css", pszSpec="*.ac3") returned 0 [0093.041] lstrlenA (lpString="*.ac3") returned 5 [0093.041] FindNextFileA (in: hFindFile=0x5b7d70, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0093.041] PeekMessageA (in: lpMsg=0xaece4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaece4) returned 0 [0093.041] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="OliveGreen.css") returned -1 [0093.041] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OliveGreen.css") returned -1 [0093.041] lstrcmpiA (lpString1="", lpString2="OliveGreen.css") returned -1 [0093.042] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis.css") returned="Oasis.css" [0093.042] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\", lpString2="OliveGreen.css" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\OliveGreen.css") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\OliveGreen.css" [0093.042] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\OliveGreen.css", pszSpec="*.zip") returned 0 [0093.042] lstrlenA (lpString="*.zip") returned 5 [0093.042] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\OliveGreen.css", pszSpec="*.rar") returned 0 [0093.042] lstrlenA (lpString="*.rar") returned 5 [0093.042] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\OliveGreen.css", pszSpec="*.7z") returned 0 [0093.042] lstrlenA (lpString="*.7z") returned 4 [0093.042] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\OliveGreen.css", pszSpec="*.tar") returned 0 [0093.042] lstrlenA (lpString="*.tar") returned 5 [0093.042] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\OliveGreen.css", pszSpec="*.gzip") returned 0 [0093.042] lstrlenA (lpString="*.gzip") returned 6 [0093.042] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\OliveGreen.css", pszSpec="*.jpg") returned 0 [0093.042] lstrlenA (lpString="*.jpg") returned 5 [0093.042] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\OliveGreen.css", pszSpec="*.jpeg") returned 0 [0093.042] lstrlenA (lpString="*.jpeg") returned 6 [0093.042] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\OliveGreen.css", pszSpec="*.psd") returned 0 [0093.042] lstrlenA (lpString="*.psd") returned 5 [0093.042] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\OliveGreen.css", pszSpec="*.cdr") returned 0 [0093.042] lstrlenA (lpString="*.cdr") returned 5 [0093.042] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\OliveGreen.css", pszSpec="*.dwg") returned 0 [0093.042] lstrlenA (lpString="*.dwg") returned 5 [0093.042] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\OliveGreen.css", pszSpec="*.max") returned 0 [0093.042] lstrlenA (lpString="*.max") returned 5 [0093.042] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\OliveGreen.css", pszSpec="*.bmp") returned 0 [0093.042] lstrlenA (lpString="*.bmp") returned 5 [0093.042] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\OliveGreen.css", pszSpec="*.gif") returned 0 [0093.042] lstrlenA (lpString="*.gif") returned 5 [0093.042] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\OliveGreen.css", pszSpec="*.png") returned 0 [0093.042] lstrlenA (lpString="*.png") returned 5 [0093.042] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\OliveGreen.css", pszSpec="*.doc") returned 0 [0093.042] lstrlenA (lpString="*.doc") returned 5 [0093.042] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\OliveGreen.css", pszSpec="*.docx") returned 0 [0093.042] lstrlenA (lpString="*.docx") returned 6 [0093.042] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\OliveGreen.css", pszSpec="*.xls") returned 0 [0093.042] lstrlenA (lpString="*.xls") returned 5 [0093.042] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\OliveGreen.css", pszSpec="*.xlsx") returned 0 [0093.042] lstrlenA (lpString="*.xlsx") returned 6 [0093.042] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\OliveGreen.css", pszSpec="*.ppt") returned 0 [0093.042] lstrlenA (lpString="*.ppt") returned 5 [0093.042] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\OliveGreen.css", pszSpec="*.pptx") returned 0 [0093.042] lstrlenA (lpString="*.pptx") returned 6 [0093.043] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\OliveGreen.css", pszSpec="*.txt") returned 0 [0093.043] lstrlenA (lpString="*.txt") returned 5 [0093.043] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\OliveGreen.css", pszSpec="*.pdf") returned 0 [0093.043] lstrlenA (lpString="*.pdf") returned 5 [0093.043] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\OliveGreen.css", pszSpec="*.djvu") returned 0 [0093.043] lstrlenA (lpString="*.djvu") returned 6 [0093.043] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\OliveGreen.css", pszSpec="*.htm") returned 0 [0093.043] lstrlenA (lpString="*.htm") returned 5 [0093.043] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\OliveGreen.css", pszSpec="*.html") returned 0 [0093.043] lstrlenA (lpString="*.html") returned 6 [0093.043] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\OliveGreen.css", pszSpec="*.mdb") returned 0 [0093.043] lstrlenA (lpString="*.mdb") returned 5 [0093.043] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\OliveGreen.css", pszSpec="*.cer") returned 0 [0093.043] lstrlenA (lpString="*.cer") returned 5 [0093.043] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\OliveGreen.css", pszSpec="*.p12") returned 0 [0093.043] lstrlenA (lpString="*.p12") returned 5 [0093.043] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\OliveGreen.css", pszSpec="*.pfx") returned 0 [0093.043] lstrlenA (lpString="*.pfx") returned 5 [0093.043] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\OliveGreen.css", pszSpec="*.kwm") returned 0 [0093.043] lstrlenA (lpString="*.kwm") returned 5 [0093.043] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\OliveGreen.css", pszSpec="*.pwm") returned 0 [0093.043] lstrlenA (lpString="*.pwm") returned 5 [0093.043] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\OliveGreen.css", pszSpec="*.1cd") returned 0 [0093.043] lstrlenA (lpString="*.1cd") returned 5 [0093.043] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\OliveGreen.css", pszSpec="*.md") returned 0 [0093.043] lstrlenA (lpString="*.md") returned 4 [0093.043] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\OliveGreen.css", pszSpec="*.mdf") returned 0 [0093.043] lstrlenA (lpString="*.mdf") returned 5 [0093.043] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\OliveGreen.css", pszSpec="*.dbf") returned 0 [0093.043] lstrlenA (lpString="*.dbf") returned 5 [0093.043] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\OliveGreen.css", pszSpec="*.odt") returned 0 [0093.043] lstrlenA (lpString="*.odt") returned 5 [0093.043] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\OliveGreen.css", pszSpec="*.vob") returned 0 [0093.043] lstrlenA (lpString="*.vob") returned 5 [0093.043] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\OliveGreen.css", pszSpec="*.ifo") returned 0 [0093.043] lstrlenA (lpString="*.ifo") returned 5 [0093.043] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\OliveGreen.css", pszSpec="*.lnk") returned 0 [0093.043] lstrlenA (lpString="*.lnk") returned 5 [0093.043] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\OliveGreen.css", pszSpec="*.torrent") returned 0 [0093.043] lstrlenA (lpString="*.torrent") returned 9 [0093.043] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\OliveGreen.css", pszSpec="*.mov") returned 0 [0093.043] lstrlenA (lpString="*.mov") returned 5 [0093.043] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\OliveGreen.css", pszSpec="*.m2v") returned 0 [0093.044] lstrlenA (lpString="*.m2v") returned 5 [0093.044] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\OliveGreen.css", pszSpec="*.3gp") returned 0 [0093.044] lstrlenA (lpString="*.3gp") returned 5 [0093.044] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\OliveGreen.css", pszSpec="*.mpeg") returned 0 [0093.044] lstrlenA (lpString="*.mpeg") returned 6 [0093.044] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\OliveGreen.css", pszSpec="*.mpg") returned 0 [0093.044] lstrlenA (lpString="*.mpg") returned 5 [0093.044] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\OliveGreen.css", pszSpec="*.flv") returned 0 [0093.044] lstrlenA (lpString="*.flv") returned 5 [0093.044] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\OliveGreen.css", pszSpec="*.avi") returned 0 [0093.044] lstrlenA (lpString="*.avi") returned 5 [0093.044] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\OliveGreen.css", pszSpec="*.mp4") returned 0 [0093.044] lstrlenA (lpString="*.mp4") returned 5 [0093.044] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\OliveGreen.css", pszSpec="*.wmv") returned 0 [0093.044] lstrlenA (lpString="*.wmv") returned 5 [0093.044] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\OliveGreen.css", pszSpec="*.divx") returned 0 [0093.044] lstrlenA (lpString="*.divx") returned 6 [0093.044] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\OliveGreen.css", pszSpec="*.mkv") returned 0 [0093.044] lstrlenA (lpString="*.mkv") returned 5 [0093.044] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\OliveGreen.css", pszSpec="*.mp3") returned 0 [0093.044] lstrlenA (lpString="*.mp3") returned 5 [0093.044] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\OliveGreen.css", pszSpec="*.wav") returned 0 [0093.044] lstrlenA (lpString="*.wav") returned 5 [0093.044] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\OliveGreen.css", pszSpec="*.flac") returned 0 [0093.044] lstrlenA (lpString="*.flac") returned 6 [0093.044] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\OliveGreen.css", pszSpec="*.ape") returned 0 [0093.044] lstrlenA (lpString="*.ape") returned 5 [0093.044] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\OliveGreen.css", pszSpec="*.wma") returned 0 [0093.044] lstrlenA (lpString="*.wma") returned 5 [0093.044] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\OliveGreen.css", pszSpec="*.ac3") returned 0 [0093.044] lstrlenA (lpString="*.ac3") returned 5 [0093.044] FindNextFileA (in: hFindFile=0x5b7d70, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0093.044] PeekMessageA (in: lpMsg=0xaece4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaece4) returned 0 [0093.044] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Premium.css") returned -1 [0093.044] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Premium.css") returned -1 [0093.044] lstrcmpiA (lpString1="", lpString2="Premium.css") returned -1 [0093.044] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\OliveGreen.css") returned="OliveGreen.css" [0093.044] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\", lpString2="Premium.css" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Premium.css") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Premium.css" [0093.044] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Premium.css", pszSpec="*.zip") returned 0 [0093.044] lstrlenA (lpString="*.zip") returned 5 [0093.044] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Premium.css", pszSpec="*.rar") returned 0 [0093.044] lstrlenA (lpString="*.rar") returned 5 [0093.045] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Premium.css", pszSpec="*.7z") returned 0 [0093.045] lstrlenA (lpString="*.7z") returned 4 [0093.045] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Premium.css", pszSpec="*.tar") returned 0 [0093.045] lstrlenA (lpString="*.tar") returned 5 [0093.045] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Premium.css", pszSpec="*.gzip") returned 0 [0093.045] lstrlenA (lpString="*.gzip") returned 6 [0093.045] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Premium.css", pszSpec="*.jpg") returned 0 [0093.045] lstrlenA (lpString="*.jpg") returned 5 [0093.045] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Premium.css", pszSpec="*.jpeg") returned 0 [0093.045] lstrlenA (lpString="*.jpeg") returned 6 [0093.045] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Premium.css", pszSpec="*.psd") returned 0 [0093.045] lstrlenA (lpString="*.psd") returned 5 [0093.045] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Premium.css", pszSpec="*.cdr") returned 0 [0093.045] lstrlenA (lpString="*.cdr") returned 5 [0093.045] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Premium.css", pszSpec="*.dwg") returned 0 [0093.045] lstrlenA (lpString="*.dwg") returned 5 [0093.045] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Premium.css", pszSpec="*.max") returned 0 [0093.045] lstrlenA (lpString="*.max") returned 5 [0093.045] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Premium.css", pszSpec="*.bmp") returned 0 [0093.045] lstrlenA (lpString="*.bmp") returned 5 [0093.045] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Premium.css", pszSpec="*.gif") returned 0 [0093.045] lstrlenA (lpString="*.gif") returned 5 [0093.045] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Premium.css", pszSpec="*.png") returned 0 [0093.045] lstrlenA (lpString="*.png") returned 5 [0093.045] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Premium.css", pszSpec="*.doc") returned 0 [0093.045] lstrlenA (lpString="*.doc") returned 5 [0093.045] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Premium.css", pszSpec="*.docx") returned 0 [0093.045] lstrlenA (lpString="*.docx") returned 6 [0093.045] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Premium.css", pszSpec="*.xls") returned 0 [0093.045] lstrlenA (lpString="*.xls") returned 5 [0093.045] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Premium.css", pszSpec="*.xlsx") returned 0 [0093.045] lstrlenA (lpString="*.xlsx") returned 6 [0093.045] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Premium.css", pszSpec="*.ppt") returned 0 [0093.045] lstrlenA (lpString="*.ppt") returned 5 [0093.045] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Premium.css", pszSpec="*.pptx") returned 0 [0093.045] lstrlenA (lpString="*.pptx") returned 6 [0093.045] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Premium.css", pszSpec="*.txt") returned 0 [0093.045] lstrlenA (lpString="*.txt") returned 5 [0093.045] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Premium.css", pszSpec="*.pdf") returned 0 [0093.045] lstrlenA (lpString="*.pdf") returned 5 [0093.045] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Premium.css", pszSpec="*.djvu") returned 0 [0093.045] lstrlenA (lpString="*.djvu") returned 6 [0093.045] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Premium.css", pszSpec="*.htm") returned 0 [0093.045] lstrlenA (lpString="*.htm") returned 5 [0093.045] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Premium.css", pszSpec="*.html") returned 0 [0093.046] lstrlenA (lpString="*.html") returned 6 [0093.046] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Premium.css", pszSpec="*.mdb") returned 0 [0093.046] lstrlenA (lpString="*.mdb") returned 5 [0093.046] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Premium.css", pszSpec="*.cer") returned 0 [0093.046] lstrlenA (lpString="*.cer") returned 5 [0093.046] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Premium.css", pszSpec="*.p12") returned 0 [0093.046] lstrlenA (lpString="*.p12") returned 5 [0093.046] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Premium.css", pszSpec="*.pfx") returned 0 [0093.046] lstrlenA (lpString="*.pfx") returned 5 [0093.046] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Premium.css", pszSpec="*.kwm") returned 0 [0093.046] lstrlenA (lpString="*.kwm") returned 5 [0093.046] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Premium.css", pszSpec="*.pwm") returned 0 [0093.046] lstrlenA (lpString="*.pwm") returned 5 [0093.046] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Premium.css", pszSpec="*.1cd") returned 0 [0093.046] lstrlenA (lpString="*.1cd") returned 5 [0093.046] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Premium.css", pszSpec="*.md") returned 0 [0093.046] lstrlenA (lpString="*.md") returned 4 [0093.046] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Premium.css", pszSpec="*.mdf") returned 0 [0093.046] lstrlenA (lpString="*.mdf") returned 5 [0093.046] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Premium.css", pszSpec="*.dbf") returned 0 [0093.046] lstrlenA (lpString="*.dbf") returned 5 [0093.046] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Premium.css", pszSpec="*.odt") returned 0 [0093.046] lstrlenA (lpString="*.odt") returned 5 [0093.046] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Premium.css", pszSpec="*.vob") returned 0 [0093.046] lstrlenA (lpString="*.vob") returned 5 [0093.046] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Premium.css", pszSpec="*.ifo") returned 0 [0093.046] lstrlenA (lpString="*.ifo") returned 5 [0093.046] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Premium.css", pszSpec="*.lnk") returned 0 [0093.046] lstrlenA (lpString="*.lnk") returned 5 [0093.046] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Premium.css", pszSpec="*.torrent") returned 0 [0093.046] lstrlenA (lpString="*.torrent") returned 9 [0093.046] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Premium.css", pszSpec="*.mov") returned 0 [0093.046] lstrlenA (lpString="*.mov") returned 5 [0093.046] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Premium.css", pszSpec="*.m2v") returned 0 [0093.046] lstrlenA (lpString="*.m2v") returned 5 [0093.046] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Premium.css", pszSpec="*.3gp") returned 0 [0093.046] lstrlenA (lpString="*.3gp") returned 5 [0093.046] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Premium.css", pszSpec="*.mpeg") returned 0 [0093.046] lstrlenA (lpString="*.mpeg") returned 6 [0093.046] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Premium.css", pszSpec="*.mpg") returned 0 [0093.046] lstrlenA (lpString="*.mpg") returned 5 [0093.046] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Premium.css", pszSpec="*.flv") returned 0 [0093.046] lstrlenA (lpString="*.flv") returned 5 [0093.046] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Premium.css", pszSpec="*.avi") returned 0 [0093.046] lstrlenA (lpString="*.avi") returned 5 [0093.046] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Premium.css", pszSpec="*.mp4") returned 0 [0093.047] lstrlenA (lpString="*.mp4") returned 5 [0093.047] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Premium.css", pszSpec="*.wmv") returned 0 [0093.047] lstrlenA (lpString="*.wmv") returned 5 [0093.047] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Premium.css", pszSpec="*.divx") returned 0 [0093.047] lstrlenA (lpString="*.divx") returned 6 [0093.047] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Premium.css", pszSpec="*.mkv") returned 0 [0093.047] lstrlenA (lpString="*.mkv") returned 5 [0093.047] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Premium.css", pszSpec="*.mp3") returned 0 [0093.047] lstrlenA (lpString="*.mp3") returned 5 [0093.047] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Premium.css", pszSpec="*.wav") returned 0 [0093.047] lstrlenA (lpString="*.wav") returned 5 [0093.047] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Premium.css", pszSpec="*.flac") returned 0 [0093.047] lstrlenA (lpString="*.flac") returned 6 [0093.047] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Premium.css", pszSpec="*.ape") returned 0 [0093.047] lstrlenA (lpString="*.ape") returned 5 [0093.047] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Premium.css", pszSpec="*.wma") returned 0 [0093.047] lstrlenA (lpString="*.wma") returned 5 [0093.047] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Premium.css", pszSpec="*.ac3") returned 0 [0093.047] lstrlenA (lpString="*.ac3") returned 5 [0093.047] FindNextFileA (in: hFindFile=0x5b7d70, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0093.047] lstrcmpA (lpString1=".", lpString2="Slate") returned -1 [0093.047] lstrcmpA (lpString1="..", lpString2="Slate") returned -1 [0093.047] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Premium.css") returned="Premium.css" [0093.047] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\", lpString2="Slate" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate" [0093.047] lstrlenA (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate") returned 100 [0093.047] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\*.*", lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 0x5be160 [0093.048] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0093.048] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 1 [0093.048] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0093.048] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0093.048] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 1 [0093.048] PeekMessageA (in: lpMsg=0xaeb94, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaeb94) returned 0 [0093.048] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="TAB_OFF.GIF") returned -1 [0093.048] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TAB_OFF.GIF") returned -1 [0093.048] lstrcmpiA (lpString1="", lpString2="TAB_OFF.GIF") returned -1 [0093.048] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\*.*") returned="*.*" [0093.048] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\", lpString2="TAB_OFF.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_OFF.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_OFF.GIF" [0093.048] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_OFF.GIF", pszSpec="*.zip") returned 0 [0093.048] lstrlenA (lpString="*.zip") returned 5 [0093.048] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_OFF.GIF", pszSpec="*.rar") returned 0 [0093.048] lstrlenA (lpString="*.rar") returned 5 [0093.048] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_OFF.GIF", pszSpec="*.7z") returned 0 [0093.048] lstrlenA (lpString="*.7z") returned 4 [0093.048] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_OFF.GIF", pszSpec="*.tar") returned 0 [0093.048] lstrlenA (lpString="*.tar") returned 5 [0093.048] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_OFF.GIF", pszSpec="*.gzip") returned 0 [0093.048] lstrlenA (lpString="*.gzip") returned 6 [0093.048] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_OFF.GIF", pszSpec="*.jpg") returned 0 [0093.048] lstrlenA (lpString="*.jpg") returned 5 [0093.048] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_OFF.GIF", pszSpec="*.jpeg") returned 0 [0093.048] lstrlenA (lpString="*.jpeg") returned 6 [0093.048] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_OFF.GIF", pszSpec="*.psd") returned 0 [0093.048] lstrlenA (lpString="*.psd") returned 5 [0093.048] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_OFF.GIF", pszSpec="*.cdr") returned 0 [0093.048] lstrlenA (lpString="*.cdr") returned 5 [0093.048] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_OFF.GIF", pszSpec="*.dwg") returned 0 [0093.048] lstrlenA (lpString="*.dwg") returned 5 [0093.048] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_OFF.GIF", pszSpec="*.max") returned 0 [0093.048] lstrlenA (lpString="*.max") returned 5 [0093.048] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_OFF.GIF", pszSpec="*.bmp") returned 0 [0093.048] lstrlenA (lpString="*.bmp") returned 5 [0093.048] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_OFF.GIF", pszSpec="*.gif") returned 1 [0093.048] lstrlenA (lpString="*.gif") returned 5 [0093.048] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_OFF.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_OFF.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_OFF.GIF" [0093.048] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_OFF.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_OFF.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_OFF.GIF" [0093.048] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_OFF.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_OFF.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_OFF.GIF." [0093.048] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_OFF.GIF.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_OFF.GIF. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_OFF.GIF. " [0093.049] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\slate\\tab_off.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0 [0093.049] GetFileSize (in: hFile=0xa0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x16c [0093.049] GetFileTime (in: hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9325dd00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x618c8a10, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9325dd00, dwHighDateTime=0x1c747ea)) returned 1 [0093.049] SetFilePointer (in: hFile=0xa0, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0093.049] ReadFile (in: hFile=0xa0, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x112, lpOverlapped=0x0) returned 1 [0093.050] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_OFF.GIF") returned="TAB_OFF.GIF" [0093.050] SetFilePointer (in: hFile=0xa0, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0093.050] WriteFile (in: hFile=0xa0, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x112, lpOverlapped=0x0) returned 1 [0093.050] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0093.050] CloseHandle (hObject=0xa0) returned 1 [0093.051] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\slate\\tab_off.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_OFF.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\slate\\tab_off.gif. ")) returned 1 [0093.053] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 1 [0093.053] PeekMessageA (in: lpMsg=0xaeb94, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaeb94) returned 0 [0093.053] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="TAB_ON.GIF") returned -1 [0093.053] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TAB_ON.GIF") returned -1 [0093.053] lstrcmpiA (lpString1="", lpString2="TAB_ON.GIF") returned -1 [0093.053] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_OFF.GIF") returned="TAB_OFF.GIF" [0093.053] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\", lpString2="TAB_ON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_ON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_ON.GIF" [0093.053] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_ON.GIF", pszSpec="*.zip") returned 0 [0093.053] lstrlenA (lpString="*.zip") returned 5 [0093.053] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_ON.GIF", pszSpec="*.rar") returned 0 [0093.053] lstrlenA (lpString="*.rar") returned 5 [0093.053] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_ON.GIF", pszSpec="*.7z") returned 0 [0093.053] lstrlenA (lpString="*.7z") returned 4 [0093.053] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_ON.GIF", pszSpec="*.tar") returned 0 [0093.053] lstrlenA (lpString="*.tar") returned 5 [0093.053] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_ON.GIF", pszSpec="*.gzip") returned 0 [0093.053] lstrlenA (lpString="*.gzip") returned 6 [0093.053] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_ON.GIF", pszSpec="*.jpg") returned 0 [0093.053] lstrlenA (lpString="*.jpg") returned 5 [0093.053] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_ON.GIF", pszSpec="*.jpeg") returned 0 [0093.053] lstrlenA (lpString="*.jpeg") returned 6 [0093.053] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_ON.GIF", pszSpec="*.psd") returned 0 [0093.053] lstrlenA (lpString="*.psd") returned 5 [0093.053] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_ON.GIF", pszSpec="*.cdr") returned 0 [0093.053] lstrlenA (lpString="*.cdr") returned 5 [0093.053] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_ON.GIF", pszSpec="*.dwg") returned 0 [0093.053] lstrlenA (lpString="*.dwg") returned 5 [0093.053] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_ON.GIF", pszSpec="*.max") returned 0 [0093.053] lstrlenA (lpString="*.max") returned 5 [0093.053] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_ON.GIF", pszSpec="*.bmp") returned 0 [0093.053] lstrlenA (lpString="*.bmp") returned 5 [0093.053] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_ON.GIF", pszSpec="*.gif") returned 1 [0093.053] lstrlenA (lpString="*.gif") returned 5 [0093.054] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_ON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_ON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_ON.GIF" [0093.054] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_ON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_ON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_ON.GIF" [0093.054] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_ON.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_ON.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_ON.GIF." [0093.054] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_ON.GIF.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_ON.GIF. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_ON.GIF. " [0093.054] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\slate\\tab_on.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0 [0093.054] GetFileSize (in: hFile=0xa0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x16c [0093.054] GetFileTime (in: hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9325dd00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x528f6190, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9325dd00, dwHighDateTime=0x1c747ea)) returned 1 [0093.054] SetFilePointer (in: hFile=0xa0, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0093.054] ReadFile (in: hFile=0xa0, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x112, lpOverlapped=0x0) returned 1 [0093.055] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_ON.GIF") returned="TAB_ON.GIF" [0093.055] SetFilePointer (in: hFile=0xa0, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0093.055] WriteFile (in: hFile=0xa0, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x112, lpOverlapped=0x0) returned 1 [0093.055] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0093.055] CloseHandle (hObject=0xa0) returned 1 [0093.056] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\slate\\tab_on.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_ON.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\slate\\tab_on.gif. ")) returned 1 [0093.057] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 0 [0093.057] FindClose (in: hFindFile=0x5be160 | out: hFindFile=0x5be160) returned 1 [0093.058] FindNextFileA (in: hFindFile=0x5b7d70, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0093.058] PeekMessageA (in: lpMsg=0xaece4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaece4) returned 0 [0093.058] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Slate.css") returned -1 [0093.058] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Slate.css") returned -1 [0093.058] lstrcmpiA (lpString1="", lpString2="Slate.css") returned -1 [0093.058] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\*.*") returned="*.*" [0093.058] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\", lpString2="Slate.css" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate.css") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate.css" [0093.058] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate.css", pszSpec="*.zip") returned 0 [0093.058] lstrlenA (lpString="*.zip") returned 5 [0093.058] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate.css", pszSpec="*.rar") returned 0 [0093.058] lstrlenA (lpString="*.rar") returned 5 [0093.058] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate.css", pszSpec="*.7z") returned 0 [0093.058] lstrlenA (lpString="*.7z") returned 4 [0093.058] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate.css", pszSpec="*.tar") returned 0 [0093.058] lstrlenA (lpString="*.tar") returned 5 [0093.058] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate.css", pszSpec="*.gzip") returned 0 [0093.058] lstrlenA (lpString="*.gzip") returned 6 [0093.058] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate.css", pszSpec="*.jpg") returned 0 [0093.058] lstrlenA (lpString="*.jpg") returned 5 [0093.058] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate.css", pszSpec="*.jpeg") returned 0 [0093.058] lstrlenA (lpString="*.jpeg") returned 6 [0093.058] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate.css", pszSpec="*.psd") returned 0 [0093.058] lstrlenA (lpString="*.psd") returned 5 [0093.058] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate.css", pszSpec="*.cdr") returned 0 [0093.058] lstrlenA (lpString="*.cdr") returned 5 [0093.058] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate.css", pszSpec="*.dwg") returned 0 [0093.058] lstrlenA (lpString="*.dwg") returned 5 [0093.058] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate.css", pszSpec="*.max") returned 0 [0093.058] lstrlenA (lpString="*.max") returned 5 [0093.059] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate.css", pszSpec="*.bmp") returned 0 [0093.059] lstrlenA (lpString="*.bmp") returned 5 [0093.059] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate.css", pszSpec="*.gif") returned 0 [0093.059] lstrlenA (lpString="*.gif") returned 5 [0093.059] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate.css", pszSpec="*.png") returned 0 [0093.059] lstrlenA (lpString="*.png") returned 5 [0093.059] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate.css", pszSpec="*.doc") returned 0 [0093.059] lstrlenA (lpString="*.doc") returned 5 [0093.059] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate.css", pszSpec="*.docx") returned 0 [0093.059] lstrlenA (lpString="*.docx") returned 6 [0093.059] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate.css", pszSpec="*.xls") returned 0 [0093.059] lstrlenA (lpString="*.xls") returned 5 [0093.059] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate.css", pszSpec="*.xlsx") returned 0 [0093.059] lstrlenA (lpString="*.xlsx") returned 6 [0093.059] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate.css", pszSpec="*.ppt") returned 0 [0093.059] lstrlenA (lpString="*.ppt") returned 5 [0093.059] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate.css", pszSpec="*.pptx") returned 0 [0093.059] lstrlenA (lpString="*.pptx") returned 6 [0093.059] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate.css", pszSpec="*.txt") returned 0 [0093.059] lstrlenA (lpString="*.txt") returned 5 [0093.059] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate.css", pszSpec="*.pdf") returned 0 [0093.059] lstrlenA (lpString="*.pdf") returned 5 [0093.059] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate.css", pszSpec="*.djvu") returned 0 [0093.059] lstrlenA (lpString="*.djvu") returned 6 [0093.059] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate.css", pszSpec="*.htm") returned 0 [0093.059] lstrlenA (lpString="*.htm") returned 5 [0093.059] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate.css", pszSpec="*.html") returned 0 [0093.059] lstrlenA (lpString="*.html") returned 6 [0093.059] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate.css", pszSpec="*.mdb") returned 0 [0093.059] lstrlenA (lpString="*.mdb") returned 5 [0093.059] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate.css", pszSpec="*.cer") returned 0 [0093.059] lstrlenA (lpString="*.cer") returned 5 [0093.059] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate.css", pszSpec="*.p12") returned 0 [0093.059] lstrlenA (lpString="*.p12") returned 5 [0093.059] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate.css", pszSpec="*.pfx") returned 0 [0093.059] lstrlenA (lpString="*.pfx") returned 5 [0093.059] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate.css", pszSpec="*.kwm") returned 0 [0093.060] lstrlenA (lpString="*.kwm") returned 5 [0093.060] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate.css", pszSpec="*.pwm") returned 0 [0093.060] lstrlenA (lpString="*.pwm") returned 5 [0093.060] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate.css", pszSpec="*.1cd") returned 0 [0093.060] lstrlenA (lpString="*.1cd") returned 5 [0093.060] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate.css", pszSpec="*.md") returned 0 [0093.060] lstrlenA (lpString="*.md") returned 4 [0093.060] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate.css", pszSpec="*.mdf") returned 0 [0093.060] lstrlenA (lpString="*.mdf") returned 5 [0093.060] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate.css", pszSpec="*.dbf") returned 0 [0093.060] lstrlenA (lpString="*.dbf") returned 5 [0093.060] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate.css", pszSpec="*.odt") returned 0 [0093.060] lstrlenA (lpString="*.odt") returned 5 [0093.060] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate.css", pszSpec="*.vob") returned 0 [0093.060] lstrlenA (lpString="*.vob") returned 5 [0093.060] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate.css", pszSpec="*.ifo") returned 0 [0093.060] lstrlenA (lpString="*.ifo") returned 5 [0093.060] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate.css", pszSpec="*.lnk") returned 0 [0093.060] lstrlenA (lpString="*.lnk") returned 5 [0093.060] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate.css", pszSpec="*.torrent") returned 0 [0093.060] lstrlenA (lpString="*.torrent") returned 9 [0093.060] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate.css", pszSpec="*.mov") returned 0 [0093.060] lstrlenA (lpString="*.mov") returned 5 [0093.060] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate.css", pszSpec="*.m2v") returned 0 [0093.060] lstrlenA (lpString="*.m2v") returned 5 [0093.060] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate.css", pszSpec="*.3gp") returned 0 [0093.060] lstrlenA (lpString="*.3gp") returned 5 [0093.060] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate.css", pszSpec="*.mpeg") returned 0 [0093.060] lstrlenA (lpString="*.mpeg") returned 6 [0093.060] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate.css", pszSpec="*.mpg") returned 0 [0093.060] lstrlenA (lpString="*.mpg") returned 5 [0093.060] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate.css", pszSpec="*.flv") returned 0 [0093.060] lstrlenA (lpString="*.flv") returned 5 [0093.060] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate.css", pszSpec="*.avi") returned 0 [0093.060] lstrlenA (lpString="*.avi") returned 5 [0093.061] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate.css", pszSpec="*.mp4") returned 0 [0093.061] lstrlenA (lpString="*.mp4") returned 5 [0093.061] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate.css", pszSpec="*.wmv") returned 0 [0093.061] lstrlenA (lpString="*.wmv") returned 5 [0093.061] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate.css", pszSpec="*.divx") returned 0 [0093.061] lstrlenA (lpString="*.divx") returned 6 [0093.061] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate.css", pszSpec="*.mkv") returned 0 [0093.061] lstrlenA (lpString="*.mkv") returned 5 [0093.061] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate.css", pszSpec="*.mp3") returned 0 [0093.061] lstrlenA (lpString="*.mp3") returned 5 [0093.061] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate.css", pszSpec="*.wav") returned 0 [0093.061] lstrlenA (lpString="*.wav") returned 5 [0093.061] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate.css", pszSpec="*.flac") returned 0 [0093.061] lstrlenA (lpString="*.flac") returned 6 [0093.061] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate.css", pszSpec="*.ape") returned 0 [0093.061] lstrlenA (lpString="*.ape") returned 5 [0093.061] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate.css", pszSpec="*.wma") returned 0 [0093.061] lstrlenA (lpString="*.wma") returned 5 [0093.061] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate.css", pszSpec="*.ac3") returned 0 [0093.061] lstrlenA (lpString="*.ac3") returned 5 [0093.061] FindNextFileA (in: hFindFile=0x5b7d70, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0093.061] PeekMessageA (in: lpMsg=0xaece4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaece4) returned 0 [0093.061] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="SlateBlue.css") returned -1 [0093.061] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SlateBlue.css") returned -1 [0093.061] lstrcmpiA (lpString1="", lpString2="SlateBlue.css") returned -1 [0093.061] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate.css") returned="Slate.css" [0093.061] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\", lpString2="SlateBlue.css" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SlateBlue.css") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SlateBlue.css" [0093.061] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SlateBlue.css", pszSpec="*.zip") returned 0 [0093.061] lstrlenA (lpString="*.zip") returned 5 [0093.061] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SlateBlue.css", pszSpec="*.rar") returned 0 [0093.061] lstrlenA (lpString="*.rar") returned 5 [0093.061] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SlateBlue.css", pszSpec="*.7z") returned 0 [0093.061] lstrlenA (lpString="*.7z") returned 4 [0093.061] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SlateBlue.css", pszSpec="*.tar") returned 0 [0093.062] lstrlenA (lpString="*.tar") returned 5 [0093.062] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SlateBlue.css", pszSpec="*.gzip") returned 0 [0093.062] lstrlenA (lpString="*.gzip") returned 6 [0093.062] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SlateBlue.css", pszSpec="*.jpg") returned 0 [0093.062] lstrlenA (lpString="*.jpg") returned 5 [0093.062] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SlateBlue.css", pszSpec="*.jpeg") returned 0 [0093.062] lstrlenA (lpString="*.jpeg") returned 6 [0093.062] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SlateBlue.css", pszSpec="*.psd") returned 0 [0093.062] lstrlenA (lpString="*.psd") returned 5 [0093.062] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SlateBlue.css", pszSpec="*.cdr") returned 0 [0093.062] lstrlenA (lpString="*.cdr") returned 5 [0093.062] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SlateBlue.css", pszSpec="*.dwg") returned 0 [0093.062] lstrlenA (lpString="*.dwg") returned 5 [0093.062] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SlateBlue.css", pszSpec="*.max") returned 0 [0093.062] lstrlenA (lpString="*.max") returned 5 [0093.062] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SlateBlue.css", pszSpec="*.bmp") returned 0 [0093.062] lstrlenA (lpString="*.bmp") returned 5 [0093.062] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SlateBlue.css", pszSpec="*.gif") returned 0 [0093.062] lstrlenA (lpString="*.gif") returned 5 [0093.062] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SlateBlue.css", pszSpec="*.png") returned 0 [0093.062] lstrlenA (lpString="*.png") returned 5 [0093.062] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SlateBlue.css", pszSpec="*.doc") returned 0 [0093.062] lstrlenA (lpString="*.doc") returned 5 [0093.062] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SlateBlue.css", pszSpec="*.docx") returned 0 [0093.062] lstrlenA (lpString="*.docx") returned 6 [0093.062] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SlateBlue.css", pszSpec="*.xls") returned 0 [0093.062] lstrlenA (lpString="*.xls") returned 5 [0093.062] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SlateBlue.css", pszSpec="*.xlsx") returned 0 [0093.062] lstrlenA (lpString="*.xlsx") returned 6 [0093.062] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SlateBlue.css", pszSpec="*.ppt") returned 0 [0093.062] lstrlenA (lpString="*.ppt") returned 5 [0093.062] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SlateBlue.css", pszSpec="*.pptx") returned 0 [0093.062] lstrlenA (lpString="*.pptx") returned 6 [0093.062] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SlateBlue.css", pszSpec="*.txt") returned 0 [0093.062] lstrlenA (lpString="*.txt") returned 5 [0093.062] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SlateBlue.css", pszSpec="*.pdf") returned 0 [0093.063] lstrlenA (lpString="*.pdf") returned 5 [0093.063] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SlateBlue.css", pszSpec="*.djvu") returned 0 [0093.063] lstrlenA (lpString="*.djvu") returned 6 [0093.063] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SlateBlue.css", pszSpec="*.htm") returned 0 [0093.063] lstrlenA (lpString="*.htm") returned 5 [0093.063] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SlateBlue.css", pszSpec="*.html") returned 0 [0093.063] lstrlenA (lpString="*.html") returned 6 [0093.063] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SlateBlue.css", pszSpec="*.mdb") returned 0 [0093.063] lstrlenA (lpString="*.mdb") returned 5 [0093.063] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SlateBlue.css", pszSpec="*.cer") returned 0 [0093.063] lstrlenA (lpString="*.cer") returned 5 [0093.063] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SlateBlue.css", pszSpec="*.p12") returned 0 [0093.063] lstrlenA (lpString="*.p12") returned 5 [0093.063] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SlateBlue.css", pszSpec="*.pfx") returned 0 [0093.063] lstrlenA (lpString="*.pfx") returned 5 [0093.063] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SlateBlue.css", pszSpec="*.kwm") returned 0 [0093.063] lstrlenA (lpString="*.kwm") returned 5 [0093.063] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SlateBlue.css", pszSpec="*.pwm") returned 0 [0093.063] lstrlenA (lpString="*.pwm") returned 5 [0093.063] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SlateBlue.css", pszSpec="*.1cd") returned 0 [0093.063] lstrlenA (lpString="*.1cd") returned 5 [0093.063] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SlateBlue.css", pszSpec="*.md") returned 0 [0093.063] lstrlenA (lpString="*.md") returned 4 [0093.063] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SlateBlue.css", pszSpec="*.mdf") returned 0 [0093.063] lstrlenA (lpString="*.mdf") returned 5 [0093.063] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SlateBlue.css", pszSpec="*.dbf") returned 0 [0093.063] lstrlenA (lpString="*.dbf") returned 5 [0093.063] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SlateBlue.css", pszSpec="*.odt") returned 0 [0093.063] lstrlenA (lpString="*.odt") returned 5 [0093.063] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SlateBlue.css", pszSpec="*.vob") returned 0 [0093.063] lstrlenA (lpString="*.vob") returned 5 [0093.063] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SlateBlue.css", pszSpec="*.ifo") returned 0 [0093.063] lstrlenA (lpString="*.ifo") returned 5 [0093.063] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SlateBlue.css", pszSpec="*.lnk") returned 0 [0093.063] lstrlenA (lpString="*.lnk") returned 5 [0093.063] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SlateBlue.css", pszSpec="*.torrent") returned 0 [0093.064] lstrlenA (lpString="*.torrent") returned 9 [0093.064] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SlateBlue.css", pszSpec="*.mov") returned 0 [0093.064] lstrlenA (lpString="*.mov") returned 5 [0093.064] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SlateBlue.css", pszSpec="*.m2v") returned 0 [0093.064] lstrlenA (lpString="*.m2v") returned 5 [0093.064] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SlateBlue.css", pszSpec="*.3gp") returned 0 [0093.064] lstrlenA (lpString="*.3gp") returned 5 [0093.064] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SlateBlue.css", pszSpec="*.mpeg") returned 0 [0093.064] lstrlenA (lpString="*.mpeg") returned 6 [0093.064] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SlateBlue.css", pszSpec="*.mpg") returned 0 [0093.064] lstrlenA (lpString="*.mpg") returned 5 [0093.064] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SlateBlue.css", pszSpec="*.flv") returned 0 [0093.064] lstrlenA (lpString="*.flv") returned 5 [0093.064] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SlateBlue.css", pszSpec="*.avi") returned 0 [0093.064] lstrlenA (lpString="*.avi") returned 5 [0093.064] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SlateBlue.css", pszSpec="*.mp4") returned 0 [0093.064] lstrlenA (lpString="*.mp4") returned 5 [0093.064] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SlateBlue.css", pszSpec="*.wmv") returned 0 [0093.064] lstrlenA (lpString="*.wmv") returned 5 [0093.064] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SlateBlue.css", pszSpec="*.divx") returned 0 [0093.064] lstrlenA (lpString="*.divx") returned 6 [0093.064] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SlateBlue.css", pszSpec="*.mkv") returned 0 [0093.064] lstrlenA (lpString="*.mkv") returned 5 [0093.064] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SlateBlue.css", pszSpec="*.mp3") returned 0 [0093.064] lstrlenA (lpString="*.mp3") returned 5 [0093.064] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SlateBlue.css", pszSpec="*.wav") returned 0 [0093.064] lstrlenA (lpString="*.wav") returned 5 [0093.064] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SlateBlue.css", pszSpec="*.flac") returned 0 [0093.064] lstrlenA (lpString="*.flac") returned 6 [0093.064] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SlateBlue.css", pszSpec="*.ape") returned 0 [0093.064] lstrlenA (lpString="*.ape") returned 5 [0093.064] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SlateBlue.css", pszSpec="*.wma") returned 0 [0093.064] lstrlenA (lpString="*.wma") returned 5 [0093.064] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SlateBlue.css", pszSpec="*.ac3") returned 0 [0093.064] lstrlenA (lpString="*.ac3") returned 5 [0093.064] FindNextFileA (in: hFindFile=0x5b7d70, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0093.064] lstrcmpA (lpString1=".", lpString2="SoftBlue") returned -1 [0093.065] lstrcmpA (lpString1="..", lpString2="SoftBlue") returned -1 [0093.065] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SlateBlue.css") returned="SlateBlue.css" [0093.065] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\", lpString2="SoftBlue" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue" [0093.065] lstrlenA (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue") returned 103 [0093.065] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\*.*", lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 0x5be160 [0093.065] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0093.065] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 1 [0093.065] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0093.065] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0093.065] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 1 [0093.065] PeekMessageA (in: lpMsg=0xaeb94, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaeb94) returned 0 [0093.065] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="background.gif") returned 1 [0093.065] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="background.gif") returned 1 [0093.065] lstrcmpiA (lpString1="", lpString2="background.gif") returned -1 [0093.065] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\*.*") returned="*.*" [0093.065] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\", lpString2="background.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\background.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\background.gif" [0093.065] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\background.gif", pszSpec="*.zip") returned 0 [0093.065] lstrlenA (lpString="*.zip") returned 5 [0093.065] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\background.gif", pszSpec="*.rar") returned 0 [0093.065] lstrlenA (lpString="*.rar") returned 5 [0093.065] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\background.gif", pszSpec="*.7z") returned 0 [0093.065] lstrlenA (lpString="*.7z") returned 4 [0093.065] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\background.gif", pszSpec="*.tar") returned 0 [0093.065] lstrlenA (lpString="*.tar") returned 5 [0093.066] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\background.gif", pszSpec="*.gzip") returned 0 [0093.066] lstrlenA (lpString="*.gzip") returned 6 [0093.066] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\background.gif", pszSpec="*.jpg") returned 0 [0093.066] lstrlenA (lpString="*.jpg") returned 5 [0093.066] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\background.gif", pszSpec="*.jpeg") returned 0 [0093.066] lstrlenA (lpString="*.jpeg") returned 6 [0093.066] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\background.gif", pszSpec="*.psd") returned 0 [0093.066] lstrlenA (lpString="*.psd") returned 5 [0093.066] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\background.gif", pszSpec="*.cdr") returned 0 [0093.066] lstrlenA (lpString="*.cdr") returned 5 [0093.066] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\background.gif", pszSpec="*.dwg") returned 0 [0093.066] lstrlenA (lpString="*.dwg") returned 5 [0093.066] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\background.gif", pszSpec="*.max") returned 0 [0093.066] lstrlenA (lpString="*.max") returned 5 [0093.066] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\background.gif", pszSpec="*.bmp") returned 0 [0093.066] lstrlenA (lpString="*.bmp") returned 5 [0093.066] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\background.gif", pszSpec="*.gif") returned 1 [0093.066] lstrlenA (lpString="*.gif") returned 5 [0093.066] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\background.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\background.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\background.gif" [0093.066] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\background.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\background.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\background.gif" [0093.066] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\background.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\background.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\background.gif." [0093.066] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\background.gif.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\background.gif. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\background.gif. " [0093.066] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\background.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\softblue\\background.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0 [0093.067] GetFileSize (in: hFile=0xa0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1afa [0093.067] GetFileTime (in: hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x94570a00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x528f6190, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x94570a00, dwHighDateTime=0x1c747ea)) returned 1 [0093.068] SetFilePointer (in: hFile=0xa0, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0093.068] ReadFile (in: hFile=0xa0, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x1aa0, lpOverlapped=0x0) returned 1 [0093.098] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\background.gif") returned="background.gif" [0093.098] SetFilePointer (in: hFile=0xa0, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0093.098] WriteFile (in: hFile=0xa0, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x1aa0, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x1aa0, lpOverlapped=0x0) returned 1 [0093.098] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0093.098] CloseHandle (hObject=0xa0) returned 1 [0093.099] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\background.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\softblue\\background.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\background.gif. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\softblue\\background.gif. ")) returned 1 [0093.100] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 1 [0093.100] PeekMessageA (in: lpMsg=0xaeb94, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaeb94) returned 0 [0093.100] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="tab_off.gif") returned -1 [0093.100] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="tab_off.gif") returned -1 [0093.100] lstrcmpiA (lpString1="", lpString2="tab_off.gif") returned -1 [0093.100] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\background.gif") returned="background.gif" [0093.100] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\", lpString2="tab_off.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_off.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_off.gif" [0093.100] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_off.gif", pszSpec="*.zip") returned 0 [0093.100] lstrlenA (lpString="*.zip") returned 5 [0093.100] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_off.gif", pszSpec="*.rar") returned 0 [0093.100] lstrlenA (lpString="*.rar") returned 5 [0093.100] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_off.gif", pszSpec="*.7z") returned 0 [0093.100] lstrlenA (lpString="*.7z") returned 4 [0093.100] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_off.gif", pszSpec="*.tar") returned 0 [0093.100] lstrlenA (lpString="*.tar") returned 5 [0093.100] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_off.gif", pszSpec="*.gzip") returned 0 [0093.100] lstrlenA (lpString="*.gzip") returned 6 [0093.100] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_off.gif", pszSpec="*.jpg") returned 0 [0093.101] lstrlenA (lpString="*.jpg") returned 5 [0093.101] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_off.gif", pszSpec="*.jpeg") returned 0 [0093.101] lstrlenA (lpString="*.jpeg") returned 6 [0093.101] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_off.gif", pszSpec="*.psd") returned 0 [0093.101] lstrlenA (lpString="*.psd") returned 5 [0093.101] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_off.gif", pszSpec="*.cdr") returned 0 [0093.101] lstrlenA (lpString="*.cdr") returned 5 [0093.101] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_off.gif", pszSpec="*.dwg") returned 0 [0093.101] lstrlenA (lpString="*.dwg") returned 5 [0093.101] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_off.gif", pszSpec="*.max") returned 0 [0093.101] lstrlenA (lpString="*.max") returned 5 [0093.101] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_off.gif", pszSpec="*.bmp") returned 0 [0093.101] lstrlenA (lpString="*.bmp") returned 5 [0093.101] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_off.gif", pszSpec="*.gif") returned 1 [0093.101] lstrlenA (lpString="*.gif") returned 5 [0093.101] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_off.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_off.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_off.gif" [0093.101] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_off.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_off.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_off.gif" [0093.101] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_off.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_off.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_off.gif." [0093.101] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_off.gif.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_off.gif. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_off.gif. " [0093.101] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_off.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\softblue\\tab_off.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0 [0093.102] GetFileSize (in: hFile=0xa0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x155 [0093.102] GetFileTime (in: hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x94570a00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x618c8a10, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x94570a00, dwHighDateTime=0x1c747ea)) returned 1 [0093.102] SetFilePointer (in: hFile=0xa0, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0093.102] ReadFile (in: hFile=0xa0, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0xfb, lpOverlapped=0x0) returned 1 [0093.103] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_off.gif") returned="tab_off.gif" [0093.103] SetFilePointer (in: hFile=0xa0, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0093.103] WriteFile (in: hFile=0xa0, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0xfb, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0xfb, lpOverlapped=0x0) returned 1 [0093.103] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0093.103] CloseHandle (hObject=0xa0) returned 1 [0093.103] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_off.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\softblue\\tab_off.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_off.gif. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\softblue\\tab_off.gif. ")) returned 1 [0093.104] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 1 [0093.104] PeekMessageA (in: lpMsg=0xaeb94, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaeb94) returned 0 [0093.104] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="tab_on.gif") returned -1 [0093.104] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="tab_on.gif") returned -1 [0093.104] lstrcmpiA (lpString1="", lpString2="tab_on.gif") returned -1 [0093.104] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_off.gif") returned="tab_off.gif" [0093.104] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\", lpString2="tab_on.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_on.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_on.gif" [0093.104] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_on.gif", pszSpec="*.zip") returned 0 [0093.104] lstrlenA (lpString="*.zip") returned 5 [0093.104] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_on.gif", pszSpec="*.rar") returned 0 [0093.104] lstrlenA (lpString="*.rar") returned 5 [0093.105] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_on.gif", pszSpec="*.7z") returned 0 [0093.105] lstrlenA (lpString="*.7z") returned 4 [0093.105] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_on.gif", pszSpec="*.tar") returned 0 [0093.105] lstrlenA (lpString="*.tar") returned 5 [0093.105] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_on.gif", pszSpec="*.gzip") returned 0 [0093.105] lstrlenA (lpString="*.gzip") returned 6 [0093.105] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_on.gif", pszSpec="*.jpg") returned 0 [0093.105] lstrlenA (lpString="*.jpg") returned 5 [0093.105] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_on.gif", pszSpec="*.jpeg") returned 0 [0093.105] lstrlenA (lpString="*.jpeg") returned 6 [0093.105] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_on.gif", pszSpec="*.psd") returned 0 [0093.105] lstrlenA (lpString="*.psd") returned 5 [0093.105] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_on.gif", pszSpec="*.cdr") returned 0 [0093.105] lstrlenA (lpString="*.cdr") returned 5 [0093.105] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_on.gif", pszSpec="*.dwg") returned 0 [0093.105] lstrlenA (lpString="*.dwg") returned 5 [0093.105] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_on.gif", pszSpec="*.max") returned 0 [0093.105] lstrlenA (lpString="*.max") returned 5 [0093.105] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_on.gif", pszSpec="*.bmp") returned 0 [0093.105] lstrlenA (lpString="*.bmp") returned 5 [0093.105] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_on.gif", pszSpec="*.gif") returned 1 [0093.105] lstrlenA (lpString="*.gif") returned 5 [0093.105] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_on.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_on.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_on.gif" [0093.105] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_on.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_on.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_on.gif" [0093.105] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_on.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_on.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_on.gif." [0093.105] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_on.gif.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_on.gif. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_on.gif. " [0093.105] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_on.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\softblue\\tab_on.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0 [0093.106] GetFileSize (in: hFile=0xa0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xde [0093.106] GetFileTime (in: hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x94570a00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x528f6190, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x94570a00, dwHighDateTime=0x1c747ea)) returned 1 [0093.106] SetFilePointer (in: hFile=0xa0, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0093.106] ReadFile (in: hFile=0xa0, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x84, lpOverlapped=0x0) returned 1 [0093.106] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_on.gif") returned="tab_on.gif" [0093.106] SetFilePointer (in: hFile=0xa0, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0093.106] WriteFile (in: hFile=0xa0, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x84, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x84, lpOverlapped=0x0) returned 1 [0093.107] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0093.107] CloseHandle (hObject=0xa0) returned 1 [0093.107] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_on.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\softblue\\tab_on.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_on.gif. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\softblue\\tab_on.gif. ")) returned 1 [0093.108] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 0 [0093.108] FindClose (in: hFindFile=0x5be160 | out: hFindFile=0x5be160) returned 1 [0093.108] FindNextFileA (in: hFindFile=0x5b7d70, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0093.108] PeekMessageA (in: lpMsg=0xaece4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaece4) returned 0 [0093.108] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="SoftBlue.css") returned -1 [0093.108] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SoftBlue.css") returned -1 [0093.108] lstrcmpiA (lpString1="", lpString2="SoftBlue.css") returned -1 [0093.108] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\*.*") returned="*.*" [0093.108] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\", lpString2="SoftBlue.css" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue.css") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue.css" [0093.109] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue.css", pszSpec="*.zip") returned 0 [0093.109] lstrlenA (lpString="*.zip") returned 5 [0093.109] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue.css", pszSpec="*.rar") returned 0 [0093.109] lstrlenA (lpString="*.rar") returned 5 [0093.109] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue.css", pszSpec="*.7z") returned 0 [0093.109] lstrlenA (lpString="*.7z") returned 4 [0093.109] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue.css", pszSpec="*.tar") returned 0 [0093.109] lstrlenA (lpString="*.tar") returned 5 [0093.109] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue.css", pszSpec="*.gzip") returned 0 [0093.109] lstrlenA (lpString="*.gzip") returned 6 [0093.109] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue.css", pszSpec="*.jpg") returned 0 [0093.109] lstrlenA (lpString="*.jpg") returned 5 [0093.109] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue.css", pszSpec="*.jpeg") returned 0 [0093.109] lstrlenA (lpString="*.jpeg") returned 6 [0093.109] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue.css", pszSpec="*.psd") returned 0 [0093.109] lstrlenA (lpString="*.psd") returned 5 [0093.109] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue.css", pszSpec="*.cdr") returned 0 [0093.109] lstrlenA (lpString="*.cdr") returned 5 [0093.109] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue.css", pszSpec="*.dwg") returned 0 [0093.109] lstrlenA (lpString="*.dwg") returned 5 [0093.109] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue.css", pszSpec="*.max") returned 0 [0093.109] lstrlenA (lpString="*.max") returned 5 [0093.109] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue.css", pszSpec="*.bmp") returned 0 [0093.109] lstrlenA (lpString="*.bmp") returned 5 [0093.109] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue.css", pszSpec="*.gif") returned 0 [0093.109] lstrlenA (lpString="*.gif") returned 5 [0093.109] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue.css", pszSpec="*.png") returned 0 [0093.109] lstrlenA (lpString="*.png") returned 5 [0093.109] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue.css", pszSpec="*.doc") returned 0 [0093.109] lstrlenA (lpString="*.doc") returned 5 [0093.109] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue.css", pszSpec="*.docx") returned 0 [0093.109] lstrlenA (lpString="*.docx") returned 6 [0093.109] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue.css", pszSpec="*.xls") returned 0 [0093.109] lstrlenA (lpString="*.xls") returned 5 [0093.109] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue.css", pszSpec="*.xlsx") returned 0 [0093.109] lstrlenA (lpString="*.xlsx") returned 6 [0093.109] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue.css", pszSpec="*.ppt") returned 0 [0093.109] lstrlenA (lpString="*.ppt") returned 5 [0093.109] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue.css", pszSpec="*.pptx") returned 0 [0093.109] lstrlenA (lpString="*.pptx") returned 6 [0093.109] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue.css", pszSpec="*.txt") returned 0 [0093.109] lstrlenA (lpString="*.txt") returned 5 [0093.109] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue.css", pszSpec="*.pdf") returned 0 [0093.109] lstrlenA (lpString="*.pdf") returned 5 [0093.109] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue.css", pszSpec="*.djvu") returned 0 [0093.109] lstrlenA (lpString="*.djvu") returned 6 [0093.109] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue.css", pszSpec="*.htm") returned 0 [0093.109] lstrlenA (lpString="*.htm") returned 5 [0093.110] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue.css", pszSpec="*.html") returned 0 [0093.110] lstrlenA (lpString="*.html") returned 6 [0093.110] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue.css", pszSpec="*.mdb") returned 0 [0093.110] lstrlenA (lpString="*.mdb") returned 5 [0093.110] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue.css", pszSpec="*.cer") returned 0 [0093.110] lstrlenA (lpString="*.cer") returned 5 [0093.110] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue.css", pszSpec="*.p12") returned 0 [0093.110] lstrlenA (lpString="*.p12") returned 5 [0093.110] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue.css", pszSpec="*.pfx") returned 0 [0093.110] lstrlenA (lpString="*.pfx") returned 5 [0093.110] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue.css", pszSpec="*.kwm") returned 0 [0093.110] lstrlenA (lpString="*.kwm") returned 5 [0093.110] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue.css", pszSpec="*.pwm") returned 0 [0093.110] lstrlenA (lpString="*.pwm") returned 5 [0093.110] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue.css", pszSpec="*.1cd") returned 0 [0093.110] lstrlenA (lpString="*.1cd") returned 5 [0093.110] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue.css", pszSpec="*.md") returned 0 [0093.110] lstrlenA (lpString="*.md") returned 4 [0093.110] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue.css", pszSpec="*.mdf") returned 0 [0093.110] lstrlenA (lpString="*.mdf") returned 5 [0093.110] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue.css", pszSpec="*.dbf") returned 0 [0093.110] lstrlenA (lpString="*.dbf") returned 5 [0093.110] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue.css", pszSpec="*.odt") returned 0 [0093.110] lstrlenA (lpString="*.odt") returned 5 [0093.110] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue.css", pszSpec="*.vob") returned 0 [0093.110] lstrlenA (lpString="*.vob") returned 5 [0093.110] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue.css", pszSpec="*.ifo") returned 0 [0093.110] lstrlenA (lpString="*.ifo") returned 5 [0093.110] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue.css", pszSpec="*.lnk") returned 0 [0093.110] lstrlenA (lpString="*.lnk") returned 5 [0093.110] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue.css", pszSpec="*.torrent") returned 0 [0093.110] lstrlenA (lpString="*.torrent") returned 9 [0093.110] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue.css", pszSpec="*.mov") returned 0 [0093.110] lstrlenA (lpString="*.mov") returned 5 [0093.110] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue.css", pszSpec="*.m2v") returned 0 [0093.110] lstrlenA (lpString="*.m2v") returned 5 [0093.110] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue.css", pszSpec="*.3gp") returned 0 [0093.110] lstrlenA (lpString="*.3gp") returned 5 [0093.110] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue.css", pszSpec="*.mpeg") returned 0 [0093.110] lstrlenA (lpString="*.mpeg") returned 6 [0093.110] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue.css", pszSpec="*.mpg") returned 0 [0093.110] lstrlenA (lpString="*.mpg") returned 5 [0093.110] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue.css", pszSpec="*.flv") returned 0 [0093.110] lstrlenA (lpString="*.flv") returned 5 [0093.110] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue.css", pszSpec="*.avi") returned 0 [0093.110] lstrlenA (lpString="*.avi") returned 5 [0093.110] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue.css", pszSpec="*.mp4") returned 0 [0093.110] lstrlenA (lpString="*.mp4") returned 5 [0093.110] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue.css", pszSpec="*.wmv") returned 0 [0093.111] lstrlenA (lpString="*.wmv") returned 5 [0093.111] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue.css", pszSpec="*.divx") returned 0 [0093.111] lstrlenA (lpString="*.divx") returned 6 [0093.111] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue.css", pszSpec="*.mkv") returned 0 [0093.111] lstrlenA (lpString="*.mkv") returned 5 [0093.111] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue.css", pszSpec="*.mp3") returned 0 [0093.111] lstrlenA (lpString="*.mp3") returned 5 [0093.111] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue.css", pszSpec="*.wav") returned 0 [0093.111] lstrlenA (lpString="*.wav") returned 5 [0093.111] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue.css", pszSpec="*.flac") returned 0 [0093.111] lstrlenA (lpString="*.flac") returned 6 [0093.111] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue.css", pszSpec="*.ape") returned 0 [0093.111] lstrlenA (lpString="*.ape") returned 5 [0093.111] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue.css", pszSpec="*.wma") returned 0 [0093.111] lstrlenA (lpString="*.wma") returned 5 [0093.111] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue.css", pszSpec="*.ac3") returned 0 [0093.111] lstrlenA (lpString="*.ac3") returned 5 [0093.111] FindNextFileA (in: hFindFile=0x5b7d70, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0093.111] lstrcmpA (lpString1=".", lpString2="SpringGreen") returned -1 [0093.111] lstrcmpA (lpString1="..", lpString2="SpringGreen") returned -1 [0093.111] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue.css") returned="SoftBlue.css" [0093.111] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\", lpString2="SpringGreen" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen" [0093.111] lstrlenA (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen") returned 106 [0093.111] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\*.*", lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 0x5be160 [0093.111] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0093.111] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 1 [0093.111] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0093.111] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0093.111] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 1 [0093.111] PeekMessageA (in: lpMsg=0xaeb94, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaeb94) returned 0 [0093.111] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BUTTON.GIF") returned 1 [0093.111] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BUTTON.GIF") returned 1 [0093.111] lstrcmpiA (lpString1="", lpString2="BUTTON.GIF") returned -1 [0093.111] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\*.*") returned="*.*" [0093.111] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\", lpString2="BUTTON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\BUTTON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\BUTTON.GIF" [0093.112] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\BUTTON.GIF", pszSpec="*.zip") returned 0 [0093.112] lstrlenA (lpString="*.zip") returned 5 [0093.112] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\BUTTON.GIF", pszSpec="*.rar") returned 0 [0093.112] lstrlenA (lpString="*.rar") returned 5 [0093.112] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\BUTTON.GIF", pszSpec="*.7z") returned 0 [0093.112] lstrlenA (lpString="*.7z") returned 4 [0093.112] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\BUTTON.GIF", pszSpec="*.tar") returned 0 [0093.112] lstrlenA (lpString="*.tar") returned 5 [0093.112] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\BUTTON.GIF", pszSpec="*.gzip") returned 0 [0093.112] lstrlenA (lpString="*.gzip") returned 6 [0093.112] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\BUTTON.GIF", pszSpec="*.jpg") returned 0 [0093.112] lstrlenA (lpString="*.jpg") returned 5 [0093.112] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\BUTTON.GIF", pszSpec="*.jpeg") returned 0 [0093.112] lstrlenA (lpString="*.jpeg") returned 6 [0093.112] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\BUTTON.GIF", pszSpec="*.psd") returned 0 [0093.112] lstrlenA (lpString="*.psd") returned 5 [0093.112] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\BUTTON.GIF", pszSpec="*.cdr") returned 0 [0093.112] lstrlenA (lpString="*.cdr") returned 5 [0093.112] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\BUTTON.GIF", pszSpec="*.dwg") returned 0 [0093.112] lstrlenA (lpString="*.dwg") returned 5 [0093.112] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\BUTTON.GIF", pszSpec="*.max") returned 0 [0093.112] lstrlenA (lpString="*.max") returned 5 [0093.112] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\BUTTON.GIF", pszSpec="*.bmp") returned 0 [0093.112] lstrlenA (lpString="*.bmp") returned 5 [0093.112] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\BUTTON.GIF", pszSpec="*.gif") returned 1 [0093.112] lstrlenA (lpString="*.gif") returned 5 [0093.112] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\BUTTON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\BUTTON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\BUTTON.GIF" [0093.112] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\BUTTON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\BUTTON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\BUTTON.GIF" [0093.112] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\BUTTON.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\BUTTON.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\BUTTON.GIF." [0093.112] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\BUTTON.GIF.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\BUTTON.GIF. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\BUTTON.GIF. " [0093.112] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\BUTTON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\springgreen\\button.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0 [0093.113] GetFileSize (in: hFile=0xa0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1ac [0093.113] GetFileTime (in: hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x94570a00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x528f6190, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x94570a00, dwHighDateTime=0x1c747ea)) returned 1 [0093.113] SetFilePointer (in: hFile=0xa0, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0093.113] ReadFile (in: hFile=0xa0, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x152, lpOverlapped=0x0) returned 1 [0093.113] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\BUTTON.GIF") returned="BUTTON.GIF" [0093.113] SetFilePointer (in: hFile=0xa0, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0093.113] WriteFile (in: hFile=0xa0, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x152, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x152, lpOverlapped=0x0) returned 1 [0093.114] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0093.114] CloseHandle (hObject=0xa0) returned 1 [0093.114] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\BUTTON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\springgreen\\button.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\BUTTON.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\springgreen\\button.gif. ")) returned 1 [0093.115] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 1 [0093.115] PeekMessageA (in: lpMsg=0xaeb94, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaeb94) returned 0 [0093.115] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="TAB_OFF.GIF") returned -1 [0093.115] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TAB_OFF.GIF") returned -1 [0093.115] lstrcmpiA (lpString1="", lpString2="TAB_OFF.GIF") returned -1 [0093.115] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\BUTTON.GIF") returned="BUTTON.GIF" [0093.115] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\", lpString2="TAB_OFF.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_OFF.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_OFF.GIF" [0093.115] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_OFF.GIF", pszSpec="*.zip") returned 0 [0093.115] lstrlenA (lpString="*.zip") returned 5 [0093.115] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_OFF.GIF", pszSpec="*.rar") returned 0 [0093.115] lstrlenA (lpString="*.rar") returned 5 [0093.115] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_OFF.GIF", pszSpec="*.7z") returned 0 [0093.115] lstrlenA (lpString="*.7z") returned 4 [0093.115] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_OFF.GIF", pszSpec="*.tar") returned 0 [0093.115] lstrlenA (lpString="*.tar") returned 5 [0093.115] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_OFF.GIF", pszSpec="*.gzip") returned 0 [0093.115] lstrlenA (lpString="*.gzip") returned 6 [0093.115] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_OFF.GIF", pszSpec="*.jpg") returned 0 [0093.115] lstrlenA (lpString="*.jpg") returned 5 [0093.115] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_OFF.GIF", pszSpec="*.jpeg") returned 0 [0093.115] lstrlenA (lpString="*.jpeg") returned 6 [0093.115] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_OFF.GIF", pszSpec="*.psd") returned 0 [0093.115] lstrlenA (lpString="*.psd") returned 5 [0093.115] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_OFF.GIF", pszSpec="*.cdr") returned 0 [0093.116] lstrlenA (lpString="*.cdr") returned 5 [0093.116] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_OFF.GIF", pszSpec="*.dwg") returned 0 [0093.116] lstrlenA (lpString="*.dwg") returned 5 [0093.116] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_OFF.GIF", pszSpec="*.max") returned 0 [0093.116] lstrlenA (lpString="*.max") returned 5 [0093.116] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_OFF.GIF", pszSpec="*.bmp") returned 0 [0093.116] lstrlenA (lpString="*.bmp") returned 5 [0093.116] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_OFF.GIF", pszSpec="*.gif") returned 1 [0093.116] lstrlenA (lpString="*.gif") returned 5 [0093.116] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_OFF.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_OFF.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_OFF.GIF" [0093.116] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_OFF.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_OFF.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_OFF.GIF" [0093.116] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_OFF.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_OFF.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_OFF.GIF." [0093.116] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_OFF.GIF.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_OFF.GIF. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_OFF.GIF. " [0093.116] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\springgreen\\tab_off.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0 [0093.116] GetFileSize (in: hFile=0xa0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x155 [0093.116] GetFileTime (in: hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x94570a00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x618c8a10, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x94570a00, dwHighDateTime=0x1c747ea)) returned 1 [0093.116] SetFilePointer (in: hFile=0xa0, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0093.116] ReadFile (in: hFile=0xa0, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0xfb, lpOverlapped=0x0) returned 1 [0093.117] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_OFF.GIF") returned="TAB_OFF.GIF" [0093.117] SetFilePointer (in: hFile=0xa0, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0093.117] WriteFile (in: hFile=0xa0, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0xfb, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0xfb, lpOverlapped=0x0) returned 1 [0093.117] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0093.117] CloseHandle (hObject=0xa0) returned 1 [0093.118] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\springgreen\\tab_off.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_OFF.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\springgreen\\tab_off.gif. ")) returned 1 [0093.118] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 1 [0093.118] PeekMessageA (in: lpMsg=0xaeb94, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaeb94) returned 0 [0093.118] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="TAB_ON.GIF") returned -1 [0093.118] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TAB_ON.GIF") returned -1 [0093.118] lstrcmpiA (lpString1="", lpString2="TAB_ON.GIF") returned -1 [0093.118] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_OFF.GIF") returned="TAB_OFF.GIF" [0093.118] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\", lpString2="TAB_ON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_ON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_ON.GIF" [0093.119] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_ON.GIF", pszSpec="*.zip") returned 0 [0093.119] lstrlenA (lpString="*.zip") returned 5 [0093.119] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_ON.GIF", pszSpec="*.rar") returned 0 [0093.119] lstrlenA (lpString="*.rar") returned 5 [0093.119] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_ON.GIF", pszSpec="*.7z") returned 0 [0093.119] lstrlenA (lpString="*.7z") returned 4 [0093.119] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_ON.GIF", pszSpec="*.tar") returned 0 [0093.119] lstrlenA (lpString="*.tar") returned 5 [0093.119] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_ON.GIF", pszSpec="*.gzip") returned 0 [0093.119] lstrlenA (lpString="*.gzip") returned 6 [0093.119] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_ON.GIF", pszSpec="*.jpg") returned 0 [0093.119] lstrlenA (lpString="*.jpg") returned 5 [0093.119] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_ON.GIF", pszSpec="*.jpeg") returned 0 [0093.119] lstrlenA (lpString="*.jpeg") returned 6 [0093.119] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_ON.GIF", pszSpec="*.psd") returned 0 [0093.119] lstrlenA (lpString="*.psd") returned 5 [0093.119] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_ON.GIF", pszSpec="*.cdr") returned 0 [0093.119] lstrlenA (lpString="*.cdr") returned 5 [0093.119] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_ON.GIF", pszSpec="*.dwg") returned 0 [0093.119] lstrlenA (lpString="*.dwg") returned 5 [0093.119] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_ON.GIF", pszSpec="*.max") returned 0 [0093.119] lstrlenA (lpString="*.max") returned 5 [0093.119] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_ON.GIF", pszSpec="*.bmp") returned 0 [0093.119] lstrlenA (lpString="*.bmp") returned 5 [0093.119] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_ON.GIF", pszSpec="*.gif") returned 1 [0093.119] lstrlenA (lpString="*.gif") returned 5 [0093.119] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_ON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_ON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_ON.GIF" [0093.119] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_ON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_ON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_ON.GIF" [0093.119] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_ON.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_ON.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_ON.GIF." [0093.119] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_ON.GIF.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_ON.GIF. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_ON.GIF. " [0093.119] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\springgreen\\tab_on.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0 [0093.120] GetFileSize (in: hFile=0xa0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xde [0093.120] GetFileTime (in: hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x94570a00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x618c8a10, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x94570a00, dwHighDateTime=0x1c747ea)) returned 1 [0093.120] SetFilePointer (in: hFile=0xa0, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0093.120] ReadFile (in: hFile=0xa0, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x84, lpOverlapped=0x0) returned 1 [0093.120] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_ON.GIF") returned="TAB_ON.GIF" [0093.120] SetFilePointer (in: hFile=0xa0, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0093.120] WriteFile (in: hFile=0xa0, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x84, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x84, lpOverlapped=0x0) returned 1 [0093.120] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0093.121] CloseHandle (hObject=0xa0) returned 1 [0093.121] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\springgreen\\tab_on.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_ON.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\springgreen\\tab_on.gif. ")) returned 1 [0093.179] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 0 [0093.179] FindClose (in: hFindFile=0x5be160 | out: hFindFile=0x5be160) returned 1 [0093.179] FindNextFileA (in: hFindFile=0x5b7d70, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0093.179] PeekMessageA (in: lpMsg=0xaece4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaece4) returned 0 [0093.179] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="SpringGreen.css") returned -1 [0093.179] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SpringGreen.css") returned -1 [0093.179] lstrcmpiA (lpString1="", lpString2="SpringGreen.css") returned -1 [0093.179] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\*.*") returned="*.*" [0093.179] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\", lpString2="SpringGreen.css" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen.css") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen.css" [0093.179] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen.css", pszSpec="*.zip") returned 0 [0093.179] lstrlenA (lpString="*.zip") returned 5 [0093.179] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen.css", pszSpec="*.rar") returned 0 [0093.179] lstrlenA (lpString="*.rar") returned 5 [0093.179] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen.css", pszSpec="*.7z") returned 0 [0093.179] lstrlenA (lpString="*.7z") returned 4 [0093.180] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen.css", pszSpec="*.tar") returned 0 [0093.180] lstrlenA (lpString="*.tar") returned 5 [0093.180] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen.css", pszSpec="*.gzip") returned 0 [0093.180] lstrlenA (lpString="*.gzip") returned 6 [0093.180] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen.css", pszSpec="*.jpg") returned 0 [0093.180] lstrlenA (lpString="*.jpg") returned 5 [0093.180] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen.css", pszSpec="*.jpeg") returned 0 [0093.180] lstrlenA (lpString="*.jpeg") returned 6 [0093.180] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen.css", pszSpec="*.psd") returned 0 [0093.180] lstrlenA (lpString="*.psd") returned 5 [0093.180] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen.css", pszSpec="*.cdr") returned 0 [0093.180] lstrlenA (lpString="*.cdr") returned 5 [0093.180] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen.css", pszSpec="*.dwg") returned 0 [0093.180] lstrlenA (lpString="*.dwg") returned 5 [0093.180] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen.css", pszSpec="*.max") returned 0 [0093.180] lstrlenA (lpString="*.max") returned 5 [0093.180] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen.css", pszSpec="*.bmp") returned 0 [0093.180] lstrlenA (lpString="*.bmp") returned 5 [0093.180] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen.css", pszSpec="*.gif") returned 0 [0093.180] lstrlenA (lpString="*.gif") returned 5 [0093.180] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen.css", pszSpec="*.png") returned 0 [0093.180] lstrlenA (lpString="*.png") returned 5 [0093.180] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen.css", pszSpec="*.doc") returned 0 [0093.180] lstrlenA (lpString="*.doc") returned 5 [0093.180] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen.css", pszSpec="*.docx") returned 0 [0093.180] lstrlenA (lpString="*.docx") returned 6 [0093.180] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen.css", pszSpec="*.xls") returned 0 [0093.180] lstrlenA (lpString="*.xls") returned 5 [0093.180] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen.css", pszSpec="*.xlsx") returned 0 [0093.180] lstrlenA (lpString="*.xlsx") returned 6 [0093.180] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen.css", pszSpec="*.ppt") returned 0 [0093.180] lstrlenA (lpString="*.ppt") returned 5 [0093.180] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen.css", pszSpec="*.pptx") returned 0 [0093.180] lstrlenA (lpString="*.pptx") returned 6 [0093.180] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen.css", pszSpec="*.txt") returned 0 [0093.180] lstrlenA (lpString="*.txt") returned 5 [0093.180] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen.css", pszSpec="*.pdf") returned 0 [0093.180] lstrlenA (lpString="*.pdf") returned 5 [0093.180] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen.css", pszSpec="*.djvu") returned 0 [0093.180] lstrlenA (lpString="*.djvu") returned 6 [0093.180] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen.css", pszSpec="*.htm") returned 0 [0093.181] lstrlenA (lpString="*.htm") returned 5 [0093.181] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen.css", pszSpec="*.html") returned 0 [0093.181] lstrlenA (lpString="*.html") returned 6 [0093.181] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen.css", pszSpec="*.mdb") returned 0 [0093.181] lstrlenA (lpString="*.mdb") returned 5 [0093.181] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen.css", pszSpec="*.cer") returned 0 [0093.181] lstrlenA (lpString="*.cer") returned 5 [0093.181] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen.css", pszSpec="*.p12") returned 0 [0093.181] lstrlenA (lpString="*.p12") returned 5 [0093.181] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen.css", pszSpec="*.pfx") returned 0 [0093.181] lstrlenA (lpString="*.pfx") returned 5 [0093.181] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen.css", pszSpec="*.kwm") returned 0 [0093.181] lstrlenA (lpString="*.kwm") returned 5 [0093.181] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen.css", pszSpec="*.pwm") returned 0 [0093.181] lstrlenA (lpString="*.pwm") returned 5 [0093.181] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen.css", pszSpec="*.1cd") returned 0 [0093.181] lstrlenA (lpString="*.1cd") returned 5 [0093.181] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen.css", pszSpec="*.md") returned 0 [0093.181] lstrlenA (lpString="*.md") returned 4 [0093.181] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen.css", pszSpec="*.mdf") returned 0 [0093.181] lstrlenA (lpString="*.mdf") returned 5 [0093.181] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen.css", pszSpec="*.dbf") returned 0 [0093.181] lstrlenA (lpString="*.dbf") returned 5 [0093.181] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen.css", pszSpec="*.odt") returned 0 [0093.181] lstrlenA (lpString="*.odt") returned 5 [0093.181] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen.css", pszSpec="*.vob") returned 0 [0093.181] lstrlenA (lpString="*.vob") returned 5 [0093.181] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen.css", pszSpec="*.ifo") returned 0 [0093.181] lstrlenA (lpString="*.ifo") returned 5 [0093.181] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen.css", pszSpec="*.lnk") returned 0 [0093.181] lstrlenA (lpString="*.lnk") returned 5 [0093.181] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen.css", pszSpec="*.torrent") returned 0 [0093.181] lstrlenA (lpString="*.torrent") returned 9 [0093.181] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen.css", pszSpec="*.mov") returned 0 [0093.181] lstrlenA (lpString="*.mov") returned 5 [0093.181] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen.css", pszSpec="*.m2v") returned 0 [0093.181] lstrlenA (lpString="*.m2v") returned 5 [0093.181] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen.css", pszSpec="*.3gp") returned 0 [0093.181] lstrlenA (lpString="*.3gp") returned 5 [0093.181] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen.css", pszSpec="*.mpeg") returned 0 [0093.181] lstrlenA (lpString="*.mpeg") returned 6 [0093.182] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen.css", pszSpec="*.mpg") returned 0 [0093.182] lstrlenA (lpString="*.mpg") returned 5 [0093.182] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen.css", pszSpec="*.flv") returned 0 [0093.182] lstrlenA (lpString="*.flv") returned 5 [0093.182] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen.css", pszSpec="*.avi") returned 0 [0093.182] lstrlenA (lpString="*.avi") returned 5 [0093.182] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen.css", pszSpec="*.mp4") returned 0 [0093.182] lstrlenA (lpString="*.mp4") returned 5 [0093.182] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen.css", pszSpec="*.wmv") returned 0 [0093.182] lstrlenA (lpString="*.wmv") returned 5 [0093.182] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen.css", pszSpec="*.divx") returned 0 [0093.182] lstrlenA (lpString="*.divx") returned 6 [0093.182] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen.css", pszSpec="*.mkv") returned 0 [0093.182] lstrlenA (lpString="*.mkv") returned 5 [0093.182] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen.css", pszSpec="*.mp3") returned 0 [0093.182] lstrlenA (lpString="*.mp3") returned 5 [0093.182] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen.css", pszSpec="*.wav") returned 0 [0093.182] lstrlenA (lpString="*.wav") returned 5 [0093.182] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen.css", pszSpec="*.flac") returned 0 [0093.182] lstrlenA (lpString="*.flac") returned 6 [0093.182] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen.css", pszSpec="*.ape") returned 0 [0093.182] lstrlenA (lpString="*.ape") returned 5 [0093.182] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen.css", pszSpec="*.wma") returned 0 [0093.182] lstrlenA (lpString="*.wma") returned 5 [0093.182] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen.css", pszSpec="*.ac3") returned 0 [0093.182] lstrlenA (lpString="*.ac3") returned 5 [0093.182] FindNextFileA (in: hFindFile=0x5b7d70, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0093.182] PeekMessageA (in: lpMsg=0xaece4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaece4) returned 0 [0093.182] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Sts.css") returned -1 [0093.182] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Sts.css") returned -1 [0093.182] lstrcmpiA (lpString1="", lpString2="Sts.css") returned -1 [0093.182] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen.css") returned="SpringGreen.css" [0093.182] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\", lpString2="Sts.css" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts.css") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts.css" [0093.182] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts.css", pszSpec="*.zip") returned 0 [0093.182] lstrlenA (lpString="*.zip") returned 5 [0093.182] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts.css", pszSpec="*.rar") returned 0 [0093.182] lstrlenA (lpString="*.rar") returned 5 [0093.182] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts.css", pszSpec="*.7z") returned 0 [0093.182] lstrlenA (lpString="*.7z") returned 4 [0093.183] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts.css", pszSpec="*.tar") returned 0 [0093.183] lstrlenA (lpString="*.tar") returned 5 [0093.183] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts.css", pszSpec="*.gzip") returned 0 [0093.183] lstrlenA (lpString="*.gzip") returned 6 [0093.183] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts.css", pszSpec="*.jpg") returned 0 [0093.183] lstrlenA (lpString="*.jpg") returned 5 [0093.183] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts.css", pszSpec="*.jpeg") returned 0 [0093.183] lstrlenA (lpString="*.jpeg") returned 6 [0093.183] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts.css", pszSpec="*.psd") returned 0 [0093.183] lstrlenA (lpString="*.psd") returned 5 [0093.183] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts.css", pszSpec="*.cdr") returned 0 [0093.183] lstrlenA (lpString="*.cdr") returned 5 [0093.183] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts.css", pszSpec="*.dwg") returned 0 [0093.183] lstrlenA (lpString="*.dwg") returned 5 [0093.183] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts.css", pszSpec="*.max") returned 0 [0093.183] lstrlenA (lpString="*.max") returned 5 [0093.183] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts.css", pszSpec="*.bmp") returned 0 [0093.183] lstrlenA (lpString="*.bmp") returned 5 [0093.183] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts.css", pszSpec="*.gif") returned 0 [0093.183] lstrlenA (lpString="*.gif") returned 5 [0093.183] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts.css", pszSpec="*.png") returned 0 [0093.183] lstrlenA (lpString="*.png") returned 5 [0093.183] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts.css", pszSpec="*.doc") returned 0 [0093.183] lstrlenA (lpString="*.doc") returned 5 [0093.183] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts.css", pszSpec="*.docx") returned 0 [0093.183] lstrlenA (lpString="*.docx") returned 6 [0093.183] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts.css", pszSpec="*.xls") returned 0 [0093.183] lstrlenA (lpString="*.xls") returned 5 [0093.183] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts.css", pszSpec="*.xlsx") returned 0 [0093.183] lstrlenA (lpString="*.xlsx") returned 6 [0093.183] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts.css", pszSpec="*.ppt") returned 0 [0093.183] lstrlenA (lpString="*.ppt") returned 5 [0093.183] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts.css", pszSpec="*.pptx") returned 0 [0093.183] lstrlenA (lpString="*.pptx") returned 6 [0093.183] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts.css", pszSpec="*.txt") returned 0 [0093.183] lstrlenA (lpString="*.txt") returned 5 [0093.183] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts.css", pszSpec="*.pdf") returned 0 [0093.183] lstrlenA (lpString="*.pdf") returned 5 [0093.183] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts.css", pszSpec="*.djvu") returned 0 [0093.183] lstrlenA (lpString="*.djvu") returned 6 [0093.183] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts.css", pszSpec="*.htm") returned 0 [0093.183] lstrlenA (lpString="*.htm") returned 5 [0093.184] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts.css", pszSpec="*.html") returned 0 [0093.184] lstrlenA (lpString="*.html") returned 6 [0093.184] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts.css", pszSpec="*.mdb") returned 0 [0093.184] lstrlenA (lpString="*.mdb") returned 5 [0093.184] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts.css", pszSpec="*.cer") returned 0 [0093.184] lstrlenA (lpString="*.cer") returned 5 [0093.184] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts.css", pszSpec="*.p12") returned 0 [0093.184] lstrlenA (lpString="*.p12") returned 5 [0093.184] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts.css", pszSpec="*.pfx") returned 0 [0093.184] lstrlenA (lpString="*.pfx") returned 5 [0093.184] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts.css", pszSpec="*.kwm") returned 0 [0093.184] lstrlenA (lpString="*.kwm") returned 5 [0093.184] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts.css", pszSpec="*.pwm") returned 0 [0093.184] lstrlenA (lpString="*.pwm") returned 5 [0093.184] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts.css", pszSpec="*.1cd") returned 0 [0093.184] lstrlenA (lpString="*.1cd") returned 5 [0093.184] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts.css", pszSpec="*.md") returned 0 [0093.184] lstrlenA (lpString="*.md") returned 4 [0093.184] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts.css", pszSpec="*.mdf") returned 0 [0093.184] lstrlenA (lpString="*.mdf") returned 5 [0093.184] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts.css", pszSpec="*.dbf") returned 0 [0093.184] lstrlenA (lpString="*.dbf") returned 5 [0093.184] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts.css", pszSpec="*.odt") returned 0 [0093.184] lstrlenA (lpString="*.odt") returned 5 [0093.184] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts.css", pszSpec="*.vob") returned 0 [0093.184] lstrlenA (lpString="*.vob") returned 5 [0093.184] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts.css", pszSpec="*.ifo") returned 0 [0093.184] lstrlenA (lpString="*.ifo") returned 5 [0093.184] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts.css", pszSpec="*.lnk") returned 0 [0093.184] lstrlenA (lpString="*.lnk") returned 5 [0093.184] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts.css", pszSpec="*.torrent") returned 0 [0093.184] lstrlenA (lpString="*.torrent") returned 9 [0093.184] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts.css", pszSpec="*.mov") returned 0 [0093.184] lstrlenA (lpString="*.mov") returned 5 [0093.184] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts.css", pszSpec="*.m2v") returned 0 [0093.184] lstrlenA (lpString="*.m2v") returned 5 [0093.184] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts.css", pszSpec="*.3gp") returned 0 [0093.184] lstrlenA (lpString="*.3gp") returned 5 [0093.184] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts.css", pszSpec="*.mpeg") returned 0 [0093.184] lstrlenA (lpString="*.mpeg") returned 6 [0093.185] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts.css", pszSpec="*.mpg") returned 0 [0093.185] lstrlenA (lpString="*.mpg") returned 5 [0093.185] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts.css", pszSpec="*.flv") returned 0 [0093.185] lstrlenA (lpString="*.flv") returned 5 [0093.185] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts.css", pszSpec="*.avi") returned 0 [0093.185] lstrlenA (lpString="*.avi") returned 5 [0093.185] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts.css", pszSpec="*.mp4") returned 0 [0093.185] lstrlenA (lpString="*.mp4") returned 5 [0093.185] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts.css", pszSpec="*.wmv") returned 0 [0093.185] lstrlenA (lpString="*.wmv") returned 5 [0093.185] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts.css", pszSpec="*.divx") returned 0 [0093.185] lstrlenA (lpString="*.divx") returned 6 [0093.185] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts.css", pszSpec="*.mkv") returned 0 [0093.185] lstrlenA (lpString="*.mkv") returned 5 [0093.185] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts.css", pszSpec="*.mp3") returned 0 [0093.185] lstrlenA (lpString="*.mp3") returned 5 [0093.185] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts.css", pszSpec="*.wav") returned 0 [0093.185] lstrlenA (lpString="*.wav") returned 5 [0093.185] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts.css", pszSpec="*.flac") returned 0 [0093.185] lstrlenA (lpString="*.flac") returned 6 [0093.185] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts.css", pszSpec="*.ape") returned 0 [0093.185] lstrlenA (lpString="*.ape") returned 5 [0093.185] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts.css", pszSpec="*.wma") returned 0 [0093.185] lstrlenA (lpString="*.wma") returned 5 [0093.185] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts.css", pszSpec="*.ac3") returned 0 [0093.185] lstrlenA (lpString="*.ac3") returned 5 [0093.185] FindNextFileA (in: hFindFile=0x5b7d70, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0093.185] lstrcmpA (lpString1=".", lpString2="STS2") returned -1 [0093.185] lstrcmpA (lpString1="..", lpString2="STS2") returned -1 [0093.185] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts.css") returned="Sts.css" [0093.185] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\", lpString2="STS2" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2" [0093.185] lstrlenA (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2") returned 99 [0093.185] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\*.*", lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 0x5be160 [0093.186] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0093.186] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 1 [0093.186] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0093.186] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0093.186] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 1 [0093.186] PeekMessageA (in: lpMsg=0xaeb94, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaeb94) returned 0 [0093.186] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="background.gif") returned 1 [0093.186] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="background.gif") returned 1 [0093.186] lstrcmpiA (lpString1="", lpString2="background.gif") returned -1 [0093.186] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\*.*") returned="*.*" [0093.186] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\", lpString2="background.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\background.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\background.gif" [0093.186] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\background.gif", pszSpec="*.zip") returned 0 [0093.186] lstrlenA (lpString="*.zip") returned 5 [0093.186] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\background.gif", pszSpec="*.rar") returned 0 [0093.186] lstrlenA (lpString="*.rar") returned 5 [0093.186] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\background.gif", pszSpec="*.7z") returned 0 [0093.186] lstrlenA (lpString="*.7z") returned 4 [0093.186] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\background.gif", pszSpec="*.tar") returned 0 [0093.186] lstrlenA (lpString="*.tar") returned 5 [0093.186] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\background.gif", pszSpec="*.gzip") returned 0 [0093.186] lstrlenA (lpString="*.gzip") returned 6 [0093.186] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\background.gif", pszSpec="*.jpg") returned 0 [0093.186] lstrlenA (lpString="*.jpg") returned 5 [0093.186] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\background.gif", pszSpec="*.jpeg") returned 0 [0093.186] lstrlenA (lpString="*.jpeg") returned 6 [0093.186] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\background.gif", pszSpec="*.psd") returned 0 [0093.186] lstrlenA (lpString="*.psd") returned 5 [0093.186] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\background.gif", pszSpec="*.cdr") returned 0 [0093.187] lstrlenA (lpString="*.cdr") returned 5 [0093.187] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\background.gif", pszSpec="*.dwg") returned 0 [0093.187] lstrlenA (lpString="*.dwg") returned 5 [0093.187] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\background.gif", pszSpec="*.max") returned 0 [0093.187] lstrlenA (lpString="*.max") returned 5 [0093.187] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\background.gif", pszSpec="*.bmp") returned 0 [0093.187] lstrlenA (lpString="*.bmp") returned 5 [0093.187] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\background.gif", pszSpec="*.gif") returned 1 [0093.187] lstrlenA (lpString="*.gif") returned 5 [0093.187] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\background.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\background.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\background.gif" [0093.187] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\background.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\background.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\background.gif" [0093.187] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\background.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\background.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\background.gif." [0093.187] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\background.gif.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\background.gif. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\background.gif. " [0093.187] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\background.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\sts2\\background.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0 [0093.187] GetFileSize (in: hFile=0xa0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xe9 [0093.187] GetFileTime (in: hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x94570a00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x528f6190, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x94570a00, dwHighDateTime=0x1c747ea)) returned 1 [0093.187] SetFilePointer (in: hFile=0xa0, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0093.187] ReadFile (in: hFile=0xa0, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x8f, lpOverlapped=0x0) returned 1 [0093.188] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\background.gif") returned="background.gif" [0093.188] SetFilePointer (in: hFile=0xa0, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0093.188] WriteFile (in: hFile=0xa0, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x8f, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x8f, lpOverlapped=0x0) returned 1 [0093.188] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0093.188] CloseHandle (hObject=0xa0) returned 1 [0093.189] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\background.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\sts2\\background.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\background.gif. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\sts2\\background.gif. ")) returned 1 [0093.190] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 1 [0093.190] PeekMessageA (in: lpMsg=0xaeb94, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaeb94) returned 0 [0093.190] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="header.gif") returned -1 [0093.190] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="header.gif") returned 1 [0093.190] lstrcmpiA (lpString1="", lpString2="header.gif") returned -1 [0093.190] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\background.gif") returned="background.gif" [0093.190] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\", lpString2="header.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\header.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\header.gif" [0093.190] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\header.gif", pszSpec="*.zip") returned 0 [0093.190] lstrlenA (lpString="*.zip") returned 5 [0093.190] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\header.gif", pszSpec="*.rar") returned 0 [0093.190] lstrlenA (lpString="*.rar") returned 5 [0093.190] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\header.gif", pszSpec="*.7z") returned 0 [0093.190] lstrlenA (lpString="*.7z") returned 4 [0093.190] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\header.gif", pszSpec="*.tar") returned 0 [0093.190] lstrlenA (lpString="*.tar") returned 5 [0093.190] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\header.gif", pszSpec="*.gzip") returned 0 [0093.190] lstrlenA (lpString="*.gzip") returned 6 [0093.190] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\header.gif", pszSpec="*.jpg") returned 0 [0093.190] lstrlenA (lpString="*.jpg") returned 5 [0093.190] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\header.gif", pszSpec="*.jpeg") returned 0 [0093.190] lstrlenA (lpString="*.jpeg") returned 6 [0093.190] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\header.gif", pszSpec="*.psd") returned 0 [0093.190] lstrlenA (lpString="*.psd") returned 5 [0093.190] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\header.gif", pszSpec="*.cdr") returned 0 [0093.190] lstrlenA (lpString="*.cdr") returned 5 [0093.190] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\header.gif", pszSpec="*.dwg") returned 0 [0093.190] lstrlenA (lpString="*.dwg") returned 5 [0093.190] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\header.gif", pszSpec="*.max") returned 0 [0093.190] lstrlenA (lpString="*.max") returned 5 [0093.190] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\header.gif", pszSpec="*.bmp") returned 0 [0093.190] lstrlenA (lpString="*.bmp") returned 5 [0093.190] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\header.gif", pszSpec="*.gif") returned 1 [0093.190] lstrlenA (lpString="*.gif") returned 5 [0093.190] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\header.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\header.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\header.gif" [0093.190] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\header.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\header.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\header.gif" [0093.190] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\header.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\header.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\header.gif." [0093.190] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\header.gif.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\header.gif. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\header.gif. " [0093.190] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\header.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\sts2\\header.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0 [0093.191] GetFileSize (in: hFile=0xa0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xcbd [0093.191] GetFileTime (in: hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x94570a00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5291c2f0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x94570a00, dwHighDateTime=0x1c747ea)) returned 1 [0093.191] SetFilePointer (in: hFile=0xa0, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0093.191] ReadFile (in: hFile=0xa0, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0xc63, lpOverlapped=0x0) returned 1 [0093.207] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\header.gif") returned="header.gif" [0093.207] SetFilePointer (in: hFile=0xa0, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0093.207] WriteFile (in: hFile=0xa0, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0xc63, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0xc63, lpOverlapped=0x0) returned 1 [0093.207] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0093.207] CloseHandle (hObject=0xa0) returned 1 [0093.208] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\header.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\sts2\\header.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\header.gif. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\sts2\\header.gif. ")) returned 1 [0093.209] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 1 [0093.209] PeekMessageA (in: lpMsg=0xaeb94, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaeb94) returned 0 [0093.209] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="tab_off.gif") returned -1 [0093.209] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="tab_off.gif") returned -1 [0093.209] lstrcmpiA (lpString1="", lpString2="tab_off.gif") returned -1 [0093.209] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\header.gif") returned="header.gif" [0093.209] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\", lpString2="tab_off.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_off.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_off.gif" [0093.209] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_off.gif", pszSpec="*.zip") returned 0 [0093.209] lstrlenA (lpString="*.zip") returned 5 [0093.209] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_off.gif", pszSpec="*.rar") returned 0 [0093.209] lstrlenA (lpString="*.rar") returned 5 [0093.209] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_off.gif", pszSpec="*.7z") returned 0 [0093.209] lstrlenA (lpString="*.7z") returned 4 [0093.209] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_off.gif", pszSpec="*.tar") returned 0 [0093.209] lstrlenA (lpString="*.tar") returned 5 [0093.209] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_off.gif", pszSpec="*.gzip") returned 0 [0093.209] lstrlenA (lpString="*.gzip") returned 6 [0093.209] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_off.gif", pszSpec="*.jpg") returned 0 [0093.209] lstrlenA (lpString="*.jpg") returned 5 [0093.209] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_off.gif", pszSpec="*.jpeg") returned 0 [0093.209] lstrlenA (lpString="*.jpeg") returned 6 [0093.209] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_off.gif", pszSpec="*.psd") returned 0 [0093.209] lstrlenA (lpString="*.psd") returned 5 [0093.209] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_off.gif", pszSpec="*.cdr") returned 0 [0093.209] lstrlenA (lpString="*.cdr") returned 5 [0093.209] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_off.gif", pszSpec="*.dwg") returned 0 [0093.209] lstrlenA (lpString="*.dwg") returned 5 [0093.209] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_off.gif", pszSpec="*.max") returned 0 [0093.209] lstrlenA (lpString="*.max") returned 5 [0093.209] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_off.gif", pszSpec="*.bmp") returned 0 [0093.209] lstrlenA (lpString="*.bmp") returned 5 [0093.209] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_off.gif", pszSpec="*.gif") returned 1 [0093.210] lstrlenA (lpString="*.gif") returned 5 [0093.210] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_off.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_off.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_off.gif" [0093.210] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_off.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_off.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_off.gif" [0093.210] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_off.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_off.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_off.gif." [0093.210] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_off.gif.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_off.gif. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_off.gif. " [0093.210] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_off.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\sts2\\tab_off.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0 [0093.210] GetFileSize (in: hFile=0xa0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1ce [0093.210] GetFileTime (in: hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x94570a00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x618c8a10, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x94570a00, dwHighDateTime=0x1c747ea)) returned 1 [0093.210] SetFilePointer (in: hFile=0xa0, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0093.210] ReadFile (in: hFile=0xa0, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x174, lpOverlapped=0x0) returned 1 [0093.211] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_off.gif") returned="tab_off.gif" [0093.211] SetFilePointer (in: hFile=0xa0, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0093.211] WriteFile (in: hFile=0xa0, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x174, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x174, lpOverlapped=0x0) returned 1 [0093.211] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0093.211] CloseHandle (hObject=0xa0) returned 1 [0093.212] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_off.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\sts2\\tab_off.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_off.gif. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\sts2\\tab_off.gif. ")) returned 1 [0093.214] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 1 [0093.214] PeekMessageA (in: lpMsg=0xaeb94, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaeb94) returned 0 [0093.214] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="tab_on.gif") returned -1 [0093.214] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="tab_on.gif") returned -1 [0093.214] lstrcmpiA (lpString1="", lpString2="tab_on.gif") returned -1 [0093.214] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_off.gif") returned="tab_off.gif" [0093.214] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\", lpString2="tab_on.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_on.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_on.gif" [0093.214] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_on.gif", pszSpec="*.zip") returned 0 [0093.214] lstrlenA (lpString="*.zip") returned 5 [0093.214] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_on.gif", pszSpec="*.rar") returned 0 [0093.214] lstrlenA (lpString="*.rar") returned 5 [0093.214] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_on.gif", pszSpec="*.7z") returned 0 [0093.214] lstrlenA (lpString="*.7z") returned 4 [0093.214] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_on.gif", pszSpec="*.tar") returned 0 [0093.214] lstrlenA (lpString="*.tar") returned 5 [0093.214] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_on.gif", pszSpec="*.gzip") returned 0 [0093.215] lstrlenA (lpString="*.gzip") returned 6 [0093.215] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_on.gif", pszSpec="*.jpg") returned 0 [0093.215] lstrlenA (lpString="*.jpg") returned 5 [0093.215] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_on.gif", pszSpec="*.jpeg") returned 0 [0093.215] lstrlenA (lpString="*.jpeg") returned 6 [0093.215] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_on.gif", pszSpec="*.psd") returned 0 [0093.215] lstrlenA (lpString="*.psd") returned 5 [0093.215] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_on.gif", pszSpec="*.cdr") returned 0 [0093.215] lstrlenA (lpString="*.cdr") returned 5 [0093.215] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_on.gif", pszSpec="*.dwg") returned 0 [0093.215] lstrlenA (lpString="*.dwg") returned 5 [0093.215] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_on.gif", pszSpec="*.max") returned 0 [0093.215] lstrlenA (lpString="*.max") returned 5 [0093.215] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_on.gif", pszSpec="*.bmp") returned 0 [0093.215] lstrlenA (lpString="*.bmp") returned 5 [0093.215] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_on.gif", pszSpec="*.gif") returned 1 [0093.215] lstrlenA (lpString="*.gif") returned 5 [0093.215] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_on.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_on.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_on.gif" [0093.215] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_on.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_on.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_on.gif" [0093.215] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_on.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_on.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_on.gif." [0093.215] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_on.gif.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_on.gif. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_on.gif. " [0093.215] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_on.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\sts2\\tab_on.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0 [0093.216] GetFileSize (in: hFile=0xa0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x108 [0093.216] GetFileTime (in: hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x94570a00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x618c8a10, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x94570a00, dwHighDateTime=0x1c747ea)) returned 1 [0093.216] SetFilePointer (in: hFile=0xa0, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0093.216] ReadFile (in: hFile=0xa0, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0xae, lpOverlapped=0x0) returned 1 [0093.216] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_on.gif") returned="tab_on.gif" [0093.216] SetFilePointer (in: hFile=0xa0, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0093.216] WriteFile (in: hFile=0xa0, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0xae, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0xae, lpOverlapped=0x0) returned 1 [0093.217] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0093.217] CloseHandle (hObject=0xa0) returned 1 [0093.218] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_on.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\sts2\\tab_on.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_on.gif. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\sts2\\tab_on.gif. ")) returned 1 [0093.219] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 0 [0093.219] FindClose (in: hFindFile=0x5be160 | out: hFindFile=0x5be160) returned 1 [0093.219] FindNextFileA (in: hFindFile=0x5b7d70, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0093.220] PeekMessageA (in: lpMsg=0xaece4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaece4) returned 0 [0093.220] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Sts2.css") returned -1 [0093.220] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Sts2.css") returned -1 [0093.220] lstrcmpiA (lpString1="", lpString2="Sts2.css") returned -1 [0093.220] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\*.*") returned="*.*" [0093.220] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\", lpString2="Sts2.css" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts2.css") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts2.css" [0093.220] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts2.css", pszSpec="*.zip") returned 0 [0093.220] lstrlenA (lpString="*.zip") returned 5 [0093.220] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts2.css", pszSpec="*.rar") returned 0 [0093.220] lstrlenA (lpString="*.rar") returned 5 [0093.220] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts2.css", pszSpec="*.7z") returned 0 [0093.220] lstrlenA (lpString="*.7z") returned 4 [0093.220] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts2.css", pszSpec="*.tar") returned 0 [0093.220] lstrlenA (lpString="*.tar") returned 5 [0093.220] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts2.css", pszSpec="*.gzip") returned 0 [0093.220] lstrlenA (lpString="*.gzip") returned 6 [0093.220] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts2.css", pszSpec="*.jpg") returned 0 [0093.220] lstrlenA (lpString="*.jpg") returned 5 [0093.220] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts2.css", pszSpec="*.jpeg") returned 0 [0093.220] lstrlenA (lpString="*.jpeg") returned 6 [0093.220] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts2.css", pszSpec="*.psd") returned 0 [0093.220] lstrlenA (lpString="*.psd") returned 5 [0093.220] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts2.css", pszSpec="*.cdr") returned 0 [0093.220] lstrlenA (lpString="*.cdr") returned 5 [0093.220] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts2.css", pszSpec="*.dwg") returned 0 [0093.220] lstrlenA (lpString="*.dwg") returned 5 [0093.220] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts2.css", pszSpec="*.max") returned 0 [0093.220] lstrlenA (lpString="*.max") returned 5 [0093.220] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts2.css", pszSpec="*.bmp") returned 0 [0093.220] lstrlenA (lpString="*.bmp") returned 5 [0093.220] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts2.css", pszSpec="*.gif") returned 0 [0093.220] lstrlenA (lpString="*.gif") returned 5 [0093.220] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts2.css", pszSpec="*.png") returned 0 [0093.220] lstrlenA (lpString="*.png") returned 5 [0093.220] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts2.css", pszSpec="*.doc") returned 0 [0093.220] lstrlenA (lpString="*.doc") returned 5 [0093.220] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts2.css", pszSpec="*.docx") returned 0 [0093.220] lstrlenA (lpString="*.docx") returned 6 [0093.220] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts2.css", pszSpec="*.xls") returned 0 [0093.220] lstrlenA (lpString="*.xls") returned 5 [0093.220] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts2.css", pszSpec="*.xlsx") returned 0 [0093.220] lstrlenA (lpString="*.xlsx") returned 6 [0093.221] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts2.css", pszSpec="*.ppt") returned 0 [0093.221] lstrlenA (lpString="*.ppt") returned 5 [0093.221] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts2.css", pszSpec="*.pptx") returned 0 [0093.221] lstrlenA (lpString="*.pptx") returned 6 [0093.221] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts2.css", pszSpec="*.txt") returned 0 [0093.221] lstrlenA (lpString="*.txt") returned 5 [0093.221] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts2.css", pszSpec="*.pdf") returned 0 [0093.221] lstrlenA (lpString="*.pdf") returned 5 [0093.221] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts2.css", pszSpec="*.djvu") returned 0 [0093.221] lstrlenA (lpString="*.djvu") returned 6 [0093.221] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts2.css", pszSpec="*.htm") returned 0 [0093.221] lstrlenA (lpString="*.htm") returned 5 [0093.221] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts2.css", pszSpec="*.html") returned 0 [0093.221] lstrlenA (lpString="*.html") returned 6 [0093.221] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts2.css", pszSpec="*.mdb") returned 0 [0093.221] lstrlenA (lpString="*.mdb") returned 5 [0093.221] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts2.css", pszSpec="*.cer") returned 0 [0093.221] lstrlenA (lpString="*.cer") returned 5 [0093.221] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts2.css", pszSpec="*.p12") returned 0 [0093.221] lstrlenA (lpString="*.p12") returned 5 [0093.221] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts2.css", pszSpec="*.pfx") returned 0 [0093.221] lstrlenA (lpString="*.pfx") returned 5 [0093.221] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts2.css", pszSpec="*.kwm") returned 0 [0093.221] lstrlenA (lpString="*.kwm") returned 5 [0093.221] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts2.css", pszSpec="*.pwm") returned 0 [0093.221] lstrlenA (lpString="*.pwm") returned 5 [0093.221] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts2.css", pszSpec="*.1cd") returned 0 [0093.221] lstrlenA (lpString="*.1cd") returned 5 [0093.221] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts2.css", pszSpec="*.md") returned 0 [0093.221] lstrlenA (lpString="*.md") returned 4 [0093.221] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts2.css", pszSpec="*.mdf") returned 0 [0093.221] lstrlenA (lpString="*.mdf") returned 5 [0093.221] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts2.css", pszSpec="*.dbf") returned 0 [0093.221] lstrlenA (lpString="*.dbf") returned 5 [0093.221] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts2.css", pszSpec="*.odt") returned 0 [0093.221] lstrlenA (lpString="*.odt") returned 5 [0093.221] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts2.css", pszSpec="*.vob") returned 0 [0093.221] lstrlenA (lpString="*.vob") returned 5 [0093.221] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts2.css", pszSpec="*.ifo") returned 0 [0093.221] lstrlenA (lpString="*.ifo") returned 5 [0093.221] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts2.css", pszSpec="*.lnk") returned 0 [0093.221] lstrlenA (lpString="*.lnk") returned 5 [0093.222] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts2.css", pszSpec="*.torrent") returned 0 [0093.222] lstrlenA (lpString="*.torrent") returned 9 [0093.222] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts2.css", pszSpec="*.mov") returned 0 [0093.222] lstrlenA (lpString="*.mov") returned 5 [0093.222] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts2.css", pszSpec="*.m2v") returned 0 [0093.222] lstrlenA (lpString="*.m2v") returned 5 [0093.222] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts2.css", pszSpec="*.3gp") returned 0 [0093.222] lstrlenA (lpString="*.3gp") returned 5 [0093.222] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts2.css", pszSpec="*.mpeg") returned 0 [0093.222] lstrlenA (lpString="*.mpeg") returned 6 [0093.222] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts2.css", pszSpec="*.mpg") returned 0 [0093.222] lstrlenA (lpString="*.mpg") returned 5 [0093.222] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts2.css", pszSpec="*.flv") returned 0 [0093.222] lstrlenA (lpString="*.flv") returned 5 [0093.222] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts2.css", pszSpec="*.avi") returned 0 [0093.222] lstrlenA (lpString="*.avi") returned 5 [0093.222] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts2.css", pszSpec="*.mp4") returned 0 [0093.222] lstrlenA (lpString="*.mp4") returned 5 [0093.222] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts2.css", pszSpec="*.wmv") returned 0 [0093.222] lstrlenA (lpString="*.wmv") returned 5 [0093.222] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts2.css", pszSpec="*.divx") returned 0 [0093.222] lstrlenA (lpString="*.divx") returned 6 [0093.222] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts2.css", pszSpec="*.mkv") returned 0 [0093.222] lstrlenA (lpString="*.mkv") returned 5 [0093.222] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts2.css", pszSpec="*.mp3") returned 0 [0093.222] lstrlenA (lpString="*.mp3") returned 5 [0093.222] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts2.css", pszSpec="*.wav") returned 0 [0093.222] lstrlenA (lpString="*.wav") returned 5 [0093.222] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts2.css", pszSpec="*.flac") returned 0 [0093.222] lstrlenA (lpString="*.flac") returned 6 [0093.222] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts2.css", pszSpec="*.ape") returned 0 [0093.222] lstrlenA (lpString="*.ape") returned 5 [0093.222] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts2.css", pszSpec="*.wma") returned 0 [0093.222] lstrlenA (lpString="*.wma") returned 5 [0093.222] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts2.css", pszSpec="*.ac3") returned 0 [0093.222] lstrlenA (lpString="*.ac3") returned 5 [0093.222] FindNextFileA (in: hFindFile=0x5b7d70, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0093.222] lstrcmpA (lpString1=".", lpString2="Swirl") returned -1 [0093.222] lstrcmpA (lpString1="..", lpString2="Swirl") returned -1 [0093.222] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts2.css") returned="Sts2.css" [0093.222] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\", lpString2="Swirl" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl" [0093.222] lstrlenA (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl") returned 100 [0093.222] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\*.*", lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 0x5be160 [0093.223] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0093.223] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 1 [0093.223] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0093.223] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0093.223] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 1 [0093.223] PeekMessageA (in: lpMsg=0xaeb94, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaeb94) returned 0 [0093.223] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="background.gif") returned 1 [0093.223] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="background.gif") returned 1 [0093.223] lstrcmpiA (lpString1="", lpString2="background.gif") returned -1 [0093.223] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\*.*") returned="*.*" [0093.223] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\", lpString2="background.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\background.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\background.gif" [0093.223] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\background.gif", pszSpec="*.zip") returned 0 [0093.223] lstrlenA (lpString="*.zip") returned 5 [0093.223] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\background.gif", pszSpec="*.rar") returned 0 [0093.223] lstrlenA (lpString="*.rar") returned 5 [0093.223] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\background.gif", pszSpec="*.7z") returned 0 [0093.223] lstrlenA (lpString="*.7z") returned 4 [0093.223] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\background.gif", pszSpec="*.tar") returned 0 [0093.223] lstrlenA (lpString="*.tar") returned 5 [0093.223] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\background.gif", pszSpec="*.gzip") returned 0 [0093.223] lstrlenA (lpString="*.gzip") returned 6 [0093.223] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\background.gif", pszSpec="*.jpg") returned 0 [0093.223] lstrlenA (lpString="*.jpg") returned 5 [0093.223] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\background.gif", pszSpec="*.jpeg") returned 0 [0093.223] lstrlenA (lpString="*.jpeg") returned 6 [0093.223] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\background.gif", pszSpec="*.psd") returned 0 [0093.223] lstrlenA (lpString="*.psd") returned 5 [0093.223] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\background.gif", pszSpec="*.cdr") returned 0 [0093.223] lstrlenA (lpString="*.cdr") returned 5 [0093.223] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\background.gif", pszSpec="*.dwg") returned 0 [0093.223] lstrlenA (lpString="*.dwg") returned 5 [0093.223] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\background.gif", pszSpec="*.max") returned 0 [0093.223] lstrlenA (lpString="*.max") returned 5 [0093.223] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\background.gif", pszSpec="*.bmp") returned 0 [0093.223] lstrlenA (lpString="*.bmp") returned 5 [0093.224] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\background.gif", pszSpec="*.gif") returned 1 [0093.224] lstrlenA (lpString="*.gif") returned 5 [0093.224] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\background.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\background.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\background.gif" [0093.224] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\background.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\background.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\background.gif" [0093.224] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\background.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\background.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\background.gif." [0093.224] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\background.gif.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\background.gif. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\background.gif. " [0093.224] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\background.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\swirl\\background.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0 [0093.224] GetFileSize (in: hFile=0xa0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x32f [0093.224] GetFileTime (in: hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x95883700, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x618c8a10, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x95883700, dwHighDateTime=0x1c747ea)) returned 1 [0093.224] SetFilePointer (in: hFile=0xa0, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0093.224] ReadFile (in: hFile=0xa0, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x2d5, lpOverlapped=0x0) returned 1 [0093.225] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\background.gif") returned="background.gif" [0093.225] SetFilePointer (in: hFile=0xa0, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0093.225] WriteFile (in: hFile=0xa0, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x2d5, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x2d5, lpOverlapped=0x0) returned 1 [0093.225] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0093.226] CloseHandle (hObject=0xa0) returned 1 [0093.226] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\background.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\swirl\\background.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\background.gif. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\swirl\\background.gif. ")) returned 1 [0093.227] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 1 [0093.227] PeekMessageA (in: lpMsg=0xaeb94, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaeb94) returned 0 [0093.227] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="header.gif") returned -1 [0093.227] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="header.gif") returned 1 [0093.227] lstrcmpiA (lpString1="", lpString2="header.gif") returned -1 [0093.227] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\background.gif") returned="background.gif" [0093.227] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\", lpString2="header.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\header.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\header.gif" [0093.227] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\header.gif", pszSpec="*.zip") returned 0 [0093.227] lstrlenA (lpString="*.zip") returned 5 [0093.227] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\header.gif", pszSpec="*.rar") returned 0 [0093.227] lstrlenA (lpString="*.rar") returned 5 [0093.227] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\header.gif", pszSpec="*.7z") returned 0 [0093.227] lstrlenA (lpString="*.7z") returned 4 [0093.227] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\header.gif", pszSpec="*.tar") returned 0 [0093.227] lstrlenA (lpString="*.tar") returned 5 [0093.227] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\header.gif", pszSpec="*.gzip") returned 0 [0093.227] lstrlenA (lpString="*.gzip") returned 6 [0093.227] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\header.gif", pszSpec="*.jpg") returned 0 [0093.227] lstrlenA (lpString="*.jpg") returned 5 [0093.227] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\header.gif", pszSpec="*.jpeg") returned 0 [0093.227] lstrlenA (lpString="*.jpeg") returned 6 [0093.227] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\header.gif", pszSpec="*.psd") returned 0 [0093.227] lstrlenA (lpString="*.psd") returned 5 [0093.227] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\header.gif", pszSpec="*.cdr") returned 0 [0093.228] lstrlenA (lpString="*.cdr") returned 5 [0093.228] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\header.gif", pszSpec="*.dwg") returned 0 [0093.228] lstrlenA (lpString="*.dwg") returned 5 [0093.228] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\header.gif", pszSpec="*.max") returned 0 [0093.228] lstrlenA (lpString="*.max") returned 5 [0093.228] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\header.gif", pszSpec="*.bmp") returned 0 [0093.228] lstrlenA (lpString="*.bmp") returned 5 [0093.228] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\header.gif", pszSpec="*.gif") returned 1 [0093.228] lstrlenA (lpString="*.gif") returned 5 [0093.228] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\header.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\header.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\header.gif" [0093.228] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\header.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\header.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\header.gif" [0093.228] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\header.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\header.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\header.gif." [0093.228] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\header.gif.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\header.gif. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\header.gif. " [0093.228] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\header.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\swirl\\header.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0 [0093.228] GetFileSize (in: hFile=0xa0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x6993 [0093.228] GetFileTime (in: hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x95883700, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5291c2f0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x95883700, dwHighDateTime=0x1c747ea)) returned 1 [0093.228] SetFilePointer (in: hFile=0xa0, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0093.228] ReadFile (in: hFile=0xa0, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x6939, lpOverlapped=0x0) returned 1 [0093.291] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\header.gif") returned="header.gif" [0093.291] SetFilePointer (in: hFile=0xa0, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0093.291] WriteFile (in: hFile=0xa0, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x6939, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x6939, lpOverlapped=0x0) returned 1 [0093.292] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0093.292] CloseHandle (hObject=0xa0) returned 1 [0093.292] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\header.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\swirl\\header.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\header.gif. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\swirl\\header.gif. ")) returned 1 [0093.293] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 1 [0093.293] PeekMessageA (in: lpMsg=0xaeb94, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaeb94) returned 0 [0093.293] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="tab_off.gif") returned -1 [0093.293] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="tab_off.gif") returned -1 [0093.293] lstrcmpiA (lpString1="", lpString2="tab_off.gif") returned -1 [0093.294] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\header.gif") returned="header.gif" [0093.294] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\", lpString2="tab_off.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_off.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_off.gif" [0093.294] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_off.gif", pszSpec="*.zip") returned 0 [0093.294] lstrlenA (lpString="*.zip") returned 5 [0093.294] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_off.gif", pszSpec="*.rar") returned 0 [0093.294] lstrlenA (lpString="*.rar") returned 5 [0093.294] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_off.gif", pszSpec="*.7z") returned 0 [0093.294] lstrlenA (lpString="*.7z") returned 4 [0093.294] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_off.gif", pszSpec="*.tar") returned 0 [0093.294] lstrlenA (lpString="*.tar") returned 5 [0093.294] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_off.gif", pszSpec="*.gzip") returned 0 [0093.294] lstrlenA (lpString="*.gzip") returned 6 [0093.294] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_off.gif", pszSpec="*.jpg") returned 0 [0093.294] lstrlenA (lpString="*.jpg") returned 5 [0093.294] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_off.gif", pszSpec="*.jpeg") returned 0 [0093.294] lstrlenA (lpString="*.jpeg") returned 6 [0093.294] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_off.gif", pszSpec="*.psd") returned 0 [0093.294] lstrlenA (lpString="*.psd") returned 5 [0093.294] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_off.gif", pszSpec="*.cdr") returned 0 [0093.294] lstrlenA (lpString="*.cdr") returned 5 [0093.294] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_off.gif", pszSpec="*.dwg") returned 0 [0093.294] lstrlenA (lpString="*.dwg") returned 5 [0093.294] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_off.gif", pszSpec="*.max") returned 0 [0093.294] lstrlenA (lpString="*.max") returned 5 [0093.294] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_off.gif", pszSpec="*.bmp") returned 0 [0093.294] lstrlenA (lpString="*.bmp") returned 5 [0093.294] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_off.gif", pszSpec="*.gif") returned 1 [0093.294] lstrlenA (lpString="*.gif") returned 5 [0093.294] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_off.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_off.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_off.gif" [0093.294] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_off.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_off.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_off.gif" [0093.294] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_off.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_off.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_off.gif." [0093.294] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_off.gif.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_off.gif. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_off.gif. " [0093.294] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_off.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\swirl\\tab_off.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0 [0093.295] GetFileSize (in: hFile=0xa0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x155 [0093.295] GetFileTime (in: hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x95883700, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5291c2f0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x95883700, dwHighDateTime=0x1c747ea)) returned 1 [0093.295] SetFilePointer (in: hFile=0xa0, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0093.295] ReadFile (in: hFile=0xa0, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0xfb, lpOverlapped=0x0) returned 1 [0093.295] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_off.gif") returned="tab_off.gif" [0093.295] SetFilePointer (in: hFile=0xa0, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0093.295] WriteFile (in: hFile=0xa0, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0xfb, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0xfb, lpOverlapped=0x0) returned 1 [0093.296] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0093.296] CloseHandle (hObject=0xa0) returned 1 [0093.296] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_off.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\swirl\\tab_off.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_off.gif. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\swirl\\tab_off.gif. ")) returned 1 [0093.352] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 1 [0093.352] PeekMessageA (in: lpMsg=0xaeb94, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaeb94) returned 0 [0093.352] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="tab_on.gif") returned -1 [0093.352] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="tab_on.gif") returned -1 [0093.352] lstrcmpiA (lpString1="", lpString2="tab_on.gif") returned -1 [0093.352] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_off.gif") returned="tab_off.gif" [0093.352] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\", lpString2="tab_on.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_on.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_on.gif" [0093.352] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_on.gif", pszSpec="*.zip") returned 0 [0093.352] lstrlenA (lpString="*.zip") returned 5 [0093.352] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_on.gif", pszSpec="*.rar") returned 0 [0093.352] lstrlenA (lpString="*.rar") returned 5 [0093.352] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_on.gif", pszSpec="*.7z") returned 0 [0093.352] lstrlenA (lpString="*.7z") returned 4 [0093.352] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_on.gif", pszSpec="*.tar") returned 0 [0093.352] lstrlenA (lpString="*.tar") returned 5 [0093.352] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_on.gif", pszSpec="*.gzip") returned 0 [0093.352] lstrlenA (lpString="*.gzip") returned 6 [0093.352] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_on.gif", pszSpec="*.jpg") returned 0 [0093.352] lstrlenA (lpString="*.jpg") returned 5 [0093.352] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_on.gif", pszSpec="*.jpeg") returned 0 [0093.352] lstrlenA (lpString="*.jpeg") returned 6 [0093.352] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_on.gif", pszSpec="*.psd") returned 0 [0093.352] lstrlenA (lpString="*.psd") returned 5 [0093.352] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_on.gif", pszSpec="*.cdr") returned 0 [0093.352] lstrlenA (lpString="*.cdr") returned 5 [0093.352] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_on.gif", pszSpec="*.dwg") returned 0 [0093.352] lstrlenA (lpString="*.dwg") returned 5 [0093.352] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_on.gif", pszSpec="*.max") returned 0 [0093.353] lstrlenA (lpString="*.max") returned 5 [0093.353] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_on.gif", pszSpec="*.bmp") returned 0 [0093.353] lstrlenA (lpString="*.bmp") returned 5 [0093.353] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_on.gif", pszSpec="*.gif") returned 1 [0093.353] lstrlenA (lpString="*.gif") returned 5 [0093.353] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_on.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_on.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_on.gif" [0093.353] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_on.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_on.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_on.gif" [0093.353] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_on.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_on.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_on.gif." [0093.353] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_on.gif.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_on.gif. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_on.gif. " [0093.353] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_on.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\swirl\\tab_on.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0 [0093.353] GetFileSize (in: hFile=0xa0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xde [0093.353] GetFileTime (in: hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x95883700, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x618c8a10, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x95883700, dwHighDateTime=0x1c747ea)) returned 1 [0093.353] SetFilePointer (in: hFile=0xa0, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0093.353] ReadFile (in: hFile=0xa0, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x84, lpOverlapped=0x0) returned 1 [0093.354] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_on.gif") returned="tab_on.gif" [0093.354] SetFilePointer (in: hFile=0xa0, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0093.354] WriteFile (in: hFile=0xa0, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x84, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x84, lpOverlapped=0x0) returned 1 [0093.354] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0093.354] CloseHandle (hObject=0xa0) returned 1 [0093.354] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_on.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\swirl\\tab_on.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_on.gif. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\swirl\\tab_on.gif. ")) returned 1 [0093.355] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 0 [0093.355] FindClose (in: hFindFile=0x5be160 | out: hFindFile=0x5be160) returned 1 [0093.355] FindNextFileA (in: hFindFile=0x5b7d70, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0093.355] PeekMessageA (in: lpMsg=0xaece4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaece4) returned 0 [0093.355] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Swirl.css") returned -1 [0093.355] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Swirl.css") returned -1 [0093.355] lstrcmpiA (lpString1="", lpString2="Swirl.css") returned -1 [0093.355] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\*.*") returned="*.*" [0093.355] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\", lpString2="Swirl.css" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl.css") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl.css" [0093.355] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl.css", pszSpec="*.zip") returned 0 [0093.355] lstrlenA (lpString="*.zip") returned 5 [0093.355] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl.css", pszSpec="*.rar") returned 0 [0093.355] lstrlenA (lpString="*.rar") returned 5 [0093.355] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl.css", pszSpec="*.7z") returned 0 [0093.355] lstrlenA (lpString="*.7z") returned 4 [0093.355] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl.css", pszSpec="*.tar") returned 0 [0093.355] lstrlenA (lpString="*.tar") returned 5 [0093.355] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl.css", pszSpec="*.gzip") returned 0 [0093.355] lstrlenA (lpString="*.gzip") returned 6 [0093.355] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl.css", pszSpec="*.jpg") returned 0 [0093.356] lstrlenA (lpString="*.jpg") returned 5 [0093.356] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl.css", pszSpec="*.jpeg") returned 0 [0093.356] lstrlenA (lpString="*.jpeg") returned 6 [0093.356] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl.css", pszSpec="*.psd") returned 0 [0093.356] lstrlenA (lpString="*.psd") returned 5 [0093.356] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl.css", pszSpec="*.cdr") returned 0 [0093.356] lstrlenA (lpString="*.cdr") returned 5 [0093.356] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl.css", pszSpec="*.dwg") returned 0 [0093.356] lstrlenA (lpString="*.dwg") returned 5 [0093.356] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl.css", pszSpec="*.max") returned 0 [0093.356] lstrlenA (lpString="*.max") returned 5 [0093.356] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl.css", pszSpec="*.bmp") returned 0 [0093.356] lstrlenA (lpString="*.bmp") returned 5 [0093.356] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl.css", pszSpec="*.gif") returned 0 [0093.356] lstrlenA (lpString="*.gif") returned 5 [0093.356] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl.css", pszSpec="*.png") returned 0 [0093.356] lstrlenA (lpString="*.png") returned 5 [0093.356] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl.css", pszSpec="*.doc") returned 0 [0093.356] lstrlenA (lpString="*.doc") returned 5 [0093.356] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl.css", pszSpec="*.docx") returned 0 [0093.356] lstrlenA (lpString="*.docx") returned 6 [0093.356] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl.css", pszSpec="*.xls") returned 0 [0093.356] lstrlenA (lpString="*.xls") returned 5 [0093.356] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl.css", pszSpec="*.xlsx") returned 0 [0093.356] lstrlenA (lpString="*.xlsx") returned 6 [0093.356] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl.css", pszSpec="*.ppt") returned 0 [0093.356] lstrlenA (lpString="*.ppt") returned 5 [0093.356] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl.css", pszSpec="*.pptx") returned 0 [0093.356] lstrlenA (lpString="*.pptx") returned 6 [0093.356] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl.css", pszSpec="*.txt") returned 0 [0093.356] lstrlenA (lpString="*.txt") returned 5 [0093.356] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl.css", pszSpec="*.pdf") returned 0 [0093.356] lstrlenA (lpString="*.pdf") returned 5 [0093.356] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl.css", pszSpec="*.djvu") returned 0 [0093.356] lstrlenA (lpString="*.djvu") returned 6 [0093.356] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl.css", pszSpec="*.htm") returned 0 [0093.356] lstrlenA (lpString="*.htm") returned 5 [0093.356] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl.css", pszSpec="*.html") returned 0 [0093.356] lstrlenA (lpString="*.html") returned 6 [0093.356] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl.css", pszSpec="*.mdb") returned 0 [0093.356] lstrlenA (lpString="*.mdb") returned 5 [0093.356] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl.css", pszSpec="*.cer") returned 0 [0093.357] lstrlenA (lpString="*.cer") returned 5 [0093.357] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl.css", pszSpec="*.p12") returned 0 [0093.357] lstrlenA (lpString="*.p12") returned 5 [0093.357] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl.css", pszSpec="*.pfx") returned 0 [0093.357] lstrlenA (lpString="*.pfx") returned 5 [0093.357] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl.css", pszSpec="*.kwm") returned 0 [0093.357] lstrlenA (lpString="*.kwm") returned 5 [0093.357] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl.css", pszSpec="*.pwm") returned 0 [0093.357] lstrlenA (lpString="*.pwm") returned 5 [0093.357] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl.css", pszSpec="*.1cd") returned 0 [0093.357] lstrlenA (lpString="*.1cd") returned 5 [0093.357] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl.css", pszSpec="*.md") returned 0 [0093.357] lstrlenA (lpString="*.md") returned 4 [0093.357] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl.css", pszSpec="*.mdf") returned 0 [0093.357] lstrlenA (lpString="*.mdf") returned 5 [0093.357] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl.css", pszSpec="*.dbf") returned 0 [0093.357] lstrlenA (lpString="*.dbf") returned 5 [0093.357] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl.css", pszSpec="*.odt") returned 0 [0093.357] lstrlenA (lpString="*.odt") returned 5 [0093.357] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl.css", pszSpec="*.vob") returned 0 [0093.357] lstrlenA (lpString="*.vob") returned 5 [0093.357] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl.css", pszSpec="*.ifo") returned 0 [0093.357] lstrlenA (lpString="*.ifo") returned 5 [0093.357] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl.css", pszSpec="*.lnk") returned 0 [0093.357] lstrlenA (lpString="*.lnk") returned 5 [0093.357] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl.css", pszSpec="*.torrent") returned 0 [0093.357] lstrlenA (lpString="*.torrent") returned 9 [0093.357] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl.css", pszSpec="*.mov") returned 0 [0093.357] lstrlenA (lpString="*.mov") returned 5 [0093.357] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl.css", pszSpec="*.m2v") returned 0 [0093.357] lstrlenA (lpString="*.m2v") returned 5 [0093.357] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl.css", pszSpec="*.3gp") returned 0 [0093.357] lstrlenA (lpString="*.3gp") returned 5 [0093.357] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl.css", pszSpec="*.mpeg") returned 0 [0093.357] lstrlenA (lpString="*.mpeg") returned 6 [0093.357] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl.css", pszSpec="*.mpg") returned 0 [0093.357] lstrlenA (lpString="*.mpg") returned 5 [0093.357] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl.css", pszSpec="*.flv") returned 0 [0093.357] lstrlenA (lpString="*.flv") returned 5 [0093.357] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl.css", pszSpec="*.avi") returned 0 [0093.357] lstrlenA (lpString="*.avi") returned 5 [0093.357] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl.css", pszSpec="*.mp4") returned 0 [0093.358] lstrlenA (lpString="*.mp4") returned 5 [0093.358] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl.css", pszSpec="*.wmv") returned 0 [0093.358] lstrlenA (lpString="*.wmv") returned 5 [0093.358] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl.css", pszSpec="*.divx") returned 0 [0093.358] lstrlenA (lpString="*.divx") returned 6 [0093.358] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl.css", pszSpec="*.mkv") returned 0 [0093.358] lstrlenA (lpString="*.mkv") returned 5 [0093.358] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl.css", pszSpec="*.mp3") returned 0 [0093.358] lstrlenA (lpString="*.mp3") returned 5 [0093.358] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl.css", pszSpec="*.wav") returned 0 [0093.358] lstrlenA (lpString="*.wav") returned 5 [0093.358] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl.css", pszSpec="*.flac") returned 0 [0093.358] lstrlenA (lpString="*.flac") returned 6 [0093.358] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl.css", pszSpec="*.ape") returned 0 [0093.358] lstrlenA (lpString="*.ape") returned 5 [0093.358] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl.css", pszSpec="*.wma") returned 0 [0093.358] lstrlenA (lpString="*.wma") returned 5 [0093.358] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl.css", pszSpec="*.ac3") returned 0 [0093.358] lstrlenA (lpString="*.ac3") returned 5 [0093.358] FindNextFileA (in: hFindFile=0x5b7d70, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0093.358] PeekMessageA (in: lpMsg=0xaece4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaece4) returned 0 [0093.358] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Teal.css") returned -1 [0093.358] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Teal.css") returned -1 [0093.358] lstrcmpiA (lpString1="", lpString2="Teal.css") returned -1 [0093.358] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl.css") returned="Swirl.css" [0093.358] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\", lpString2="Teal.css" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Teal.css") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Teal.css" [0093.358] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Teal.css", pszSpec="*.zip") returned 0 [0093.358] lstrlenA (lpString="*.zip") returned 5 [0093.358] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Teal.css", pszSpec="*.rar") returned 0 [0093.358] lstrlenA (lpString="*.rar") returned 5 [0093.358] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Teal.css", pszSpec="*.7z") returned 0 [0093.358] lstrlenA (lpString="*.7z") returned 4 [0093.358] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Teal.css", pszSpec="*.tar") returned 0 [0093.358] lstrlenA (lpString="*.tar") returned 5 [0093.358] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Teal.css", pszSpec="*.gzip") returned 0 [0093.358] lstrlenA (lpString="*.gzip") returned 6 [0093.358] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Teal.css", pszSpec="*.jpg") returned 0 [0093.358] lstrlenA (lpString="*.jpg") returned 5 [0093.358] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Teal.css", pszSpec="*.jpeg") returned 0 [0093.358] lstrlenA (lpString="*.jpeg") returned 6 [0093.358] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Teal.css", pszSpec="*.psd") returned 0 [0093.358] lstrlenA (lpString="*.psd") returned 5 [0093.359] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Teal.css", pszSpec="*.cdr") returned 0 [0093.359] lstrlenA (lpString="*.cdr") returned 5 [0093.359] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Teal.css", pszSpec="*.dwg") returned 0 [0093.359] lstrlenA (lpString="*.dwg") returned 5 [0093.359] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Teal.css", pszSpec="*.max") returned 0 [0093.359] lstrlenA (lpString="*.max") returned 5 [0093.359] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Teal.css", pszSpec="*.bmp") returned 0 [0093.359] lstrlenA (lpString="*.bmp") returned 5 [0093.359] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Teal.css", pszSpec="*.gif") returned 0 [0093.359] lstrlenA (lpString="*.gif") returned 5 [0093.359] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Teal.css", pszSpec="*.png") returned 0 [0093.359] lstrlenA (lpString="*.png") returned 5 [0093.359] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Teal.css", pszSpec="*.doc") returned 0 [0093.359] lstrlenA (lpString="*.doc") returned 5 [0093.359] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Teal.css", pszSpec="*.docx") returned 0 [0093.359] lstrlenA (lpString="*.docx") returned 6 [0093.359] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Teal.css", pszSpec="*.xls") returned 0 [0093.359] lstrlenA (lpString="*.xls") returned 5 [0093.359] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Teal.css", pszSpec="*.xlsx") returned 0 [0093.359] lstrlenA (lpString="*.xlsx") returned 6 [0093.359] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Teal.css", pszSpec="*.ppt") returned 0 [0093.359] lstrlenA (lpString="*.ppt") returned 5 [0093.359] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Teal.css", pszSpec="*.pptx") returned 0 [0093.359] lstrlenA (lpString="*.pptx") returned 6 [0093.359] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Teal.css", pszSpec="*.txt") returned 0 [0093.359] lstrlenA (lpString="*.txt") returned 5 [0093.359] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Teal.css", pszSpec="*.pdf") returned 0 [0093.359] lstrlenA (lpString="*.pdf") returned 5 [0093.359] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Teal.css", pszSpec="*.djvu") returned 0 [0093.359] lstrlenA (lpString="*.djvu") returned 6 [0093.359] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Teal.css", pszSpec="*.htm") returned 0 [0093.359] lstrlenA (lpString="*.htm") returned 5 [0093.359] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Teal.css", pszSpec="*.html") returned 0 [0093.359] lstrlenA (lpString="*.html") returned 6 [0093.359] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Teal.css", pszSpec="*.mdb") returned 0 [0093.359] lstrlenA (lpString="*.mdb") returned 5 [0093.359] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Teal.css", pszSpec="*.cer") returned 0 [0093.359] lstrlenA (lpString="*.cer") returned 5 [0093.359] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Teal.css", pszSpec="*.p12") returned 0 [0093.359] lstrlenA (lpString="*.p12") returned 5 [0093.359] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Teal.css", pszSpec="*.pfx") returned 0 [0093.359] lstrlenA (lpString="*.pfx") returned 5 [0093.359] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Teal.css", pszSpec="*.kwm") returned 0 [0093.359] lstrlenA (lpString="*.kwm") returned 5 [0093.359] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Teal.css", pszSpec="*.pwm") returned 0 [0093.359] lstrlenA (lpString="*.pwm") returned 5 [0093.359] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Teal.css", pszSpec="*.1cd") returned 0 [0093.359] lstrlenA (lpString="*.1cd") returned 5 [0093.359] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Teal.css", pszSpec="*.md") returned 0 [0093.359] lstrlenA (lpString="*.md") returned 4 [0093.360] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Teal.css", pszSpec="*.mdf") returned 0 [0093.360] lstrlenA (lpString="*.mdf") returned 5 [0093.360] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Teal.css", pszSpec="*.dbf") returned 0 [0093.360] lstrlenA (lpString="*.dbf") returned 5 [0093.360] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Teal.css", pszSpec="*.odt") returned 0 [0093.360] lstrlenA (lpString="*.odt") returned 5 [0093.360] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Teal.css", pszSpec="*.vob") returned 0 [0093.360] lstrlenA (lpString="*.vob") returned 5 [0093.360] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Teal.css", pszSpec="*.ifo") returned 0 [0093.360] lstrlenA (lpString="*.ifo") returned 5 [0093.360] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Teal.css", pszSpec="*.lnk") returned 0 [0093.360] lstrlenA (lpString="*.lnk") returned 5 [0093.360] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Teal.css", pszSpec="*.torrent") returned 0 [0093.360] lstrlenA (lpString="*.torrent") returned 9 [0093.360] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Teal.css", pszSpec="*.mov") returned 0 [0093.360] lstrlenA (lpString="*.mov") returned 5 [0093.360] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Teal.css", pszSpec="*.m2v") returned 0 [0093.360] lstrlenA (lpString="*.m2v") returned 5 [0093.360] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Teal.css", pszSpec="*.3gp") returned 0 [0093.360] lstrlenA (lpString="*.3gp") returned 5 [0093.360] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Teal.css", pszSpec="*.mpeg") returned 0 [0093.360] lstrlenA (lpString="*.mpeg") returned 6 [0093.360] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Teal.css", pszSpec="*.mpg") returned 0 [0093.360] lstrlenA (lpString="*.mpg") returned 5 [0093.360] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Teal.css", pszSpec="*.flv") returned 0 [0093.360] lstrlenA (lpString="*.flv") returned 5 [0093.360] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Teal.css", pszSpec="*.avi") returned 0 [0093.360] lstrlenA (lpString="*.avi") returned 5 [0093.360] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Teal.css", pszSpec="*.mp4") returned 0 [0093.360] lstrlenA (lpString="*.mp4") returned 5 [0093.360] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Teal.css", pszSpec="*.wmv") returned 0 [0093.360] lstrlenA (lpString="*.wmv") returned 5 [0093.360] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Teal.css", pszSpec="*.divx") returned 0 [0093.360] lstrlenA (lpString="*.divx") returned 6 [0093.360] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Teal.css", pszSpec="*.mkv") returned 0 [0093.360] lstrlenA (lpString="*.mkv") returned 5 [0093.360] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Teal.css", pszSpec="*.mp3") returned 0 [0093.360] lstrlenA (lpString="*.mp3") returned 5 [0093.360] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Teal.css", pszSpec="*.wav") returned 0 [0093.360] lstrlenA (lpString="*.wav") returned 5 [0093.360] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Teal.css", pszSpec="*.flac") returned 0 [0093.360] lstrlenA (lpString="*.flac") returned 6 [0093.360] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Teal.css", pszSpec="*.ape") returned 0 [0093.360] lstrlenA (lpString="*.ape") returned 5 [0093.360] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Teal.css", pszSpec="*.wma") returned 0 [0093.360] lstrlenA (lpString="*.wma") returned 5 [0093.360] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Teal.css", pszSpec="*.ac3") returned 0 [0093.360] lstrlenA (lpString="*.ac3") returned 5 [0093.360] FindNextFileA (in: hFindFile=0x5b7d70, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0093.360] PeekMessageA (in: lpMsg=0xaece4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaece4) returned 0 [0093.360] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="TexturedBlue.css") returned -1 [0093.361] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TexturedBlue.css") returned -1 [0093.361] lstrcmpiA (lpString1="", lpString2="TexturedBlue.css") returned -1 [0093.361] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Teal.css") returned="Teal.css" [0093.361] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\", lpString2="TexturedBlue.css" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\TexturedBlue.css") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\TexturedBlue.css" [0093.361] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\TexturedBlue.css", pszSpec="*.zip") returned 0 [0093.361] lstrlenA (lpString="*.zip") returned 5 [0093.361] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\TexturedBlue.css", pszSpec="*.rar") returned 0 [0093.361] lstrlenA (lpString="*.rar") returned 5 [0093.361] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\TexturedBlue.css", pszSpec="*.7z") returned 0 [0093.361] lstrlenA (lpString="*.7z") returned 4 [0093.361] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\TexturedBlue.css", pszSpec="*.tar") returned 0 [0093.361] lstrlenA (lpString="*.tar") returned 5 [0093.361] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\TexturedBlue.css", pszSpec="*.gzip") returned 0 [0093.361] lstrlenA (lpString="*.gzip") returned 6 [0093.361] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\TexturedBlue.css", pszSpec="*.jpg") returned 0 [0093.361] lstrlenA (lpString="*.jpg") returned 5 [0093.361] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\TexturedBlue.css", pszSpec="*.jpeg") returned 0 [0093.361] lstrlenA (lpString="*.jpeg") returned 6 [0093.361] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\TexturedBlue.css", pszSpec="*.psd") returned 0 [0093.361] lstrlenA (lpString="*.psd") returned 5 [0093.361] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\TexturedBlue.css", pszSpec="*.cdr") returned 0 [0093.361] lstrlenA (lpString="*.cdr") returned 5 [0093.361] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\TexturedBlue.css", pszSpec="*.dwg") returned 0 [0093.361] lstrlenA (lpString="*.dwg") returned 5 [0093.361] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\TexturedBlue.css", pszSpec="*.max") returned 0 [0093.361] lstrlenA (lpString="*.max") returned 5 [0093.361] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\TexturedBlue.css", pszSpec="*.bmp") returned 0 [0093.361] lstrlenA (lpString="*.bmp") returned 5 [0093.361] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\TexturedBlue.css", pszSpec="*.gif") returned 0 [0093.361] lstrlenA (lpString="*.gif") returned 5 [0093.361] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\TexturedBlue.css", pszSpec="*.png") returned 0 [0093.361] lstrlenA (lpString="*.png") returned 5 [0093.361] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\TexturedBlue.css", pszSpec="*.doc") returned 0 [0093.361] lstrlenA (lpString="*.doc") returned 5 [0093.361] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\TexturedBlue.css", pszSpec="*.docx") returned 0 [0093.361] lstrlenA (lpString="*.docx") returned 6 [0093.361] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\TexturedBlue.css", pszSpec="*.xls") returned 0 [0093.361] lstrlenA (lpString="*.xls") returned 5 [0093.361] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\TexturedBlue.css", pszSpec="*.xlsx") returned 0 [0093.361] lstrlenA (lpString="*.xlsx") returned 6 [0093.361] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\TexturedBlue.css", pszSpec="*.ppt") returned 0 [0093.361] lstrlenA (lpString="*.ppt") returned 5 [0093.361] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\TexturedBlue.css", pszSpec="*.pptx") returned 0 [0093.361] lstrlenA (lpString="*.pptx") returned 6 [0093.361] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\TexturedBlue.css", pszSpec="*.txt") returned 0 [0093.361] lstrlenA (lpString="*.txt") returned 5 [0093.361] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\TexturedBlue.css", pszSpec="*.pdf") returned 0 [0093.361] lstrlenA (lpString="*.pdf") returned 5 [0093.361] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\TexturedBlue.css", pszSpec="*.djvu") returned 0 [0093.362] lstrlenA (lpString="*.djvu") returned 6 [0093.362] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\TexturedBlue.css", pszSpec="*.htm") returned 0 [0093.362] lstrlenA (lpString="*.htm") returned 5 [0093.362] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\TexturedBlue.css", pszSpec="*.html") returned 0 [0093.362] lstrlenA (lpString="*.html") returned 6 [0093.362] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\TexturedBlue.css", pszSpec="*.mdb") returned 0 [0093.362] lstrlenA (lpString="*.mdb") returned 5 [0093.362] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\TexturedBlue.css", pszSpec="*.cer") returned 0 [0093.362] lstrlenA (lpString="*.cer") returned 5 [0093.362] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\TexturedBlue.css", pszSpec="*.p12") returned 0 [0093.362] lstrlenA (lpString="*.p12") returned 5 [0093.362] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\TexturedBlue.css", pszSpec="*.pfx") returned 0 [0093.362] lstrlenA (lpString="*.pfx") returned 5 [0093.362] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\TexturedBlue.css", pszSpec="*.kwm") returned 0 [0093.362] lstrlenA (lpString="*.kwm") returned 5 [0093.362] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\TexturedBlue.css", pszSpec="*.pwm") returned 0 [0093.362] lstrlenA (lpString="*.pwm") returned 5 [0093.362] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\TexturedBlue.css", pszSpec="*.1cd") returned 0 [0093.362] lstrlenA (lpString="*.1cd") returned 5 [0093.362] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\TexturedBlue.css", pszSpec="*.md") returned 0 [0093.362] lstrlenA (lpString="*.md") returned 4 [0093.362] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\TexturedBlue.css", pszSpec="*.mdf") returned 0 [0093.362] lstrlenA (lpString="*.mdf") returned 5 [0093.362] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\TexturedBlue.css", pszSpec="*.dbf") returned 0 [0093.362] lstrlenA (lpString="*.dbf") returned 5 [0093.362] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\TexturedBlue.css", pszSpec="*.odt") returned 0 [0093.362] lstrlenA (lpString="*.odt") returned 5 [0093.362] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\TexturedBlue.css", pszSpec="*.vob") returned 0 [0093.362] lstrlenA (lpString="*.vob") returned 5 [0093.362] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\TexturedBlue.css", pszSpec="*.ifo") returned 0 [0093.362] lstrlenA (lpString="*.ifo") returned 5 [0093.362] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\TexturedBlue.css", pszSpec="*.lnk") returned 0 [0093.362] lstrlenA (lpString="*.lnk") returned 5 [0093.362] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\TexturedBlue.css", pszSpec="*.torrent") returned 0 [0093.362] lstrlenA (lpString="*.torrent") returned 9 [0093.362] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\TexturedBlue.css", pszSpec="*.mov") returned 0 [0093.362] lstrlenA (lpString="*.mov") returned 5 [0093.362] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\TexturedBlue.css", pszSpec="*.m2v") returned 0 [0093.362] lstrlenA (lpString="*.m2v") returned 5 [0093.362] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\TexturedBlue.css", pszSpec="*.3gp") returned 0 [0093.362] lstrlenA (lpString="*.3gp") returned 5 [0093.362] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\TexturedBlue.css", pszSpec="*.mpeg") returned 0 [0093.362] lstrlenA (lpString="*.mpeg") returned 6 [0093.362] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\TexturedBlue.css", pszSpec="*.mpg") returned 0 [0093.362] lstrlenA (lpString="*.mpg") returned 5 [0093.362] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\TexturedBlue.css", pszSpec="*.flv") returned 0 [0093.362] lstrlenA (lpString="*.flv") returned 5 [0093.362] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\TexturedBlue.css", pszSpec="*.avi") returned 0 [0093.362] lstrlenA (lpString="*.avi") returned 5 [0093.362] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\TexturedBlue.css", pszSpec="*.mp4") returned 0 [0093.362] lstrlenA (lpString="*.mp4") returned 5 [0093.363] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\TexturedBlue.css", pszSpec="*.wmv") returned 0 [0093.363] lstrlenA (lpString="*.wmv") returned 5 [0093.363] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\TexturedBlue.css", pszSpec="*.divx") returned 0 [0093.363] lstrlenA (lpString="*.divx") returned 6 [0093.363] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\TexturedBlue.css", pszSpec="*.mkv") returned 0 [0093.363] lstrlenA (lpString="*.mkv") returned 5 [0093.363] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\TexturedBlue.css", pszSpec="*.mp3") returned 0 [0093.363] lstrlenA (lpString="*.mp3") returned 5 [0093.363] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\TexturedBlue.css", pszSpec="*.wav") returned 0 [0093.363] lstrlenA (lpString="*.wav") returned 5 [0093.363] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\TexturedBlue.css", pszSpec="*.flac") returned 0 [0093.363] lstrlenA (lpString="*.flac") returned 6 [0093.363] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\TexturedBlue.css", pszSpec="*.ape") returned 0 [0093.363] lstrlenA (lpString="*.ape") returned 5 [0093.363] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\TexturedBlue.css", pszSpec="*.wma") returned 0 [0093.363] lstrlenA (lpString="*.wma") returned 5 [0093.363] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\TexturedBlue.css", pszSpec="*.ac3") returned 0 [0093.363] lstrlenA (lpString="*.ac3") returned 5 [0093.363] FindNextFileA (in: hFindFile=0x5b7d70, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0093.363] PeekMessageA (in: lpMsg=0xaece4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaece4) returned 0 [0093.363] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="VelvetRose.css") returned -1 [0093.363] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="VelvetRose.css") returned -1 [0093.363] lstrcmpiA (lpString1="", lpString2="VelvetRose.css") returned -1 [0093.363] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\TexturedBlue.css") returned="TexturedBlue.css" [0093.363] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\", lpString2="VelvetRose.css" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\VelvetRose.css") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\VelvetRose.css" [0093.363] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\VelvetRose.css", pszSpec="*.zip") returned 0 [0093.363] lstrlenA (lpString="*.zip") returned 5 [0093.363] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\VelvetRose.css", pszSpec="*.rar") returned 0 [0093.363] lstrlenA (lpString="*.rar") returned 5 [0093.363] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\VelvetRose.css", pszSpec="*.7z") returned 0 [0093.363] lstrlenA (lpString="*.7z") returned 4 [0093.363] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\VelvetRose.css", pszSpec="*.tar") returned 0 [0093.363] lstrlenA (lpString="*.tar") returned 5 [0093.363] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\VelvetRose.css", pszSpec="*.gzip") returned 0 [0093.363] lstrlenA (lpString="*.gzip") returned 6 [0093.363] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\VelvetRose.css", pszSpec="*.jpg") returned 0 [0093.363] lstrlenA (lpString="*.jpg") returned 5 [0093.363] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\VelvetRose.css", pszSpec="*.jpeg") returned 0 [0093.363] lstrlenA (lpString="*.jpeg") returned 6 [0093.363] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\VelvetRose.css", pszSpec="*.psd") returned 0 [0093.363] lstrlenA (lpString="*.psd") returned 5 [0093.363] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\VelvetRose.css", pszSpec="*.cdr") returned 0 [0093.363] lstrlenA (lpString="*.cdr") returned 5 [0093.363] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\VelvetRose.css", pszSpec="*.dwg") returned 0 [0093.363] lstrlenA (lpString="*.dwg") returned 5 [0093.363] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\VelvetRose.css", pszSpec="*.max") returned 0 [0093.363] lstrlenA (lpString="*.max") returned 5 [0093.363] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\VelvetRose.css", pszSpec="*.bmp") returned 0 [0093.363] lstrlenA (lpString="*.bmp") returned 5 [0093.363] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\VelvetRose.css", pszSpec="*.gif") returned 0 [0093.364] lstrlenA (lpString="*.gif") returned 5 [0093.364] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\VelvetRose.css", pszSpec="*.png") returned 0 [0093.364] lstrlenA (lpString="*.png") returned 5 [0093.364] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\VelvetRose.css", pszSpec="*.doc") returned 0 [0093.364] lstrlenA (lpString="*.doc") returned 5 [0093.364] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\VelvetRose.css", pszSpec="*.docx") returned 0 [0093.364] lstrlenA (lpString="*.docx") returned 6 [0093.364] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\VelvetRose.css", pszSpec="*.xls") returned 0 [0093.364] lstrlenA (lpString="*.xls") returned 5 [0093.364] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\VelvetRose.css", pszSpec="*.xlsx") returned 0 [0093.364] lstrlenA (lpString="*.xlsx") returned 6 [0093.364] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\VelvetRose.css", pszSpec="*.ppt") returned 0 [0093.364] lstrlenA (lpString="*.ppt") returned 5 [0093.364] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\VelvetRose.css", pszSpec="*.pptx") returned 0 [0093.364] lstrlenA (lpString="*.pptx") returned 6 [0093.364] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\VelvetRose.css", pszSpec="*.txt") returned 0 [0093.364] lstrlenA (lpString="*.txt") returned 5 [0093.364] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\VelvetRose.css", pszSpec="*.pdf") returned 0 [0093.364] lstrlenA (lpString="*.pdf") returned 5 [0093.364] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\VelvetRose.css", pszSpec="*.djvu") returned 0 [0093.364] lstrlenA (lpString="*.djvu") returned 6 [0093.364] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\VelvetRose.css", pszSpec="*.htm") returned 0 [0093.364] lstrlenA (lpString="*.htm") returned 5 [0093.364] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\VelvetRose.css", pszSpec="*.html") returned 0 [0093.364] lstrlenA (lpString="*.html") returned 6 [0093.364] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\VelvetRose.css", pszSpec="*.mdb") returned 0 [0093.364] lstrlenA (lpString="*.mdb") returned 5 [0093.364] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\VelvetRose.css", pszSpec="*.cer") returned 0 [0093.364] lstrlenA (lpString="*.cer") returned 5 [0093.364] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\VelvetRose.css", pszSpec="*.p12") returned 0 [0093.364] lstrlenA (lpString="*.p12") returned 5 [0093.364] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\VelvetRose.css", pszSpec="*.pfx") returned 0 [0093.364] lstrlenA (lpString="*.pfx") returned 5 [0093.364] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\VelvetRose.css", pszSpec="*.kwm") returned 0 [0093.364] lstrlenA (lpString="*.kwm") returned 5 [0093.364] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\VelvetRose.css", pszSpec="*.pwm") returned 0 [0093.364] lstrlenA (lpString="*.pwm") returned 5 [0093.364] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\VelvetRose.css", pszSpec="*.1cd") returned 0 [0093.364] lstrlenA (lpString="*.1cd") returned 5 [0093.364] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\VelvetRose.css", pszSpec="*.md") returned 0 [0093.364] lstrlenA (lpString="*.md") returned 4 [0093.364] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\VelvetRose.css", pszSpec="*.mdf") returned 0 [0093.364] lstrlenA (lpString="*.mdf") returned 5 [0093.364] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\VelvetRose.css", pszSpec="*.dbf") returned 0 [0093.364] lstrlenA (lpString="*.dbf") returned 5 [0093.364] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\VelvetRose.css", pszSpec="*.odt") returned 0 [0093.364] lstrlenA (lpString="*.odt") returned 5 [0093.364] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\VelvetRose.css", pszSpec="*.vob") returned 0 [0093.364] lstrlenA (lpString="*.vob") returned 5 [0093.364] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\VelvetRose.css", pszSpec="*.ifo") returned 0 [0093.364] lstrlenA (lpString="*.ifo") returned 5 [0093.365] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\VelvetRose.css", pszSpec="*.lnk") returned 0 [0093.365] lstrlenA (lpString="*.lnk") returned 5 [0093.365] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\VelvetRose.css", pszSpec="*.torrent") returned 0 [0093.365] lstrlenA (lpString="*.torrent") returned 9 [0093.365] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\VelvetRose.css", pszSpec="*.mov") returned 0 [0093.365] lstrlenA (lpString="*.mov") returned 5 [0093.365] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\VelvetRose.css", pszSpec="*.m2v") returned 0 [0093.365] lstrlenA (lpString="*.m2v") returned 5 [0093.365] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\VelvetRose.css", pszSpec="*.3gp") returned 0 [0093.365] lstrlenA (lpString="*.3gp") returned 5 [0093.365] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\VelvetRose.css", pszSpec="*.mpeg") returned 0 [0093.365] lstrlenA (lpString="*.mpeg") returned 6 [0093.365] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\VelvetRose.css", pszSpec="*.mpg") returned 0 [0093.365] lstrlenA (lpString="*.mpg") returned 5 [0093.365] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\VelvetRose.css", pszSpec="*.flv") returned 0 [0093.365] lstrlenA (lpString="*.flv") returned 5 [0093.365] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\VelvetRose.css", pszSpec="*.avi") returned 0 [0093.365] lstrlenA (lpString="*.avi") returned 5 [0093.365] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\VelvetRose.css", pszSpec="*.mp4") returned 0 [0093.365] lstrlenA (lpString="*.mp4") returned 5 [0093.365] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\VelvetRose.css", pszSpec="*.wmv") returned 0 [0093.365] lstrlenA (lpString="*.wmv") returned 5 [0093.365] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\VelvetRose.css", pszSpec="*.divx") returned 0 [0093.365] lstrlenA (lpString="*.divx") returned 6 [0093.365] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\VelvetRose.css", pszSpec="*.mkv") returned 0 [0093.365] lstrlenA (lpString="*.mkv") returned 5 [0093.365] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\VelvetRose.css", pszSpec="*.mp3") returned 0 [0093.365] lstrlenA (lpString="*.mp3") returned 5 [0093.365] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\VelvetRose.css", pszSpec="*.wav") returned 0 [0093.365] lstrlenA (lpString="*.wav") returned 5 [0093.365] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\VelvetRose.css", pszSpec="*.flac") returned 0 [0093.365] lstrlenA (lpString="*.flac") returned 6 [0093.365] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\VelvetRose.css", pszSpec="*.ape") returned 0 [0093.365] lstrlenA (lpString="*.ape") returned 5 [0093.365] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\VelvetRose.css", pszSpec="*.wma") returned 0 [0093.365] lstrlenA (lpString="*.wma") returned 5 [0093.365] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\VelvetRose.css", pszSpec="*.ac3") returned 0 [0093.365] lstrlenA (lpString="*.ac3") returned 5 [0093.365] FindNextFileA (in: hFindFile=0x5b7d70, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 0 [0093.365] FindClose (in: hFindFile=0x5b7d70 | out: hFindFile=0x5b7d70) returned 1 [0093.366] FindNextFileA (in: hFindFile=0x5b7d30, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0093.366] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0093.366] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="FormsVersion1Warning.htm") returned -1 [0093.366] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FormsVersion1Warning.htm") returned 1 [0093.366] lstrcmpiA (lpString1="", lpString2="FormsVersion1Warning.htm") returned -1 [0093.366] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\*.*") returned="*.*" [0093.366] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="FormsVersion1Warning.htm" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsVersion1Warning.htm") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsVersion1Warning.htm" [0093.366] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsVersion1Warning.htm", pszSpec="*.zip") returned 0 [0093.366] lstrlenA (lpString="*.zip") returned 5 [0093.366] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsVersion1Warning.htm", pszSpec="*.rar") returned 0 [0093.366] lstrlenA (lpString="*.rar") returned 5 [0093.366] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsVersion1Warning.htm", pszSpec="*.7z") returned 0 [0093.366] lstrlenA (lpString="*.7z") returned 4 [0093.366] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsVersion1Warning.htm", pszSpec="*.tar") returned 0 [0093.366] lstrlenA (lpString="*.tar") returned 5 [0093.366] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsVersion1Warning.htm", pszSpec="*.gzip") returned 0 [0093.366] lstrlenA (lpString="*.gzip") returned 6 [0093.366] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsVersion1Warning.htm", pszSpec="*.jpg") returned 0 [0093.366] lstrlenA (lpString="*.jpg") returned 5 [0093.366] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsVersion1Warning.htm", pszSpec="*.jpeg") returned 0 [0093.366] lstrlenA (lpString="*.jpeg") returned 6 [0093.366] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsVersion1Warning.htm", pszSpec="*.psd") returned 0 [0093.366] lstrlenA (lpString="*.psd") returned 5 [0093.366] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsVersion1Warning.htm", pszSpec="*.cdr") returned 0 [0093.366] lstrlenA (lpString="*.cdr") returned 5 [0093.366] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsVersion1Warning.htm", pszSpec="*.dwg") returned 0 [0093.366] lstrlenA (lpString="*.dwg") returned 5 [0093.366] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsVersion1Warning.htm", pszSpec="*.max") returned 0 [0093.366] lstrlenA (lpString="*.max") returned 5 [0093.366] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsVersion1Warning.htm", pszSpec="*.bmp") returned 0 [0093.366] lstrlenA (lpString="*.bmp") returned 5 [0093.366] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsVersion1Warning.htm", pszSpec="*.gif") returned 0 [0093.366] lstrlenA (lpString="*.gif") returned 5 [0093.366] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsVersion1Warning.htm", pszSpec="*.png") returned 0 [0093.366] lstrlenA (lpString="*.png") returned 5 [0093.366] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsVersion1Warning.htm", pszSpec="*.doc") returned 0 [0093.366] lstrlenA (lpString="*.doc") returned 5 [0093.366] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsVersion1Warning.htm", pszSpec="*.docx") returned 0 [0093.366] lstrlenA (lpString="*.docx") returned 6 [0093.366] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsVersion1Warning.htm", pszSpec="*.xls") returned 0 [0093.366] lstrlenA (lpString="*.xls") returned 5 [0093.366] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsVersion1Warning.htm", pszSpec="*.xlsx") returned 0 [0093.366] lstrlenA (lpString="*.xlsx") returned 6 [0093.366] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsVersion1Warning.htm", pszSpec="*.ppt") returned 0 [0093.366] lstrlenA (lpString="*.ppt") returned 5 [0093.366] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsVersion1Warning.htm", pszSpec="*.pptx") returned 0 [0093.366] lstrlenA (lpString="*.pptx") returned 6 [0093.366] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsVersion1Warning.htm", pszSpec="*.txt") returned 0 [0093.367] lstrlenA (lpString="*.txt") returned 5 [0093.367] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsVersion1Warning.htm" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsVersion1Warning.htm") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsVersion1Warning.htm" [0093.367] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsVersion1Warning.htm" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsVersion1Warning.htm") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsVersion1Warning.htm" [0093.367] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsVersion1Warning.htm", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsVersion1Warning.htm.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsVersion1Warning.htm." [0093.367] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsVersion1Warning.htm.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsVersion1Warning.htm. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsVersion1Warning.htm. " [0093.367] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsVersion1Warning.htm" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsversion1warning.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0093.368] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x8f6 [0093.368] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x95883700, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5298e710, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x95883700, dwHighDateTime=0x1c747ea)) returned 1 [0093.368] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0093.368] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x89c, lpOverlapped=0x0) returned 1 [0093.442] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsVersion1Warning.htm") returned="FormsVersion1Warning.htm" [0093.442] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0093.442] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x89c, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x89c, lpOverlapped=0x0) returned 1 [0093.442] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0093.442] CloseHandle (hObject=0x98) returned 1 [0093.443] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsVersion1Warning.htm" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsversion1warning.htm"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsVersion1Warning.htm. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsversion1warning.htm. ")) returned 1 [0093.444] FindNextFileA (in: hFindFile=0x5b7d30, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0093.444] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0093.444] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="FormsViewAttachmentIcons.jpg") returned -1 [0093.444] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FormsViewAttachmentIcons.jpg") returned 1 [0093.444] lstrcmpiA (lpString1="", lpString2="FormsViewAttachmentIcons.jpg") returned -1 [0093.444] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsVersion1Warning.htm") returned="FormsVersion1Warning.htm" [0093.444] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="FormsViewAttachmentIcons.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIcons.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIcons.jpg" [0093.444] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIcons.jpg", pszSpec="*.zip") returned 0 [0093.444] lstrlenA (lpString="*.zip") returned 5 [0093.444] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIcons.jpg", pszSpec="*.rar") returned 0 [0093.444] lstrlenA (lpString="*.rar") returned 5 [0093.444] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIcons.jpg", pszSpec="*.7z") returned 0 [0093.444] lstrlenA (lpString="*.7z") returned 4 [0093.444] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIcons.jpg", pszSpec="*.tar") returned 0 [0093.444] lstrlenA (lpString="*.tar") returned 5 [0093.444] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIcons.jpg", pszSpec="*.gzip") returned 0 [0093.444] lstrlenA (lpString="*.gzip") returned 6 [0093.444] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIcons.jpg", pszSpec="*.jpg") returned 1 [0093.444] lstrlenA (lpString="*.jpg") returned 5 [0093.444] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIcons.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIcons.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIcons.jpg" [0093.444] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIcons.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIcons.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIcons.jpg" [0093.444] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIcons.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIcons.jpg.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIcons.jpg." [0093.444] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIcons.jpg.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIcons.jpg. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIcons.jpg. " [0093.444] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIcons.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsviewattachmenticons.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0093.445] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2ee3 [0093.445] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x95883700, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x618eeb70, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x95883700, dwHighDateTime=0x1c747ea)) returned 1 [0093.445] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0093.445] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x2e89, lpOverlapped=0x0) returned 1 [0093.447] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIcons.jpg") returned="FormsViewAttachmentIcons.jpg" [0093.447] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0093.447] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x2e89, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x2e89, lpOverlapped=0x0) returned 1 [0093.447] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0093.447] CloseHandle (hObject=0x98) returned 1 [0093.448] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIcons.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsviewattachmenticons.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIcons.jpg. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsviewattachmenticons.jpg. ")) returned 1 [0093.449] FindNextFileA (in: hFindFile=0x5b7d30, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0093.449] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0093.449] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="FormsViewAttachmentIconsMask.bmp") returned -1 [0093.449] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FormsViewAttachmentIconsMask.bmp") returned 1 [0093.449] lstrcmpiA (lpString1="", lpString2="FormsViewAttachmentIconsMask.bmp") returned -1 [0093.449] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIcons.jpg") returned="FormsViewAttachmentIcons.jpg" [0093.449] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="FormsViewAttachmentIconsMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIconsMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIconsMask.bmp" [0093.449] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.zip") returned 0 [0093.449] lstrlenA (lpString="*.zip") returned 5 [0093.449] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.rar") returned 0 [0093.449] lstrlenA (lpString="*.rar") returned 5 [0093.449] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.7z") returned 0 [0093.449] lstrlenA (lpString="*.7z") returned 4 [0093.449] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.tar") returned 0 [0093.449] lstrlenA (lpString="*.tar") returned 5 [0093.449] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.gzip") returned 0 [0093.449] lstrlenA (lpString="*.gzip") returned 6 [0093.449] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.jpg") returned 0 [0093.449] lstrlenA (lpString="*.jpg") returned 5 [0093.449] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.jpeg") returned 0 [0093.449] lstrlenA (lpString="*.jpeg") returned 6 [0093.449] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.psd") returned 0 [0093.449] lstrlenA (lpString="*.psd") returned 5 [0093.449] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.cdr") returned 0 [0093.449] lstrlenA (lpString="*.cdr") returned 5 [0093.449] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.dwg") returned 0 [0093.449] lstrlenA (lpString="*.dwg") returned 5 [0093.449] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.max") returned 0 [0093.449] lstrlenA (lpString="*.max") returned 5 [0093.449] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.bmp") returned 1 [0093.449] lstrlenA (lpString="*.bmp") returned 5 [0093.449] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIconsMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIconsMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIconsMask.bmp" [0093.449] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIconsMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIconsMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIconsMask.bmp" [0093.449] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIconsMask.bmp", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIconsMask.bmp.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIconsMask.bmp." [0093.450] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIconsMask.bmp.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIconsMask.bmp. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIconsMask.bmp. " [0093.450] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIconsMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsviewattachmenticonsmask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0093.450] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x638 [0093.450] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x95883700, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5298e710, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x95883700, dwHighDateTime=0x1c747ea)) returned 1 [0093.450] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0093.450] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x5de, lpOverlapped=0x0) returned 1 [0093.493] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIconsMask.bmp") returned="FormsViewAttachmentIconsMask.bmp" [0093.493] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0093.493] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x5de, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x5de, lpOverlapped=0x0) returned 1 [0093.493] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0093.493] CloseHandle (hObject=0x98) returned 1 [0093.494] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIconsMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsviewattachmenticonsmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIconsMask.bmp. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsviewattachmenticonsmask.bmp. ")) returned 1 [0093.496] FindNextFileA (in: hFindFile=0x5b7d30, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0093.496] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0093.496] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="FormsViewFrame.html") returned -1 [0093.496] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FormsViewFrame.html") returned 1 [0093.496] lstrcmpiA (lpString1="", lpString2="FormsViewFrame.html") returned -1 [0093.496] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIconsMask.bmp") returned="FormsViewAttachmentIconsMask.bmp" [0093.496] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="FormsViewFrame.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewFrame.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewFrame.html" [0093.496] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewFrame.html", pszSpec="*.zip") returned 0 [0093.496] lstrlenA (lpString="*.zip") returned 5 [0093.496] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewFrame.html", pszSpec="*.rar") returned 0 [0093.496] lstrlenA (lpString="*.rar") returned 5 [0093.496] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewFrame.html", pszSpec="*.7z") returned 0 [0093.496] lstrlenA (lpString="*.7z") returned 4 [0093.496] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewFrame.html", pszSpec="*.tar") returned 0 [0093.496] lstrlenA (lpString="*.tar") returned 5 [0093.496] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewFrame.html", pszSpec="*.gzip") returned 0 [0093.496] lstrlenA (lpString="*.gzip") returned 6 [0093.496] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewFrame.html", pszSpec="*.jpg") returned 0 [0093.496] lstrlenA (lpString="*.jpg") returned 5 [0093.496] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewFrame.html", pszSpec="*.jpeg") returned 0 [0093.496] lstrlenA (lpString="*.jpeg") returned 6 [0093.496] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewFrame.html", pszSpec="*.psd") returned 0 [0093.496] lstrlenA (lpString="*.psd") returned 5 [0093.496] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewFrame.html", pszSpec="*.cdr") returned 0 [0093.496] lstrlenA (lpString="*.cdr") returned 5 [0093.496] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewFrame.html", pszSpec="*.dwg") returned 0 [0093.496] lstrlenA (lpString="*.dwg") returned 5 [0093.496] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewFrame.html", pszSpec="*.max") returned 0 [0093.497] lstrlenA (lpString="*.max") returned 5 [0093.497] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewFrame.html", pszSpec="*.bmp") returned 0 [0093.497] lstrlenA (lpString="*.bmp") returned 5 [0093.497] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewFrame.html", pszSpec="*.gif") returned 0 [0093.497] lstrlenA (lpString="*.gif") returned 5 [0093.497] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewFrame.html", pszSpec="*.png") returned 0 [0093.497] lstrlenA (lpString="*.png") returned 5 [0093.497] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewFrame.html", pszSpec="*.doc") returned 0 [0093.497] lstrlenA (lpString="*.doc") returned 5 [0093.497] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewFrame.html", pszSpec="*.docx") returned 0 [0093.497] lstrlenA (lpString="*.docx") returned 6 [0093.497] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewFrame.html", pszSpec="*.xls") returned 0 [0093.497] lstrlenA (lpString="*.xls") returned 5 [0093.497] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewFrame.html", pszSpec="*.xlsx") returned 0 [0093.497] lstrlenA (lpString="*.xlsx") returned 6 [0093.497] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewFrame.html", pszSpec="*.ppt") returned 0 [0093.497] lstrlenA (lpString="*.ppt") returned 5 [0093.497] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewFrame.html", pszSpec="*.pptx") returned 0 [0093.497] lstrlenA (lpString="*.pptx") returned 6 [0093.497] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewFrame.html", pszSpec="*.txt") returned 0 [0093.497] lstrlenA (lpString="*.txt") returned 5 [0093.497] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewFrame.html", pszSpec="*.pdf") returned 0 [0093.497] lstrlenA (lpString="*.pdf") returned 5 [0093.497] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewFrame.html", pszSpec="*.djvu") returned 0 [0093.497] lstrlenA (lpString="*.djvu") returned 6 [0093.497] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewFrame.html", pszSpec="*.htm") returned 0 [0093.497] lstrlenA (lpString="*.htm") returned 5 [0093.497] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewFrame.html", pszSpec="*.html") returned 1 [0093.497] lstrlenA (lpString="*.html") returned 6 [0093.497] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewFrame.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewFrame.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewFrame.html" [0093.497] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewFrame.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewFrame.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewFrame.html" [0093.497] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewFrame.html", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewFrame.html.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewFrame.html." [0093.497] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewFrame.html.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewFrame.html. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewFrame.html. " [0093.497] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewFrame.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsviewframe.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0093.498] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1313 [0093.498] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x95883700, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5298e710, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x95883700, dwHighDateTime=0x1c747ea)) returned 1 [0093.498] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0093.498] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x12b9, lpOverlapped=0x0) returned 1 [0094.747] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewFrame.html") returned="FormsViewFrame.html" [0094.747] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0094.747] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x12b9, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x12b9, lpOverlapped=0x0) returned 1 [0094.747] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0094.747] CloseHandle (hObject=0x98) returned 1 [0094.748] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewFrame.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsviewframe.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewFrame.html. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsviewframe.html. ")) returned 1 [0094.749] FindNextFileA (in: hFindFile=0x5b7d30, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0094.749] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0094.749] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="FormsViewTemplate.html") returned -1 [0094.749] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FormsViewTemplate.html") returned 1 [0094.749] lstrcmpiA (lpString1="", lpString2="FormsViewTemplate.html") returned -1 [0094.749] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewFrame.html") returned="FormsViewFrame.html" [0094.749] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="FormsViewTemplate.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewTemplate.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewTemplate.html" [0094.749] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewTemplate.html", pszSpec="*.zip") returned 0 [0094.749] lstrlenA (lpString="*.zip") returned 5 [0094.749] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewTemplate.html", pszSpec="*.rar") returned 0 [0094.749] lstrlenA (lpString="*.rar") returned 5 [0094.749] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewTemplate.html", pszSpec="*.7z") returned 0 [0094.749] lstrlenA (lpString="*.7z") returned 4 [0094.749] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewTemplate.html", pszSpec="*.tar") returned 0 [0094.749] lstrlenA (lpString="*.tar") returned 5 [0094.749] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewTemplate.html", pszSpec="*.gzip") returned 0 [0094.749] lstrlenA (lpString="*.gzip") returned 6 [0094.749] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewTemplate.html", pszSpec="*.jpg") returned 0 [0094.749] lstrlenA (lpString="*.jpg") returned 5 [0094.749] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewTemplate.html", pszSpec="*.jpeg") returned 0 [0094.749] lstrlenA (lpString="*.jpeg") returned 6 [0094.749] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewTemplate.html", pszSpec="*.psd") returned 0 [0094.749] lstrlenA (lpString="*.psd") returned 5 [0094.749] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewTemplate.html", pszSpec="*.cdr") returned 0 [0094.749] lstrlenA (lpString="*.cdr") returned 5 [0094.749] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewTemplate.html", pszSpec="*.dwg") returned 0 [0094.749] lstrlenA (lpString="*.dwg") returned 5 [0094.749] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewTemplate.html", pszSpec="*.max") returned 0 [0094.749] lstrlenA (lpString="*.max") returned 5 [0094.749] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewTemplate.html", pszSpec="*.bmp") returned 0 [0094.749] lstrlenA (lpString="*.bmp") returned 5 [0094.749] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewTemplate.html", pszSpec="*.gif") returned 0 [0094.749] lstrlenA (lpString="*.gif") returned 5 [0094.749] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewTemplate.html", pszSpec="*.png") returned 0 [0094.749] lstrlenA (lpString="*.png") returned 5 [0094.749] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewTemplate.html", pszSpec="*.doc") returned 0 [0094.749] lstrlenA (lpString="*.doc") returned 5 [0094.749] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewTemplate.html", pszSpec="*.docx") returned 0 [0094.750] lstrlenA (lpString="*.docx") returned 6 [0094.750] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewTemplate.html", pszSpec="*.xls") returned 0 [0094.750] lstrlenA (lpString="*.xls") returned 5 [0094.750] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewTemplate.html", pszSpec="*.xlsx") returned 0 [0094.750] lstrlenA (lpString="*.xlsx") returned 6 [0094.750] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewTemplate.html", pszSpec="*.ppt") returned 0 [0094.750] lstrlenA (lpString="*.ppt") returned 5 [0094.750] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewTemplate.html", pszSpec="*.pptx") returned 0 [0094.750] lstrlenA (lpString="*.pptx") returned 6 [0094.750] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewTemplate.html", pszSpec="*.txt") returned 0 [0094.750] lstrlenA (lpString="*.txt") returned 5 [0094.750] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewTemplate.html", pszSpec="*.pdf") returned 0 [0094.750] lstrlenA (lpString="*.pdf") returned 5 [0094.750] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewTemplate.html", pszSpec="*.djvu") returned 0 [0094.750] lstrlenA (lpString="*.djvu") returned 6 [0094.750] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewTemplate.html", pszSpec="*.htm") returned 0 [0094.750] lstrlenA (lpString="*.htm") returned 5 [0094.750] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewTemplate.html", pszSpec="*.html") returned 1 [0094.750] lstrlenA (lpString="*.html") returned 6 [0094.750] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewTemplate.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewTemplate.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewTemplate.html" [0094.750] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewTemplate.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewTemplate.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewTemplate.html" [0094.750] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewTemplate.html", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewTemplate.html.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewTemplate.html." [0094.750] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewTemplate.html.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewTemplate.html. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewTemplate.html. " [0094.750] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsviewtemplate.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0094.751] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xa89 [0094.751] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x96b96400, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x618eeb70, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x96b96400, dwHighDateTime=0x1c747ea)) returned 1 [0094.751] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0094.751] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0xa2f, lpOverlapped=0x0) returned 1 [0094.752] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewTemplate.html") returned="FormsViewTemplate.html" [0094.752] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0094.752] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0xa2f, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0xa2f, lpOverlapped=0x0) returned 1 [0094.752] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0094.752] CloseHandle (hObject=0x98) returned 1 [0094.753] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsviewtemplate.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewTemplate.html. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsviewtemplate.html. ")) returned 1 [0094.754] FindNextFileA (in: hFindFile=0x5b7d30, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0094.754] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0094.754] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="FormToolImages.jpg") returned -1 [0094.754] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FormToolImages.jpg") returned 1 [0094.754] lstrcmpiA (lpString1="", lpString2="FormToolImages.jpg") returned -1 [0094.754] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewTemplate.html") returned="FormsViewTemplate.html" [0094.754] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="FormToolImages.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormToolImages.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormToolImages.jpg" [0094.754] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormToolImages.jpg", pszSpec="*.zip") returned 0 [0094.754] lstrlenA (lpString="*.zip") returned 5 [0094.754] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormToolImages.jpg", pszSpec="*.rar") returned 0 [0094.754] lstrlenA (lpString="*.rar") returned 5 [0094.754] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormToolImages.jpg", pszSpec="*.7z") returned 0 [0094.754] lstrlenA (lpString="*.7z") returned 4 [0094.754] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormToolImages.jpg", pszSpec="*.tar") returned 0 [0094.754] lstrlenA (lpString="*.tar") returned 5 [0094.754] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormToolImages.jpg", pszSpec="*.gzip") returned 0 [0094.754] lstrlenA (lpString="*.gzip") returned 6 [0094.754] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormToolImages.jpg", pszSpec="*.jpg") returned 1 [0094.754] lstrlenA (lpString="*.jpg") returned 5 [0094.754] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormToolImages.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormToolImages.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormToolImages.jpg" [0094.754] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormToolImages.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormToolImages.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormToolImages.jpg" [0094.754] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormToolImages.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormToolImages.jpg.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormToolImages.jpg." [0094.754] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormToolImages.jpg.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormToolImages.jpg. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormToolImages.jpg. " [0094.754] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormToolImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formtoolimages.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0094.754] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1bfb [0094.754] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x96b96400, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x529b4870, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x96b96400, dwHighDateTime=0x1c747ea)) returned 1 [0094.754] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0094.755] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x1ba1, lpOverlapped=0x0) returned 1 [0094.849] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormToolImages.jpg") returned="FormToolImages.jpg" [0094.849] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0094.849] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x1ba1, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x1ba1, lpOverlapped=0x0) returned 1 [0094.849] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0094.849] CloseHandle (hObject=0x98) returned 1 [0094.849] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormToolImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formtoolimages.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormToolImages.jpg. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formtoolimages.jpg. ")) returned 1 [0094.851] FindNextFileA (in: hFindFile=0x5b7d30, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0094.851] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0094.851] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="form_edit.js") returned -1 [0094.851] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="form_edit.js") returned 1 [0094.851] lstrcmpiA (lpString1="", lpString2="form_edit.js") returned -1 [0094.851] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormToolImages.jpg") returned="FormToolImages.jpg" [0094.851] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="form_edit.js" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\form_edit.js") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\form_edit.js" [0094.851] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\form_edit.js", pszSpec="*.zip") returned 0 [0094.851] lstrlenA (lpString="*.zip") returned 5 [0094.851] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\form_edit.js", pszSpec="*.rar") returned 0 [0094.851] lstrlenA (lpString="*.rar") returned 5 [0094.852] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\form_edit.js", pszSpec="*.7z") returned 0 [0094.852] lstrlenA (lpString="*.7z") returned 4 [0094.852] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\form_edit.js", pszSpec="*.tar") returned 0 [0094.852] lstrlenA (lpString="*.tar") returned 5 [0094.852] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\form_edit.js", pszSpec="*.gzip") returned 0 [0094.852] lstrlenA (lpString="*.gzip") returned 6 [0094.852] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\form_edit.js", pszSpec="*.jpg") returned 0 [0094.852] lstrlenA (lpString="*.jpg") returned 5 [0094.852] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\form_edit.js", pszSpec="*.jpeg") returned 0 [0094.852] lstrlenA (lpString="*.jpeg") returned 6 [0094.852] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\form_edit.js", pszSpec="*.psd") returned 0 [0094.852] lstrlenA (lpString="*.psd") returned 5 [0094.852] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\form_edit.js", pszSpec="*.cdr") returned 0 [0094.852] lstrlenA (lpString="*.cdr") returned 5 [0094.852] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\form_edit.js", pszSpec="*.dwg") returned 0 [0094.852] lstrlenA (lpString="*.dwg") returned 5 [0094.852] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\form_edit.js", pszSpec="*.max") returned 0 [0094.852] lstrlenA (lpString="*.max") returned 5 [0094.852] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\form_edit.js", pszSpec="*.bmp") returned 0 [0094.852] lstrlenA (lpString="*.bmp") returned 5 [0094.852] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\form_edit.js", pszSpec="*.gif") returned 0 [0094.852] lstrlenA (lpString="*.gif") returned 5 [0094.852] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\form_edit.js", pszSpec="*.png") returned 0 [0094.852] lstrlenA (lpString="*.png") returned 5 [0094.852] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\form_edit.js", pszSpec="*.doc") returned 0 [0094.852] lstrlenA (lpString="*.doc") returned 5 [0094.852] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\form_edit.js", pszSpec="*.docx") returned 0 [0094.852] lstrlenA (lpString="*.docx") returned 6 [0094.852] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\form_edit.js", pszSpec="*.xls") returned 0 [0094.852] lstrlenA (lpString="*.xls") returned 5 [0094.852] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\form_edit.js", pszSpec="*.xlsx") returned 0 [0094.852] lstrlenA (lpString="*.xlsx") returned 6 [0094.852] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\form_edit.js", pszSpec="*.ppt") returned 0 [0094.852] lstrlenA (lpString="*.ppt") returned 5 [0094.852] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\form_edit.js", pszSpec="*.pptx") returned 0 [0094.852] lstrlenA (lpString="*.pptx") returned 6 [0094.852] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\form_edit.js", pszSpec="*.txt") returned 0 [0094.852] lstrlenA (lpString="*.txt") returned 5 [0094.852] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\form_edit.js", pszSpec="*.pdf") returned 0 [0094.852] lstrlenA (lpString="*.pdf") returned 5 [0094.852] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\form_edit.js", pszSpec="*.djvu") returned 0 [0094.852] lstrlenA (lpString="*.djvu") returned 6 [0094.853] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\form_edit.js", pszSpec="*.htm") returned 0 [0094.853] lstrlenA (lpString="*.htm") returned 5 [0094.853] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\form_edit.js", pszSpec="*.html") returned 0 [0094.853] lstrlenA (lpString="*.html") returned 6 [0094.853] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\form_edit.js", pszSpec="*.mdb") returned 0 [0094.853] lstrlenA (lpString="*.mdb") returned 5 [0094.853] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\form_edit.js", pszSpec="*.cer") returned 0 [0094.853] lstrlenA (lpString="*.cer") returned 5 [0094.853] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\form_edit.js", pszSpec="*.p12") returned 0 [0094.853] lstrlenA (lpString="*.p12") returned 5 [0094.853] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\form_edit.js", pszSpec="*.pfx") returned 0 [0094.853] lstrlenA (lpString="*.pfx") returned 5 [0094.853] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\form_edit.js", pszSpec="*.kwm") returned 0 [0094.853] lstrlenA (lpString="*.kwm") returned 5 [0094.853] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\form_edit.js", pszSpec="*.pwm") returned 0 [0094.853] lstrlenA (lpString="*.pwm") returned 5 [0094.853] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\form_edit.js", pszSpec="*.1cd") returned 0 [0094.853] lstrlenA (lpString="*.1cd") returned 5 [0094.853] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\form_edit.js", pszSpec="*.md") returned 0 [0094.853] lstrlenA (lpString="*.md") returned 4 [0094.853] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\form_edit.js", pszSpec="*.mdf") returned 0 [0094.853] lstrlenA (lpString="*.mdf") returned 5 [0094.853] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\form_edit.js", pszSpec="*.dbf") returned 0 [0094.853] lstrlenA (lpString="*.dbf") returned 5 [0094.853] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\form_edit.js", pszSpec="*.odt") returned 0 [0094.853] lstrlenA (lpString="*.odt") returned 5 [0094.853] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\form_edit.js", pszSpec="*.vob") returned 0 [0094.853] lstrlenA (lpString="*.vob") returned 5 [0094.853] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\form_edit.js", pszSpec="*.ifo") returned 0 [0094.853] lstrlenA (lpString="*.ifo") returned 5 [0094.853] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\form_edit.js", pszSpec="*.lnk") returned 0 [0094.853] lstrlenA (lpString="*.lnk") returned 5 [0094.853] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\form_edit.js", pszSpec="*.torrent") returned 0 [0094.853] lstrlenA (lpString="*.torrent") returned 9 [0094.853] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\form_edit.js", pszSpec="*.mov") returned 0 [0094.853] lstrlenA (lpString="*.mov") returned 5 [0094.853] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\form_edit.js", pszSpec="*.m2v") returned 0 [0094.853] lstrlenA (lpString="*.m2v") returned 5 [0094.853] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\form_edit.js", pszSpec="*.3gp") returned 0 [0094.853] lstrlenA (lpString="*.3gp") returned 5 [0094.854] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\form_edit.js", pszSpec="*.mpeg") returned 0 [0094.854] lstrlenA (lpString="*.mpeg") returned 6 [0094.854] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\form_edit.js", pszSpec="*.mpg") returned 0 [0094.854] lstrlenA (lpString="*.mpg") returned 5 [0094.854] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\form_edit.js", pszSpec="*.flv") returned 0 [0094.854] lstrlenA (lpString="*.flv") returned 5 [0094.854] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\form_edit.js", pszSpec="*.avi") returned 0 [0094.854] lstrlenA (lpString="*.avi") returned 5 [0094.854] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\form_edit.js", pszSpec="*.mp4") returned 0 [0094.854] lstrlenA (lpString="*.mp4") returned 5 [0094.854] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\form_edit.js", pszSpec="*.wmv") returned 0 [0094.854] lstrlenA (lpString="*.wmv") returned 5 [0094.854] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\form_edit.js", pszSpec="*.divx") returned 0 [0094.854] lstrlenA (lpString="*.divx") returned 6 [0094.854] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\form_edit.js", pszSpec="*.mkv") returned 0 [0094.854] lstrlenA (lpString="*.mkv") returned 5 [0094.854] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\form_edit.js", pszSpec="*.mp3") returned 0 [0094.854] lstrlenA (lpString="*.mp3") returned 5 [0094.854] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\form_edit.js", pszSpec="*.wav") returned 0 [0094.854] lstrlenA (lpString="*.wav") returned 5 [0094.854] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\form_edit.js", pszSpec="*.flac") returned 0 [0094.854] lstrlenA (lpString="*.flac") returned 6 [0094.854] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\form_edit.js", pszSpec="*.ape") returned 0 [0094.854] lstrlenA (lpString="*.ape") returned 5 [0094.854] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\form_edit.js", pszSpec="*.wma") returned 0 [0094.854] lstrlenA (lpString="*.wma") returned 5 [0094.854] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\form_edit.js", pszSpec="*.ac3") returned 0 [0094.854] lstrlenA (lpString="*.ac3") returned 5 [0094.854] FindNextFileA (in: hFindFile=0x5b7d30, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0094.854] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0094.854] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="LAUNCH.GIF") returned -1 [0094.854] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="LAUNCH.GIF") returned -1 [0094.854] lstrcmpiA (lpString1="", lpString2="LAUNCH.GIF") returned -1 [0094.854] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\form_edit.js") returned="form_edit.js" [0094.854] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="LAUNCH.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\LAUNCH.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\LAUNCH.GIF" [0094.854] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\LAUNCH.GIF", pszSpec="*.zip") returned 0 [0094.854] lstrlenA (lpString="*.zip") returned 5 [0094.854] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\LAUNCH.GIF", pszSpec="*.rar") returned 0 [0094.854] lstrlenA (lpString="*.rar") returned 5 [0094.854] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\LAUNCH.GIF", pszSpec="*.7z") returned 0 [0094.854] lstrlenA (lpString="*.7z") returned 4 [0094.855] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\LAUNCH.GIF", pszSpec="*.tar") returned 0 [0094.855] lstrlenA (lpString="*.tar") returned 5 [0094.855] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\LAUNCH.GIF", pszSpec="*.gzip") returned 0 [0094.855] lstrlenA (lpString="*.gzip") returned 6 [0094.855] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\LAUNCH.GIF", pszSpec="*.jpg") returned 0 [0094.855] lstrlenA (lpString="*.jpg") returned 5 [0094.855] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\LAUNCH.GIF", pszSpec="*.jpeg") returned 0 [0094.855] lstrlenA (lpString="*.jpeg") returned 6 [0094.855] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\LAUNCH.GIF", pszSpec="*.psd") returned 0 [0094.855] lstrlenA (lpString="*.psd") returned 5 [0094.855] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\LAUNCH.GIF", pszSpec="*.cdr") returned 0 [0094.855] lstrlenA (lpString="*.cdr") returned 5 [0094.855] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\LAUNCH.GIF", pszSpec="*.dwg") returned 0 [0094.855] lstrlenA (lpString="*.dwg") returned 5 [0094.855] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\LAUNCH.GIF", pszSpec="*.max") returned 0 [0094.855] lstrlenA (lpString="*.max") returned 5 [0094.855] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\LAUNCH.GIF", pszSpec="*.bmp") returned 0 [0094.855] lstrlenA (lpString="*.bmp") returned 5 [0094.855] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\LAUNCH.GIF", pszSpec="*.gif") returned 1 [0094.855] lstrlenA (lpString="*.gif") returned 5 [0094.855] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\LAUNCH.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\LAUNCH.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\LAUNCH.GIF" [0094.855] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\LAUNCH.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\LAUNCH.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\LAUNCH.GIF" [0094.855] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\LAUNCH.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\LAUNCH.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\LAUNCH.GIF." [0094.855] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\LAUNCH.GIF.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\LAUNCH.GIF. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\LAUNCH.GIF. " [0094.855] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\LAUNCH.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\launch.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0094.856] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x267 [0094.856] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x96b96400, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x66247150, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x96b96400, dwHighDateTime=0x1c747ea)) returned 1 [0094.856] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0094.856] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x20d, lpOverlapped=0x0) returned 1 [0094.857] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\LAUNCH.GIF") returned="LAUNCH.GIF" [0094.857] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0094.857] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x20d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x20d, lpOverlapped=0x0) returned 1 [0094.857] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0094.857] CloseHandle (hObject=0x98) returned 1 [0094.859] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\LAUNCH.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\launch.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\LAUNCH.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\launch.gif. ")) returned 1 [0094.999] FindNextFileA (in: hFindFile=0x5b7d30, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0094.999] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0094.999] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="macroprogress.gif") returned -1 [0094.999] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="macroprogress.gif") returned -1 [0094.999] lstrcmpiA (lpString1="", lpString2="macroprogress.gif") returned -1 [0094.999] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\LAUNCH.GIF") returned="LAUNCH.GIF" [0094.999] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="macroprogress.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\macroprogress.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\macroprogress.gif" [0094.999] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\macroprogress.gif", pszSpec="*.zip") returned 0 [0094.999] lstrlenA (lpString="*.zip") returned 5 [0094.999] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\macroprogress.gif", pszSpec="*.rar") returned 0 [0094.999] lstrlenA (lpString="*.rar") returned 5 [0094.999] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\macroprogress.gif", pszSpec="*.7z") returned 0 [0094.999] lstrlenA (lpString="*.7z") returned 4 [0094.999] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\macroprogress.gif", pszSpec="*.tar") returned 0 [0094.999] lstrlenA (lpString="*.tar") returned 5 [0094.999] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\macroprogress.gif", pszSpec="*.gzip") returned 0 [0094.999] lstrlenA (lpString="*.gzip") returned 6 [0094.999] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\macroprogress.gif", pszSpec="*.jpg") returned 0 [0094.999] lstrlenA (lpString="*.jpg") returned 5 [0094.999] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\macroprogress.gif", pszSpec="*.jpeg") returned 0 [0094.999] lstrlenA (lpString="*.jpeg") returned 6 [0094.999] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\macroprogress.gif", pszSpec="*.psd") returned 0 [0094.999] lstrlenA (lpString="*.psd") returned 5 [0094.999] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\macroprogress.gif", pszSpec="*.cdr") returned 0 [0094.999] lstrlenA (lpString="*.cdr") returned 5 [0094.999] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\macroprogress.gif", pszSpec="*.dwg") returned 0 [0094.999] lstrlenA (lpString="*.dwg") returned 5 [0094.999] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\macroprogress.gif", pszSpec="*.max") returned 0 [0094.999] lstrlenA (lpString="*.max") returned 5 [0094.999] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\macroprogress.gif", pszSpec="*.bmp") returned 0 [0094.999] lstrlenA (lpString="*.bmp") returned 5 [0094.999] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\macroprogress.gif", pszSpec="*.gif") returned 1 [0094.999] lstrlenA (lpString="*.gif") returned 5 [0094.999] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\macroprogress.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\macroprogress.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\macroprogress.gif" [0094.999] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\macroprogress.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\macroprogress.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\macroprogress.gif" [0095.000] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\macroprogress.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\macroprogress.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\macroprogress.gif." [0095.000] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\macroprogress.gif.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\macroprogress.gif. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\macroprogress.gif. " [0095.000] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\macroprogress.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\macroprogress.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0095.001] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x30074 [0095.001] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x418f4a00, dwHighDateTime=0x1c9fe9d), lpLastAccessTime=0x407536*(dwLowDateTime=0x58285d50, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x418f4a00, dwHighDateTime=0x1c9fe9d)) returned 1 [0095.001] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0095.001] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x3001a, lpOverlapped=0x0) returned 1 [0095.267] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\macroprogress.gif") returned="macroprogress.gif" [0095.268] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0095.268] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x3001a, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x3001a, lpOverlapped=0x0) returned 1 [0095.268] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0095.269] CloseHandle (hObject=0x98) returned 1 [0095.270] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\macroprogress.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\macroprogress.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\macroprogress.gif. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\macroprogress.gif. ")) returned 1 [0095.271] FindNextFileA (in: hFindFile=0x5b7d30, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0095.271] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0095.271] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="PublicFunctions.js") returned -1 [0095.271] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PublicFunctions.js") returned -1 [0095.271] lstrcmpiA (lpString1="", lpString2="PublicFunctions.js") returned -1 [0095.271] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\macroprogress.gif") returned="macroprogress.gif" [0095.271] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="PublicFunctions.js" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\PublicFunctions.js") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\PublicFunctions.js" [0095.271] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\PublicFunctions.js", pszSpec="*.zip") returned 0 [0095.271] lstrlenA (lpString="*.zip") returned 5 [0095.271] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\PublicFunctions.js", pszSpec="*.rar") returned 0 [0095.271] lstrlenA (lpString="*.rar") returned 5 [0095.271] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\PublicFunctions.js", pszSpec="*.7z") returned 0 [0095.271] lstrlenA (lpString="*.7z") returned 4 [0095.271] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\PublicFunctions.js", pszSpec="*.tar") returned 0 [0095.271] lstrlenA (lpString="*.tar") returned 5 [0095.271] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\PublicFunctions.js", pszSpec="*.gzip") returned 0 [0095.271] lstrlenA (lpString="*.gzip") returned 6 [0095.271] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\PublicFunctions.js", pszSpec="*.jpg") returned 0 [0095.271] lstrlenA (lpString="*.jpg") returned 5 [0095.271] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\PublicFunctions.js", pszSpec="*.jpeg") returned 0 [0095.271] lstrlenA (lpString="*.jpeg") returned 6 [0095.271] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\PublicFunctions.js", pszSpec="*.psd") returned 0 [0095.271] lstrlenA (lpString="*.psd") returned 5 [0095.271] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\PublicFunctions.js", pszSpec="*.cdr") returned 0 [0095.271] lstrlenA (lpString="*.cdr") returned 5 [0095.271] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\PublicFunctions.js", pszSpec="*.dwg") returned 0 [0095.272] lstrlenA (lpString="*.dwg") returned 5 [0095.272] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\PublicFunctions.js", pszSpec="*.max") returned 0 [0095.272] lstrlenA (lpString="*.max") returned 5 [0095.272] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\PublicFunctions.js", pszSpec="*.bmp") returned 0 [0095.272] lstrlenA (lpString="*.bmp") returned 5 [0095.272] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\PublicFunctions.js", pszSpec="*.gif") returned 0 [0095.272] lstrlenA (lpString="*.gif") returned 5 [0095.272] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\PublicFunctions.js", pszSpec="*.png") returned 0 [0095.272] lstrlenA (lpString="*.png") returned 5 [0095.272] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\PublicFunctions.js", pszSpec="*.doc") returned 0 [0095.272] lstrlenA (lpString="*.doc") returned 5 [0095.272] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\PublicFunctions.js", pszSpec="*.docx") returned 0 [0095.272] lstrlenA (lpString="*.docx") returned 6 [0095.272] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\PublicFunctions.js", pszSpec="*.xls") returned 0 [0095.272] lstrlenA (lpString="*.xls") returned 5 [0095.272] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\PublicFunctions.js", pszSpec="*.xlsx") returned 0 [0095.272] lstrlenA (lpString="*.xlsx") returned 6 [0095.272] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\PublicFunctions.js", pszSpec="*.ppt") returned 0 [0095.272] lstrlenA (lpString="*.ppt") returned 5 [0095.272] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\PublicFunctions.js", pszSpec="*.pptx") returned 0 [0095.272] lstrlenA (lpString="*.pptx") returned 6 [0095.272] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\PublicFunctions.js", pszSpec="*.txt") returned 0 [0095.272] lstrlenA (lpString="*.txt") returned 5 [0095.272] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\PublicFunctions.js", pszSpec="*.pdf") returned 0 [0095.272] lstrlenA (lpString="*.pdf") returned 5 [0095.272] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\PublicFunctions.js", pszSpec="*.djvu") returned 0 [0095.272] lstrlenA (lpString="*.djvu") returned 6 [0095.272] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\PublicFunctions.js", pszSpec="*.htm") returned 0 [0095.272] lstrlenA (lpString="*.htm") returned 5 [0095.272] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\PublicFunctions.js", pszSpec="*.html") returned 0 [0095.272] lstrlenA (lpString="*.html") returned 6 [0095.272] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\PublicFunctions.js", pszSpec="*.mdb") returned 0 [0095.272] lstrlenA (lpString="*.mdb") returned 5 [0095.272] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\PublicFunctions.js", pszSpec="*.cer") returned 0 [0095.272] lstrlenA (lpString="*.cer") returned 5 [0095.272] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\PublicFunctions.js", pszSpec="*.p12") returned 0 [0095.272] lstrlenA (lpString="*.p12") returned 5 [0095.272] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\PublicFunctions.js", pszSpec="*.pfx") returned 0 [0095.272] lstrlenA (lpString="*.pfx") returned 5 [0095.272] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\PublicFunctions.js", pszSpec="*.kwm") returned 0 [0095.273] lstrlenA (lpString="*.kwm") returned 5 [0095.273] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\PublicFunctions.js", pszSpec="*.pwm") returned 0 [0095.273] lstrlenA (lpString="*.pwm") returned 5 [0095.273] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\PublicFunctions.js", pszSpec="*.1cd") returned 0 [0095.273] lstrlenA (lpString="*.1cd") returned 5 [0095.273] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\PublicFunctions.js", pszSpec="*.md") returned 0 [0095.273] lstrlenA (lpString="*.md") returned 4 [0095.273] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\PublicFunctions.js", pszSpec="*.mdf") returned 0 [0095.273] lstrlenA (lpString="*.mdf") returned 5 [0095.273] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\PublicFunctions.js", pszSpec="*.dbf") returned 0 [0095.273] lstrlenA (lpString="*.dbf") returned 5 [0095.273] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\PublicFunctions.js", pszSpec="*.odt") returned 0 [0095.273] lstrlenA (lpString="*.odt") returned 5 [0095.273] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\PublicFunctions.js", pszSpec="*.vob") returned 0 [0095.273] lstrlenA (lpString="*.vob") returned 5 [0095.273] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\PublicFunctions.js", pszSpec="*.ifo") returned 0 [0095.273] lstrlenA (lpString="*.ifo") returned 5 [0095.273] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\PublicFunctions.js", pszSpec="*.lnk") returned 0 [0095.273] lstrlenA (lpString="*.lnk") returned 5 [0095.273] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\PublicFunctions.js", pszSpec="*.torrent") returned 0 [0095.273] lstrlenA (lpString="*.torrent") returned 9 [0095.273] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\PublicFunctions.js", pszSpec="*.mov") returned 0 [0095.273] lstrlenA (lpString="*.mov") returned 5 [0095.273] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\PublicFunctions.js", pszSpec="*.m2v") returned 0 [0095.273] lstrlenA (lpString="*.m2v") returned 5 [0095.273] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\PublicFunctions.js", pszSpec="*.3gp") returned 0 [0095.273] lstrlenA (lpString="*.3gp") returned 5 [0095.273] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\PublicFunctions.js", pszSpec="*.mpeg") returned 0 [0095.273] lstrlenA (lpString="*.mpeg") returned 6 [0095.273] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\PublicFunctions.js", pszSpec="*.mpg") returned 0 [0095.273] lstrlenA (lpString="*.mpg") returned 5 [0095.273] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\PublicFunctions.js", pszSpec="*.flv") returned 0 [0095.273] lstrlenA (lpString="*.flv") returned 5 [0095.273] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\PublicFunctions.js", pszSpec="*.avi") returned 0 [0095.273] lstrlenA (lpString="*.avi") returned 5 [0095.273] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\PublicFunctions.js", pszSpec="*.mp4") returned 0 [0095.273] lstrlenA (lpString="*.mp4") returned 5 [0095.273] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\PublicFunctions.js", pszSpec="*.wmv") returned 0 [0095.273] lstrlenA (lpString="*.wmv") returned 5 [0095.273] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\PublicFunctions.js", pszSpec="*.divx") returned 0 [0095.273] lstrlenA (lpString="*.divx") returned 6 [0095.273] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\PublicFunctions.js", pszSpec="*.mkv") returned 0 [0095.273] lstrlenA (lpString="*.mkv") returned 5 [0095.273] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\PublicFunctions.js", pszSpec="*.mp3") returned 0 [0095.273] lstrlenA (lpString="*.mp3") returned 5 [0095.273] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\PublicFunctions.js", pszSpec="*.wav") returned 0 [0095.273] lstrlenA (lpString="*.wav") returned 5 [0095.273] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\PublicFunctions.js", pszSpec="*.flac") returned 0 [0095.273] lstrlenA (lpString="*.flac") returned 6 [0095.274] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\PublicFunctions.js", pszSpec="*.ape") returned 0 [0095.274] lstrlenA (lpString="*.ape") returned 5 [0095.274] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\PublicFunctions.js", pszSpec="*.wma") returned 0 [0095.274] lstrlenA (lpString="*.wma") returned 5 [0095.274] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\PublicFunctions.js", pszSpec="*.ac3") returned 0 [0095.274] lstrlenA (lpString="*.ac3") returned 5 [0095.274] FindNextFileA (in: hFindFile=0x5b7d30, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0095.274] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0095.274] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="rtf_alignleft.gif") returned -1 [0095.274] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="rtf_alignleft.gif") returned -1 [0095.274] lstrcmpiA (lpString1="", lpString2="rtf_alignleft.gif") returned -1 [0095.274] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\PublicFunctions.js") returned="PublicFunctions.js" [0095.274] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="rtf_alignleft.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignleft.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignleft.gif" [0095.274] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignleft.gif", pszSpec="*.zip") returned 0 [0095.274] lstrlenA (lpString="*.zip") returned 5 [0095.274] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignleft.gif", pszSpec="*.rar") returned 0 [0095.274] lstrlenA (lpString="*.rar") returned 5 [0095.274] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignleft.gif", pszSpec="*.7z") returned 0 [0095.274] lstrlenA (lpString="*.7z") returned 4 [0095.274] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignleft.gif", pszSpec="*.tar") returned 0 [0095.274] lstrlenA (lpString="*.tar") returned 5 [0095.274] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignleft.gif", pszSpec="*.gzip") returned 0 [0095.274] lstrlenA (lpString="*.gzip") returned 6 [0095.274] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignleft.gif", pszSpec="*.jpg") returned 0 [0095.274] lstrlenA (lpString="*.jpg") returned 5 [0095.274] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignleft.gif", pszSpec="*.jpeg") returned 0 [0095.274] lstrlenA (lpString="*.jpeg") returned 6 [0095.274] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignleft.gif", pszSpec="*.psd") returned 0 [0095.274] lstrlenA (lpString="*.psd") returned 5 [0095.274] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignleft.gif", pszSpec="*.cdr") returned 0 [0095.274] lstrlenA (lpString="*.cdr") returned 5 [0095.274] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignleft.gif", pszSpec="*.dwg") returned 0 [0095.274] lstrlenA (lpString="*.dwg") returned 5 [0095.274] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignleft.gif", pszSpec="*.max") returned 0 [0095.274] lstrlenA (lpString="*.max") returned 5 [0095.274] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignleft.gif", pszSpec="*.bmp") returned 0 [0095.274] lstrlenA (lpString="*.bmp") returned 5 [0095.274] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignleft.gif", pszSpec="*.gif") returned 1 [0095.274] lstrlenA (lpString="*.gif") returned 5 [0095.274] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignleft.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignleft.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignleft.gif" [0095.274] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignleft.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignleft.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignleft.gif" [0095.274] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignleft.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignleft.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignleft.gif." [0095.274] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignleft.gif.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignleft.gif. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignleft.gif. " [0095.274] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignleft.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_alignleft.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0095.368] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x350 [0095.368] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x96b96400, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5a8e8010, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x96b96400, dwHighDateTime=0x1c747ea)) returned 1 [0095.368] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0095.368] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x2f6, lpOverlapped=0x0) returned 1 [0095.437] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignleft.gif") returned="rtf_alignleft.gif" [0095.437] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0095.437] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x2f6, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x2f6, lpOverlapped=0x0) returned 1 [0095.438] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0095.438] CloseHandle (hObject=0x98) returned 1 [0095.438] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignleft.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_alignleft.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignleft.gif. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_alignleft.gif. ")) returned 1 [0095.439] FindNextFileA (in: hFindFile=0x5b7d30, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0095.439] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0095.439] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="rtf_alignright.gif") returned -1 [0095.439] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="rtf_alignright.gif") returned -1 [0095.439] lstrcmpiA (lpString1="", lpString2="rtf_alignright.gif") returned -1 [0095.439] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignleft.gif") returned="rtf_alignleft.gif" [0095.439] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="rtf_alignright.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignright.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignright.gif" [0095.439] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignright.gif", pszSpec="*.zip") returned 0 [0095.439] lstrlenA (lpString="*.zip") returned 5 [0095.439] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignright.gif", pszSpec="*.rar") returned 0 [0095.439] lstrlenA (lpString="*.rar") returned 5 [0095.439] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignright.gif", pszSpec="*.7z") returned 0 [0095.439] lstrlenA (lpString="*.7z") returned 4 [0095.439] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignright.gif", pszSpec="*.tar") returned 0 [0095.439] lstrlenA (lpString="*.tar") returned 5 [0095.439] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignright.gif", pszSpec="*.gzip") returned 0 [0095.439] lstrlenA (lpString="*.gzip") returned 6 [0095.439] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignright.gif", pszSpec="*.jpg") returned 0 [0095.439] lstrlenA (lpString="*.jpg") returned 5 [0095.439] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignright.gif", pszSpec="*.jpeg") returned 0 [0095.439] lstrlenA (lpString="*.jpeg") returned 6 [0095.439] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignright.gif", pszSpec="*.psd") returned 0 [0095.439] lstrlenA (lpString="*.psd") returned 5 [0095.439] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignright.gif", pszSpec="*.cdr") returned 0 [0095.439] lstrlenA (lpString="*.cdr") returned 5 [0095.439] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignright.gif", pszSpec="*.dwg") returned 0 [0095.439] lstrlenA (lpString="*.dwg") returned 5 [0095.439] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignright.gif", pszSpec="*.max") returned 0 [0095.439] lstrlenA (lpString="*.max") returned 5 [0095.439] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignright.gif", pszSpec="*.bmp") returned 0 [0095.439] lstrlenA (lpString="*.bmp") returned 5 [0095.439] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignright.gif", pszSpec="*.gif") returned 1 [0095.439] lstrlenA (lpString="*.gif") returned 5 [0095.439] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignright.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignright.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignright.gif" [0095.439] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignright.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignright.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignright.gif" [0095.439] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignright.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignright.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignright.gif." [0095.439] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignright.gif.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignright.gif. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignright.gif. " [0095.439] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignright.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_alignright.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0095.440] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x34f [0095.440] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x96b96400, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x6d227b50, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x96b96400, dwHighDateTime=0x1c747ea)) returned 1 [0095.440] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0095.440] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x2f5, lpOverlapped=0x0) returned 1 [0095.459] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignright.gif") returned="rtf_alignright.gif" [0095.459] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0095.459] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x2f5, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x2f5, lpOverlapped=0x0) returned 1 [0095.459] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0095.459] CloseHandle (hObject=0x98) returned 1 [0095.459] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignright.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_alignright.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignright.gif. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_alignright.gif. ")) returned 1 [0095.460] FindNextFileA (in: hFindFile=0x5b7d30, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0095.460] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0095.460] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="RTF_BOLD.GIF") returned -1 [0095.460] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="RTF_BOLD.GIF") returned -1 [0095.460] lstrcmpiA (lpString1="", lpString2="RTF_BOLD.GIF") returned -1 [0095.460] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignright.gif") returned="rtf_alignright.gif" [0095.460] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="RTF_BOLD.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\RTF_BOLD.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\RTF_BOLD.GIF" [0095.460] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\RTF_BOLD.GIF", pszSpec="*.zip") returned 0 [0095.460] lstrlenA (lpString="*.zip") returned 5 [0095.460] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\RTF_BOLD.GIF", pszSpec="*.rar") returned 0 [0095.460] lstrlenA (lpString="*.rar") returned 5 [0095.460] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\RTF_BOLD.GIF", pszSpec="*.7z") returned 0 [0095.460] lstrlenA (lpString="*.7z") returned 4 [0095.460] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\RTF_BOLD.GIF", pszSpec="*.tar") returned 0 [0095.460] lstrlenA (lpString="*.tar") returned 5 [0095.461] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\RTF_BOLD.GIF", pszSpec="*.gzip") returned 0 [0095.461] lstrlenA (lpString="*.gzip") returned 6 [0095.461] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\RTF_BOLD.GIF", pszSpec="*.jpg") returned 0 [0095.461] lstrlenA (lpString="*.jpg") returned 5 [0095.461] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\RTF_BOLD.GIF", pszSpec="*.jpeg") returned 0 [0095.461] lstrlenA (lpString="*.jpeg") returned 6 [0095.461] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\RTF_BOLD.GIF", pszSpec="*.psd") returned 0 [0095.461] lstrlenA (lpString="*.psd") returned 5 [0095.461] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\RTF_BOLD.GIF", pszSpec="*.cdr") returned 0 [0095.461] lstrlenA (lpString="*.cdr") returned 5 [0095.461] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\RTF_BOLD.GIF", pszSpec="*.dwg") returned 0 [0095.461] lstrlenA (lpString="*.dwg") returned 5 [0095.461] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\RTF_BOLD.GIF", pszSpec="*.max") returned 0 [0095.461] lstrlenA (lpString="*.max") returned 5 [0095.461] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\RTF_BOLD.GIF", pszSpec="*.bmp") returned 0 [0095.461] lstrlenA (lpString="*.bmp") returned 5 [0095.461] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\RTF_BOLD.GIF", pszSpec="*.gif") returned 1 [0095.461] lstrlenA (lpString="*.gif") returned 5 [0095.461] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\RTF_BOLD.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\RTF_BOLD.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\RTF_BOLD.GIF" [0095.461] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\RTF_BOLD.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\RTF_BOLD.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\RTF_BOLD.GIF" [0095.461] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\RTF_BOLD.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\RTF_BOLD.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\RTF_BOLD.GIF." [0095.461] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\RTF_BOLD.GIF.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\RTF_BOLD.GIF. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\RTF_BOLD.GIF. " [0095.461] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\RTF_BOLD.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_bold.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0095.462] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x366 [0095.462] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x96b96400, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5a8e8010, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x96b96400, dwHighDateTime=0x1c747ea)) returned 1 [0095.462] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0095.462] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x30c, lpOverlapped=0x0) returned 1 [0095.463] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\RTF_BOLD.GIF") returned="RTF_BOLD.GIF" [0095.463] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0095.463] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x30c, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x30c, lpOverlapped=0x0) returned 1 [0095.463] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0095.463] CloseHandle (hObject=0x98) returned 1 [0095.463] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\RTF_BOLD.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_bold.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\RTF_BOLD.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_bold.gif. ")) returned 1 [0095.464] FindNextFileA (in: hFindFile=0x5b7d30, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0095.464] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0095.464] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="rtf_bullets.gif") returned -1 [0095.464] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="rtf_bullets.gif") returned -1 [0095.464] lstrcmpiA (lpString1="", lpString2="rtf_bullets.gif") returned -1 [0095.464] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\RTF_BOLD.GIF") returned="RTF_BOLD.GIF" [0095.464] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="rtf_bullets.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_bullets.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_bullets.gif" [0095.464] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_bullets.gif", pszSpec="*.zip") returned 0 [0095.464] lstrlenA (lpString="*.zip") returned 5 [0095.464] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_bullets.gif", pszSpec="*.rar") returned 0 [0095.464] lstrlenA (lpString="*.rar") returned 5 [0095.464] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_bullets.gif", pszSpec="*.7z") returned 0 [0095.464] lstrlenA (lpString="*.7z") returned 4 [0095.464] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_bullets.gif", pszSpec="*.tar") returned 0 [0095.464] lstrlenA (lpString="*.tar") returned 5 [0095.464] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_bullets.gif", pszSpec="*.gzip") returned 0 [0095.464] lstrlenA (lpString="*.gzip") returned 6 [0095.464] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_bullets.gif", pszSpec="*.jpg") returned 0 [0095.464] lstrlenA (lpString="*.jpg") returned 5 [0095.464] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_bullets.gif", pszSpec="*.jpeg") returned 0 [0095.464] lstrlenA (lpString="*.jpeg") returned 6 [0095.464] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_bullets.gif", pszSpec="*.psd") returned 0 [0095.464] lstrlenA (lpString="*.psd") returned 5 [0095.464] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_bullets.gif", pszSpec="*.cdr") returned 0 [0095.464] lstrlenA (lpString="*.cdr") returned 5 [0095.464] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_bullets.gif", pszSpec="*.dwg") returned 0 [0095.464] lstrlenA (lpString="*.dwg") returned 5 [0095.464] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_bullets.gif", pszSpec="*.max") returned 0 [0095.464] lstrlenA (lpString="*.max") returned 5 [0095.464] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_bullets.gif", pszSpec="*.bmp") returned 0 [0095.464] lstrlenA (lpString="*.bmp") returned 5 [0095.464] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_bullets.gif", pszSpec="*.gif") returned 1 [0095.464] lstrlenA (lpString="*.gif") returned 5 [0095.464] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_bullets.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_bullets.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_bullets.gif" [0095.464] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_bullets.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_bullets.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_bullets.gif" [0095.464] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_bullets.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_bullets.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_bullets.gif." [0095.464] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_bullets.gif.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_bullets.gif. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_bullets.gif. " [0095.465] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_bullets.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_bullets.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0095.466] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x365 [0095.466] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x96b96400, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5a8e8010, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x96b96400, dwHighDateTime=0x1c747ea)) returned 1 [0095.466] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0095.466] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x30b, lpOverlapped=0x0) returned 1 [0095.487] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_bullets.gif") returned="rtf_bullets.gif" [0095.487] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0095.487] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x30b, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x30b, lpOverlapped=0x0) returned 1 [0095.487] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0095.487] CloseHandle (hObject=0x98) returned 1 [0095.487] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_bullets.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_bullets.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_bullets.gif. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_bullets.gif. ")) returned 1 [0095.488] FindNextFileA (in: hFindFile=0x5b7d30, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0095.488] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0095.488] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="rtf_center.gif") returned -1 [0095.488] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="rtf_center.gif") returned -1 [0095.488] lstrcmpiA (lpString1="", lpString2="rtf_center.gif") returned -1 [0095.488] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_bullets.gif") returned="rtf_bullets.gif" [0095.488] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="rtf_center.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_center.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_center.gif" [0095.488] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_center.gif", pszSpec="*.zip") returned 0 [0095.488] lstrlenA (lpString="*.zip") returned 5 [0095.488] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_center.gif", pszSpec="*.rar") returned 0 [0095.488] lstrlenA (lpString="*.rar") returned 5 [0095.488] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_center.gif", pszSpec="*.7z") returned 0 [0095.488] lstrlenA (lpString="*.7z") returned 4 [0095.488] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_center.gif", pszSpec="*.tar") returned 0 [0095.488] lstrlenA (lpString="*.tar") returned 5 [0095.488] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_center.gif", pszSpec="*.gzip") returned 0 [0095.488] lstrlenA (lpString="*.gzip") returned 6 [0095.488] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_center.gif", pszSpec="*.jpg") returned 0 [0095.488] lstrlenA (lpString="*.jpg") returned 5 [0095.488] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_center.gif", pszSpec="*.jpeg") returned 0 [0095.488] lstrlenA (lpString="*.jpeg") returned 6 [0095.488] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_center.gif", pszSpec="*.psd") returned 0 [0095.489] lstrlenA (lpString="*.psd") returned 5 [0095.489] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_center.gif", pszSpec="*.cdr") returned 0 [0095.489] lstrlenA (lpString="*.cdr") returned 5 [0095.489] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_center.gif", pszSpec="*.dwg") returned 0 [0095.489] lstrlenA (lpString="*.dwg") returned 5 [0095.489] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_center.gif", pszSpec="*.max") returned 0 [0095.489] lstrlenA (lpString="*.max") returned 5 [0095.489] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_center.gif", pszSpec="*.bmp") returned 0 [0095.489] lstrlenA (lpString="*.bmp") returned 5 [0095.489] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_center.gif", pszSpec="*.gif") returned 1 [0095.489] lstrlenA (lpString="*.gif") returned 5 [0095.489] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_center.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_center.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_center.gif" [0095.489] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_center.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_center.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_center.gif" [0095.489] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_center.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_center.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_center.gif." [0095.489] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_center.gif.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_center.gif. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_center.gif. " [0095.489] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_center.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_center.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0095.489] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x34f [0095.489] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x96b96400, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5a8e8010, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x96b96400, dwHighDateTime=0x1c747ea)) returned 1 [0095.489] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0095.490] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x2f5, lpOverlapped=0x0) returned 1 [0095.629] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_center.gif") returned="rtf_center.gif" [0095.629] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0095.629] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x2f5, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x2f5, lpOverlapped=0x0) returned 1 [0095.629] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0095.629] CloseHandle (hObject=0x98) returned 1 [0095.630] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_center.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_center.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_center.gif. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_center.gif. ")) returned 1 [0095.631] FindNextFileA (in: hFindFile=0x5b7d30, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0095.631] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0095.631] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="rtf_choosecolor.gif") returned -1 [0095.631] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="rtf_choosecolor.gif") returned -1 [0095.631] lstrcmpiA (lpString1="", lpString2="rtf_choosecolor.gif") returned -1 [0095.631] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_center.gif") returned="rtf_center.gif" [0095.631] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="rtf_choosecolor.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosecolor.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosecolor.gif" [0095.631] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosecolor.gif", pszSpec="*.zip") returned 0 [0095.631] lstrlenA (lpString="*.zip") returned 5 [0095.631] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosecolor.gif", pszSpec="*.rar") returned 0 [0095.631] lstrlenA (lpString="*.rar") returned 5 [0095.631] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosecolor.gif", pszSpec="*.7z") returned 0 [0095.631] lstrlenA (lpString="*.7z") returned 4 [0095.631] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosecolor.gif", pszSpec="*.tar") returned 0 [0095.631] lstrlenA (lpString="*.tar") returned 5 [0095.631] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosecolor.gif", pszSpec="*.gzip") returned 0 [0095.631] lstrlenA (lpString="*.gzip") returned 6 [0095.631] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosecolor.gif", pszSpec="*.jpg") returned 0 [0095.631] lstrlenA (lpString="*.jpg") returned 5 [0095.631] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosecolor.gif", pszSpec="*.jpeg") returned 0 [0095.631] lstrlenA (lpString="*.jpeg") returned 6 [0095.631] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosecolor.gif", pszSpec="*.psd") returned 0 [0095.631] lstrlenA (lpString="*.psd") returned 5 [0095.631] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosecolor.gif", pszSpec="*.cdr") returned 0 [0095.631] lstrlenA (lpString="*.cdr") returned 5 [0095.631] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosecolor.gif", pszSpec="*.dwg") returned 0 [0095.631] lstrlenA (lpString="*.dwg") returned 5 [0095.631] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosecolor.gif", pszSpec="*.max") returned 0 [0095.631] lstrlenA (lpString="*.max") returned 5 [0095.631] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosecolor.gif", pszSpec="*.bmp") returned 0 [0095.631] lstrlenA (lpString="*.bmp") returned 5 [0095.631] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosecolor.gif", pszSpec="*.gif") returned 1 [0095.631] lstrlenA (lpString="*.gif") returned 5 [0095.631] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosecolor.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosecolor.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosecolor.gif" [0095.631] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosecolor.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosecolor.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosecolor.gif" [0095.632] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosecolor.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosecolor.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosecolor.gif." [0095.632] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosecolor.gif.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosecolor.gif. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosecolor.gif. " [0095.632] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosecolor.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_choosecolor.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0095.633] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3ee [0095.633] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x3031bc00, dwHighDateTime=0x1ca033b), lpLastAccessTime=0x407536*(dwLowDateTime=0x5a8e8010, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x3031bc00, dwHighDateTime=0x1ca033b)) returned 1 [0095.633] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0095.634] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x394, lpOverlapped=0x0) returned 1 [0095.635] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosecolor.gif") returned="rtf_choosecolor.gif" [0095.635] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0095.635] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x394, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x394, lpOverlapped=0x0) returned 1 [0095.636] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0095.636] CloseHandle (hObject=0x98) returned 1 [0095.636] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosecolor.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_choosecolor.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosecolor.gif. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_choosecolor.gif. ")) returned 1 [0095.636] FindNextFileA (in: hFindFile=0x5b7d30, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0095.636] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0095.637] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="rtf_choosefont.gif") returned -1 [0095.637] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="rtf_choosefont.gif") returned -1 [0095.637] lstrcmpiA (lpString1="", lpString2="rtf_choosefont.gif") returned -1 [0095.637] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosecolor.gif") returned="rtf_choosecolor.gif" [0095.637] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="rtf_choosefont.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosefont.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosefont.gif" [0095.637] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosefont.gif", pszSpec="*.zip") returned 0 [0095.637] lstrlenA (lpString="*.zip") returned 5 [0095.637] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosefont.gif", pszSpec="*.rar") returned 0 [0095.637] lstrlenA (lpString="*.rar") returned 5 [0095.637] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosefont.gif", pszSpec="*.7z") returned 0 [0095.637] lstrlenA (lpString="*.7z") returned 4 [0095.637] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosefont.gif", pszSpec="*.tar") returned 0 [0095.637] lstrlenA (lpString="*.tar") returned 5 [0095.637] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosefont.gif", pszSpec="*.gzip") returned 0 [0095.637] lstrlenA (lpString="*.gzip") returned 6 [0095.637] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosefont.gif", pszSpec="*.jpg") returned 0 [0095.637] lstrlenA (lpString="*.jpg") returned 5 [0095.637] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosefont.gif", pszSpec="*.jpeg") returned 0 [0095.637] lstrlenA (lpString="*.jpeg") returned 6 [0095.637] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosefont.gif", pszSpec="*.psd") returned 0 [0095.637] lstrlenA (lpString="*.psd") returned 5 [0095.637] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosefont.gif", pszSpec="*.cdr") returned 0 [0095.637] lstrlenA (lpString="*.cdr") returned 5 [0095.637] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosefont.gif", pszSpec="*.dwg") returned 0 [0095.637] lstrlenA (lpString="*.dwg") returned 5 [0095.637] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosefont.gif", pszSpec="*.max") returned 0 [0095.637] lstrlenA (lpString="*.max") returned 5 [0095.637] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosefont.gif", pszSpec="*.bmp") returned 0 [0095.637] lstrlenA (lpString="*.bmp") returned 5 [0095.637] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosefont.gif", pszSpec="*.gif") returned 1 [0095.637] lstrlenA (lpString="*.gif") returned 5 [0095.637] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosefont.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosefont.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosefont.gif" [0095.637] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosefont.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosefont.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosefont.gif" [0095.637] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosefont.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosefont.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosefont.gif." [0095.638] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosefont.gif.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosefont.gif. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosefont.gif. " [0095.638] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosefont.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_choosefont.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0095.638] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x37a [0095.638] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x96b96400, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x6d227b50, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x96b96400, dwHighDateTime=0x1c747ea)) returned 1 [0095.638] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0095.638] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x320, lpOverlapped=0x0) returned 1 [0095.650] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosefont.gif") returned="rtf_choosefont.gif" [0095.651] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0095.651] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x320, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x320, lpOverlapped=0x0) returned 1 [0095.651] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0095.651] CloseHandle (hObject=0x98) returned 1 [0095.651] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosefont.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_choosefont.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosefont.gif. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_choosefont.gif. ")) returned 1 [0095.653] FindNextFileA (in: hFindFile=0x5b7d30, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0095.653] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0095.653] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="rtf_decreaseindent.gif") returned -1 [0095.653] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="rtf_decreaseindent.gif") returned -1 [0095.653] lstrcmpiA (lpString1="", lpString2="rtf_decreaseindent.gif") returned -1 [0095.653] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosefont.gif") returned="rtf_choosefont.gif" [0095.653] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="rtf_decreaseindent.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_decreaseindent.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_decreaseindent.gif" [0095.653] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_decreaseindent.gif", pszSpec="*.zip") returned 0 [0095.654] lstrlenA (lpString="*.zip") returned 5 [0095.654] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_decreaseindent.gif", pszSpec="*.rar") returned 0 [0095.654] lstrlenA (lpString="*.rar") returned 5 [0095.654] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_decreaseindent.gif", pszSpec="*.7z") returned 0 [0095.654] lstrlenA (lpString="*.7z") returned 4 [0095.654] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_decreaseindent.gif", pszSpec="*.tar") returned 0 [0095.654] lstrlenA (lpString="*.tar") returned 5 [0095.654] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_decreaseindent.gif", pszSpec="*.gzip") returned 0 [0095.654] lstrlenA (lpString="*.gzip") returned 6 [0095.654] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_decreaseindent.gif", pszSpec="*.jpg") returned 0 [0095.654] lstrlenA (lpString="*.jpg") returned 5 [0095.654] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_decreaseindent.gif", pszSpec="*.jpeg") returned 0 [0095.654] lstrlenA (lpString="*.jpeg") returned 6 [0095.654] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_decreaseindent.gif", pszSpec="*.psd") returned 0 [0095.654] lstrlenA (lpString="*.psd") returned 5 [0095.654] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_decreaseindent.gif", pszSpec="*.cdr") returned 0 [0095.654] lstrlenA (lpString="*.cdr") returned 5 [0095.654] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_decreaseindent.gif", pszSpec="*.dwg") returned 0 [0095.654] lstrlenA (lpString="*.dwg") returned 5 [0095.654] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_decreaseindent.gif", pszSpec="*.max") returned 0 [0095.654] lstrlenA (lpString="*.max") returned 5 [0095.654] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_decreaseindent.gif", pszSpec="*.bmp") returned 0 [0095.654] lstrlenA (lpString="*.bmp") returned 5 [0095.654] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_decreaseindent.gif", pszSpec="*.gif") returned 1 [0095.654] lstrlenA (lpString="*.gif") returned 5 [0095.654] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_decreaseindent.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_decreaseindent.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_decreaseindent.gif" [0095.654] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_decreaseindent.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_decreaseindent.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_decreaseindent.gif" [0095.654] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_decreaseindent.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_decreaseindent.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_decreaseindent.gif." [0095.654] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_decreaseindent.gif.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_decreaseindent.gif. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_decreaseindent.gif. " [0095.654] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_decreaseindent.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_decreaseindent.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0095.655] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x35f [0095.655] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x97ea9100, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x6d227b50, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x97ea9100, dwHighDateTime=0x1c747ea)) returned 1 [0095.655] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0095.655] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x305, lpOverlapped=0x0) returned 1 [0095.675] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_decreaseindent.gif") returned="rtf_decreaseindent.gif" [0095.676] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0095.676] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x305, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x305, lpOverlapped=0x0) returned 1 [0095.676] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0095.676] CloseHandle (hObject=0x98) returned 1 [0095.676] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_decreaseindent.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_decreaseindent.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_decreaseindent.gif. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_decreaseindent.gif. ")) returned 1 [0095.677] FindNextFileA (in: hFindFile=0x5b7d30, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0095.677] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0095.677] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="rtf_increaseindent.gif") returned -1 [0095.677] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="rtf_increaseindent.gif") returned -1 [0095.677] lstrcmpiA (lpString1="", lpString2="rtf_increaseindent.gif") returned -1 [0095.677] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_decreaseindent.gif") returned="rtf_decreaseindent.gif" [0095.677] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="rtf_increaseindent.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_increaseindent.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_increaseindent.gif" [0095.677] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_increaseindent.gif", pszSpec="*.zip") returned 0 [0095.677] lstrlenA (lpString="*.zip") returned 5 [0095.677] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_increaseindent.gif", pszSpec="*.rar") returned 0 [0095.677] lstrlenA (lpString="*.rar") returned 5 [0095.677] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_increaseindent.gif", pszSpec="*.7z") returned 0 [0095.677] lstrlenA (lpString="*.7z") returned 4 [0095.677] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_increaseindent.gif", pszSpec="*.tar") returned 0 [0095.677] lstrlenA (lpString="*.tar") returned 5 [0095.677] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_increaseindent.gif", pszSpec="*.gzip") returned 0 [0095.677] lstrlenA (lpString="*.gzip") returned 6 [0095.677] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_increaseindent.gif", pszSpec="*.jpg") returned 0 [0095.677] lstrlenA (lpString="*.jpg") returned 5 [0095.677] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_increaseindent.gif", pszSpec="*.jpeg") returned 0 [0095.677] lstrlenA (lpString="*.jpeg") returned 6 [0095.677] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_increaseindent.gif", pszSpec="*.psd") returned 0 [0095.677] lstrlenA (lpString="*.psd") returned 5 [0095.677] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_increaseindent.gif", pszSpec="*.cdr") returned 0 [0095.677] lstrlenA (lpString="*.cdr") returned 5 [0095.677] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_increaseindent.gif", pszSpec="*.dwg") returned 0 [0095.677] lstrlenA (lpString="*.dwg") returned 5 [0095.677] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_increaseindent.gif", pszSpec="*.max") returned 0 [0095.677] lstrlenA (lpString="*.max") returned 5 [0095.677] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_increaseindent.gif", pszSpec="*.bmp") returned 0 [0095.677] lstrlenA (lpString="*.bmp") returned 5 [0095.677] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_increaseindent.gif", pszSpec="*.gif") returned 1 [0095.677] lstrlenA (lpString="*.gif") returned 5 [0095.677] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_increaseindent.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_increaseindent.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_increaseindent.gif" [0095.677] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_increaseindent.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_increaseindent.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_increaseindent.gif" [0095.677] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_increaseindent.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_increaseindent.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_increaseindent.gif." [0095.678] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_increaseindent.gif.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_increaseindent.gif. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_increaseindent.gif. " [0095.678] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_increaseindent.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_increaseindent.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0095.678] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x35d [0095.678] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x97ea9100, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x6d24dcb0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x97ea9100, dwHighDateTime=0x1c747ea)) returned 1 [0095.679] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0095.679] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x303, lpOverlapped=0x0) returned 1 [0095.734] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_increaseindent.gif") returned="rtf_increaseindent.gif" [0095.734] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0095.734] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x303, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x303, lpOverlapped=0x0) returned 1 [0095.734] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0095.734] CloseHandle (hObject=0x98) returned 1 [0095.734] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_increaseindent.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_increaseindent.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_increaseindent.gif. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_increaseindent.gif. ")) returned 1 [0095.735] FindNextFileA (in: hFindFile=0x5b7d30, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0095.735] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0095.735] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="rtf_italic.gif") returned -1 [0095.735] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="rtf_italic.gif") returned -1 [0095.735] lstrcmpiA (lpString1="", lpString2="rtf_italic.gif") returned -1 [0095.735] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_increaseindent.gif") returned="rtf_increaseindent.gif" [0095.735] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="rtf_italic.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_italic.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_italic.gif" [0095.735] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_italic.gif", pszSpec="*.zip") returned 0 [0095.735] lstrlenA (lpString="*.zip") returned 5 [0095.735] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_italic.gif", pszSpec="*.rar") returned 0 [0095.735] lstrlenA (lpString="*.rar") returned 5 [0095.735] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_italic.gif", pszSpec="*.7z") returned 0 [0095.735] lstrlenA (lpString="*.7z") returned 4 [0095.735] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_italic.gif", pszSpec="*.tar") returned 0 [0095.735] lstrlenA (lpString="*.tar") returned 5 [0095.736] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_italic.gif", pszSpec="*.gzip") returned 0 [0095.736] lstrlenA (lpString="*.gzip") returned 6 [0095.736] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_italic.gif", pszSpec="*.jpg") returned 0 [0095.736] lstrlenA (lpString="*.jpg") returned 5 [0095.736] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_italic.gif", pszSpec="*.jpeg") returned 0 [0095.736] lstrlenA (lpString="*.jpeg") returned 6 [0095.736] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_italic.gif", pszSpec="*.psd") returned 0 [0095.736] lstrlenA (lpString="*.psd") returned 5 [0095.736] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_italic.gif", pszSpec="*.cdr") returned 0 [0095.736] lstrlenA (lpString="*.cdr") returned 5 [0095.736] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_italic.gif", pszSpec="*.dwg") returned 0 [0095.736] lstrlenA (lpString="*.dwg") returned 5 [0095.736] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_italic.gif", pszSpec="*.max") returned 0 [0095.736] lstrlenA (lpString="*.max") returned 5 [0095.736] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_italic.gif", pszSpec="*.bmp") returned 0 [0095.736] lstrlenA (lpString="*.bmp") returned 5 [0095.736] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_italic.gif", pszSpec="*.gif") returned 1 [0095.736] lstrlenA (lpString="*.gif") returned 5 [0095.736] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_italic.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_italic.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_italic.gif" [0095.736] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_italic.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_italic.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_italic.gif" [0095.736] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_italic.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_italic.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_italic.gif." [0095.736] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_italic.gif.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_italic.gif. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_italic.gif. " [0095.736] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_italic.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_italic.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0095.737] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x354 [0095.737] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x97ea9100, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5a8e8010, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x97ea9100, dwHighDateTime=0x1c747ea)) returned 1 [0095.737] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0095.737] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x2fa, lpOverlapped=0x0) returned 1 [0095.738] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_italic.gif") returned="rtf_italic.gif" [0095.738] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0095.738] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x2fa, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x2fa, lpOverlapped=0x0) returned 1 [0095.738] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0095.738] CloseHandle (hObject=0x98) returned 1 [0095.738] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_italic.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_italic.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_italic.gif. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_italic.gif. ")) returned 1 [0095.739] FindNextFileA (in: hFindFile=0x5b7d30, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0095.739] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0095.739] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="rtf_justify.gif") returned -1 [0095.739] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="rtf_justify.gif") returned -1 [0095.739] lstrcmpiA (lpString1="", lpString2="rtf_justify.gif") returned -1 [0095.739] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_italic.gif") returned="rtf_italic.gif" [0095.739] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="rtf_justify.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_justify.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_justify.gif" [0095.739] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_justify.gif", pszSpec="*.zip") returned 0 [0095.739] lstrlenA (lpString="*.zip") returned 5 [0095.739] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_justify.gif", pszSpec="*.rar") returned 0 [0095.739] lstrlenA (lpString="*.rar") returned 5 [0095.739] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_justify.gif", pszSpec="*.7z") returned 0 [0095.739] lstrlenA (lpString="*.7z") returned 4 [0095.739] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_justify.gif", pszSpec="*.tar") returned 0 [0095.739] lstrlenA (lpString="*.tar") returned 5 [0095.739] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_justify.gif", pszSpec="*.gzip") returned 0 [0095.739] lstrlenA (lpString="*.gzip") returned 6 [0095.739] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_justify.gif", pszSpec="*.jpg") returned 0 [0095.739] lstrlenA (lpString="*.jpg") returned 5 [0095.739] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_justify.gif", pszSpec="*.jpeg") returned 0 [0095.739] lstrlenA (lpString="*.jpeg") returned 6 [0095.739] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_justify.gif", pszSpec="*.psd") returned 0 [0095.739] lstrlenA (lpString="*.psd") returned 5 [0095.739] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_justify.gif", pszSpec="*.cdr") returned 0 [0095.740] lstrlenA (lpString="*.cdr") returned 5 [0095.740] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_justify.gif", pszSpec="*.dwg") returned 0 [0095.740] lstrlenA (lpString="*.dwg") returned 5 [0095.740] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_justify.gif", pszSpec="*.max") returned 0 [0095.740] lstrlenA (lpString="*.max") returned 5 [0095.740] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_justify.gif", pszSpec="*.bmp") returned 0 [0095.740] lstrlenA (lpString="*.bmp") returned 5 [0095.740] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_justify.gif", pszSpec="*.gif") returned 1 [0095.740] lstrlenA (lpString="*.gif") returned 5 [0095.740] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_justify.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_justify.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_justify.gif" [0095.740] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_justify.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_justify.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_justify.gif" [0095.740] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_justify.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_justify.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_justify.gif." [0095.740] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_justify.gif.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_justify.gif. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_justify.gif. " [0095.740] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_justify.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_justify.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0095.740] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x352 [0095.740] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x97ea9100, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x6d24dcb0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x97ea9100, dwHighDateTime=0x1c747ea)) returned 1 [0095.740] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0095.740] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x2f8, lpOverlapped=0x0) returned 1 [0095.792] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_justify.gif") returned="rtf_justify.gif" [0095.793] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0095.793] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x2f8, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x2f8, lpOverlapped=0x0) returned 1 [0095.793] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0095.793] CloseHandle (hObject=0x98) returned 1 [0095.793] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_justify.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_justify.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_justify.gif. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_justify.gif. ")) returned 1 [0095.794] FindNextFileA (in: hFindFile=0x5b7d30, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0095.794] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0095.794] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="rtf_pressed.gif") returned -1 [0095.794] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="rtf_pressed.gif") returned -1 [0095.794] lstrcmpiA (lpString1="", lpString2="rtf_pressed.gif") returned -1 [0095.794] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_justify.gif") returned="rtf_justify.gif" [0095.794] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="rtf_pressed.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_pressed.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_pressed.gif" [0095.794] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_pressed.gif", pszSpec="*.zip") returned 0 [0095.794] lstrlenA (lpString="*.zip") returned 5 [0095.794] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_pressed.gif", pszSpec="*.rar") returned 0 [0095.794] lstrlenA (lpString="*.rar") returned 5 [0095.794] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_pressed.gif", pszSpec="*.7z") returned 0 [0095.794] lstrlenA (lpString="*.7z") returned 4 [0095.794] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_pressed.gif", pszSpec="*.tar") returned 0 [0095.794] lstrlenA (lpString="*.tar") returned 5 [0095.794] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_pressed.gif", pszSpec="*.gzip") returned 0 [0095.795] lstrlenA (lpString="*.gzip") returned 6 [0095.795] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_pressed.gif", pszSpec="*.jpg") returned 0 [0095.795] lstrlenA (lpString="*.jpg") returned 5 [0095.795] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_pressed.gif", pszSpec="*.jpeg") returned 0 [0095.795] lstrlenA (lpString="*.jpeg") returned 6 [0095.795] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_pressed.gif", pszSpec="*.psd") returned 0 [0095.795] lstrlenA (lpString="*.psd") returned 5 [0095.795] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_pressed.gif", pszSpec="*.cdr") returned 0 [0095.795] lstrlenA (lpString="*.cdr") returned 5 [0095.795] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_pressed.gif", pszSpec="*.dwg") returned 0 [0095.795] lstrlenA (lpString="*.dwg") returned 5 [0095.795] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_pressed.gif", pszSpec="*.max") returned 0 [0095.795] lstrlenA (lpString="*.max") returned 5 [0095.795] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_pressed.gif", pszSpec="*.bmp") returned 0 [0095.795] lstrlenA (lpString="*.bmp") returned 5 [0095.795] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_pressed.gif", pszSpec="*.gif") returned 1 [0095.795] lstrlenA (lpString="*.gif") returned 5 [0095.795] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_pressed.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_pressed.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_pressed.gif" [0095.795] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_pressed.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_pressed.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_pressed.gif" [0095.795] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_pressed.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_pressed.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_pressed.gif." [0095.795] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_pressed.gif.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_pressed.gif. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_pressed.gif. " [0095.795] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_pressed.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_pressed.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0095.796] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x373 [0095.796] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x97ea9100, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5a90e170, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x97ea9100, dwHighDateTime=0x1c747ea)) returned 1 [0095.796] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0095.796] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x319, lpOverlapped=0x0) returned 1 [0095.797] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_pressed.gif") returned="rtf_pressed.gif" [0095.797] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0095.797] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x319, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x319, lpOverlapped=0x0) returned 1 [0095.797] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0095.797] CloseHandle (hObject=0x98) returned 1 [0095.797] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_pressed.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_pressed.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_pressed.gif. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_pressed.gif. ")) returned 1 [0095.798] FindNextFileA (in: hFindFile=0x5b7d30, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0095.798] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0095.798] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="rtf_underline.gif") returned -1 [0095.798] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="rtf_underline.gif") returned -1 [0095.798] lstrcmpiA (lpString1="", lpString2="rtf_underline.gif") returned -1 [0095.798] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_pressed.gif") returned="rtf_pressed.gif" [0095.798] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="rtf_underline.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_underline.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_underline.gif" [0095.798] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_underline.gif", pszSpec="*.zip") returned 0 [0095.798] lstrlenA (lpString="*.zip") returned 5 [0095.798] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_underline.gif", pszSpec="*.rar") returned 0 [0095.798] lstrlenA (lpString="*.rar") returned 5 [0095.798] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_underline.gif", pszSpec="*.7z") returned 0 [0095.798] lstrlenA (lpString="*.7z") returned 4 [0095.798] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_underline.gif", pszSpec="*.tar") returned 0 [0095.798] lstrlenA (lpString="*.tar") returned 5 [0095.798] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_underline.gif", pszSpec="*.gzip") returned 0 [0095.798] lstrlenA (lpString="*.gzip") returned 6 [0095.798] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_underline.gif", pszSpec="*.jpg") returned 0 [0095.798] lstrlenA (lpString="*.jpg") returned 5 [0095.798] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_underline.gif", pszSpec="*.jpeg") returned 0 [0095.798] lstrlenA (lpString="*.jpeg") returned 6 [0095.798] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_underline.gif", pszSpec="*.psd") returned 0 [0095.798] lstrlenA (lpString="*.psd") returned 5 [0095.798] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_underline.gif", pszSpec="*.cdr") returned 0 [0095.798] lstrlenA (lpString="*.cdr") returned 5 [0095.798] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_underline.gif", pszSpec="*.dwg") returned 0 [0095.798] lstrlenA (lpString="*.dwg") returned 5 [0095.798] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_underline.gif", pszSpec="*.max") returned 0 [0095.798] lstrlenA (lpString="*.max") returned 5 [0095.798] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_underline.gif", pszSpec="*.bmp") returned 0 [0095.798] lstrlenA (lpString="*.bmp") returned 5 [0095.798] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_underline.gif", pszSpec="*.gif") returned 1 [0095.798] lstrlenA (lpString="*.gif") returned 5 [0095.798] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_underline.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_underline.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_underline.gif" [0095.798] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_underline.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_underline.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_underline.gif" [0095.798] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_underline.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_underline.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_underline.gif." [0095.798] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_underline.gif.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_underline.gif. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_underline.gif. " [0095.799] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_underline.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_underline.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0095.799] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x35c [0095.799] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x97ea9100, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5a90e170, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x97ea9100, dwHighDateTime=0x1c747ea)) returned 1 [0095.799] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0095.799] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x302, lpOverlapped=0x0) returned 1 [0095.800] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_underline.gif") returned="rtf_underline.gif" [0095.800] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0095.800] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x302, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x302, lpOverlapped=0x0) returned 1 [0095.800] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0095.801] CloseHandle (hObject=0x98) returned 1 [0095.801] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_underline.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_underline.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_underline.gif. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_underline.gif. ")) returned 1 [0095.801] FindNextFileA (in: hFindFile=0x5b7d30, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0095.801] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0095.801] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="SAVE.GIF") returned -1 [0095.801] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SAVE.GIF") returned -1 [0095.801] lstrcmpiA (lpString1="", lpString2="SAVE.GIF") returned -1 [0095.801] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_underline.gif") returned="rtf_underline.gif" [0095.801] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="SAVE.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SAVE.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SAVE.GIF" [0095.801] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SAVE.GIF", pszSpec="*.zip") returned 0 [0095.801] lstrlenA (lpString="*.zip") returned 5 [0095.801] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SAVE.GIF", pszSpec="*.rar") returned 0 [0095.801] lstrlenA (lpString="*.rar") returned 5 [0095.801] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SAVE.GIF", pszSpec="*.7z") returned 0 [0095.801] lstrlenA (lpString="*.7z") returned 4 [0095.801] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SAVE.GIF", pszSpec="*.tar") returned 0 [0095.801] lstrlenA (lpString="*.tar") returned 5 [0095.801] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SAVE.GIF", pszSpec="*.gzip") returned 0 [0095.801] lstrlenA (lpString="*.gzip") returned 6 [0095.801] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SAVE.GIF", pszSpec="*.jpg") returned 0 [0095.801] lstrlenA (lpString="*.jpg") returned 5 [0095.801] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SAVE.GIF", pszSpec="*.jpeg") returned 0 [0095.802] lstrlenA (lpString="*.jpeg") returned 6 [0095.802] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SAVE.GIF", pszSpec="*.psd") returned 0 [0095.802] lstrlenA (lpString="*.psd") returned 5 [0095.802] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SAVE.GIF", pszSpec="*.cdr") returned 0 [0095.802] lstrlenA (lpString="*.cdr") returned 5 [0095.802] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SAVE.GIF", pszSpec="*.dwg") returned 0 [0095.802] lstrlenA (lpString="*.dwg") returned 5 [0095.802] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SAVE.GIF", pszSpec="*.max") returned 0 [0095.802] lstrlenA (lpString="*.max") returned 5 [0095.802] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SAVE.GIF", pszSpec="*.bmp") returned 0 [0095.802] lstrlenA (lpString="*.bmp") returned 5 [0095.802] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SAVE.GIF", pszSpec="*.gif") returned 1 [0095.802] lstrlenA (lpString="*.gif") returned 5 [0095.802] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SAVE.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SAVE.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SAVE.GIF" [0095.802] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SAVE.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SAVE.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SAVE.GIF" [0095.802] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SAVE.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SAVE.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SAVE.GIF." [0095.802] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SAVE.GIF.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SAVE.GIF. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SAVE.GIF. " [0095.802] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SAVE.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\save.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0095.802] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x26d [0095.802] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x58b9b600, dwHighDateTime=0x1ca033b), lpLastAccessTime=0x407536*(dwLowDateTime=0x5a90e170, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x58b9b600, dwHighDateTime=0x1ca033b)) returned 1 [0095.802] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0095.802] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x213, lpOverlapped=0x0) returned 1 [0095.803] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SAVE.GIF") returned="SAVE.GIF" [0095.803] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0095.803] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x213, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x213, lpOverlapped=0x0) returned 1 [0095.803] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0095.803] CloseHandle (hObject=0x98) returned 1 [0095.803] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SAVE.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\save.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SAVE.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\save.gif. ")) returned 1 [0095.805] FindNextFileA (in: hFindFile=0x5b7d30, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0095.805] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0095.805] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="SUBMIT.JS") returned -1 [0095.805] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SUBMIT.JS") returned -1 [0095.805] lstrcmpiA (lpString1="", lpString2="SUBMIT.JS") returned -1 [0095.805] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SAVE.GIF") returned="SAVE.GIF" [0095.805] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="SUBMIT.JS" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SUBMIT.JS") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SUBMIT.JS" [0095.805] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SUBMIT.JS", pszSpec="*.zip") returned 0 [0095.805] lstrlenA (lpString="*.zip") returned 5 [0095.805] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SUBMIT.JS", pszSpec="*.rar") returned 0 [0095.805] lstrlenA (lpString="*.rar") returned 5 [0095.805] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SUBMIT.JS", pszSpec="*.7z") returned 0 [0095.805] lstrlenA (lpString="*.7z") returned 4 [0095.805] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SUBMIT.JS", pszSpec="*.tar") returned 0 [0095.805] lstrlenA (lpString="*.tar") returned 5 [0095.805] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SUBMIT.JS", pszSpec="*.gzip") returned 0 [0095.805] lstrlenA (lpString="*.gzip") returned 6 [0095.805] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SUBMIT.JS", pszSpec="*.jpg") returned 0 [0095.805] lstrlenA (lpString="*.jpg") returned 5 [0095.805] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SUBMIT.JS", pszSpec="*.jpeg") returned 0 [0095.805] lstrlenA (lpString="*.jpeg") returned 6 [0095.805] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SUBMIT.JS", pszSpec="*.psd") returned 0 [0095.805] lstrlenA (lpString="*.psd") returned 5 [0095.805] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SUBMIT.JS", pszSpec="*.cdr") returned 0 [0095.805] lstrlenA (lpString="*.cdr") returned 5 [0095.805] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SUBMIT.JS", pszSpec="*.dwg") returned 0 [0095.805] lstrlenA (lpString="*.dwg") returned 5 [0095.805] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SUBMIT.JS", pszSpec="*.max") returned 0 [0095.805] lstrlenA (lpString="*.max") returned 5 [0095.805] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SUBMIT.JS", pszSpec="*.bmp") returned 0 [0095.805] lstrlenA (lpString="*.bmp") returned 5 [0095.805] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SUBMIT.JS", pszSpec="*.gif") returned 0 [0095.805] lstrlenA (lpString="*.gif") returned 5 [0095.805] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SUBMIT.JS", pszSpec="*.png") returned 0 [0095.805] lstrlenA (lpString="*.png") returned 5 [0095.805] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SUBMIT.JS", pszSpec="*.doc") returned 0 [0095.805] lstrlenA (lpString="*.doc") returned 5 [0095.805] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SUBMIT.JS", pszSpec="*.docx") returned 0 [0095.805] lstrlenA (lpString="*.docx") returned 6 [0095.805] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SUBMIT.JS", pszSpec="*.xls") returned 0 [0095.805] lstrlenA (lpString="*.xls") returned 5 [0095.805] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SUBMIT.JS", pszSpec="*.xlsx") returned 0 [0095.805] lstrlenA (lpString="*.xlsx") returned 6 [0095.805] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SUBMIT.JS", pszSpec="*.ppt") returned 0 [0095.805] lstrlenA (lpString="*.ppt") returned 5 [0095.805] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SUBMIT.JS", pszSpec="*.pptx") returned 0 [0095.805] lstrlenA (lpString="*.pptx") returned 6 [0095.806] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SUBMIT.JS", pszSpec="*.txt") returned 0 [0095.806] lstrlenA (lpString="*.txt") returned 5 [0095.806] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SUBMIT.JS", pszSpec="*.pdf") returned 0 [0095.806] lstrlenA (lpString="*.pdf") returned 5 [0095.806] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SUBMIT.JS", pszSpec="*.djvu") returned 0 [0095.806] lstrlenA (lpString="*.djvu") returned 6 [0095.806] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SUBMIT.JS", pszSpec="*.htm") returned 0 [0095.806] lstrlenA (lpString="*.htm") returned 5 [0095.806] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SUBMIT.JS", pszSpec="*.html") returned 0 [0095.806] lstrlenA (lpString="*.html") returned 6 [0095.806] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SUBMIT.JS", pszSpec="*.mdb") returned 0 [0095.806] lstrlenA (lpString="*.mdb") returned 5 [0095.806] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SUBMIT.JS", pszSpec="*.cer") returned 0 [0095.806] lstrlenA (lpString="*.cer") returned 5 [0095.806] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SUBMIT.JS", pszSpec="*.p12") returned 0 [0095.806] lstrlenA (lpString="*.p12") returned 5 [0095.806] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SUBMIT.JS", pszSpec="*.pfx") returned 0 [0095.806] lstrlenA (lpString="*.pfx") returned 5 [0095.806] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SUBMIT.JS", pszSpec="*.kwm") returned 0 [0095.806] lstrlenA (lpString="*.kwm") returned 5 [0095.806] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SUBMIT.JS", pszSpec="*.pwm") returned 0 [0095.806] lstrlenA (lpString="*.pwm") returned 5 [0095.806] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SUBMIT.JS", pszSpec="*.1cd") returned 0 [0095.806] lstrlenA (lpString="*.1cd") returned 5 [0095.806] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SUBMIT.JS", pszSpec="*.md") returned 0 [0095.806] lstrlenA (lpString="*.md") returned 4 [0095.806] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SUBMIT.JS", pszSpec="*.mdf") returned 0 [0095.806] lstrlenA (lpString="*.mdf") returned 5 [0095.806] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SUBMIT.JS", pszSpec="*.dbf") returned 0 [0095.806] lstrlenA (lpString="*.dbf") returned 5 [0095.806] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SUBMIT.JS", pszSpec="*.odt") returned 0 [0095.806] lstrlenA (lpString="*.odt") returned 5 [0095.806] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SUBMIT.JS", pszSpec="*.vob") returned 0 [0095.806] lstrlenA (lpString="*.vob") returned 5 [0095.806] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SUBMIT.JS", pszSpec="*.ifo") returned 0 [0095.806] lstrlenA (lpString="*.ifo") returned 5 [0095.806] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SUBMIT.JS", pszSpec="*.lnk") returned 0 [0095.806] lstrlenA (lpString="*.lnk") returned 5 [0095.806] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SUBMIT.JS", pszSpec="*.torrent") returned 0 [0095.806] lstrlenA (lpString="*.torrent") returned 9 [0095.806] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SUBMIT.JS", pszSpec="*.mov") returned 0 [0095.806] lstrlenA (lpString="*.mov") returned 5 [0095.806] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SUBMIT.JS", pszSpec="*.m2v") returned 0 [0095.806] lstrlenA (lpString="*.m2v") returned 5 [0095.806] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SUBMIT.JS", pszSpec="*.3gp") returned 0 [0095.806] lstrlenA (lpString="*.3gp") returned 5 [0095.806] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SUBMIT.JS", pszSpec="*.mpeg") returned 0 [0095.806] lstrlenA (lpString="*.mpeg") returned 6 [0095.807] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SUBMIT.JS", pszSpec="*.mpg") returned 0 [0095.807] lstrlenA (lpString="*.mpg") returned 5 [0095.807] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SUBMIT.JS", pszSpec="*.flv") returned 0 [0095.807] lstrlenA (lpString="*.flv") returned 5 [0095.807] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SUBMIT.JS", pszSpec="*.avi") returned 0 [0095.807] lstrlenA (lpString="*.avi") returned 5 [0095.807] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SUBMIT.JS", pszSpec="*.mp4") returned 0 [0095.807] lstrlenA (lpString="*.mp4") returned 5 [0095.807] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SUBMIT.JS", pszSpec="*.wmv") returned 0 [0095.807] lstrlenA (lpString="*.wmv") returned 5 [0095.807] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SUBMIT.JS", pszSpec="*.divx") returned 0 [0095.807] lstrlenA (lpString="*.divx") returned 6 [0095.807] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SUBMIT.JS", pszSpec="*.mkv") returned 0 [0095.807] lstrlenA (lpString="*.mkv") returned 5 [0095.807] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SUBMIT.JS", pszSpec="*.mp3") returned 0 [0095.807] lstrlenA (lpString="*.mp3") returned 5 [0095.807] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SUBMIT.JS", pszSpec="*.wav") returned 0 [0095.807] lstrlenA (lpString="*.wav") returned 5 [0095.807] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SUBMIT.JS", pszSpec="*.flac") returned 0 [0095.807] lstrlenA (lpString="*.flac") returned 6 [0095.807] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SUBMIT.JS", pszSpec="*.ape") returned 0 [0095.807] lstrlenA (lpString="*.ape") returned 5 [0095.807] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SUBMIT.JS", pszSpec="*.wma") returned 0 [0095.807] lstrlenA (lpString="*.wma") returned 5 [0095.807] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SUBMIT.JS", pszSpec="*.ac3") returned 0 [0095.807] lstrlenA (lpString="*.ac3") returned 5 [0095.807] FindNextFileA (in: hFindFile=0x5b7d30, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0095.807] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0095.807] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="utilityfunctions.js") returned -1 [0095.807] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="utilityfunctions.js") returned -1 [0095.807] lstrcmpiA (lpString1="", lpString2="utilityfunctions.js") returned -1 [0095.807] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SUBMIT.JS") returned="SUBMIT.JS" [0095.807] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="utilityfunctions.js" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\utilityfunctions.js") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\utilityfunctions.js" [0095.807] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\utilityfunctions.js", pszSpec="*.zip") returned 0 [0095.808] lstrlenA (lpString="*.zip") returned 5 [0095.808] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\utilityfunctions.js", pszSpec="*.rar") returned 0 [0095.808] lstrlenA (lpString="*.rar") returned 5 [0095.808] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\utilityfunctions.js", pszSpec="*.7z") returned 0 [0095.808] lstrlenA (lpString="*.7z") returned 4 [0095.808] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\utilityfunctions.js", pszSpec="*.tar") returned 0 [0095.808] lstrlenA (lpString="*.tar") returned 5 [0095.808] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\utilityfunctions.js", pszSpec="*.gzip") returned 0 [0095.808] lstrlenA (lpString="*.gzip") returned 6 [0095.808] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\utilityfunctions.js", pszSpec="*.jpg") returned 0 [0095.808] lstrlenA (lpString="*.jpg") returned 5 [0095.808] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\utilityfunctions.js", pszSpec="*.jpeg") returned 0 [0095.808] lstrlenA (lpString="*.jpeg") returned 6 [0095.808] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\utilityfunctions.js", pszSpec="*.psd") returned 0 [0095.808] lstrlenA (lpString="*.psd") returned 5 [0095.808] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\utilityfunctions.js", pszSpec="*.cdr") returned 0 [0095.808] lstrlenA (lpString="*.cdr") returned 5 [0095.808] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\utilityfunctions.js", pszSpec="*.dwg") returned 0 [0095.808] lstrlenA (lpString="*.dwg") returned 5 [0095.808] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\utilityfunctions.js", pszSpec="*.max") returned 0 [0095.808] lstrlenA (lpString="*.max") returned 5 [0095.808] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\utilityfunctions.js", pszSpec="*.bmp") returned 0 [0095.808] lstrlenA (lpString="*.bmp") returned 5 [0095.808] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\utilityfunctions.js", pszSpec="*.gif") returned 0 [0095.808] lstrlenA (lpString="*.gif") returned 5 [0095.808] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\utilityfunctions.js", pszSpec="*.png") returned 0 [0095.808] lstrlenA (lpString="*.png") returned 5 [0095.808] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\utilityfunctions.js", pszSpec="*.doc") returned 0 [0095.808] lstrlenA (lpString="*.doc") returned 5 [0095.808] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\utilityfunctions.js", pszSpec="*.docx") returned 0 [0095.808] lstrlenA (lpString="*.docx") returned 6 [0095.808] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\utilityfunctions.js", pszSpec="*.xls") returned 0 [0095.808] lstrlenA (lpString="*.xls") returned 5 [0095.808] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\utilityfunctions.js", pszSpec="*.xlsx") returned 0 [0095.808] lstrlenA (lpString="*.xlsx") returned 6 [0095.808] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\utilityfunctions.js", pszSpec="*.ppt") returned 0 [0095.808] lstrlenA (lpString="*.ppt") returned 5 [0095.808] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\utilityfunctions.js", pszSpec="*.pptx") returned 0 [0095.808] lstrlenA (lpString="*.pptx") returned 6 [0095.808] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\utilityfunctions.js", pszSpec="*.txt") returned 0 [0095.808] lstrlenA (lpString="*.txt") returned 5 [0095.809] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\utilityfunctions.js", pszSpec="*.pdf") returned 0 [0095.809] lstrlenA (lpString="*.pdf") returned 5 [0095.809] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\utilityfunctions.js", pszSpec="*.djvu") returned 0 [0095.809] lstrlenA (lpString="*.djvu") returned 6 [0095.809] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\utilityfunctions.js", pszSpec="*.htm") returned 0 [0095.809] lstrlenA (lpString="*.htm") returned 5 [0095.809] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\utilityfunctions.js", pszSpec="*.html") returned 0 [0095.809] lstrlenA (lpString="*.html") returned 6 [0095.809] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\utilityfunctions.js", pszSpec="*.mdb") returned 0 [0095.809] lstrlenA (lpString="*.mdb") returned 5 [0095.809] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\utilityfunctions.js", pszSpec="*.cer") returned 0 [0095.809] lstrlenA (lpString="*.cer") returned 5 [0095.809] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\utilityfunctions.js", pszSpec="*.p12") returned 0 [0095.809] lstrlenA (lpString="*.p12") returned 5 [0095.809] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\utilityfunctions.js", pszSpec="*.pfx") returned 0 [0095.809] lstrlenA (lpString="*.pfx") returned 5 [0095.809] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\utilityfunctions.js", pszSpec="*.kwm") returned 0 [0095.809] lstrlenA (lpString="*.kwm") returned 5 [0095.809] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\utilityfunctions.js", pszSpec="*.pwm") returned 0 [0095.809] lstrlenA (lpString="*.pwm") returned 5 [0095.809] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\utilityfunctions.js", pszSpec="*.1cd") returned 0 [0095.809] lstrlenA (lpString="*.1cd") returned 5 [0095.809] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\utilityfunctions.js", pszSpec="*.md") returned 0 [0095.809] lstrlenA (lpString="*.md") returned 4 [0095.809] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\utilityfunctions.js", pszSpec="*.mdf") returned 0 [0095.809] lstrlenA (lpString="*.mdf") returned 5 [0095.809] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\utilityfunctions.js", pszSpec="*.dbf") returned 0 [0095.809] lstrlenA (lpString="*.dbf") returned 5 [0095.809] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\utilityfunctions.js", pszSpec="*.odt") returned 0 [0095.809] lstrlenA (lpString="*.odt") returned 5 [0095.809] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\utilityfunctions.js", pszSpec="*.vob") returned 0 [0095.809] lstrlenA (lpString="*.vob") returned 5 [0095.809] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\utilityfunctions.js", pszSpec="*.ifo") returned 0 [0095.809] lstrlenA (lpString="*.ifo") returned 5 [0095.809] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\utilityfunctions.js", pszSpec="*.lnk") returned 0 [0095.809] lstrlenA (lpString="*.lnk") returned 5 [0095.809] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\utilityfunctions.js", pszSpec="*.torrent") returned 0 [0095.809] lstrlenA (lpString="*.torrent") returned 9 [0095.809] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\utilityfunctions.js", pszSpec="*.mov") returned 0 [0095.809] lstrlenA (lpString="*.mov") returned 5 [0095.810] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\utilityfunctions.js", pszSpec="*.m2v") returned 0 [0095.810] lstrlenA (lpString="*.m2v") returned 5 [0095.810] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\utilityfunctions.js", pszSpec="*.3gp") returned 0 [0095.810] lstrlenA (lpString="*.3gp") returned 5 [0095.810] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\utilityfunctions.js", pszSpec="*.mpeg") returned 0 [0095.810] lstrlenA (lpString="*.mpeg") returned 6 [0095.810] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\utilityfunctions.js", pszSpec="*.mpg") returned 0 [0095.810] lstrlenA (lpString="*.mpg") returned 5 [0095.810] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\utilityfunctions.js", pszSpec="*.flv") returned 0 [0095.810] lstrlenA (lpString="*.flv") returned 5 [0095.810] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\utilityfunctions.js", pszSpec="*.avi") returned 0 [0095.810] lstrlenA (lpString="*.avi") returned 5 [0095.810] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\utilityfunctions.js", pszSpec="*.mp4") returned 0 [0095.810] lstrlenA (lpString="*.mp4") returned 5 [0095.810] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\utilityfunctions.js", pszSpec="*.wmv") returned 0 [0095.810] lstrlenA (lpString="*.wmv") returned 5 [0095.810] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\utilityfunctions.js", pszSpec="*.divx") returned 0 [0095.810] lstrlenA (lpString="*.divx") returned 6 [0095.810] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\utilityfunctions.js", pszSpec="*.mkv") returned 0 [0095.810] lstrlenA (lpString="*.mkv") returned 5 [0095.810] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\utilityfunctions.js", pszSpec="*.mp3") returned 0 [0095.810] lstrlenA (lpString="*.mp3") returned 5 [0095.810] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\utilityfunctions.js", pszSpec="*.wav") returned 0 [0095.810] lstrlenA (lpString="*.wav") returned 5 [0095.810] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\utilityfunctions.js", pszSpec="*.flac") returned 0 [0095.810] lstrlenA (lpString="*.flac") returned 6 [0095.810] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\utilityfunctions.js", pszSpec="*.ape") returned 0 [0095.810] lstrlenA (lpString="*.ape") returned 5 [0095.810] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\utilityfunctions.js", pszSpec="*.wma") returned 0 [0095.810] lstrlenA (lpString="*.wma") returned 5 [0095.810] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\utilityfunctions.js", pszSpec="*.ac3") returned 0 [0095.810] lstrlenA (lpString="*.ac3") returned 5 [0095.810] FindNextFileA (in: hFindFile=0x5b7d30, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0095.810] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0095.810] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="validation.js") returned -1 [0095.810] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="validation.js") returned -1 [0095.810] lstrcmpiA (lpString1="", lpString2="validation.js") returned -1 [0095.810] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\utilityfunctions.js") returned="utilityfunctions.js" [0095.810] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="validation.js" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\validation.js") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\validation.js" [0095.811] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\validation.js", pszSpec="*.zip") returned 0 [0095.811] lstrlenA (lpString="*.zip") returned 5 [0095.811] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\validation.js", pszSpec="*.rar") returned 0 [0095.811] lstrlenA (lpString="*.rar") returned 5 [0095.811] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\validation.js", pszSpec="*.7z") returned 0 [0095.811] lstrlenA (lpString="*.7z") returned 4 [0095.811] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\validation.js", pszSpec="*.tar") returned 0 [0095.811] lstrlenA (lpString="*.tar") returned 5 [0095.811] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\validation.js", pszSpec="*.gzip") returned 0 [0095.811] lstrlenA (lpString="*.gzip") returned 6 [0095.811] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\validation.js", pszSpec="*.jpg") returned 0 [0095.811] lstrlenA (lpString="*.jpg") returned 5 [0095.811] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\validation.js", pszSpec="*.jpeg") returned 0 [0095.811] lstrlenA (lpString="*.jpeg") returned 6 [0095.811] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\validation.js", pszSpec="*.psd") returned 0 [0095.811] lstrlenA (lpString="*.psd") returned 5 [0095.811] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\validation.js", pszSpec="*.cdr") returned 0 [0095.811] lstrlenA (lpString="*.cdr") returned 5 [0095.811] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\validation.js", pszSpec="*.dwg") returned 0 [0095.811] lstrlenA (lpString="*.dwg") returned 5 [0095.811] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\validation.js", pszSpec="*.max") returned 0 [0095.811] lstrlenA (lpString="*.max") returned 5 [0095.811] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\validation.js", pszSpec="*.bmp") returned 0 [0095.811] lstrlenA (lpString="*.bmp") returned 5 [0095.811] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\validation.js", pszSpec="*.gif") returned 0 [0095.811] lstrlenA (lpString="*.gif") returned 5 [0095.811] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\validation.js", pszSpec="*.png") returned 0 [0095.811] lstrlenA (lpString="*.png") returned 5 [0095.811] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\validation.js", pszSpec="*.doc") returned 0 [0095.811] lstrlenA (lpString="*.doc") returned 5 [0095.811] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\validation.js", pszSpec="*.docx") returned 0 [0095.811] lstrlenA (lpString="*.docx") returned 6 [0095.811] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\validation.js", pszSpec="*.xls") returned 0 [0095.811] lstrlenA (lpString="*.xls") returned 5 [0095.811] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\validation.js", pszSpec="*.xlsx") returned 0 [0095.811] lstrlenA (lpString="*.xlsx") returned 6 [0095.811] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\validation.js", pszSpec="*.ppt") returned 0 [0095.811] lstrlenA (lpString="*.ppt") returned 5 [0095.811] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\validation.js", pszSpec="*.pptx") returned 0 [0095.812] lstrlenA (lpString="*.pptx") returned 6 [0095.812] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\validation.js", pszSpec="*.txt") returned 0 [0095.812] lstrlenA (lpString="*.txt") returned 5 [0095.812] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\validation.js", pszSpec="*.pdf") returned 0 [0095.812] lstrlenA (lpString="*.pdf") returned 5 [0095.812] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\validation.js", pszSpec="*.djvu") returned 0 [0095.812] lstrlenA (lpString="*.djvu") returned 6 [0095.812] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\validation.js", pszSpec="*.htm") returned 0 [0095.812] lstrlenA (lpString="*.htm") returned 5 [0095.812] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\validation.js", pszSpec="*.html") returned 0 [0095.812] lstrlenA (lpString="*.html") returned 6 [0095.812] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\validation.js", pszSpec="*.mdb") returned 0 [0095.812] lstrlenA (lpString="*.mdb") returned 5 [0095.812] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\validation.js", pszSpec="*.cer") returned 0 [0095.812] lstrlenA (lpString="*.cer") returned 5 [0095.812] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\validation.js", pszSpec="*.p12") returned 0 [0095.812] lstrlenA (lpString="*.p12") returned 5 [0095.812] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\validation.js", pszSpec="*.pfx") returned 0 [0095.812] lstrlenA (lpString="*.pfx") returned 5 [0095.812] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\validation.js", pszSpec="*.kwm") returned 0 [0095.812] lstrlenA (lpString="*.kwm") returned 5 [0095.812] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\validation.js", pszSpec="*.pwm") returned 0 [0095.812] lstrlenA (lpString="*.pwm") returned 5 [0095.812] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\validation.js", pszSpec="*.1cd") returned 0 [0095.812] lstrlenA (lpString="*.1cd") returned 5 [0095.812] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\validation.js", pszSpec="*.md") returned 0 [0095.812] lstrlenA (lpString="*.md") returned 4 [0095.812] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\validation.js", pszSpec="*.mdf") returned 0 [0095.812] lstrlenA (lpString="*.mdf") returned 5 [0095.812] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\validation.js", pszSpec="*.dbf") returned 0 [0095.812] lstrlenA (lpString="*.dbf") returned 5 [0095.812] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\validation.js", pszSpec="*.odt") returned 0 [0095.812] lstrlenA (lpString="*.odt") returned 5 [0095.812] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\validation.js", pszSpec="*.vob") returned 0 [0095.812] lstrlenA (lpString="*.vob") returned 5 [0095.812] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\validation.js", pszSpec="*.ifo") returned 0 [0095.812] lstrlenA (lpString="*.ifo") returned 5 [0095.812] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\validation.js", pszSpec="*.lnk") returned 0 [0095.812] lstrlenA (lpString="*.lnk") returned 5 [0095.812] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\validation.js", pszSpec="*.torrent") returned 0 [0095.813] lstrlenA (lpString="*.torrent") returned 9 [0095.813] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\validation.js", pszSpec="*.mov") returned 0 [0095.813] lstrlenA (lpString="*.mov") returned 5 [0095.813] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\validation.js", pszSpec="*.m2v") returned 0 [0095.813] lstrlenA (lpString="*.m2v") returned 5 [0095.813] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\validation.js", pszSpec="*.3gp") returned 0 [0095.813] lstrlenA (lpString="*.3gp") returned 5 [0095.813] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\validation.js", pszSpec="*.mpeg") returned 0 [0095.813] lstrlenA (lpString="*.mpeg") returned 6 [0095.813] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\validation.js", pszSpec="*.mpg") returned 0 [0095.813] lstrlenA (lpString="*.mpg") returned 5 [0095.813] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\validation.js", pszSpec="*.flv") returned 0 [0095.813] lstrlenA (lpString="*.flv") returned 5 [0095.813] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\validation.js", pszSpec="*.avi") returned 0 [0095.813] lstrlenA (lpString="*.avi") returned 5 [0095.813] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\validation.js", pszSpec="*.mp4") returned 0 [0095.813] lstrlenA (lpString="*.mp4") returned 5 [0095.813] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\validation.js", pszSpec="*.wmv") returned 0 [0095.813] lstrlenA (lpString="*.wmv") returned 5 [0095.813] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\validation.js", pszSpec="*.divx") returned 0 [0095.813] lstrlenA (lpString="*.divx") returned 6 [0095.813] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\validation.js", pszSpec="*.mkv") returned 0 [0095.813] lstrlenA (lpString="*.mkv") returned 5 [0095.813] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\validation.js", pszSpec="*.mp3") returned 0 [0095.813] lstrlenA (lpString="*.mp3") returned 5 [0095.813] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\validation.js", pszSpec="*.wav") returned 0 [0095.813] lstrlenA (lpString="*.wav") returned 5 [0095.813] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\validation.js", pszSpec="*.flac") returned 0 [0095.813] lstrlenA (lpString="*.flac") returned 6 [0095.813] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\validation.js", pszSpec="*.ape") returned 0 [0095.813] lstrlenA (lpString="*.ape") returned 5 [0095.813] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\validation.js", pszSpec="*.wma") returned 0 [0095.813] lstrlenA (lpString="*.wma") returned 5 [0095.813] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\validation.js", pszSpec="*.ac3") returned 0 [0095.813] lstrlenA (lpString="*.ac3") returned 5 [0095.813] FindNextFileA (in: hFindFile=0x5b7d30, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0095.813] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0095.813] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="VIEW.ICO") returned -1 [0095.813] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="VIEW.ICO") returned -1 [0095.813] lstrcmpiA (lpString1="", lpString2="VIEW.ICO") returned -1 [0095.814] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\validation.js") returned="validation.js" [0095.814] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="VIEW.ICO" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.ICO") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.ICO" [0095.814] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.ICO", pszSpec="*.zip") returned 0 [0095.814] lstrlenA (lpString="*.zip") returned 5 [0095.814] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.ICO", pszSpec="*.rar") returned 0 [0095.814] lstrlenA (lpString="*.rar") returned 5 [0095.814] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.ICO", pszSpec="*.7z") returned 0 [0095.814] lstrlenA (lpString="*.7z") returned 4 [0095.814] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.ICO", pszSpec="*.tar") returned 0 [0095.814] lstrlenA (lpString="*.tar") returned 5 [0095.814] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.ICO", pszSpec="*.gzip") returned 0 [0095.814] lstrlenA (lpString="*.gzip") returned 6 [0095.814] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.ICO", pszSpec="*.jpg") returned 0 [0095.814] lstrlenA (lpString="*.jpg") returned 5 [0095.814] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.ICO", pszSpec="*.jpeg") returned 0 [0095.814] lstrlenA (lpString="*.jpeg") returned 6 [0095.814] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.ICO", pszSpec="*.psd") returned 0 [0095.814] lstrlenA (lpString="*.psd") returned 5 [0095.814] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.ICO", pszSpec="*.cdr") returned 0 [0095.814] lstrlenA (lpString="*.cdr") returned 5 [0095.814] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.ICO", pszSpec="*.dwg") returned 0 [0095.814] lstrlenA (lpString="*.dwg") returned 5 [0095.814] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.ICO", pszSpec="*.max") returned 0 [0095.814] lstrlenA (lpString="*.max") returned 5 [0095.814] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.ICO", pszSpec="*.bmp") returned 0 [0095.814] lstrlenA (lpString="*.bmp") returned 5 [0095.814] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.ICO", pszSpec="*.gif") returned 0 [0095.814] lstrlenA (lpString="*.gif") returned 5 [0095.814] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.ICO", pszSpec="*.png") returned 0 [0095.814] lstrlenA (lpString="*.png") returned 5 [0095.814] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.ICO", pszSpec="*.doc") returned 0 [0095.814] lstrlenA (lpString="*.doc") returned 5 [0095.814] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.ICO", pszSpec="*.docx") returned 0 [0095.814] lstrlenA (lpString="*.docx") returned 6 [0095.814] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.ICO", pszSpec="*.xls") returned 0 [0095.814] lstrlenA (lpString="*.xls") returned 5 [0095.814] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.ICO", pszSpec="*.xlsx") returned 0 [0095.814] lstrlenA (lpString="*.xlsx") returned 6 [0095.814] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.ICO", pszSpec="*.ppt") returned 0 [0095.814] lstrlenA (lpString="*.ppt") returned 5 [0095.814] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.ICO", pszSpec="*.pptx") returned 0 [0095.815] lstrlenA (lpString="*.pptx") returned 6 [0095.815] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.ICO", pszSpec="*.txt") returned 0 [0095.815] lstrlenA (lpString="*.txt") returned 5 [0095.815] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.ICO", pszSpec="*.pdf") returned 0 [0095.815] lstrlenA (lpString="*.pdf") returned 5 [0095.815] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.ICO", pszSpec="*.djvu") returned 0 [0095.815] lstrlenA (lpString="*.djvu") returned 6 [0095.815] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.ICO", pszSpec="*.htm") returned 0 [0095.815] lstrlenA (lpString="*.htm") returned 5 [0095.815] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.ICO", pszSpec="*.html") returned 0 [0095.815] lstrlenA (lpString="*.html") returned 6 [0095.815] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.ICO", pszSpec="*.mdb") returned 0 [0095.815] lstrlenA (lpString="*.mdb") returned 5 [0095.815] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.ICO", pszSpec="*.cer") returned 0 [0095.815] lstrlenA (lpString="*.cer") returned 5 [0095.815] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.ICO", pszSpec="*.p12") returned 0 [0095.815] lstrlenA (lpString="*.p12") returned 5 [0095.815] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.ICO", pszSpec="*.pfx") returned 0 [0095.815] lstrlenA (lpString="*.pfx") returned 5 [0095.815] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.ICO", pszSpec="*.kwm") returned 0 [0095.815] lstrlenA (lpString="*.kwm") returned 5 [0095.815] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.ICO", pszSpec="*.pwm") returned 0 [0095.815] lstrlenA (lpString="*.pwm") returned 5 [0095.815] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.ICO", pszSpec="*.1cd") returned 0 [0095.815] lstrlenA (lpString="*.1cd") returned 5 [0095.815] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.ICO", pszSpec="*.md") returned 0 [0095.815] lstrlenA (lpString="*.md") returned 4 [0095.815] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.ICO", pszSpec="*.mdf") returned 0 [0095.815] lstrlenA (lpString="*.mdf") returned 5 [0095.815] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.ICO", pszSpec="*.dbf") returned 0 [0095.815] lstrlenA (lpString="*.dbf") returned 5 [0095.815] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.ICO", pszSpec="*.odt") returned 0 [0095.815] lstrlenA (lpString="*.odt") returned 5 [0095.815] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.ICO", pszSpec="*.vob") returned 0 [0095.815] lstrlenA (lpString="*.vob") returned 5 [0095.815] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.ICO", pszSpec="*.ifo") returned 0 [0095.815] lstrlenA (lpString="*.ifo") returned 5 [0095.815] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.ICO", pszSpec="*.lnk") returned 0 [0095.815] lstrlenA (lpString="*.lnk") returned 5 [0095.815] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.ICO", pszSpec="*.torrent") returned 0 [0095.816] lstrlenA (lpString="*.torrent") returned 9 [0095.816] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.ICO", pszSpec="*.mov") returned 0 [0095.816] lstrlenA (lpString="*.mov") returned 5 [0095.816] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.ICO", pszSpec="*.m2v") returned 0 [0095.816] lstrlenA (lpString="*.m2v") returned 5 [0095.816] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.ICO", pszSpec="*.3gp") returned 0 [0095.816] lstrlenA (lpString="*.3gp") returned 5 [0095.816] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.ICO", pszSpec="*.mpeg") returned 0 [0095.816] lstrlenA (lpString="*.mpeg") returned 6 [0095.816] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.ICO", pszSpec="*.mpg") returned 0 [0095.816] lstrlenA (lpString="*.mpg") returned 5 [0095.816] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.ICO", pszSpec="*.flv") returned 0 [0095.816] lstrlenA (lpString="*.flv") returned 5 [0095.816] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.ICO", pszSpec="*.avi") returned 0 [0095.816] lstrlenA (lpString="*.avi") returned 5 [0095.816] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.ICO", pszSpec="*.mp4") returned 0 [0095.816] lstrlenA (lpString="*.mp4") returned 5 [0095.816] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.ICO", pszSpec="*.wmv") returned 0 [0095.816] lstrlenA (lpString="*.wmv") returned 5 [0095.816] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.ICO", pszSpec="*.divx") returned 0 [0095.816] lstrlenA (lpString="*.divx") returned 6 [0095.816] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.ICO", pszSpec="*.mkv") returned 0 [0095.816] lstrlenA (lpString="*.mkv") returned 5 [0095.816] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.ICO", pszSpec="*.mp3") returned 0 [0095.816] lstrlenA (lpString="*.mp3") returned 5 [0095.816] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.ICO", pszSpec="*.wav") returned 0 [0095.816] lstrlenA (lpString="*.wav") returned 5 [0095.816] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.ICO", pszSpec="*.flac") returned 0 [0095.816] lstrlenA (lpString="*.flac") returned 6 [0095.816] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.ICO", pszSpec="*.ape") returned 0 [0095.816] lstrlenA (lpString="*.ape") returned 5 [0095.816] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.ICO", pszSpec="*.wma") returned 0 [0095.816] lstrlenA (lpString="*.wma") returned 5 [0095.816] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.ICO", pszSpec="*.ac3") returned 0 [0095.816] lstrlenA (lpString="*.ac3") returned 5 [0095.816] FindNextFileA (in: hFindFile=0x5b7d30, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0095.817] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0095.817] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="VIEW.JS") returned -1 [0095.817] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="VIEW.JS") returned -1 [0095.817] lstrcmpiA (lpString1="", lpString2="VIEW.JS") returned -1 [0095.817] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.ICO") returned="VIEW.ICO" [0095.817] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="VIEW.JS" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.JS") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.JS" [0095.817] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.JS", pszSpec="*.zip") returned 0 [0095.817] lstrlenA (lpString="*.zip") returned 5 [0095.817] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.JS", pszSpec="*.rar") returned 0 [0095.817] lstrlenA (lpString="*.rar") returned 5 [0095.817] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.JS", pszSpec="*.7z") returned 0 [0095.817] lstrlenA (lpString="*.7z") returned 4 [0095.817] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.JS", pszSpec="*.tar") returned 0 [0095.817] lstrlenA (lpString="*.tar") returned 5 [0095.817] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.JS", pszSpec="*.gzip") returned 0 [0095.817] lstrlenA (lpString="*.gzip") returned 6 [0095.817] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.JS", pszSpec="*.jpg") returned 0 [0095.817] lstrlenA (lpString="*.jpg") returned 5 [0095.817] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.JS", pszSpec="*.jpeg") returned 0 [0095.817] lstrlenA (lpString="*.jpeg") returned 6 [0095.817] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.JS", pszSpec="*.psd") returned 0 [0095.817] lstrlenA (lpString="*.psd") returned 5 [0095.817] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.JS", pszSpec="*.cdr") returned 0 [0095.817] lstrlenA (lpString="*.cdr") returned 5 [0095.817] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.JS", pszSpec="*.dwg") returned 0 [0095.817] lstrlenA (lpString="*.dwg") returned 5 [0095.817] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.JS", pszSpec="*.max") returned 0 [0095.817] lstrlenA (lpString="*.max") returned 5 [0095.817] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.JS", pszSpec="*.bmp") returned 0 [0095.817] lstrlenA (lpString="*.bmp") returned 5 [0095.817] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.JS", pszSpec="*.gif") returned 0 [0095.817] lstrlenA (lpString="*.gif") returned 5 [0095.817] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.JS", pszSpec="*.png") returned 0 [0095.817] lstrlenA (lpString="*.png") returned 5 [0095.817] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.JS", pszSpec="*.doc") returned 0 [0095.817] lstrlenA (lpString="*.doc") returned 5 [0095.817] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.JS", pszSpec="*.docx") returned 0 [0095.817] lstrlenA (lpString="*.docx") returned 6 [0095.817] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.JS", pszSpec="*.xls") returned 0 [0095.817] lstrlenA (lpString="*.xls") returned 5 [0095.818] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.JS", pszSpec="*.xlsx") returned 0 [0095.818] lstrlenA (lpString="*.xlsx") returned 6 [0095.818] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.JS", pszSpec="*.ppt") returned 0 [0095.818] lstrlenA (lpString="*.ppt") returned 5 [0095.818] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.JS", pszSpec="*.pptx") returned 0 [0095.818] lstrlenA (lpString="*.pptx") returned 6 [0095.818] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.JS", pszSpec="*.txt") returned 0 [0095.818] lstrlenA (lpString="*.txt") returned 5 [0095.818] FindNextFileA (in: hFindFile=0x5b7d30, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0095.818] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0095.818] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="ViewHeaderPreview.jpg") returned -1 [0095.818] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ViewHeaderPreview.jpg") returned -1 [0095.818] lstrcmpiA (lpString1="", lpString2="ViewHeaderPreview.jpg") returned -1 [0095.818] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.JS") returned="VIEW.JS" [0095.818] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", lpString2="ViewHeaderPreview.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ViewHeaderPreview.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ViewHeaderPreview.jpg" [0095.818] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ViewHeaderPreview.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ViewHeaderPreview.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ViewHeaderPreview.jpg" [0095.818] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ViewHeaderPreview.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ViewHeaderPreview.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ViewHeaderPreview.jpg" [0095.818] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ViewHeaderPreview.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ViewHeaderPreview.jpg.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ViewHeaderPreview.jpg." [0095.818] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ViewHeaderPreview.jpg.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ViewHeaderPreview.jpg. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ViewHeaderPreview.jpg. " [0095.818] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ViewHeaderPreview.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\viewheaderpreview.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0095.819] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xd78 [0095.819] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x991bbe00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x706f8370, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x991bbe00, dwHighDateTime=0x1c747ea)) returned 1 [0095.819] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0095.819] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0xd1e, lpOverlapped=0x0) returned 1 [0095.820] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ViewHeaderPreview.jpg") returned="ViewHeaderPreview.jpg" [0095.820] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0095.820] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0xd1e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0xd1e, lpOverlapped=0x0) returned 1 [0095.820] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0095.820] CloseHandle (hObject=0x98) returned 1 [0095.820] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ViewHeaderPreview.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\viewheaderpreview.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ViewHeaderPreview.jpg. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\viewheaderpreview.jpg. ")) returned 1 [0095.821] FindNextFileA (in: hFindFile=0x5b7d30, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 0 [0095.821] FindClose (in: hFindFile=0x5b7d30 | out: hFindFile=0x5b7d30) returned 1 [0095.821] FindNextFileA (in: hFindFile=0x5b7dd0, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0095.821] lstrcmpA (lpString1=".", lpString2="GrooveForms4") returned -1 [0095.821] lstrcmpA (lpString1="..", lpString2="GrooveForms4") returned -1 [0095.821] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\*.*") returned="*.*" [0095.821] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\", lpString2="GrooveForms4" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4" [0095.821] lstrlenA (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4") returned 82 [0095.821] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\*.*", lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 0x5be160 [0095.841] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0095.841] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0095.843] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0095.843] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0095.843] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0095.843] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0095.843] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="ADD.GIF") returned 1 [0095.843] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ADD.GIF") returned 1 [0095.843] lstrcmpiA (lpString1="", lpString2="ADD.GIF") returned -1 [0095.843] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\*.*") returned="*.*" [0095.843] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="ADD.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ADD.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ADD.GIF" [0095.843] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ADD.GIF", pszSpec="*.zip") returned 0 [0095.843] lstrlenA (lpString="*.zip") returned 5 [0095.843] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ADD.GIF", pszSpec="*.rar") returned 0 [0095.843] lstrlenA (lpString="*.rar") returned 5 [0095.843] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ADD.GIF", pszSpec="*.7z") returned 0 [0095.843] lstrlenA (lpString="*.7z") returned 4 [0095.843] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ADD.GIF", pszSpec="*.tar") returned 0 [0095.843] lstrlenA (lpString="*.tar") returned 5 [0095.843] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ADD.GIF", pszSpec="*.gzip") returned 0 [0095.843] lstrlenA (lpString="*.gzip") returned 6 [0095.843] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ADD.GIF", pszSpec="*.jpg") returned 0 [0095.843] lstrlenA (lpString="*.jpg") returned 5 [0095.843] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ADD.GIF", pszSpec="*.jpeg") returned 0 [0095.843] lstrlenA (lpString="*.jpeg") returned 6 [0095.843] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ADD.GIF", pszSpec="*.psd") returned 0 [0095.843] lstrlenA (lpString="*.psd") returned 5 [0095.843] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ADD.GIF", pszSpec="*.cdr") returned 0 [0095.843] lstrlenA (lpString="*.cdr") returned 5 [0095.843] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ADD.GIF", pszSpec="*.dwg") returned 0 [0095.843] lstrlenA (lpString="*.dwg") returned 5 [0095.844] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ADD.GIF", pszSpec="*.max") returned 0 [0095.844] lstrlenA (lpString="*.max") returned 5 [0095.844] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ADD.GIF", pszSpec="*.bmp") returned 0 [0095.844] lstrlenA (lpString="*.bmp") returned 5 [0095.844] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ADD.GIF", pszSpec="*.gif") returned 1 [0095.844] lstrlenA (lpString="*.gif") returned 5 [0095.844] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ADD.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ADD.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ADD.GIF" [0095.844] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ADD.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ADD.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ADD.GIF" [0095.844] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ADD.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ADD.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ADD.GIF." [0095.844] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ADD.GIF.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ADD.GIF. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ADD.GIF. " [0095.844] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ADD.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\add.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0095.844] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x244 [0095.844] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x991bbe00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5eaf6290, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x991bbe00, dwHighDateTime=0x1c747ea)) returned 1 [0095.844] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0095.845] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x1ea, lpOverlapped=0x0) returned 1 [0095.845] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ADD.GIF") returned="ADD.GIF" [0095.845] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0095.845] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x1ea, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x1ea, lpOverlapped=0x0) returned 1 [0095.845] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0095.845] CloseHandle (hObject=0x98) returned 1 [0095.845] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ADD.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\add.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ADD.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\add.gif. ")) returned 1 [0095.846] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0095.846] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0095.846] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="AddToViewArrow.jpg") returned 1 [0095.846] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AddToViewArrow.jpg") returned 1 [0095.846] lstrcmpiA (lpString1="", lpString2="AddToViewArrow.jpg") returned -1 [0095.846] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ADD.GIF") returned="ADD.GIF" [0095.846] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="AddToViewArrow.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrow.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrow.jpg" [0095.846] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrow.jpg", pszSpec="*.zip") returned 0 [0095.846] lstrlenA (lpString="*.zip") returned 5 [0095.846] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrow.jpg", pszSpec="*.rar") returned 0 [0095.846] lstrlenA (lpString="*.rar") returned 5 [0095.846] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrow.jpg", pszSpec="*.7z") returned 0 [0095.846] lstrlenA (lpString="*.7z") returned 4 [0095.846] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrow.jpg", pszSpec="*.tar") returned 0 [0095.847] lstrlenA (lpString="*.tar") returned 5 [0095.847] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrow.jpg", pszSpec="*.gzip") returned 0 [0095.847] lstrlenA (lpString="*.gzip") returned 6 [0095.847] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrow.jpg", pszSpec="*.jpg") returned 1 [0095.847] lstrlenA (lpString="*.jpg") returned 5 [0095.847] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrow.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrow.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrow.jpg" [0095.847] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrow.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrow.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrow.jpg" [0095.847] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrow.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrow.jpg.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrow.jpg." [0095.847] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrow.jpg.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrow.jpg. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrow.jpg. " [0095.847] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrow.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\addtoviewarrow.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0095.847] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xbe8 [0095.847] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x991bbe00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5127f1f0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x991bbe00, dwHighDateTime=0x1c747ea)) returned 1 [0095.847] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0095.847] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0xb8e, lpOverlapped=0x0) returned 1 [0095.870] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrow.jpg") returned="AddToViewArrow.jpg" [0095.870] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0095.870] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0xb8e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0xb8e, lpOverlapped=0x0) returned 1 [0095.870] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0095.871] CloseHandle (hObject=0x98) returned 1 [0095.871] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrow.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\addtoviewarrow.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrow.jpg. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\addtoviewarrow.jpg. ")) returned 1 [0095.871] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0095.871] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0095.871] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="AddToViewArrowMask.bmp") returned 1 [0095.871] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AddToViewArrowMask.bmp") returned 1 [0095.871] lstrcmpiA (lpString1="", lpString2="AddToViewArrowMask.bmp") returned -1 [0095.871] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrow.jpg") returned="AddToViewArrow.jpg" [0095.872] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="AddToViewArrowMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrowMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrowMask.bmp" [0095.872] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrowMask.bmp", pszSpec="*.zip") returned 0 [0095.872] lstrlenA (lpString="*.zip") returned 5 [0095.872] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrowMask.bmp", pszSpec="*.rar") returned 0 [0095.872] lstrlenA (lpString="*.rar") returned 5 [0095.872] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrowMask.bmp", pszSpec="*.7z") returned 0 [0095.872] lstrlenA (lpString="*.7z") returned 4 [0095.872] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrowMask.bmp", pszSpec="*.tar") returned 0 [0095.872] lstrlenA (lpString="*.tar") returned 5 [0095.872] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrowMask.bmp", pszSpec="*.gzip") returned 0 [0095.872] lstrlenA (lpString="*.gzip") returned 6 [0095.872] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrowMask.bmp", pszSpec="*.jpg") returned 0 [0095.872] lstrlenA (lpString="*.jpg") returned 5 [0095.872] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrowMask.bmp", pszSpec="*.jpeg") returned 0 [0095.872] lstrlenA (lpString="*.jpeg") returned 6 [0095.872] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrowMask.bmp", pszSpec="*.psd") returned 0 [0095.872] lstrlenA (lpString="*.psd") returned 5 [0095.872] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrowMask.bmp", pszSpec="*.cdr") returned 0 [0095.872] lstrlenA (lpString="*.cdr") returned 5 [0095.872] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrowMask.bmp", pszSpec="*.dwg") returned 0 [0095.872] lstrlenA (lpString="*.dwg") returned 5 [0095.872] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrowMask.bmp", pszSpec="*.max") returned 0 [0095.872] lstrlenA (lpString="*.max") returned 5 [0095.872] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrowMask.bmp", pszSpec="*.bmp") returned 1 [0095.872] lstrlenA (lpString="*.bmp") returned 5 [0095.872] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrowMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrowMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrowMask.bmp" [0095.872] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrowMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrowMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrowMask.bmp" [0095.872] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrowMask.bmp", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrowMask.bmp.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrowMask.bmp." [0095.872] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrowMask.bmp.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrowMask.bmp. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrowMask.bmp. " [0095.872] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrowMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\addtoviewarrowmask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0095.873] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x924 [0095.873] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x991bbe00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5eaf6290, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x991bbe00, dwHighDateTime=0x1c747ea)) returned 1 [0095.873] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0095.873] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x8ca, lpOverlapped=0x0) returned 1 [0095.899] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrowMask.bmp") returned="AddToViewArrowMask.bmp" [0095.900] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0095.900] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x8ca, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x8ca, lpOverlapped=0x0) returned 1 [0095.900] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0095.900] CloseHandle (hObject=0x98) returned 1 [0095.900] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrowMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\addtoviewarrowmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrowMask.bmp. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\addtoviewarrowmask.bmp. ")) returned 1 [0095.901] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0095.902] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0095.902] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="attention.gif") returned 1 [0095.902] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="attention.gif") returned 1 [0095.902] lstrcmpiA (lpString1="", lpString2="attention.gif") returned -1 [0095.902] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrowMask.bmp") returned="AddToViewArrowMask.bmp" [0095.902] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="attention.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\attention.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\attention.gif" [0095.902] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\attention.gif", pszSpec="*.zip") returned 0 [0095.902] lstrlenA (lpString="*.zip") returned 5 [0095.902] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\attention.gif", pszSpec="*.rar") returned 0 [0095.902] lstrlenA (lpString="*.rar") returned 5 [0095.902] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\attention.gif", pszSpec="*.7z") returned 0 [0095.902] lstrlenA (lpString="*.7z") returned 4 [0095.902] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\attention.gif", pszSpec="*.tar") returned 0 [0095.902] lstrlenA (lpString="*.tar") returned 5 [0095.902] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\attention.gif", pszSpec="*.gzip") returned 0 [0095.902] lstrlenA (lpString="*.gzip") returned 6 [0095.902] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\attention.gif", pszSpec="*.jpg") returned 0 [0095.902] lstrlenA (lpString="*.jpg") returned 5 [0095.902] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\attention.gif", pszSpec="*.jpeg") returned 0 [0095.902] lstrlenA (lpString="*.jpeg") returned 6 [0095.902] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\attention.gif", pszSpec="*.psd") returned 0 [0095.902] lstrlenA (lpString="*.psd") returned 5 [0095.902] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\attention.gif", pszSpec="*.cdr") returned 0 [0095.902] lstrlenA (lpString="*.cdr") returned 5 [0095.902] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\attention.gif", pszSpec="*.dwg") returned 0 [0095.902] lstrlenA (lpString="*.dwg") returned 5 [0095.902] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\attention.gif", pszSpec="*.max") returned 0 [0095.902] lstrlenA (lpString="*.max") returned 5 [0095.902] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\attention.gif", pszSpec="*.bmp") returned 0 [0095.903] lstrlenA (lpString="*.bmp") returned 5 [0095.903] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\attention.gif", pszSpec="*.gif") returned 1 [0095.903] lstrlenA (lpString="*.gif") returned 5 [0095.903] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\attention.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\attention.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\attention.gif" [0095.903] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\attention.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\attention.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\attention.gif" [0095.903] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\attention.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\attention.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\attention.gif." [0095.903] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\attention.gif.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\attention.gif. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\attention.gif. " [0095.903] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\attention.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\attention.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0095.903] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xae8 [0095.903] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x991bbe00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x51767f50, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x991bbe00, dwHighDateTime=0x1c747ea)) returned 1 [0095.903] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0095.904] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0xa8e, lpOverlapped=0x0) returned 1 [0095.936] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\attention.gif") returned="attention.gif" [0095.936] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0095.936] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0xa8e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0xa8e, lpOverlapped=0x0) returned 1 [0095.936] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0095.936] CloseHandle (hObject=0x98) returned 1 [0095.936] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\attention.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\attention.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\attention.gif. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\attention.gif. ")) returned 1 [0095.937] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0095.937] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0095.937] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BG_ADOBE.GIF") returned 1 [0095.937] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BG_ADOBE.GIF") returned 1 [0095.937] lstrcmpiA (lpString1="", lpString2="BG_ADOBE.GIF") returned -1 [0095.937] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\attention.gif") returned="attention.gif" [0095.937] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="BG_ADOBE.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\BG_ADOBE.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\BG_ADOBE.GIF" [0095.937] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\BG_ADOBE.GIF", pszSpec="*.zip") returned 0 [0095.937] lstrlenA (lpString="*.zip") returned 5 [0095.937] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\BG_ADOBE.GIF", pszSpec="*.rar") returned 0 [0095.937] lstrlenA (lpString="*.rar") returned 5 [0095.937] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\BG_ADOBE.GIF", pszSpec="*.7z") returned 0 [0095.937] lstrlenA (lpString="*.7z") returned 4 [0095.937] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\BG_ADOBE.GIF", pszSpec="*.tar") returned 0 [0095.937] lstrlenA (lpString="*.tar") returned 5 [0095.938] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\BG_ADOBE.GIF", pszSpec="*.gzip") returned 0 [0095.938] lstrlenA (lpString="*.gzip") returned 6 [0095.938] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\BG_ADOBE.GIF", pszSpec="*.jpg") returned 0 [0095.938] lstrlenA (lpString="*.jpg") returned 5 [0095.938] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\BG_ADOBE.GIF", pszSpec="*.jpeg") returned 0 [0095.938] lstrlenA (lpString="*.jpeg") returned 6 [0095.938] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\BG_ADOBE.GIF", pszSpec="*.psd") returned 0 [0095.938] lstrlenA (lpString="*.psd") returned 5 [0095.938] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\BG_ADOBE.GIF", pszSpec="*.cdr") returned 0 [0095.938] lstrlenA (lpString="*.cdr") returned 5 [0095.938] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\BG_ADOBE.GIF", pszSpec="*.dwg") returned 0 [0095.938] lstrlenA (lpString="*.dwg") returned 5 [0095.938] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\BG_ADOBE.GIF", pszSpec="*.max") returned 0 [0095.938] lstrlenA (lpString="*.max") returned 5 [0095.938] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\BG_ADOBE.GIF", pszSpec="*.bmp") returned 0 [0095.938] lstrlenA (lpString="*.bmp") returned 5 [0095.938] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\BG_ADOBE.GIF", pszSpec="*.gif") returned 1 [0095.938] lstrlenA (lpString="*.gif") returned 5 [0095.938] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\BG_ADOBE.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\BG_ADOBE.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\BG_ADOBE.GIF" [0095.938] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\BG_ADOBE.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\BG_ADOBE.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\BG_ADOBE.GIF" [0095.938] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\BG_ADOBE.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\BG_ADOBE.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\BG_ADOBE.GIF." [0095.938] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\BG_ADOBE.GIF.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\BG_ADOBE.GIF. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\BG_ADOBE.GIF. " [0095.938] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\BG_ADOBE.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_adobe.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0095.938] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x614e [0095.938] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x991bbe00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5f61e9b0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x991bbe00, dwHighDateTime=0x1c747ea)) returned 1 [0095.939] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0095.939] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x60f4, lpOverlapped=0x0) returned 1 [0095.966] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\BG_ADOBE.GIF") returned="BG_ADOBE.GIF" [0095.966] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0095.966] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x60f4, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x60f4, lpOverlapped=0x0) returned 1 [0095.966] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0095.966] CloseHandle (hObject=0x98) returned 1 [0095.966] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\BG_ADOBE.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_adobe.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\BG_ADOBE.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_adobe.gif. ")) returned 1 [0095.967] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0095.967] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0095.967] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="bg_Casual.gif") returned 1 [0095.967] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bg_Casual.gif") returned 1 [0095.967] lstrcmpiA (lpString1="", lpString2="bg_Casual.gif") returned -1 [0095.967] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\BG_ADOBE.GIF") returned="BG_ADOBE.GIF" [0095.967] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="bg_Casual.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Casual.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Casual.gif" [0095.967] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Casual.gif", pszSpec="*.zip") returned 0 [0095.967] lstrlenA (lpString="*.zip") returned 5 [0095.967] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Casual.gif", pszSpec="*.rar") returned 0 [0095.967] lstrlenA (lpString="*.rar") returned 5 [0095.967] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Casual.gif", pszSpec="*.7z") returned 0 [0095.967] lstrlenA (lpString="*.7z") returned 4 [0095.967] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Casual.gif", pszSpec="*.tar") returned 0 [0095.967] lstrlenA (lpString="*.tar") returned 5 [0095.967] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Casual.gif", pszSpec="*.gzip") returned 0 [0095.967] lstrlenA (lpString="*.gzip") returned 6 [0095.967] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Casual.gif", pszSpec="*.jpg") returned 0 [0095.967] lstrlenA (lpString="*.jpg") returned 5 [0095.967] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Casual.gif", pszSpec="*.jpeg") returned 0 [0095.967] lstrlenA (lpString="*.jpeg") returned 6 [0095.967] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Casual.gif", pszSpec="*.psd") returned 0 [0095.967] lstrlenA (lpString="*.psd") returned 5 [0095.968] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Casual.gif", pszSpec="*.cdr") returned 0 [0095.968] lstrlenA (lpString="*.cdr") returned 5 [0095.968] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Casual.gif", pszSpec="*.dwg") returned 0 [0095.968] lstrlenA (lpString="*.dwg") returned 5 [0095.968] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Casual.gif", pszSpec="*.max") returned 0 [0095.968] lstrlenA (lpString="*.max") returned 5 [0095.968] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Casual.gif", pszSpec="*.bmp") returned 0 [0095.968] lstrlenA (lpString="*.bmp") returned 5 [0095.968] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Casual.gif", pszSpec="*.gif") returned 1 [0095.968] lstrlenA (lpString="*.gif") returned 5 [0095.968] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Casual.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Casual.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Casual.gif" [0095.968] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Casual.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Casual.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Casual.gif" [0095.968] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Casual.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Casual.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Casual.gif." [0095.968] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Casual.gif.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Casual.gif. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Casual.gif. " [0095.968] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Casual.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_casual.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0095.970] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x161d [0095.970] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x991bbe00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5197d290, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x991bbe00, dwHighDateTime=0x1c747ea)) returned 1 [0095.970] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0095.970] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x15c3, lpOverlapped=0x0) returned 1 [0095.980] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Casual.gif") returned="bg_Casual.gif" [0095.980] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0095.980] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x15c3, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x15c3, lpOverlapped=0x0) returned 1 [0095.986] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0095.986] CloseHandle (hObject=0x98) returned 1 [0095.986] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Casual.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_casual.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Casual.gif. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_casual.gif. ")) returned 1 [0095.987] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0095.987] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0095.987] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="bg_Country.gif") returned 1 [0095.987] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bg_Country.gif") returned 1 [0095.987] lstrcmpiA (lpString1="", lpString2="bg_Country.gif") returned -1 [0095.987] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Casual.gif") returned="bg_Casual.gif" [0095.987] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="bg_Country.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Country.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Country.gif" [0095.987] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Country.gif", pszSpec="*.zip") returned 0 [0095.987] lstrlenA (lpString="*.zip") returned 5 [0095.987] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Country.gif", pszSpec="*.rar") returned 0 [0095.987] lstrlenA (lpString="*.rar") returned 5 [0095.987] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Country.gif", pszSpec="*.7z") returned 0 [0095.987] lstrlenA (lpString="*.7z") returned 4 [0095.987] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Country.gif", pszSpec="*.tar") returned 0 [0095.987] lstrlenA (lpString="*.tar") returned 5 [0095.987] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Country.gif", pszSpec="*.gzip") returned 0 [0095.987] lstrlenA (lpString="*.gzip") returned 6 [0095.987] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Country.gif", pszSpec="*.jpg") returned 0 [0095.987] lstrlenA (lpString="*.jpg") returned 5 [0095.987] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Country.gif", pszSpec="*.jpeg") returned 0 [0095.987] lstrlenA (lpString="*.jpeg") returned 6 [0095.987] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Country.gif", pszSpec="*.psd") returned 0 [0095.987] lstrlenA (lpString="*.psd") returned 5 [0095.987] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Country.gif", pszSpec="*.cdr") returned 0 [0095.987] lstrlenA (lpString="*.cdr") returned 5 [0095.987] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Country.gif", pszSpec="*.dwg") returned 0 [0095.987] lstrlenA (lpString="*.dwg") returned 5 [0095.987] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Country.gif", pszSpec="*.max") returned 0 [0095.987] lstrlenA (lpString="*.max") returned 5 [0095.987] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Country.gif", pszSpec="*.bmp") returned 0 [0095.988] lstrlenA (lpString="*.bmp") returned 5 [0095.988] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Country.gif", pszSpec="*.gif") returned 1 [0095.988] lstrlenA (lpString="*.gif") returned 5 [0095.988] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Country.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Country.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Country.gif" [0095.988] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Country.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Country.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Country.gif" [0095.988] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Country.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Country.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Country.gif." [0095.988] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Country.gif.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Country.gif. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Country.gif. " [0095.988] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Country.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_country.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0095.988] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x7dd3 [0095.988] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x991bbe00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x519a33f0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x991bbe00, dwHighDateTime=0x1c747ea)) returned 1 [0095.988] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0095.988] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x7d79, lpOverlapped=0x0) returned 1 [0096.024] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Country.gif") returned="bg_Country.gif" [0096.024] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0096.024] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x7d79, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x7d79, lpOverlapped=0x0) returned 1 [0096.024] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0096.024] CloseHandle (hObject=0x98) returned 1 [0096.024] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Country.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_country.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Country.gif. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_country.gif. ")) returned 1 [0096.025] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0096.025] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0096.025] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="bg_Earthy.gif") returned 1 [0096.025] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bg_Earthy.gif") returned 1 [0096.025] lstrcmpiA (lpString1="", lpString2="bg_Earthy.gif") returned -1 [0096.025] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Country.gif") returned="bg_Country.gif" [0096.025] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="bg_Earthy.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Earthy.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Earthy.gif" [0096.025] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Earthy.gif", pszSpec="*.zip") returned 0 [0096.025] lstrlenA (lpString="*.zip") returned 5 [0096.025] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Earthy.gif", pszSpec="*.rar") returned 0 [0096.025] lstrlenA (lpString="*.rar") returned 5 [0096.025] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Earthy.gif", pszSpec="*.7z") returned 0 [0096.025] lstrlenA (lpString="*.7z") returned 4 [0096.025] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Earthy.gif", pszSpec="*.tar") returned 0 [0096.025] lstrlenA (lpString="*.tar") returned 5 [0096.025] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Earthy.gif", pszSpec="*.gzip") returned 0 [0096.025] lstrlenA (lpString="*.gzip") returned 6 [0096.025] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Earthy.gif", pszSpec="*.jpg") returned 0 [0096.025] lstrlenA (lpString="*.jpg") returned 5 [0096.025] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Earthy.gif", pszSpec="*.jpeg") returned 0 [0096.025] lstrlenA (lpString="*.jpeg") returned 6 [0096.025] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Earthy.gif", pszSpec="*.psd") returned 0 [0096.025] lstrlenA (lpString="*.psd") returned 5 [0096.025] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Earthy.gif", pszSpec="*.cdr") returned 0 [0096.025] lstrlenA (lpString="*.cdr") returned 5 [0096.025] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Earthy.gif", pszSpec="*.dwg") returned 0 [0096.025] lstrlenA (lpString="*.dwg") returned 5 [0096.026] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Earthy.gif", pszSpec="*.max") returned 0 [0096.026] lstrlenA (lpString="*.max") returned 5 [0096.026] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Earthy.gif", pszSpec="*.bmp") returned 0 [0096.026] lstrlenA (lpString="*.bmp") returned 5 [0096.026] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Earthy.gif", pszSpec="*.gif") returned 1 [0096.026] lstrlenA (lpString="*.gif") returned 5 [0096.026] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Earthy.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Earthy.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Earthy.gif" [0096.026] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Earthy.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Earthy.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Earthy.gif" [0096.026] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Earthy.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Earthy.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Earthy.gif." [0096.026] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Earthy.gif.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Earthy.gif. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Earthy.gif. " [0096.026] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Earthy.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_earthy.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0096.026] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x132a [0096.026] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9a4ceb00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x519a33f0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9a4ceb00, dwHighDateTime=0x1c747ea)) returned 1 [0096.026] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0096.026] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x12d0, lpOverlapped=0x0) returned 1 [0096.069] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Earthy.gif") returned="bg_Earthy.gif" [0096.069] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0096.069] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x12d0, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x12d0, lpOverlapped=0x0) returned 1 [0096.070] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0096.070] CloseHandle (hObject=0x98) returned 1 [0096.070] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Earthy.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_earthy.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Earthy.gif. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_earthy.gif. ")) returned 1 [0096.070] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0096.071] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0096.071] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="bg_FormsHomePage.gif") returned 1 [0096.071] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bg_FormsHomePage.gif") returned 1 [0096.071] lstrcmpiA (lpString1="", lpString2="bg_FormsHomePage.gif") returned -1 [0096.071] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Earthy.gif") returned="bg_Earthy.gif" [0096.071] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="bg_FormsHomePage.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePage.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePage.gif" [0096.071] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePage.gif", pszSpec="*.zip") returned 0 [0096.071] lstrlenA (lpString="*.zip") returned 5 [0096.071] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePage.gif", pszSpec="*.rar") returned 0 [0096.071] lstrlenA (lpString="*.rar") returned 5 [0096.071] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePage.gif", pszSpec="*.7z") returned 0 [0096.071] lstrlenA (lpString="*.7z") returned 4 [0096.071] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePage.gif", pszSpec="*.tar") returned 0 [0096.071] lstrlenA (lpString="*.tar") returned 5 [0096.071] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePage.gif", pszSpec="*.gzip") returned 0 [0096.071] lstrlenA (lpString="*.gzip") returned 6 [0096.071] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePage.gif", pszSpec="*.jpg") returned 0 [0096.071] lstrlenA (lpString="*.jpg") returned 5 [0096.071] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePage.gif", pszSpec="*.jpeg") returned 0 [0096.071] lstrlenA (lpString="*.jpeg") returned 6 [0096.071] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePage.gif", pszSpec="*.psd") returned 0 [0096.071] lstrlenA (lpString="*.psd") returned 5 [0096.071] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePage.gif", pszSpec="*.cdr") returned 0 [0096.071] lstrlenA (lpString="*.cdr") returned 5 [0096.071] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePage.gif", pszSpec="*.dwg") returned 0 [0096.071] lstrlenA (lpString="*.dwg") returned 5 [0096.071] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePage.gif", pszSpec="*.max") returned 0 [0096.071] lstrlenA (lpString="*.max") returned 5 [0096.071] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePage.gif", pszSpec="*.bmp") returned 0 [0096.071] lstrlenA (lpString="*.bmp") returned 5 [0096.071] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePage.gif", pszSpec="*.gif") returned 1 [0096.071] lstrlenA (lpString="*.gif") returned 5 [0096.071] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePage.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePage.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePage.gif" [0096.071] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePage.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePage.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePage.gif" [0096.071] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePage.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePage.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePage.gif." [0096.071] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePage.gif.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePage.gif. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePage.gif. " [0096.071] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePage.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_formshomepage.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0096.072] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x167bd [0096.072] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9a4ceb00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5f644b10, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9a4ceb00, dwHighDateTime=0x1c747ea)) returned 1 [0096.072] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0096.072] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x16763, lpOverlapped=0x0) returned 1 [0096.086] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePage.gif") returned="bg_FormsHomePage.gif" [0096.087] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0096.087] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x16763, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x16763, lpOverlapped=0x0) returned 1 [0096.087] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0096.087] CloseHandle (hObject=0x98) returned 1 [0096.087] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePage.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_formshomepage.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePage.gif. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_formshomepage.gif. ")) returned 1 [0096.088] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0096.088] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0096.088] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="bg_FormsHomePageBlank.gif") returned 1 [0096.088] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bg_FormsHomePageBlank.gif") returned 1 [0096.088] lstrcmpiA (lpString1="", lpString2="bg_FormsHomePageBlank.gif") returned -1 [0096.088] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePage.gif") returned="bg_FormsHomePage.gif" [0096.088] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="bg_FormsHomePageBlank.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageBlank.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageBlank.gif" [0096.088] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageBlank.gif", pszSpec="*.zip") returned 0 [0096.088] lstrlenA (lpString="*.zip") returned 5 [0096.088] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageBlank.gif", pszSpec="*.rar") returned 0 [0096.088] lstrlenA (lpString="*.rar") returned 5 [0096.088] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageBlank.gif", pszSpec="*.7z") returned 0 [0096.088] lstrlenA (lpString="*.7z") returned 4 [0096.088] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageBlank.gif", pszSpec="*.tar") returned 0 [0096.088] lstrlenA (lpString="*.tar") returned 5 [0096.088] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageBlank.gif", pszSpec="*.gzip") returned 0 [0096.088] lstrlenA (lpString="*.gzip") returned 6 [0096.088] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageBlank.gif", pszSpec="*.jpg") returned 0 [0096.088] lstrlenA (lpString="*.jpg") returned 5 [0096.088] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageBlank.gif", pszSpec="*.jpeg") returned 0 [0096.088] lstrlenA (lpString="*.jpeg") returned 6 [0096.088] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageBlank.gif", pszSpec="*.psd") returned 0 [0096.088] lstrlenA (lpString="*.psd") returned 5 [0096.088] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageBlank.gif", pszSpec="*.cdr") returned 0 [0096.088] lstrlenA (lpString="*.cdr") returned 5 [0096.088] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageBlank.gif", pszSpec="*.dwg") returned 0 [0096.088] lstrlenA (lpString="*.dwg") returned 5 [0096.088] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageBlank.gif", pszSpec="*.max") returned 0 [0096.088] lstrlenA (lpString="*.max") returned 5 [0096.088] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageBlank.gif", pszSpec="*.bmp") returned 0 [0096.088] lstrlenA (lpString="*.bmp") returned 5 [0096.088] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageBlank.gif", pszSpec="*.gif") returned 1 [0096.088] lstrlenA (lpString="*.gif") returned 5 [0096.089] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageBlank.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageBlank.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageBlank.gif" [0096.089] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageBlank.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageBlank.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageBlank.gif" [0096.089] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageBlank.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageBlank.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageBlank.gif." [0096.089] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageBlank.gif.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageBlank.gif. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageBlank.gif. " [0096.089] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageBlank.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_formshomepageblank.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0096.089] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4ebb [0096.089] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9a4ceb00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5f644b10, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9a4ceb00, dwHighDateTime=0x1c747ea)) returned 1 [0096.089] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0096.089] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x4e61, lpOverlapped=0x0) returned 1 [0096.090] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageBlank.gif") returned="bg_FormsHomePageBlank.gif" [0096.090] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0096.091] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x4e61, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x4e61, lpOverlapped=0x0) returned 1 [0096.091] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0096.091] CloseHandle (hObject=0x98) returned 1 [0096.091] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageBlank.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_formshomepageblank.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageBlank.gif. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_formshomepageblank.gif. ")) returned 1 [0096.091] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0096.091] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0096.091] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="bg_FormsHomePageSlice.gif") returned 1 [0096.091] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bg_FormsHomePageSlice.gif") returned 1 [0096.091] lstrcmpiA (lpString1="", lpString2="bg_FormsHomePageSlice.gif") returned -1 [0096.091] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageBlank.gif") returned="bg_FormsHomePageBlank.gif" [0096.091] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="bg_FormsHomePageSlice.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageSlice.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageSlice.gif" [0096.092] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageSlice.gif", pszSpec="*.zip") returned 0 [0096.092] lstrlenA (lpString="*.zip") returned 5 [0096.092] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageSlice.gif", pszSpec="*.rar") returned 0 [0096.092] lstrlenA (lpString="*.rar") returned 5 [0096.092] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageSlice.gif", pszSpec="*.7z") returned 0 [0096.092] lstrlenA (lpString="*.7z") returned 4 [0096.092] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageSlice.gif", pszSpec="*.tar") returned 0 [0096.092] lstrlenA (lpString="*.tar") returned 5 [0096.092] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageSlice.gif", pszSpec="*.gzip") returned 0 [0096.092] lstrlenA (lpString="*.gzip") returned 6 [0096.092] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageSlice.gif", pszSpec="*.jpg") returned 0 [0096.092] lstrlenA (lpString="*.jpg") returned 5 [0096.092] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageSlice.gif", pszSpec="*.jpeg") returned 0 [0096.092] lstrlenA (lpString="*.jpeg") returned 6 [0096.092] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageSlice.gif", pszSpec="*.psd") returned 0 [0096.092] lstrlenA (lpString="*.psd") returned 5 [0096.092] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageSlice.gif", pszSpec="*.cdr") returned 0 [0096.092] lstrlenA (lpString="*.cdr") returned 5 [0096.092] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageSlice.gif", pszSpec="*.dwg") returned 0 [0096.092] lstrlenA (lpString="*.dwg") returned 5 [0096.092] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageSlice.gif", pszSpec="*.max") returned 0 [0096.092] lstrlenA (lpString="*.max") returned 5 [0096.092] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageSlice.gif", pszSpec="*.bmp") returned 0 [0096.092] lstrlenA (lpString="*.bmp") returned 5 [0096.092] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageSlice.gif", pszSpec="*.gif") returned 1 [0096.092] lstrlenA (lpString="*.gif") returned 5 [0096.092] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageSlice.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageSlice.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageSlice.gif" [0096.092] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageSlice.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageSlice.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageSlice.gif" [0096.092] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageSlice.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageSlice.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageSlice.gif." [0096.092] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageSlice.gif.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageSlice.gif. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageSlice.gif. " [0096.092] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageSlice.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_formshomepageslice.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0096.092] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x40f [0096.092] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9a4ceb00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5f644b10, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9a4ceb00, dwHighDateTime=0x1c747ea)) returned 1 [0096.092] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0096.092] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x3b5, lpOverlapped=0x0) returned 1 [0096.093] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageSlice.gif") returned="bg_FormsHomePageSlice.gif" [0096.093] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0096.094] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x3b5, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x3b5, lpOverlapped=0x0) returned 1 [0096.094] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0096.094] CloseHandle (hObject=0x98) returned 1 [0096.094] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageSlice.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_formshomepageslice.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageSlice.gif. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_formshomepageslice.gif. ")) returned 1 [0096.094] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0096.094] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0096.094] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="bg_GreenTea.gif") returned 1 [0096.094] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bg_GreenTea.gif") returned 1 [0096.094] lstrcmpiA (lpString1="", lpString2="bg_GreenTea.gif") returned -1 [0096.094] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageSlice.gif") returned="bg_FormsHomePageSlice.gif" [0096.094] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="bg_GreenTea.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_GreenTea.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_GreenTea.gif" [0096.094] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_GreenTea.gif", pszSpec="*.zip") returned 0 [0096.094] lstrlenA (lpString="*.zip") returned 5 [0096.094] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_GreenTea.gif", pszSpec="*.rar") returned 0 [0096.094] lstrlenA (lpString="*.rar") returned 5 [0096.094] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_GreenTea.gif", pszSpec="*.7z") returned 0 [0096.094] lstrlenA (lpString="*.7z") returned 4 [0096.094] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_GreenTea.gif", pszSpec="*.tar") returned 0 [0096.094] lstrlenA (lpString="*.tar") returned 5 [0096.094] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_GreenTea.gif", pszSpec="*.gzip") returned 0 [0096.094] lstrlenA (lpString="*.gzip") returned 6 [0096.094] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_GreenTea.gif", pszSpec="*.jpg") returned 0 [0096.095] lstrlenA (lpString="*.jpg") returned 5 [0096.095] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_GreenTea.gif", pszSpec="*.jpeg") returned 0 [0096.095] lstrlenA (lpString="*.jpeg") returned 6 [0096.095] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_GreenTea.gif", pszSpec="*.psd") returned 0 [0096.095] lstrlenA (lpString="*.psd") returned 5 [0096.095] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_GreenTea.gif", pszSpec="*.cdr") returned 0 [0096.095] lstrlenA (lpString="*.cdr") returned 5 [0096.095] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_GreenTea.gif", pszSpec="*.dwg") returned 0 [0096.095] lstrlenA (lpString="*.dwg") returned 5 [0096.095] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_GreenTea.gif", pszSpec="*.max") returned 0 [0096.095] lstrlenA (lpString="*.max") returned 5 [0096.095] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_GreenTea.gif", pszSpec="*.bmp") returned 0 [0096.095] lstrlenA (lpString="*.bmp") returned 5 [0096.095] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_GreenTea.gif", pszSpec="*.gif") returned 1 [0096.095] lstrlenA (lpString="*.gif") returned 5 [0096.095] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_GreenTea.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_GreenTea.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_GreenTea.gif" [0096.095] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_GreenTea.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_GreenTea.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_GreenTea.gif" [0096.095] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_GreenTea.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_GreenTea.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_GreenTea.gif." [0096.095] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_GreenTea.gif.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_GreenTea.gif. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_GreenTea.gif. " [0096.095] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_GreenTea.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_greentea.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0096.095] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x5690 [0096.095] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9a4ceb00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5f644b10, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9a4ceb00, dwHighDateTime=0x1c747ea)) returned 1 [0096.095] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0096.095] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x5636, lpOverlapped=0x0) returned 1 [0096.096] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_GreenTea.gif") returned="bg_GreenTea.gif" [0096.096] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0096.096] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x5636, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x5636, lpOverlapped=0x0) returned 1 [0096.096] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0096.097] CloseHandle (hObject=0x98) returned 1 [0096.097] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_GreenTea.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_greentea.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_GreenTea.gif. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_greentea.gif. ")) returned 1 [0096.097] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0096.097] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0096.097] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="bg_Groove.gif") returned 1 [0096.097] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bg_Groove.gif") returned 1 [0096.097] lstrcmpiA (lpString1="", lpString2="bg_Groove.gif") returned -1 [0096.097] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_GreenTea.gif") returned="bg_GreenTea.gif" [0096.097] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="bg_Groove.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Groove.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Groove.gif" [0096.097] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Groove.gif", pszSpec="*.zip") returned 0 [0096.097] lstrlenA (lpString="*.zip") returned 5 [0096.097] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Groove.gif", pszSpec="*.rar") returned 0 [0096.097] lstrlenA (lpString="*.rar") returned 5 [0096.097] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Groove.gif", pszSpec="*.7z") returned 0 [0096.097] lstrlenA (lpString="*.7z") returned 4 [0096.097] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Groove.gif", pszSpec="*.tar") returned 0 [0096.097] lstrlenA (lpString="*.tar") returned 5 [0096.097] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Groove.gif", pszSpec="*.gzip") returned 0 [0096.097] lstrlenA (lpString="*.gzip") returned 6 [0096.097] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Groove.gif", pszSpec="*.jpg") returned 0 [0096.097] lstrlenA (lpString="*.jpg") returned 5 [0096.097] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Groove.gif", pszSpec="*.jpeg") returned 0 [0096.097] lstrlenA (lpString="*.jpeg") returned 6 [0096.097] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Groove.gif", pszSpec="*.psd") returned 0 [0096.097] lstrlenA (lpString="*.psd") returned 5 [0096.098] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Groove.gif", pszSpec="*.cdr") returned 0 [0096.098] lstrlenA (lpString="*.cdr") returned 5 [0096.098] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Groove.gif", pszSpec="*.dwg") returned 0 [0096.098] lstrlenA (lpString="*.dwg") returned 5 [0096.098] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Groove.gif", pszSpec="*.max") returned 0 [0096.098] lstrlenA (lpString="*.max") returned 5 [0096.098] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Groove.gif", pszSpec="*.bmp") returned 0 [0096.098] lstrlenA (lpString="*.bmp") returned 5 [0096.098] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Groove.gif", pszSpec="*.gif") returned 1 [0096.098] lstrlenA (lpString="*.gif") returned 5 [0096.098] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Groove.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Groove.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Groove.gif" [0096.098] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Groove.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Groove.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Groove.gif" [0096.098] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Groove.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Groove.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Groove.gif." [0096.098] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Groove.gif.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Groove.gif. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Groove.gif. " [0096.098] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Groove.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_groove.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0096.098] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x6a [0096.098] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9a4ceb00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x519a33f0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9a4ceb00, dwHighDateTime=0x1c747ea)) returned 1 [0096.098] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0096.098] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x10, lpOverlapped=0x0) returned 1 [0096.099] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Groove.gif") returned="bg_Groove.gif" [0096.099] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0096.099] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x10, lpOverlapped=0x0) returned 1 [0096.099] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0096.099] CloseHandle (hObject=0x98) returned 1 [0096.099] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Groove.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_groove.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Groove.gif. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_groove.gif. ")) returned 1 [0096.100] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0096.100] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0096.100] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="bg_LightSpirit.gif") returned 1 [0096.100] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bg_LightSpirit.gif") returned 1 [0096.100] lstrcmpiA (lpString1="", lpString2="bg_LightSpirit.gif") returned -1 [0096.100] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Groove.gif") returned="bg_Groove.gif" [0096.100] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="bg_LightSpirit.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_LightSpirit.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_LightSpirit.gif" [0096.100] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_LightSpirit.gif", pszSpec="*.zip") returned 0 [0096.100] lstrlenA (lpString="*.zip") returned 5 [0096.100] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_LightSpirit.gif", pszSpec="*.rar") returned 0 [0096.100] lstrlenA (lpString="*.rar") returned 5 [0096.100] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_LightSpirit.gif", pszSpec="*.7z") returned 0 [0096.100] lstrlenA (lpString="*.7z") returned 4 [0096.100] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_LightSpirit.gif", pszSpec="*.tar") returned 0 [0096.100] lstrlenA (lpString="*.tar") returned 5 [0096.100] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_LightSpirit.gif", pszSpec="*.gzip") returned 0 [0096.100] lstrlenA (lpString="*.gzip") returned 6 [0096.100] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_LightSpirit.gif", pszSpec="*.jpg") returned 0 [0096.100] lstrlenA (lpString="*.jpg") returned 5 [0096.100] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_LightSpirit.gif", pszSpec="*.jpeg") returned 0 [0096.100] lstrlenA (lpString="*.jpeg") returned 6 [0096.100] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_LightSpirit.gif", pszSpec="*.psd") returned 0 [0096.100] lstrlenA (lpString="*.psd") returned 5 [0096.100] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_LightSpirit.gif", pszSpec="*.cdr") returned 0 [0096.100] lstrlenA (lpString="*.cdr") returned 5 [0096.100] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_LightSpirit.gif", pszSpec="*.dwg") returned 0 [0096.100] lstrlenA (lpString="*.dwg") returned 5 [0096.100] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_LightSpirit.gif", pszSpec="*.max") returned 0 [0096.100] lstrlenA (lpString="*.max") returned 5 [0096.100] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_LightSpirit.gif", pszSpec="*.bmp") returned 0 [0096.100] lstrlenA (lpString="*.bmp") returned 5 [0096.100] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_LightSpirit.gif", pszSpec="*.gif") returned 1 [0096.101] lstrlenA (lpString="*.gif") returned 5 [0096.101] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_LightSpirit.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_LightSpirit.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_LightSpirit.gif" [0096.101] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_LightSpirit.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_LightSpirit.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_LightSpirit.gif" [0096.101] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_LightSpirit.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_LightSpirit.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_LightSpirit.gif." [0096.101] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_LightSpirit.gif.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_LightSpirit.gif. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_LightSpirit.gif. " [0096.101] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_LightSpirit.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_lightspirit.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0096.101] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x21a6 [0096.101] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9a4ceb00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x519a33f0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9a4ceb00, dwHighDateTime=0x1c747ea)) returned 1 [0096.101] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0096.101] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x214c, lpOverlapped=0x0) returned 1 [0096.107] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_LightSpirit.gif") returned="bg_LightSpirit.gif" [0096.107] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0096.107] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x214c, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x214c, lpOverlapped=0x0) returned 1 [0096.107] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0096.108] CloseHandle (hObject=0x98) returned 1 [0096.108] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_LightSpirit.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_lightspirit.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_LightSpirit.gif. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_lightspirit.gif. ")) returned 1 [0096.108] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0096.108] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0096.108] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="bg_OliveGreen.gif") returned 1 [0096.108] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bg_OliveGreen.gif") returned 1 [0096.108] lstrcmpiA (lpString1="", lpString2="bg_OliveGreen.gif") returned -1 [0096.108] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_LightSpirit.gif") returned="bg_LightSpirit.gif" [0096.108] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="bg_OliveGreen.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_OliveGreen.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_OliveGreen.gif" [0096.109] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_OliveGreen.gif", pszSpec="*.zip") returned 0 [0096.109] lstrlenA (lpString="*.zip") returned 5 [0096.109] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_OliveGreen.gif", pszSpec="*.rar") returned 0 [0096.109] lstrlenA (lpString="*.rar") returned 5 [0096.109] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_OliveGreen.gif", pszSpec="*.7z") returned 0 [0096.109] lstrlenA (lpString="*.7z") returned 4 [0096.109] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_OliveGreen.gif", pszSpec="*.tar") returned 0 [0096.109] lstrlenA (lpString="*.tar") returned 5 [0096.109] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_OliveGreen.gif", pszSpec="*.gzip") returned 0 [0096.109] lstrlenA (lpString="*.gzip") returned 6 [0096.109] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_OliveGreen.gif", pszSpec="*.jpg") returned 0 [0096.109] lstrlenA (lpString="*.jpg") returned 5 [0096.109] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_OliveGreen.gif", pszSpec="*.jpeg") returned 0 [0096.109] lstrlenA (lpString="*.jpeg") returned 6 [0096.109] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_OliveGreen.gif", pszSpec="*.psd") returned 0 [0096.109] lstrlenA (lpString="*.psd") returned 5 [0096.109] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_OliveGreen.gif", pszSpec="*.cdr") returned 0 [0096.109] lstrlenA (lpString="*.cdr") returned 5 [0096.109] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_OliveGreen.gif", pszSpec="*.dwg") returned 0 [0096.109] lstrlenA (lpString="*.dwg") returned 5 [0096.109] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_OliveGreen.gif", pszSpec="*.max") returned 0 [0096.109] lstrlenA (lpString="*.max") returned 5 [0096.109] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_OliveGreen.gif", pszSpec="*.bmp") returned 0 [0096.109] lstrlenA (lpString="*.bmp") returned 5 [0096.109] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_OliveGreen.gif", pszSpec="*.gif") returned 1 [0096.109] lstrlenA (lpString="*.gif") returned 5 [0096.109] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_OliveGreen.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_OliveGreen.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_OliveGreen.gif" [0096.109] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_OliveGreen.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_OliveGreen.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_OliveGreen.gif" [0096.109] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_OliveGreen.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_OliveGreen.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_OliveGreen.gif." [0096.109] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_OliveGreen.gif.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_OliveGreen.gif. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_OliveGreen.gif. " [0096.109] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_OliveGreen.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_olivegreen.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0096.110] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3d57 [0096.110] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9a4ceb00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x519a33f0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9a4ceb00, dwHighDateTime=0x1c747ea)) returned 1 [0096.110] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0096.110] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x3cfd, lpOverlapped=0x0) returned 1 [0096.158] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_OliveGreen.gif") returned="bg_OliveGreen.gif" [0096.158] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0096.158] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x3cfd, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x3cfd, lpOverlapped=0x0) returned 1 [0096.158] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0096.158] CloseHandle (hObject=0x98) returned 1 [0096.159] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_OliveGreen.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_olivegreen.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_OliveGreen.gif. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_olivegreen.gif. ")) returned 1 [0096.159] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0096.159] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0096.159] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="bg_Premium.gif") returned 1 [0096.159] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bg_Premium.gif") returned 1 [0096.159] lstrcmpiA (lpString1="", lpString2="bg_Premium.gif") returned -1 [0096.159] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_OliveGreen.gif") returned="bg_OliveGreen.gif" [0096.159] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="bg_Premium.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Premium.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Premium.gif" [0096.159] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Premium.gif", pszSpec="*.zip") returned 0 [0096.160] lstrlenA (lpString="*.zip") returned 5 [0096.160] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Premium.gif", pszSpec="*.rar") returned 0 [0096.160] lstrlenA (lpString="*.rar") returned 5 [0096.160] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Premium.gif", pszSpec="*.7z") returned 0 [0096.160] lstrlenA (lpString="*.7z") returned 4 [0096.160] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Premium.gif", pszSpec="*.tar") returned 0 [0096.160] lstrlenA (lpString="*.tar") returned 5 [0096.160] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Premium.gif", pszSpec="*.gzip") returned 0 [0096.160] lstrlenA (lpString="*.gzip") returned 6 [0096.160] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Premium.gif", pszSpec="*.jpg") returned 0 [0096.160] lstrlenA (lpString="*.jpg") returned 5 [0096.160] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Premium.gif", pszSpec="*.jpeg") returned 0 [0096.160] lstrlenA (lpString="*.jpeg") returned 6 [0096.160] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Premium.gif", pszSpec="*.psd") returned 0 [0096.160] lstrlenA (lpString="*.psd") returned 5 [0096.160] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Premium.gif", pszSpec="*.cdr") returned 0 [0096.160] lstrlenA (lpString="*.cdr") returned 5 [0096.160] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Premium.gif", pszSpec="*.dwg") returned 0 [0096.160] lstrlenA (lpString="*.dwg") returned 5 [0096.160] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Premium.gif", pszSpec="*.max") returned 0 [0096.160] lstrlenA (lpString="*.max") returned 5 [0096.160] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Premium.gif", pszSpec="*.bmp") returned 0 [0096.160] lstrlenA (lpString="*.bmp") returned 5 [0096.160] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Premium.gif", pszSpec="*.gif") returned 1 [0096.160] lstrlenA (lpString="*.gif") returned 5 [0096.160] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Premium.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Premium.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Premium.gif" [0096.160] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Premium.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Premium.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Premium.gif" [0096.160] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Premium.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Premium.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Premium.gif." [0096.162] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Premium.gif.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Premium.gif. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Premium.gif. " [0096.162] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Premium.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_premium.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0096.162] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1845 [0096.162] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9a4ceb00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5f66ac70, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9a4ceb00, dwHighDateTime=0x1c747ea)) returned 1 [0096.163] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0096.163] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x17eb, lpOverlapped=0x0) returned 1 [0096.164] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Premium.gif") returned="bg_Premium.gif" [0096.164] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0096.164] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x17eb, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x17eb, lpOverlapped=0x0) returned 1 [0096.165] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0096.165] CloseHandle (hObject=0x98) returned 1 [0096.165] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Premium.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_premium.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Premium.gif. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_premium.gif. ")) returned 1 [0096.165] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0096.165] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0096.165] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="bg_SlateBlue.gif") returned 1 [0096.165] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bg_SlateBlue.gif") returned 1 [0096.165] lstrcmpiA (lpString1="", lpString2="bg_SlateBlue.gif") returned -1 [0096.165] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Premium.gif") returned="bg_Premium.gif" [0096.165] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="bg_SlateBlue.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_SlateBlue.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_SlateBlue.gif" [0096.165] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_SlateBlue.gif", pszSpec="*.zip") returned 0 [0096.166] lstrlenA (lpString="*.zip") returned 5 [0096.166] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_SlateBlue.gif", pszSpec="*.rar") returned 0 [0096.166] lstrlenA (lpString="*.rar") returned 5 [0096.166] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_SlateBlue.gif", pszSpec="*.7z") returned 0 [0096.166] lstrlenA (lpString="*.7z") returned 4 [0096.166] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_SlateBlue.gif", pszSpec="*.tar") returned 0 [0096.166] lstrlenA (lpString="*.tar") returned 5 [0096.166] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_SlateBlue.gif", pszSpec="*.gzip") returned 0 [0096.166] lstrlenA (lpString="*.gzip") returned 6 [0096.166] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_SlateBlue.gif", pszSpec="*.jpg") returned 0 [0096.166] lstrlenA (lpString="*.jpg") returned 5 [0096.166] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_SlateBlue.gif", pszSpec="*.jpeg") returned 0 [0096.166] lstrlenA (lpString="*.jpeg") returned 6 [0096.166] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_SlateBlue.gif", pszSpec="*.psd") returned 0 [0096.166] lstrlenA (lpString="*.psd") returned 5 [0096.166] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_SlateBlue.gif", pszSpec="*.cdr") returned 0 [0096.166] lstrlenA (lpString="*.cdr") returned 5 [0096.166] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_SlateBlue.gif", pszSpec="*.dwg") returned 0 [0096.166] lstrlenA (lpString="*.dwg") returned 5 [0096.166] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_SlateBlue.gif", pszSpec="*.max") returned 0 [0096.166] lstrlenA (lpString="*.max") returned 5 [0096.166] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_SlateBlue.gif", pszSpec="*.bmp") returned 0 [0096.166] lstrlenA (lpString="*.bmp") returned 5 [0096.166] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_SlateBlue.gif", pszSpec="*.gif") returned 1 [0096.166] lstrlenA (lpString="*.gif") returned 5 [0096.166] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_SlateBlue.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_SlateBlue.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_SlateBlue.gif" [0096.166] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_SlateBlue.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_SlateBlue.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_SlateBlue.gif" [0096.166] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_SlateBlue.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_SlateBlue.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_SlateBlue.gif." [0096.166] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_SlateBlue.gif.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_SlateBlue.gif. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_SlateBlue.gif. " [0096.166] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_SlateBlue.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_slateblue.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0096.167] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x5141 [0096.167] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9a4ceb00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5f66ac70, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9a4ceb00, dwHighDateTime=0x1c747ea)) returned 1 [0096.167] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0096.167] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x50e7, lpOverlapped=0x0) returned 1 [0096.168] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_SlateBlue.gif") returned="bg_SlateBlue.gif" [0096.168] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0096.168] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x50e7, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x50e7, lpOverlapped=0x0) returned 1 [0096.168] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0096.168] CloseHandle (hObject=0x98) returned 1 [0096.168] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_SlateBlue.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_slateblue.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_SlateBlue.gif. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_slateblue.gif. ")) returned 1 [0096.170] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0096.170] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0096.170] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="bg_TexturedBlue.gif") returned 1 [0096.170] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bg_TexturedBlue.gif") returned 1 [0096.170] lstrcmpiA (lpString1="", lpString2="bg_TexturedBlue.gif") returned -1 [0096.170] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_SlateBlue.gif") returned="bg_SlateBlue.gif" [0096.170] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="bg_TexturedBlue.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_TexturedBlue.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_TexturedBlue.gif" [0096.170] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_TexturedBlue.gif", pszSpec="*.zip") returned 0 [0096.170] lstrlenA (lpString="*.zip") returned 5 [0096.170] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_TexturedBlue.gif", pszSpec="*.rar") returned 0 [0096.170] lstrlenA (lpString="*.rar") returned 5 [0096.170] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_TexturedBlue.gif", pszSpec="*.7z") returned 0 [0096.170] lstrlenA (lpString="*.7z") returned 4 [0096.170] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_TexturedBlue.gif", pszSpec="*.tar") returned 0 [0096.170] lstrlenA (lpString="*.tar") returned 5 [0096.170] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_TexturedBlue.gif", pszSpec="*.gzip") returned 0 [0096.170] lstrlenA (lpString="*.gzip") returned 6 [0096.170] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_TexturedBlue.gif", pszSpec="*.jpg") returned 0 [0096.170] lstrlenA (lpString="*.jpg") returned 5 [0096.170] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_TexturedBlue.gif", pszSpec="*.jpeg") returned 0 [0096.170] lstrlenA (lpString="*.jpeg") returned 6 [0096.170] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_TexturedBlue.gif", pszSpec="*.psd") returned 0 [0096.170] lstrlenA (lpString="*.psd") returned 5 [0096.170] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_TexturedBlue.gif", pszSpec="*.cdr") returned 0 [0096.170] lstrlenA (lpString="*.cdr") returned 5 [0096.170] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_TexturedBlue.gif", pszSpec="*.dwg") returned 0 [0096.170] lstrlenA (lpString="*.dwg") returned 5 [0096.170] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_TexturedBlue.gif", pszSpec="*.max") returned 0 [0096.170] lstrlenA (lpString="*.max") returned 5 [0096.170] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_TexturedBlue.gif", pszSpec="*.bmp") returned 0 [0096.170] lstrlenA (lpString="*.bmp") returned 5 [0096.170] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_TexturedBlue.gif", pszSpec="*.gif") returned 1 [0096.170] lstrlenA (lpString="*.gif") returned 5 [0096.170] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_TexturedBlue.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_TexturedBlue.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_TexturedBlue.gif" [0096.171] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_TexturedBlue.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_TexturedBlue.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_TexturedBlue.gif" [0096.171] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_TexturedBlue.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_TexturedBlue.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_TexturedBlue.gif." [0096.171] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_TexturedBlue.gif.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_TexturedBlue.gif. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_TexturedBlue.gif. " [0096.171] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_TexturedBlue.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_texturedblue.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0096.171] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x193c [0096.171] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9a4ceb00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5f66ac70, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9a4ceb00, dwHighDateTime=0x1c747ea)) returned 1 [0096.171] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0096.171] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x18e2, lpOverlapped=0x0) returned 1 [0096.180] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_TexturedBlue.gif") returned="bg_TexturedBlue.gif" [0096.180] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0096.180] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x18e2, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x18e2, lpOverlapped=0x0) returned 1 [0096.180] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0096.180] CloseHandle (hObject=0x98) returned 1 [0096.180] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_TexturedBlue.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_texturedblue.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_TexturedBlue.gif. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_texturedblue.gif. ")) returned 1 [0096.181] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0096.181] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0096.181] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="bg_VelvetRose.gif") returned 1 [0096.181] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="bg_VelvetRose.gif") returned 1 [0096.181] lstrcmpiA (lpString1="", lpString2="bg_VelvetRose.gif") returned -1 [0096.181] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_TexturedBlue.gif") returned="bg_TexturedBlue.gif" [0096.181] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="bg_VelvetRose.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_VelvetRose.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_VelvetRose.gif" [0096.181] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_VelvetRose.gif", pszSpec="*.zip") returned 0 [0096.181] lstrlenA (lpString="*.zip") returned 5 [0096.181] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_VelvetRose.gif", pszSpec="*.rar") returned 0 [0096.181] lstrlenA (lpString="*.rar") returned 5 [0096.181] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_VelvetRose.gif", pszSpec="*.7z") returned 0 [0096.181] lstrlenA (lpString="*.7z") returned 4 [0096.181] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_VelvetRose.gif", pszSpec="*.tar") returned 0 [0096.181] lstrlenA (lpString="*.tar") returned 5 [0096.181] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_VelvetRose.gif", pszSpec="*.gzip") returned 0 [0096.181] lstrlenA (lpString="*.gzip") returned 6 [0096.181] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_VelvetRose.gif", pszSpec="*.jpg") returned 0 [0096.181] lstrlenA (lpString="*.jpg") returned 5 [0096.181] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_VelvetRose.gif", pszSpec="*.jpeg") returned 0 [0096.181] lstrlenA (lpString="*.jpeg") returned 6 [0096.181] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_VelvetRose.gif", pszSpec="*.psd") returned 0 [0096.181] lstrlenA (lpString="*.psd") returned 5 [0096.181] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_VelvetRose.gif", pszSpec="*.cdr") returned 0 [0096.181] lstrlenA (lpString="*.cdr") returned 5 [0096.181] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_VelvetRose.gif", pszSpec="*.dwg") returned 0 [0096.181] lstrlenA (lpString="*.dwg") returned 5 [0096.181] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_VelvetRose.gif", pszSpec="*.max") returned 0 [0096.181] lstrlenA (lpString="*.max") returned 5 [0096.181] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_VelvetRose.gif", pszSpec="*.bmp") returned 0 [0096.181] lstrlenA (lpString="*.bmp") returned 5 [0096.181] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_VelvetRose.gif", pszSpec="*.gif") returned 1 [0096.182] lstrlenA (lpString="*.gif") returned 5 [0096.182] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_VelvetRose.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_VelvetRose.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_VelvetRose.gif" [0096.182] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_VelvetRose.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_VelvetRose.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_VelvetRose.gif" [0096.182] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_VelvetRose.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_VelvetRose.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_VelvetRose.gif." [0096.182] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_VelvetRose.gif.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_VelvetRose.gif. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_VelvetRose.gif. " [0096.182] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_VelvetRose.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_velvetrose.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0096.207] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3c64 [0096.207] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9a4ceb00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x519a33f0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9a4ceb00, dwHighDateTime=0x1c747ea)) returned 1 [0096.207] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0096.207] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x3c0a, lpOverlapped=0x0) returned 1 [0096.222] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_VelvetRose.gif") returned="bg_VelvetRose.gif" [0096.222] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0096.222] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x3c0a, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x3c0a, lpOverlapped=0x0) returned 1 [0096.222] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0096.222] CloseHandle (hObject=0x98) returned 1 [0096.222] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_VelvetRose.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_velvetrose.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_VelvetRose.gif. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_velvetrose.gif. ")) returned 1 [0096.223] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0096.223] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0096.223] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="button_left.gif") returned 1 [0096.223] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="button_left.gif") returned 1 [0096.223] lstrcmpiA (lpString1="", lpString2="button_left.gif") returned -1 [0096.223] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_VelvetRose.gif") returned="bg_VelvetRose.gif" [0096.223] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="button_left.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left.gif" [0096.223] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left.gif", pszSpec="*.zip") returned 0 [0096.223] lstrlenA (lpString="*.zip") returned 5 [0096.223] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left.gif", pszSpec="*.rar") returned 0 [0096.223] lstrlenA (lpString="*.rar") returned 5 [0096.223] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left.gif", pszSpec="*.7z") returned 0 [0096.223] lstrlenA (lpString="*.7z") returned 4 [0096.223] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left.gif", pszSpec="*.tar") returned 0 [0096.223] lstrlenA (lpString="*.tar") returned 5 [0096.223] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left.gif", pszSpec="*.gzip") returned 0 [0096.223] lstrlenA (lpString="*.gzip") returned 6 [0096.223] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left.gif", pszSpec="*.jpg") returned 0 [0096.223] lstrlenA (lpString="*.jpg") returned 5 [0096.223] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left.gif", pszSpec="*.jpeg") returned 0 [0096.224] lstrlenA (lpString="*.jpeg") returned 6 [0096.224] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left.gif", pszSpec="*.psd") returned 0 [0096.224] lstrlenA (lpString="*.psd") returned 5 [0096.224] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left.gif", pszSpec="*.cdr") returned 0 [0096.224] lstrlenA (lpString="*.cdr") returned 5 [0096.224] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left.gif", pszSpec="*.dwg") returned 0 [0096.224] lstrlenA (lpString="*.dwg") returned 5 [0096.224] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left.gif", pszSpec="*.max") returned 0 [0096.224] lstrlenA (lpString="*.max") returned 5 [0096.224] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left.gif", pszSpec="*.bmp") returned 0 [0096.224] lstrlenA (lpString="*.bmp") returned 5 [0096.224] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left.gif", pszSpec="*.gif") returned 1 [0096.224] lstrlenA (lpString="*.gif") returned 5 [0096.224] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left.gif" [0096.224] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left.gif" [0096.224] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left.gif." [0096.224] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left.gif.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left.gif. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left.gif. " [0096.224] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\button_left.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0096.224] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x171 [0096.225] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9a4ceb00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x51b6c470, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9a4ceb00, dwHighDateTime=0x1c747ea)) returned 1 [0096.225] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0096.225] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x117, lpOverlapped=0x0) returned 1 [0096.225] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left.gif") returned="button_left.gif" [0096.225] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0096.225] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x117, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x117, lpOverlapped=0x0) returned 1 [0096.225] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0096.225] CloseHandle (hObject=0x98) returned 1 [0096.226] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\button_left.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left.gif. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\button_left.gif. ")) returned 1 [0096.228] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0096.228] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0096.228] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="button_left_over.gif") returned 1 [0096.228] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="button_left_over.gif") returned 1 [0096.228] lstrcmpiA (lpString1="", lpString2="button_left_over.gif") returned -1 [0096.228] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left.gif") returned="button_left.gif" [0096.228] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="button_left_over.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left_over.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left_over.gif" [0096.228] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left_over.gif", pszSpec="*.zip") returned 0 [0096.228] lstrlenA (lpString="*.zip") returned 5 [0096.228] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left_over.gif", pszSpec="*.rar") returned 0 [0096.228] lstrlenA (lpString="*.rar") returned 5 [0096.228] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left_over.gif", pszSpec="*.7z") returned 0 [0096.228] lstrlenA (lpString="*.7z") returned 4 [0096.228] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left_over.gif", pszSpec="*.tar") returned 0 [0096.228] lstrlenA (lpString="*.tar") returned 5 [0096.228] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left_over.gif", pszSpec="*.gzip") returned 0 [0096.228] lstrlenA (lpString="*.gzip") returned 6 [0096.228] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left_over.gif", pszSpec="*.jpg") returned 0 [0096.228] lstrlenA (lpString="*.jpg") returned 5 [0096.228] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left_over.gif", pszSpec="*.jpeg") returned 0 [0096.228] lstrlenA (lpString="*.jpeg") returned 6 [0096.228] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left_over.gif", pszSpec="*.psd") returned 0 [0096.228] lstrlenA (lpString="*.psd") returned 5 [0096.229] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left_over.gif", pszSpec="*.cdr") returned 0 [0096.229] lstrlenA (lpString="*.cdr") returned 5 [0096.229] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left_over.gif", pszSpec="*.dwg") returned 0 [0096.229] lstrlenA (lpString="*.dwg") returned 5 [0096.229] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left_over.gif", pszSpec="*.max") returned 0 [0096.229] lstrlenA (lpString="*.max") returned 5 [0096.229] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left_over.gif", pszSpec="*.bmp") returned 0 [0096.229] lstrlenA (lpString="*.bmp") returned 5 [0096.229] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left_over.gif", pszSpec="*.gif") returned 1 [0096.229] lstrlenA (lpString="*.gif") returned 5 [0096.229] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left_over.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left_over.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left_over.gif" [0096.229] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left_over.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left_over.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left_over.gif" [0096.229] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left_over.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left_over.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left_over.gif." [0096.229] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left_over.gif.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left_over.gif. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left_over.gif. " [0096.229] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left_over.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\button_left_over.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0096.229] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x176 [0096.229] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9b7e1800, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x51b6c470, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9b7e1800, dwHighDateTime=0x1c747ea)) returned 1 [0096.229] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0096.229] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x11c, lpOverlapped=0x0) returned 1 [0096.230] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left_over.gif") returned="button_left_over.gif" [0096.230] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0096.230] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x11c, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x11c, lpOverlapped=0x0) returned 1 [0096.230] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0096.230] CloseHandle (hObject=0x98) returned 1 [0096.230] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left_over.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\button_left_over.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left_over.gif. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\button_left_over.gif. ")) returned 1 [0096.231] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0096.231] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0096.231] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="button_mid.gif") returned 1 [0096.231] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="button_mid.gif") returned 1 [0096.231] lstrcmpiA (lpString1="", lpString2="button_mid.gif") returned -1 [0096.231] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left_over.gif") returned="button_left_over.gif" [0096.231] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="button_mid.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid.gif" [0096.231] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid.gif", pszSpec="*.zip") returned 0 [0096.231] lstrlenA (lpString="*.zip") returned 5 [0096.231] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid.gif", pszSpec="*.rar") returned 0 [0096.231] lstrlenA (lpString="*.rar") returned 5 [0096.231] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid.gif", pszSpec="*.7z") returned 0 [0096.231] lstrlenA (lpString="*.7z") returned 4 [0096.231] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid.gif", pszSpec="*.tar") returned 0 [0096.231] lstrlenA (lpString="*.tar") returned 5 [0096.231] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid.gif", pszSpec="*.gzip") returned 0 [0096.231] lstrlenA (lpString="*.gzip") returned 6 [0096.231] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid.gif", pszSpec="*.jpg") returned 0 [0096.231] lstrlenA (lpString="*.jpg") returned 5 [0096.231] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid.gif", pszSpec="*.jpeg") returned 0 [0096.231] lstrlenA (lpString="*.jpeg") returned 6 [0096.231] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid.gif", pszSpec="*.psd") returned 0 [0096.231] lstrlenA (lpString="*.psd") returned 5 [0096.231] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid.gif", pszSpec="*.cdr") returned 0 [0096.231] lstrlenA (lpString="*.cdr") returned 5 [0096.231] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid.gif", pszSpec="*.dwg") returned 0 [0096.231] lstrlenA (lpString="*.dwg") returned 5 [0096.231] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid.gif", pszSpec="*.max") returned 0 [0096.231] lstrlenA (lpString="*.max") returned 5 [0096.231] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid.gif", pszSpec="*.bmp") returned 0 [0096.231] lstrlenA (lpString="*.bmp") returned 5 [0096.232] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid.gif", pszSpec="*.gif") returned 1 [0096.232] lstrlenA (lpString="*.gif") returned 5 [0096.232] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid.gif" [0096.232] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid.gif" [0096.232] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid.gif." [0096.232] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid.gif.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid.gif. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid.gif. " [0096.232] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\button_mid.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0096.232] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb5 [0096.232] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9b7e1800, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x51b925d0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9b7e1800, dwHighDateTime=0x1c747ea)) returned 1 [0096.232] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0096.232] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x5b, lpOverlapped=0x0) returned 1 [0096.233] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid.gif") returned="button_mid.gif" [0096.233] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0096.233] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x5b, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x5b, lpOverlapped=0x0) returned 1 [0096.233] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0096.233] CloseHandle (hObject=0x98) returned 1 [0096.233] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\button_mid.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid.gif. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\button_mid.gif. ")) returned 1 [0096.234] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0096.234] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0096.234] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="button_mid_over.gif") returned 1 [0096.234] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="button_mid_over.gif") returned 1 [0096.234] lstrcmpiA (lpString1="", lpString2="button_mid_over.gif") returned -1 [0096.234] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid.gif") returned="button_mid.gif" [0096.234] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="button_mid_over.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid_over.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid_over.gif" [0096.234] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid_over.gif", pszSpec="*.zip") returned 0 [0096.234] lstrlenA (lpString="*.zip") returned 5 [0096.234] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid_over.gif", pszSpec="*.rar") returned 0 [0096.234] lstrlenA (lpString="*.rar") returned 5 [0096.234] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid_over.gif", pszSpec="*.7z") returned 0 [0096.234] lstrlenA (lpString="*.7z") returned 4 [0096.234] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid_over.gif", pszSpec="*.tar") returned 0 [0096.234] lstrlenA (lpString="*.tar") returned 5 [0096.234] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid_over.gif", pszSpec="*.gzip") returned 0 [0096.234] lstrlenA (lpString="*.gzip") returned 6 [0096.234] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid_over.gif", pszSpec="*.jpg") returned 0 [0096.234] lstrlenA (lpString="*.jpg") returned 5 [0096.234] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid_over.gif", pszSpec="*.jpeg") returned 0 [0096.234] lstrlenA (lpString="*.jpeg") returned 6 [0096.234] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid_over.gif", pszSpec="*.psd") returned 0 [0096.234] lstrlenA (lpString="*.psd") returned 5 [0096.234] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid_over.gif", pszSpec="*.cdr") returned 0 [0096.234] lstrlenA (lpString="*.cdr") returned 5 [0096.234] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid_over.gif", pszSpec="*.dwg") returned 0 [0096.234] lstrlenA (lpString="*.dwg") returned 5 [0096.234] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid_over.gif", pszSpec="*.max") returned 0 [0096.234] lstrlenA (lpString="*.max") returned 5 [0096.234] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid_over.gif", pszSpec="*.bmp") returned 0 [0096.234] lstrlenA (lpString="*.bmp") returned 5 [0096.234] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid_over.gif", pszSpec="*.gif") returned 1 [0096.234] lstrlenA (lpString="*.gif") returned 5 [0096.234] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid_over.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid_over.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid_over.gif" [0096.234] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid_over.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid_over.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid_over.gif" [0096.234] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid_over.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid_over.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid_over.gif." [0096.234] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid_over.gif.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid_over.gif. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid_over.gif. " [0096.234] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid_over.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\button_mid_over.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0096.235] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb7 [0096.235] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9b7e1800, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x60120f70, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9b7e1800, dwHighDateTime=0x1c747ea)) returned 1 [0096.235] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0096.235] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x5d, lpOverlapped=0x0) returned 1 [0096.235] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid_over.gif") returned="button_mid_over.gif" [0096.235] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0096.235] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x5d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x5d, lpOverlapped=0x0) returned 1 [0096.235] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0096.235] CloseHandle (hObject=0x98) returned 1 [0096.236] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid_over.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\button_mid_over.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid_over.gif. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\button_mid_over.gif. ")) returned 1 [0096.238] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0096.238] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0096.238] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="button_right.gif") returned 1 [0096.238] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="button_right.gif") returned 1 [0096.238] lstrcmpiA (lpString1="", lpString2="button_right.gif") returned -1 [0096.238] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid_over.gif") returned="button_mid_over.gif" [0096.238] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="button_right.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right.gif" [0096.238] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right.gif", pszSpec="*.zip") returned 0 [0096.238] lstrlenA (lpString="*.zip") returned 5 [0096.238] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right.gif", pszSpec="*.rar") returned 0 [0096.238] lstrlenA (lpString="*.rar") returned 5 [0096.238] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right.gif", pszSpec="*.7z") returned 0 [0096.238] lstrlenA (lpString="*.7z") returned 4 [0096.238] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right.gif", pszSpec="*.tar") returned 0 [0096.238] lstrlenA (lpString="*.tar") returned 5 [0096.238] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right.gif", pszSpec="*.gzip") returned 0 [0096.238] lstrlenA (lpString="*.gzip") returned 6 [0096.238] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right.gif", pszSpec="*.jpg") returned 0 [0096.238] lstrlenA (lpString="*.jpg") returned 5 [0096.238] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right.gif", pszSpec="*.jpeg") returned 0 [0096.238] lstrlenA (lpString="*.jpeg") returned 6 [0096.238] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right.gif", pszSpec="*.psd") returned 0 [0096.238] lstrlenA (lpString="*.psd") returned 5 [0096.238] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right.gif", pszSpec="*.cdr") returned 0 [0096.238] lstrlenA (lpString="*.cdr") returned 5 [0096.238] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right.gif", pszSpec="*.dwg") returned 0 [0096.238] lstrlenA (lpString="*.dwg") returned 5 [0096.238] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right.gif", pszSpec="*.max") returned 0 [0096.238] lstrlenA (lpString="*.max") returned 5 [0096.238] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right.gif", pszSpec="*.bmp") returned 0 [0096.238] lstrlenA (lpString="*.bmp") returned 5 [0096.238] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right.gif", pszSpec="*.gif") returned 1 [0096.238] lstrlenA (lpString="*.gif") returned 5 [0096.238] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right.gif" [0096.238] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right.gif" [0096.238] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right.gif." [0096.238] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right.gif.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right.gif. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right.gif. " [0096.238] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\button_right.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0096.239] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x171 [0096.239] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9b7e1800, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x51b925d0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9b7e1800, dwHighDateTime=0x1c747ea)) returned 1 [0096.239] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0096.239] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x117, lpOverlapped=0x0) returned 1 [0096.239] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right.gif") returned="button_right.gif" [0096.239] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0096.239] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x117, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x117, lpOverlapped=0x0) returned 1 [0096.240] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0096.240] CloseHandle (hObject=0x98) returned 1 [0096.247] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\button_right.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right.gif. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\button_right.gif. ")) returned 1 [0096.248] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0096.248] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0096.248] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="button_right_over.gif") returned 1 [0096.248] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="button_right_over.gif") returned 1 [0096.248] lstrcmpiA (lpString1="", lpString2="button_right_over.gif") returned -1 [0096.248] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right.gif") returned="button_right.gif" [0096.248] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="button_right_over.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right_over.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right_over.gif" [0096.248] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right_over.gif", pszSpec="*.zip") returned 0 [0096.248] lstrlenA (lpString="*.zip") returned 5 [0096.248] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right_over.gif", pszSpec="*.rar") returned 0 [0096.248] lstrlenA (lpString="*.rar") returned 5 [0096.248] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right_over.gif", pszSpec="*.7z") returned 0 [0096.248] lstrlenA (lpString="*.7z") returned 4 [0096.248] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right_over.gif", pszSpec="*.tar") returned 0 [0096.248] lstrlenA (lpString="*.tar") returned 5 [0096.248] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right_over.gif", pszSpec="*.gzip") returned 0 [0096.248] lstrlenA (lpString="*.gzip") returned 6 [0096.248] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right_over.gif", pszSpec="*.jpg") returned 0 [0096.248] lstrlenA (lpString="*.jpg") returned 5 [0096.248] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right_over.gif", pszSpec="*.jpeg") returned 0 [0096.248] lstrlenA (lpString="*.jpeg") returned 6 [0096.248] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right_over.gif", pszSpec="*.psd") returned 0 [0096.248] lstrlenA (lpString="*.psd") returned 5 [0096.248] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right_over.gif", pszSpec="*.cdr") returned 0 [0096.248] lstrlenA (lpString="*.cdr") returned 5 [0096.248] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right_over.gif", pszSpec="*.dwg") returned 0 [0096.249] lstrlenA (lpString="*.dwg") returned 5 [0096.249] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right_over.gif", pszSpec="*.max") returned 0 [0096.249] lstrlenA (lpString="*.max") returned 5 [0096.249] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right_over.gif", pszSpec="*.bmp") returned 0 [0096.249] lstrlenA (lpString="*.bmp") returned 5 [0096.249] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right_over.gif", pszSpec="*.gif") returned 1 [0096.249] lstrlenA (lpString="*.gif") returned 5 [0096.249] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right_over.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right_over.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right_over.gif" [0096.249] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right_over.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right_over.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right_over.gif" [0096.249] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right_over.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right_over.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right_over.gif." [0096.249] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right_over.gif.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right_over.gif. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right_over.gif. " [0096.249] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right_over.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\button_right_over.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0096.249] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x244 [0096.249] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9b7e1800, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x51b925d0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9b7e1800, dwHighDateTime=0x1c747ea)) returned 1 [0096.249] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0096.249] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x1ea, lpOverlapped=0x0) returned 1 [0096.279] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right_over.gif") returned="button_right_over.gif" [0096.279] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0096.279] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x1ea, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x1ea, lpOverlapped=0x0) returned 1 [0096.279] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0096.279] CloseHandle (hObject=0x98) returned 1 [0096.280] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right_over.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\button_right_over.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right_over.gif. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\button_right_over.gif. ")) returned 1 [0096.280] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0096.280] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0096.280] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="CALENDAR.GIF") returned 1 [0096.280] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="CALENDAR.GIF") returned 1 [0096.280] lstrcmpiA (lpString1="", lpString2="CALENDAR.GIF") returned -1 [0096.280] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right_over.gif") returned="button_right_over.gif" [0096.280] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="CALENDAR.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\CALENDAR.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\CALENDAR.GIF" [0096.280] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\CALENDAR.GIF", pszSpec="*.zip") returned 0 [0096.281] lstrlenA (lpString="*.zip") returned 5 [0096.281] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\CALENDAR.GIF", pszSpec="*.rar") returned 0 [0096.281] lstrlenA (lpString="*.rar") returned 5 [0096.281] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\CALENDAR.GIF", pszSpec="*.7z") returned 0 [0096.281] lstrlenA (lpString="*.7z") returned 4 [0096.281] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\CALENDAR.GIF", pszSpec="*.tar") returned 0 [0096.281] lstrlenA (lpString="*.tar") returned 5 [0096.281] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\CALENDAR.GIF", pszSpec="*.gzip") returned 0 [0096.281] lstrlenA (lpString="*.gzip") returned 6 [0096.281] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\CALENDAR.GIF", pszSpec="*.jpg") returned 0 [0096.281] lstrlenA (lpString="*.jpg") returned 5 [0096.281] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\CALENDAR.GIF", pszSpec="*.jpeg") returned 0 [0096.281] lstrlenA (lpString="*.jpeg") returned 6 [0096.281] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\CALENDAR.GIF", pszSpec="*.psd") returned 0 [0096.281] lstrlenA (lpString="*.psd") returned 5 [0096.281] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\CALENDAR.GIF", pszSpec="*.cdr") returned 0 [0096.281] lstrlenA (lpString="*.cdr") returned 5 [0096.281] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\CALENDAR.GIF", pszSpec="*.dwg") returned 0 [0096.281] lstrlenA (lpString="*.dwg") returned 5 [0096.281] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\CALENDAR.GIF", pszSpec="*.max") returned 0 [0096.281] lstrlenA (lpString="*.max") returned 5 [0096.281] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\CALENDAR.GIF", pszSpec="*.bmp") returned 0 [0096.281] lstrlenA (lpString="*.bmp") returned 5 [0096.281] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\CALENDAR.GIF", pszSpec="*.gif") returned 1 [0096.281] lstrlenA (lpString="*.gif") returned 5 [0096.281] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\CALENDAR.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\CALENDAR.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\CALENDAR.GIF" [0096.281] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\CALENDAR.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\CALENDAR.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\CALENDAR.GIF" [0096.281] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\CALENDAR.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\CALENDAR.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\CALENDAR.GIF." [0096.281] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\CALENDAR.GIF.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\CALENDAR.GIF. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\CALENDAR.GIF. " [0096.281] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\CALENDAR.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\calendar.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0096.282] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x383 [0096.282] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9b7e1800, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x51bb8730, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9b7e1800, dwHighDateTime=0x1c747ea)) returned 1 [0096.282] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0096.282] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x329, lpOverlapped=0x0) returned 1 [0096.283] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\CALENDAR.GIF") returned="CALENDAR.GIF" [0096.283] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0096.283] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x329, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x329, lpOverlapped=0x0) returned 1 [0096.283] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0096.283] CloseHandle (hObject=0x98) returned 1 [0096.283] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\CALENDAR.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\calendar.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\CALENDAR.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\calendar.gif. ")) returned 1 [0096.283] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0096.284] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0096.284] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="DELETE.GIF") returned 1 [0096.284] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DELETE.GIF") returned 1 [0096.284] lstrcmpiA (lpString1="", lpString2="DELETE.GIF") returned -1 [0096.284] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\CALENDAR.GIF") returned="CALENDAR.GIF" [0096.284] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="DELETE.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\DELETE.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\DELETE.GIF" [0096.284] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\DELETE.GIF", pszSpec="*.zip") returned 0 [0096.284] lstrlenA (lpString="*.zip") returned 5 [0096.284] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\DELETE.GIF", pszSpec="*.rar") returned 0 [0096.284] lstrlenA (lpString="*.rar") returned 5 [0096.284] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\DELETE.GIF", pszSpec="*.7z") returned 0 [0096.284] lstrlenA (lpString="*.7z") returned 4 [0096.284] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\DELETE.GIF", pszSpec="*.tar") returned 0 [0096.284] lstrlenA (lpString="*.tar") returned 5 [0096.284] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\DELETE.GIF", pszSpec="*.gzip") returned 0 [0096.284] lstrlenA (lpString="*.gzip") returned 6 [0096.284] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\DELETE.GIF", pszSpec="*.jpg") returned 0 [0096.284] lstrlenA (lpString="*.jpg") returned 5 [0096.284] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\DELETE.GIF", pszSpec="*.jpeg") returned 0 [0096.284] lstrlenA (lpString="*.jpeg") returned 6 [0096.284] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\DELETE.GIF", pszSpec="*.psd") returned 0 [0096.284] lstrlenA (lpString="*.psd") returned 5 [0096.284] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\DELETE.GIF", pszSpec="*.cdr") returned 0 [0096.284] lstrlenA (lpString="*.cdr") returned 5 [0096.284] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\DELETE.GIF", pszSpec="*.dwg") returned 0 [0096.284] lstrlenA (lpString="*.dwg") returned 5 [0096.284] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\DELETE.GIF", pszSpec="*.max") returned 0 [0096.284] lstrlenA (lpString="*.max") returned 5 [0096.284] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\DELETE.GIF", pszSpec="*.bmp") returned 0 [0096.284] lstrlenA (lpString="*.bmp") returned 5 [0096.284] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\DELETE.GIF", pszSpec="*.gif") returned 1 [0096.284] lstrlenA (lpString="*.gif") returned 5 [0096.284] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\DELETE.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\DELETE.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\DELETE.GIF" [0096.284] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\DELETE.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\DELETE.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\DELETE.GIF" [0096.284] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\DELETE.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\DELETE.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\DELETE.GIF." [0096.284] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\DELETE.GIF.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\DELETE.GIF. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\DELETE.GIF. " [0096.284] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\DELETE.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\delete.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0096.285] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x271 [0096.285] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9b7e1800, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x60760930, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9b7e1800, dwHighDateTime=0x1c747ea)) returned 1 [0096.285] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0096.285] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x217, lpOverlapped=0x0) returned 1 [0096.285] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\DELETE.GIF") returned="DELETE.GIF" [0096.285] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0096.285] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x217, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x217, lpOverlapped=0x0) returned 1 [0096.285] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0096.285] CloseHandle (hObject=0x98) returned 1 [0096.286] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\DELETE.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\delete.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\DELETE.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\delete.gif. ")) returned 1 [0096.474] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0096.474] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0096.474] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="ERROR.GIF") returned -1 [0096.475] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ERROR.GIF") returned 1 [0096.475] lstrcmpiA (lpString1="", lpString2="ERROR.GIF") returned -1 [0096.475] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\DELETE.GIF") returned="DELETE.GIF" [0096.475] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="ERROR.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ERROR.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ERROR.GIF" [0096.475] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ERROR.GIF", pszSpec="*.zip") returned 0 [0096.475] lstrlenA (lpString="*.zip") returned 5 [0096.475] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ERROR.GIF", pszSpec="*.rar") returned 0 [0096.475] lstrlenA (lpString="*.rar") returned 5 [0096.475] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ERROR.GIF", pszSpec="*.7z") returned 0 [0096.475] lstrlenA (lpString="*.7z") returned 4 [0096.475] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ERROR.GIF", pszSpec="*.tar") returned 0 [0096.475] lstrlenA (lpString="*.tar") returned 5 [0096.476] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ERROR.GIF", pszSpec="*.gzip") returned 0 [0096.476] lstrlenA (lpString="*.gzip") returned 6 [0096.476] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ERROR.GIF", pszSpec="*.jpg") returned 0 [0096.476] lstrlenA (lpString="*.jpg") returned 5 [0096.476] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ERROR.GIF", pszSpec="*.jpeg") returned 0 [0096.476] lstrlenA (lpString="*.jpeg") returned 6 [0096.476] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ERROR.GIF", pszSpec="*.psd") returned 0 [0096.476] lstrlenA (lpString="*.psd") returned 5 [0096.476] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ERROR.GIF", pszSpec="*.cdr") returned 0 [0096.476] lstrlenA (lpString="*.cdr") returned 5 [0096.476] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ERROR.GIF", pszSpec="*.dwg") returned 0 [0096.476] lstrlenA (lpString="*.dwg") returned 5 [0096.477] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ERROR.GIF", pszSpec="*.max") returned 0 [0096.477] lstrlenA (lpString="*.max") returned 5 [0096.477] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ERROR.GIF", pszSpec="*.bmp") returned 0 [0096.477] lstrlenA (lpString="*.bmp") returned 5 [0096.477] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ERROR.GIF", pszSpec="*.gif") returned 1 [0096.477] lstrlenA (lpString="*.gif") returned 5 [0096.477] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ERROR.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ERROR.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ERROR.GIF" [0096.477] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ERROR.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ERROR.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ERROR.GIF" [0096.477] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ERROR.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ERROR.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ERROR.GIF." [0096.477] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ERROR.GIF.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ERROR.GIF. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ERROR.GIF. " [0096.477] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ERROR.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\error.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0096.484] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x369 [0096.484] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9b7e1800, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x51fe2db0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9b7e1800, dwHighDateTime=0x1c747ea)) returned 1 [0096.484] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0096.484] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x30f, lpOverlapped=0x0) returned 1 [0096.487] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ERROR.GIF") returned="ERROR.GIF" [0096.487] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0096.487] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x30f, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x30f, lpOverlapped=0x0) returned 1 [0096.488] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0096.488] CloseHandle (hObject=0x98) returned 1 [0096.488] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ERROR.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\error.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ERROR.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\error.gif. ")) returned 1 [0096.489] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0096.490] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0096.490] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="FORM.ICO") returned -1 [0096.490] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FORM.ICO") returned 1 [0096.490] lstrcmpiA (lpString1="", lpString2="FORM.ICO") returned -1 [0096.490] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ERROR.GIF") returned="ERROR.GIF" [0096.490] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="FORM.ICO" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.ICO") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.ICO" [0096.490] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.ICO", pszSpec="*.zip") returned 0 [0096.490] lstrlenA (lpString="*.zip") returned 5 [0096.490] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.ICO", pszSpec="*.rar") returned 0 [0096.490] lstrlenA (lpString="*.rar") returned 5 [0096.490] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.ICO", pszSpec="*.7z") returned 0 [0096.490] lstrlenA (lpString="*.7z") returned 4 [0096.490] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.ICO", pszSpec="*.tar") returned 0 [0096.490] lstrlenA (lpString="*.tar") returned 5 [0096.490] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.ICO", pszSpec="*.gzip") returned 0 [0096.490] lstrlenA (lpString="*.gzip") returned 6 [0096.491] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.ICO", pszSpec="*.jpg") returned 0 [0096.491] lstrlenA (lpString="*.jpg") returned 5 [0096.491] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.ICO", pszSpec="*.jpeg") returned 0 [0096.491] lstrlenA (lpString="*.jpeg") returned 6 [0096.491] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.ICO", pszSpec="*.psd") returned 0 [0096.491] lstrlenA (lpString="*.psd") returned 5 [0096.491] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.ICO", pszSpec="*.cdr") returned 0 [0096.491] lstrlenA (lpString="*.cdr") returned 5 [0096.491] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.ICO", pszSpec="*.dwg") returned 0 [0096.491] lstrlenA (lpString="*.dwg") returned 5 [0096.491] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.ICO", pszSpec="*.max") returned 0 [0096.491] lstrlenA (lpString="*.max") returned 5 [0096.491] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.ICO", pszSpec="*.bmp") returned 0 [0096.491] lstrlenA (lpString="*.bmp") returned 5 [0096.491] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.ICO", pszSpec="*.gif") returned 0 [0096.491] lstrlenA (lpString="*.gif") returned 5 [0096.491] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.ICO", pszSpec="*.png") returned 0 [0096.492] lstrlenA (lpString="*.png") returned 5 [0096.492] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.ICO", pszSpec="*.doc") returned 0 [0096.492] lstrlenA (lpString="*.doc") returned 5 [0096.492] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.ICO", pszSpec="*.docx") returned 0 [0096.492] lstrlenA (lpString="*.docx") returned 6 [0096.492] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.ICO", pszSpec="*.xls") returned 0 [0096.492] lstrlenA (lpString="*.xls") returned 5 [0096.492] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.ICO", pszSpec="*.xlsx") returned 0 [0096.492] lstrlenA (lpString="*.xlsx") returned 6 [0096.492] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.ICO", pszSpec="*.ppt") returned 0 [0096.492] lstrlenA (lpString="*.ppt") returned 5 [0096.492] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.ICO", pszSpec="*.pptx") returned 0 [0096.492] lstrlenA (lpString="*.pptx") returned 6 [0096.492] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.ICO", pszSpec="*.txt") returned 0 [0096.492] lstrlenA (lpString="*.txt") returned 5 [0096.492] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.ICO", pszSpec="*.pdf") returned 0 [0096.492] lstrlenA (lpString="*.pdf") returned 5 [0096.493] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.ICO", pszSpec="*.djvu") returned 0 [0096.493] lstrlenA (lpString="*.djvu") returned 6 [0096.493] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.ICO", pszSpec="*.htm") returned 0 [0096.493] lstrlenA (lpString="*.htm") returned 5 [0096.493] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.ICO", pszSpec="*.html") returned 0 [0096.493] lstrlenA (lpString="*.html") returned 6 [0096.493] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.ICO", pszSpec="*.mdb") returned 0 [0096.493] lstrlenA (lpString="*.mdb") returned 5 [0096.493] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.ICO", pszSpec="*.cer") returned 0 [0096.493] lstrlenA (lpString="*.cer") returned 5 [0096.493] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.ICO", pszSpec="*.p12") returned 0 [0096.493] lstrlenA (lpString="*.p12") returned 5 [0096.493] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.ICO", pszSpec="*.pfx") returned 0 [0096.493] lstrlenA (lpString="*.pfx") returned 5 [0096.494] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.ICO", pszSpec="*.kwm") returned 0 [0096.494] lstrlenA (lpString="*.kwm") returned 5 [0096.494] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.ICO", pszSpec="*.pwm") returned 0 [0096.494] lstrlenA (lpString="*.pwm") returned 5 [0096.494] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.ICO", pszSpec="*.1cd") returned 0 [0096.494] lstrlenA (lpString="*.1cd") returned 5 [0096.494] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.ICO", pszSpec="*.md") returned 0 [0096.494] lstrlenA (lpString="*.md") returned 4 [0096.494] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.ICO", pszSpec="*.mdf") returned 0 [0096.494] lstrlenA (lpString="*.mdf") returned 5 [0096.494] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.ICO", pszSpec="*.dbf") returned 0 [0096.494] lstrlenA (lpString="*.dbf") returned 5 [0096.494] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.ICO", pszSpec="*.odt") returned 0 [0096.494] lstrlenA (lpString="*.odt") returned 5 [0096.495] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.ICO", pszSpec="*.vob") returned 0 [0096.495] lstrlenA (lpString="*.vob") returned 5 [0096.495] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.ICO", pszSpec="*.ifo") returned 0 [0096.495] lstrlenA (lpString="*.ifo") returned 5 [0096.495] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.ICO", pszSpec="*.lnk") returned 0 [0096.495] lstrlenA (lpString="*.lnk") returned 5 [0096.495] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.ICO", pszSpec="*.torrent") returned 0 [0096.495] lstrlenA (lpString="*.torrent") returned 9 [0096.495] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.ICO", pszSpec="*.mov") returned 0 [0096.495] lstrlenA (lpString="*.mov") returned 5 [0096.495] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.ICO", pszSpec="*.m2v") returned 0 [0096.495] lstrlenA (lpString="*.m2v") returned 5 [0096.495] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.ICO", pszSpec="*.3gp") returned 0 [0096.495] lstrlenA (lpString="*.3gp") returned 5 [0096.496] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.ICO", pszSpec="*.mpeg") returned 0 [0096.496] lstrlenA (lpString="*.mpeg") returned 6 [0096.496] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.ICO", pszSpec="*.mpg") returned 0 [0096.496] lstrlenA (lpString="*.mpg") returned 5 [0096.496] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.ICO", pszSpec="*.flv") returned 0 [0096.499] lstrlenA (lpString="*.flv") returned 5 [0096.499] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.ICO", pszSpec="*.avi") returned 0 [0096.499] lstrlenA (lpString="*.avi") returned 5 [0096.499] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.ICO", pszSpec="*.mp4") returned 0 [0096.499] lstrlenA (lpString="*.mp4") returned 5 [0096.499] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.ICO", pszSpec="*.wmv") returned 0 [0096.499] lstrlenA (lpString="*.wmv") returned 5 [0096.499] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.ICO", pszSpec="*.divx") returned 0 [0096.499] lstrlenA (lpString="*.divx") returned 6 [0096.500] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.ICO", pszSpec="*.mkv") returned 0 [0096.500] lstrlenA (lpString="*.mkv") returned 5 [0096.500] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.ICO", pszSpec="*.mp3") returned 0 [0096.500] lstrlenA (lpString="*.mp3") returned 5 [0096.500] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.ICO", pszSpec="*.wav") returned 0 [0096.500] lstrlenA (lpString="*.wav") returned 5 [0096.500] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.ICO", pszSpec="*.flac") returned 0 [0096.500] lstrlenA (lpString="*.flac") returned 6 [0096.500] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.ICO", pszSpec="*.ape") returned 0 [0096.500] lstrlenA (lpString="*.ape") returned 5 [0096.500] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.ICO", pszSpec="*.wma") returned 0 [0096.500] lstrlenA (lpString="*.wma") returned 5 [0096.500] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.ICO", pszSpec="*.ac3") returned 0 [0096.500] lstrlenA (lpString="*.ac3") returned 5 [0096.501] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0096.501] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0096.501] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="FORM.JS") returned -1 [0096.501] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FORM.JS") returned 1 [0096.501] lstrcmpiA (lpString1="", lpString2="FORM.JS") returned -1 [0096.501] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.ICO") returned="FORM.ICO" [0096.501] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="FORM.JS" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.JS") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.JS" [0096.501] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.JS", pszSpec="*.zip") returned 0 [0096.501] lstrlenA (lpString="*.zip") returned 5 [0096.501] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.JS", pszSpec="*.rar") returned 0 [0096.501] lstrlenA (lpString="*.rar") returned 5 [0096.501] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.JS", pszSpec="*.7z") returned 0 [0096.501] lstrlenA (lpString="*.7z") returned 4 [0096.502] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.JS", pszSpec="*.tar") returned 0 [0096.502] lstrlenA (lpString="*.tar") returned 5 [0096.502] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.JS", pszSpec="*.gzip") returned 0 [0096.502] lstrlenA (lpString="*.gzip") returned 6 [0096.502] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.JS", pszSpec="*.jpg") returned 0 [0096.502] lstrlenA (lpString="*.jpg") returned 5 [0096.502] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.JS", pszSpec="*.jpeg") returned 0 [0096.502] lstrlenA (lpString="*.jpeg") returned 6 [0096.502] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.JS", pszSpec="*.psd") returned 0 [0096.502] lstrlenA (lpString="*.psd") returned 5 [0096.502] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.JS", pszSpec="*.cdr") returned 0 [0096.502] lstrlenA (lpString="*.cdr") returned 5 [0096.502] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.JS", pszSpec="*.dwg") returned 0 [0096.502] lstrlenA (lpString="*.dwg") returned 5 [0096.502] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.JS", pszSpec="*.max") returned 0 [0096.503] lstrlenA (lpString="*.max") returned 5 [0096.503] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.JS", pszSpec="*.bmp") returned 0 [0096.503] lstrlenA (lpString="*.bmp") returned 5 [0096.503] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.JS", pszSpec="*.gif") returned 0 [0096.503] lstrlenA (lpString="*.gif") returned 5 [0096.503] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.JS", pszSpec="*.png") returned 0 [0096.503] lstrlenA (lpString="*.png") returned 5 [0096.503] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.JS", pszSpec="*.doc") returned 0 [0096.503] lstrlenA (lpString="*.doc") returned 5 [0096.503] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.JS", pszSpec="*.docx") returned 0 [0096.503] lstrlenA (lpString="*.docx") returned 6 [0096.503] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.JS", pszSpec="*.xls") returned 0 [0096.503] lstrlenA (lpString="*.xls") returned 5 [0096.503] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.JS", pszSpec="*.xlsx") returned 0 [0096.503] lstrlenA (lpString="*.xlsx") returned 6 [0096.503] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.JS", pszSpec="*.ppt") returned 0 [0096.503] lstrlenA (lpString="*.ppt") returned 5 [0096.503] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.JS", pszSpec="*.pptx") returned 0 [0096.504] lstrlenA (lpString="*.pptx") returned 6 [0096.504] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.JS", pszSpec="*.txt") returned 0 [0096.504] lstrlenA (lpString="*.txt") returned 5 [0096.504] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.JS", pszSpec="*.pdf") returned 0 [0096.504] lstrlenA (lpString="*.pdf") returned 5 [0096.504] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.JS", pszSpec="*.djvu") returned 0 [0096.504] lstrlenA (lpString="*.djvu") returned 6 [0096.504] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.JS", pszSpec="*.htm") returned 0 [0096.504] lstrlenA (lpString="*.htm") returned 5 [0096.504] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.JS", pszSpec="*.html") returned 0 [0096.504] lstrlenA (lpString="*.html") returned 6 [0096.504] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.JS", pszSpec="*.mdb") returned 0 [0096.504] lstrlenA (lpString="*.mdb") returned 5 [0096.504] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.JS", pszSpec="*.cer") returned 0 [0096.504] lstrlenA (lpString="*.cer") returned 5 [0096.504] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.JS", pszSpec="*.p12") returned 0 [0096.504] lstrlenA (lpString="*.p12") returned 5 [0096.504] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.JS", pszSpec="*.pfx") returned 0 [0096.505] lstrlenA (lpString="*.pfx") returned 5 [0096.505] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.JS", pszSpec="*.kwm") returned 0 [0096.505] lstrlenA (lpString="*.kwm") returned 5 [0096.505] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.JS", pszSpec="*.pwm") returned 0 [0096.505] lstrlenA (lpString="*.pwm") returned 5 [0096.505] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.JS", pszSpec="*.1cd") returned 0 [0096.505] lstrlenA (lpString="*.1cd") returned 5 [0096.505] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.JS", pszSpec="*.md") returned 0 [0096.505] lstrlenA (lpString="*.md") returned 4 [0096.505] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.JS", pszSpec="*.mdf") returned 0 [0096.505] lstrlenA (lpString="*.mdf") returned 5 [0096.505] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.JS", pszSpec="*.dbf") returned 0 [0096.505] lstrlenA (lpString="*.dbf") returned 5 [0096.505] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.JS", pszSpec="*.odt") returned 0 [0096.505] lstrlenA (lpString="*.odt") returned 5 [0096.505] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.JS", pszSpec="*.vob") returned 0 [0096.505] lstrlenA (lpString="*.vob") returned 5 [0096.506] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.JS", pszSpec="*.ifo") returned 0 [0096.506] lstrlenA (lpString="*.ifo") returned 5 [0096.506] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.JS", pszSpec="*.lnk") returned 0 [0096.506] lstrlenA (lpString="*.lnk") returned 5 [0096.506] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.JS", pszSpec="*.torrent") returned 0 [0096.506] lstrlenA (lpString="*.torrent") returned 9 [0096.506] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.JS", pszSpec="*.mov") returned 0 [0096.506] lstrlenA (lpString="*.mov") returned 5 [0096.506] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.JS", pszSpec="*.m2v") returned 0 [0096.506] lstrlenA (lpString="*.m2v") returned 5 [0096.506] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.JS", pszSpec="*.3gp") returned 0 [0096.506] lstrlenA (lpString="*.3gp") returned 5 [0096.506] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.JS", pszSpec="*.mpeg") returned 0 [0096.506] lstrlenA (lpString="*.mpeg") returned 6 [0096.507] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.JS", pszSpec="*.mpg") returned 0 [0096.507] lstrlenA (lpString="*.mpg") returned 5 [0096.507] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.JS", pszSpec="*.flv") returned 0 [0096.507] lstrlenA (lpString="*.flv") returned 5 [0096.507] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.JS", pszSpec="*.avi") returned 0 [0096.507] lstrlenA (lpString="*.avi") returned 5 [0096.507] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.JS", pszSpec="*.mp4") returned 0 [0096.507] lstrlenA (lpString="*.mp4") returned 5 [0096.507] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.JS", pszSpec="*.wmv") returned 0 [0096.507] lstrlenA (lpString="*.wmv") returned 5 [0096.507] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.JS", pszSpec="*.divx") returned 0 [0096.507] lstrlenA (lpString="*.divx") returned 6 [0096.507] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.JS", pszSpec="*.mkv") returned 0 [0096.507] lstrlenA (lpString="*.mkv") returned 5 [0096.507] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.JS", pszSpec="*.mp3") returned 0 [0096.507] lstrlenA (lpString="*.mp3") returned 5 [0096.507] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.JS", pszSpec="*.wav") returned 0 [0096.507] lstrlenA (lpString="*.wav") returned 5 [0096.507] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.JS", pszSpec="*.flac") returned 0 [0096.507] lstrlenA (lpString="*.flac") returned 6 [0096.507] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.JS", pszSpec="*.ape") returned 0 [0096.507] lstrlenA (lpString="*.ape") returned 5 [0096.507] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.JS", pszSpec="*.wma") returned 0 [0096.507] lstrlenA (lpString="*.wma") returned 5 [0096.508] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.JS", pszSpec="*.ac3") returned 0 [0096.508] lstrlenA (lpString="*.ac3") returned 5 [0096.508] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0096.508] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0096.508] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="FormsBlankPage.html") returned -1 [0096.508] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FormsBlankPage.html") returned 1 [0096.508] lstrcmpiA (lpString1="", lpString2="FormsBlankPage.html") returned -1 [0096.508] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.JS") returned="FORM.JS" [0096.508] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="FormsBlankPage.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBlankPage.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBlankPage.html" [0096.508] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBlankPage.html", pszSpec="*.zip") returned 0 [0096.508] lstrlenA (lpString="*.zip") returned 5 [0096.508] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBlankPage.html", pszSpec="*.rar") returned 0 [0096.508] lstrlenA (lpString="*.rar") returned 5 [0096.508] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBlankPage.html", pszSpec="*.7z") returned 0 [0096.508] lstrlenA (lpString="*.7z") returned 4 [0096.508] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBlankPage.html", pszSpec="*.tar") returned 0 [0096.508] lstrlenA (lpString="*.tar") returned 5 [0096.508] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBlankPage.html", pszSpec="*.gzip") returned 0 [0096.508] lstrlenA (lpString="*.gzip") returned 6 [0096.508] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBlankPage.html", pszSpec="*.jpg") returned 0 [0096.508] lstrlenA (lpString="*.jpg") returned 5 [0096.508] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBlankPage.html", pszSpec="*.jpeg") returned 0 [0096.508] lstrlenA (lpString="*.jpeg") returned 6 [0096.509] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBlankPage.html", pszSpec="*.psd") returned 0 [0096.509] lstrlenA (lpString="*.psd") returned 5 [0096.509] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBlankPage.html", pszSpec="*.cdr") returned 0 [0096.509] lstrlenA (lpString="*.cdr") returned 5 [0096.509] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBlankPage.html", pszSpec="*.dwg") returned 0 [0096.509] lstrlenA (lpString="*.dwg") returned 5 [0096.509] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBlankPage.html", pszSpec="*.max") returned 0 [0096.509] lstrlenA (lpString="*.max") returned 5 [0096.509] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBlankPage.html", pszSpec="*.bmp") returned 0 [0096.509] lstrlenA (lpString="*.bmp") returned 5 [0096.509] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBlankPage.html", pszSpec="*.gif") returned 0 [0096.509] lstrlenA (lpString="*.gif") returned 5 [0096.509] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBlankPage.html", pszSpec="*.png") returned 0 [0096.509] lstrlenA (lpString="*.png") returned 5 [0096.509] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBlankPage.html", pszSpec="*.doc") returned 0 [0096.509] lstrlenA (lpString="*.doc") returned 5 [0096.509] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBlankPage.html", pszSpec="*.docx") returned 0 [0096.509] lstrlenA (lpString="*.docx") returned 6 [0096.509] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBlankPage.html", pszSpec="*.xls") returned 0 [0096.509] lstrlenA (lpString="*.xls") returned 5 [0096.509] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBlankPage.html", pszSpec="*.xlsx") returned 0 [0096.509] lstrlenA (lpString="*.xlsx") returned 6 [0096.509] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBlankPage.html", pszSpec="*.ppt") returned 0 [0096.509] lstrlenA (lpString="*.ppt") returned 5 [0096.509] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBlankPage.html", pszSpec="*.pptx") returned 0 [0096.510] lstrlenA (lpString="*.pptx") returned 6 [0096.510] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBlankPage.html", pszSpec="*.txt") returned 0 [0096.510] lstrlenA (lpString="*.txt") returned 5 [0096.510] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBlankPage.html", pszSpec="*.pdf") returned 0 [0096.510] lstrlenA (lpString="*.pdf") returned 5 [0096.510] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBlankPage.html", pszSpec="*.djvu") returned 0 [0096.510] lstrlenA (lpString="*.djvu") returned 6 [0096.510] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBlankPage.html", pszSpec="*.htm") returned 0 [0096.510] lstrlenA (lpString="*.htm") returned 5 [0096.510] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBlankPage.html", pszSpec="*.html") returned 1 [0096.510] lstrlenA (lpString="*.html") returned 6 [0096.510] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBlankPage.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBlankPage.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBlankPage.html" [0096.510] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBlankPage.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBlankPage.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBlankPage.html" [0096.510] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBlankPage.html", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBlankPage.html.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBlankPage.html." [0096.510] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBlankPage.html.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBlankPage.html. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBlankPage.html. " [0096.510] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBlankPage.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsblankpage.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0096.512] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x45f [0096.512] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9b7e1800, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x618c8a10, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9b7e1800, dwHighDateTime=0x1c747ea)) returned 1 [0096.512] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0096.512] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x405, lpOverlapped=0x0) returned 1 [0096.514] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBlankPage.html") returned="FormsBlankPage.html" [0096.514] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0096.514] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x405, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x405, lpOverlapped=0x0) returned 1 [0096.514] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0096.514] CloseHandle (hObject=0x98) returned 1 [0096.514] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBlankPage.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsblankpage.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBlankPage.html. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsblankpage.html. ")) returned 1 [0096.515] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0096.542] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0096.542] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="FormsBrowserUpgrade.html") returned -1 [0096.542] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FormsBrowserUpgrade.html") returned 1 [0096.542] lstrcmpiA (lpString1="", lpString2="FormsBrowserUpgrade.html") returned -1 [0096.542] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBlankPage.html") returned="FormsBlankPage.html" [0096.542] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="FormsBrowserUpgrade.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBrowserUpgrade.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBrowserUpgrade.html" [0096.542] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBrowserUpgrade.html", pszSpec="*.zip") returned 0 [0096.542] lstrlenA (lpString="*.zip") returned 5 [0096.542] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBrowserUpgrade.html", pszSpec="*.rar") returned 0 [0096.542] lstrlenA (lpString="*.rar") returned 5 [0096.542] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBrowserUpgrade.html", pszSpec="*.7z") returned 0 [0096.542] lstrlenA (lpString="*.7z") returned 4 [0096.542] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBrowserUpgrade.html", pszSpec="*.tar") returned 0 [0096.542] lstrlenA (lpString="*.tar") returned 5 [0096.542] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBrowserUpgrade.html", pszSpec="*.gzip") returned 0 [0096.542] lstrlenA (lpString="*.gzip") returned 6 [0096.542] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBrowserUpgrade.html", pszSpec="*.jpg") returned 0 [0096.542] lstrlenA (lpString="*.jpg") returned 5 [0096.542] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBrowserUpgrade.html", pszSpec="*.jpeg") returned 0 [0096.543] lstrlenA (lpString="*.jpeg") returned 6 [0096.543] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBrowserUpgrade.html", pszSpec="*.psd") returned 0 [0096.543] lstrlenA (lpString="*.psd") returned 5 [0096.543] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBrowserUpgrade.html", pszSpec="*.cdr") returned 0 [0096.543] lstrlenA (lpString="*.cdr") returned 5 [0096.543] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBrowserUpgrade.html", pszSpec="*.dwg") returned 0 [0096.543] lstrlenA (lpString="*.dwg") returned 5 [0096.543] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBrowserUpgrade.html", pszSpec="*.max") returned 0 [0096.543] lstrlenA (lpString="*.max") returned 5 [0096.543] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBrowserUpgrade.html", pszSpec="*.bmp") returned 0 [0096.543] lstrlenA (lpString="*.bmp") returned 5 [0096.543] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBrowserUpgrade.html", pszSpec="*.gif") returned 0 [0096.543] lstrlenA (lpString="*.gif") returned 5 [0096.543] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBrowserUpgrade.html", pszSpec="*.png") returned 0 [0096.543] lstrlenA (lpString="*.png") returned 5 [0096.543] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBrowserUpgrade.html", pszSpec="*.doc") returned 0 [0096.543] lstrlenA (lpString="*.doc") returned 5 [0096.543] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBrowserUpgrade.html", pszSpec="*.docx") returned 0 [0096.543] lstrlenA (lpString="*.docx") returned 6 [0096.543] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBrowserUpgrade.html", pszSpec="*.xls") returned 0 [0096.543] lstrlenA (lpString="*.xls") returned 5 [0096.543] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBrowserUpgrade.html", pszSpec="*.xlsx") returned 0 [0096.543] lstrlenA (lpString="*.xlsx") returned 6 [0096.543] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBrowserUpgrade.html", pszSpec="*.ppt") returned 0 [0096.543] lstrlenA (lpString="*.ppt") returned 5 [0096.543] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBrowserUpgrade.html", pszSpec="*.pptx") returned 0 [0096.543] lstrlenA (lpString="*.pptx") returned 6 [0096.543] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBrowserUpgrade.html", pszSpec="*.txt") returned 0 [0096.543] lstrlenA (lpString="*.txt") returned 5 [0096.543] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBrowserUpgrade.html", pszSpec="*.pdf") returned 0 [0096.543] lstrlenA (lpString="*.pdf") returned 5 [0096.543] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBrowserUpgrade.html", pszSpec="*.djvu") returned 0 [0096.543] lstrlenA (lpString="*.djvu") returned 6 [0096.543] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBrowserUpgrade.html", pszSpec="*.htm") returned 0 [0096.543] lstrlenA (lpString="*.htm") returned 5 [0096.543] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBrowserUpgrade.html", pszSpec="*.html") returned 1 [0096.543] lstrlenA (lpString="*.html") returned 6 [0096.543] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBrowserUpgrade.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBrowserUpgrade.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBrowserUpgrade.html" [0096.543] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBrowserUpgrade.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBrowserUpgrade.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBrowserUpgrade.html" [0096.543] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBrowserUpgrade.html", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBrowserUpgrade.html.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBrowserUpgrade.html." [0096.543] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBrowserUpgrade.html.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBrowserUpgrade.html. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBrowserUpgrade.html. " [0096.543] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBrowserUpgrade.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsbrowserupgrade.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0096.544] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x852 [0096.544] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9b7e1800, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x618c8a10, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9b7e1800, dwHighDateTime=0x1c747ea)) returned 1 [0096.544] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0096.544] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x7f8, lpOverlapped=0x0) returned 1 [0096.545] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBrowserUpgrade.html") returned="FormsBrowserUpgrade.html" [0096.545] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0096.545] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x7f8, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x7f8, lpOverlapped=0x0) returned 1 [0096.545] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0096.545] CloseHandle (hObject=0x98) returned 1 [0096.546] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBrowserUpgrade.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsbrowserupgrade.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBrowserUpgrade.html. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsbrowserupgrade.html. ")) returned 1 [0096.546] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0096.546] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0096.546] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="FormsColorChart.html") returned -1 [0096.546] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FormsColorChart.html") returned 1 [0096.546] lstrcmpiA (lpString1="", lpString2="FormsColorChart.html") returned -1 [0096.546] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBrowserUpgrade.html") returned="FormsBrowserUpgrade.html" [0096.546] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="FormsColorChart.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsColorChart.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsColorChart.html" [0096.546] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsColorChart.html", pszSpec="*.zip") returned 0 [0096.546] lstrlenA (lpString="*.zip") returned 5 [0096.546] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsColorChart.html", pszSpec="*.rar") returned 0 [0096.546] lstrlenA (lpString="*.rar") returned 5 [0096.547] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsColorChart.html", pszSpec="*.7z") returned 0 [0096.547] lstrlenA (lpString="*.7z") returned 4 [0096.547] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsColorChart.html", pszSpec="*.tar") returned 0 [0096.547] lstrlenA (lpString="*.tar") returned 5 [0096.547] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsColorChart.html", pszSpec="*.gzip") returned 0 [0096.547] lstrlenA (lpString="*.gzip") returned 6 [0096.547] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsColorChart.html", pszSpec="*.jpg") returned 0 [0096.547] lstrlenA (lpString="*.jpg") returned 5 [0096.547] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsColorChart.html", pszSpec="*.jpeg") returned 0 [0096.547] lstrlenA (lpString="*.jpeg") returned 6 [0096.547] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsColorChart.html", pszSpec="*.psd") returned 0 [0096.547] lstrlenA (lpString="*.psd") returned 5 [0096.547] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsColorChart.html", pszSpec="*.cdr") returned 0 [0096.547] lstrlenA (lpString="*.cdr") returned 5 [0096.547] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsColorChart.html", pszSpec="*.dwg") returned 0 [0096.547] lstrlenA (lpString="*.dwg") returned 5 [0096.547] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsColorChart.html", pszSpec="*.max") returned 0 [0096.547] lstrlenA (lpString="*.max") returned 5 [0096.547] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsColorChart.html", pszSpec="*.bmp") returned 0 [0096.547] lstrlenA (lpString="*.bmp") returned 5 [0096.547] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsColorChart.html", pszSpec="*.gif") returned 0 [0096.547] lstrlenA (lpString="*.gif") returned 5 [0096.547] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsColorChart.html", pszSpec="*.png") returned 0 [0096.547] lstrlenA (lpString="*.png") returned 5 [0096.547] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsColorChart.html", pszSpec="*.doc") returned 0 [0096.547] lstrlenA (lpString="*.doc") returned 5 [0096.547] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsColorChart.html", pszSpec="*.docx") returned 0 [0096.547] lstrlenA (lpString="*.docx") returned 6 [0096.547] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsColorChart.html", pszSpec="*.xls") returned 0 [0096.547] lstrlenA (lpString="*.xls") returned 5 [0096.547] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsColorChart.html", pszSpec="*.xlsx") returned 0 [0096.547] lstrlenA (lpString="*.xlsx") returned 6 [0096.547] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsColorChart.html", pszSpec="*.ppt") returned 0 [0096.547] lstrlenA (lpString="*.ppt") returned 5 [0096.547] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsColorChart.html", pszSpec="*.pptx") returned 0 [0096.547] lstrlenA (lpString="*.pptx") returned 6 [0096.547] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsColorChart.html", pszSpec="*.txt") returned 0 [0096.547] lstrlenA (lpString="*.txt") returned 5 [0096.547] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsColorChart.html", pszSpec="*.pdf") returned 0 [0096.547] lstrlenA (lpString="*.pdf") returned 5 [0096.547] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsColorChart.html", pszSpec="*.djvu") returned 0 [0096.547] lstrlenA (lpString="*.djvu") returned 6 [0096.547] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsColorChart.html", pszSpec="*.htm") returned 0 [0096.547] lstrlenA (lpString="*.htm") returned 5 [0096.547] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsColorChart.html", pszSpec="*.html") returned 1 [0096.547] lstrlenA (lpString="*.html") returned 6 [0096.547] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsColorChart.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsColorChart.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsColorChart.html" [0096.547] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsColorChart.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsColorChart.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsColorChart.html" [0096.547] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsColorChart.html", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsColorChart.html.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsColorChart.html." [0096.548] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsColorChart.html.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsColorChart.html. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsColorChart.html. " [0096.548] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsColorChart.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formscolorchart.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0096.548] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2ef [0096.548] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9caf4500, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x618c8a10, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9caf4500, dwHighDateTime=0x1c747ea)) returned 1 [0096.548] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0096.548] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x295, lpOverlapped=0x0) returned 1 [0096.549] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsColorChart.html") returned="FormsColorChart.html" [0096.549] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0096.549] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x295, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x295, lpOverlapped=0x0) returned 1 [0096.549] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0096.554] CloseHandle (hObject=0x98) returned 1 [0096.554] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsColorChart.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formscolorchart.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsColorChart.html. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formscolorchart.html. ")) returned 1 [0096.554] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0096.554] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0096.554] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="FormsFormTemplate.html") returned -1 [0096.555] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FormsFormTemplate.html") returned 1 [0096.555] lstrcmpiA (lpString1="", lpString2="FormsFormTemplate.html") returned -1 [0096.555] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsColorChart.html") returned="FormsColorChart.html" [0096.555] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="FormsFormTemplate.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsFormTemplate.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsFormTemplate.html" [0096.555] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsFormTemplate.html", pszSpec="*.zip") returned 0 [0096.555] lstrlenA (lpString="*.zip") returned 5 [0096.555] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsFormTemplate.html", pszSpec="*.rar") returned 0 [0096.555] lstrlenA (lpString="*.rar") returned 5 [0096.555] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsFormTemplate.html", pszSpec="*.7z") returned 0 [0096.555] lstrlenA (lpString="*.7z") returned 4 [0096.555] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsFormTemplate.html", pszSpec="*.tar") returned 0 [0096.555] lstrlenA (lpString="*.tar") returned 5 [0096.555] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsFormTemplate.html", pszSpec="*.gzip") returned 0 [0096.555] lstrlenA (lpString="*.gzip") returned 6 [0096.555] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsFormTemplate.html", pszSpec="*.jpg") returned 0 [0096.555] lstrlenA (lpString="*.jpg") returned 5 [0096.555] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsFormTemplate.html", pszSpec="*.jpeg") returned 0 [0096.555] lstrlenA (lpString="*.jpeg") returned 6 [0096.555] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsFormTemplate.html", pszSpec="*.psd") returned 0 [0096.555] lstrlenA (lpString="*.psd") returned 5 [0096.555] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsFormTemplate.html", pszSpec="*.cdr") returned 0 [0096.555] lstrlenA (lpString="*.cdr") returned 5 [0096.555] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsFormTemplate.html", pszSpec="*.dwg") returned 0 [0096.555] lstrlenA (lpString="*.dwg") returned 5 [0096.555] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsFormTemplate.html", pszSpec="*.max") returned 0 [0096.555] lstrlenA (lpString="*.max") returned 5 [0096.555] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsFormTemplate.html", pszSpec="*.bmp") returned 0 [0096.555] lstrlenA (lpString="*.bmp") returned 5 [0096.555] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsFormTemplate.html", pszSpec="*.gif") returned 0 [0096.555] lstrlenA (lpString="*.gif") returned 5 [0096.555] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsFormTemplate.html", pszSpec="*.png") returned 0 [0096.555] lstrlenA (lpString="*.png") returned 5 [0096.555] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsFormTemplate.html", pszSpec="*.doc") returned 0 [0096.555] lstrlenA (lpString="*.doc") returned 5 [0096.555] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsFormTemplate.html", pszSpec="*.docx") returned 0 [0096.555] lstrlenA (lpString="*.docx") returned 6 [0096.555] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsFormTemplate.html", pszSpec="*.xls") returned 0 [0096.555] lstrlenA (lpString="*.xls") returned 5 [0096.555] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsFormTemplate.html", pszSpec="*.xlsx") returned 0 [0096.555] lstrlenA (lpString="*.xlsx") returned 6 [0096.555] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsFormTemplate.html", pszSpec="*.ppt") returned 0 [0096.555] lstrlenA (lpString="*.ppt") returned 5 [0096.555] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsFormTemplate.html", pszSpec="*.pptx") returned 0 [0096.555] lstrlenA (lpString="*.pptx") returned 6 [0096.555] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsFormTemplate.html", pszSpec="*.txt") returned 0 [0096.555] lstrlenA (lpString="*.txt") returned 5 [0096.556] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsFormTemplate.html", pszSpec="*.pdf") returned 0 [0096.556] lstrlenA (lpString="*.pdf") returned 5 [0096.556] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsFormTemplate.html", pszSpec="*.djvu") returned 0 [0096.556] lstrlenA (lpString="*.djvu") returned 6 [0096.556] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsFormTemplate.html", pszSpec="*.htm") returned 0 [0096.556] lstrlenA (lpString="*.htm") returned 5 [0096.556] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsFormTemplate.html", pszSpec="*.html") returned 1 [0096.556] lstrlenA (lpString="*.html") returned 6 [0096.556] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsFormTemplate.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsFormTemplate.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsFormTemplate.html" [0096.556] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsFormTemplate.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsFormTemplate.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsFormTemplate.html" [0096.556] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsFormTemplate.html", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsFormTemplate.html.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsFormTemplate.html." [0096.556] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsFormTemplate.html.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsFormTemplate.html. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsFormTemplate.html. " [0096.556] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsFormTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsformtemplate.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0096.556] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x115a [0096.556] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9caf4500, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x618c8a10, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9caf4500, dwHighDateTime=0x1c747ea)) returned 1 [0096.556] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0096.556] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x1100, lpOverlapped=0x0) returned 1 [0096.557] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsFormTemplate.html") returned="FormsFormTemplate.html" [0096.557] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0096.557] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x1100, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x1100, lpOverlapped=0x0) returned 1 [0096.558] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0096.558] CloseHandle (hObject=0x98) returned 1 [0096.558] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsFormTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsformtemplate.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsFormTemplate.html. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsformtemplate.html. ")) returned 1 [0096.558] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0096.558] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0096.558] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="FormsHomePage.html") returned -1 [0096.558] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FormsHomePage.html") returned 1 [0096.558] lstrcmpiA (lpString1="", lpString2="FormsHomePage.html") returned -1 [0096.558] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsFormTemplate.html") returned="FormsFormTemplate.html" [0096.558] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="FormsHomePage.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePage.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePage.html" [0096.558] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePage.html", pszSpec="*.zip") returned 0 [0096.558] lstrlenA (lpString="*.zip") returned 5 [0096.558] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePage.html", pszSpec="*.rar") returned 0 [0096.558] lstrlenA (lpString="*.rar") returned 5 [0096.558] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePage.html", pszSpec="*.7z") returned 0 [0096.558] lstrlenA (lpString="*.7z") returned 4 [0096.559] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePage.html", pszSpec="*.tar") returned 0 [0096.559] lstrlenA (lpString="*.tar") returned 5 [0096.559] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePage.html", pszSpec="*.gzip") returned 0 [0096.559] lstrlenA (lpString="*.gzip") returned 6 [0096.559] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePage.html", pszSpec="*.jpg") returned 0 [0096.559] lstrlenA (lpString="*.jpg") returned 5 [0096.559] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePage.html", pszSpec="*.jpeg") returned 0 [0096.559] lstrlenA (lpString="*.jpeg") returned 6 [0096.559] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePage.html", pszSpec="*.psd") returned 0 [0096.559] lstrlenA (lpString="*.psd") returned 5 [0096.559] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePage.html", pszSpec="*.cdr") returned 0 [0096.559] lstrlenA (lpString="*.cdr") returned 5 [0096.559] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePage.html", pszSpec="*.dwg") returned 0 [0096.559] lstrlenA (lpString="*.dwg") returned 5 [0096.559] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePage.html", pszSpec="*.max") returned 0 [0096.559] lstrlenA (lpString="*.max") returned 5 [0096.559] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePage.html", pszSpec="*.bmp") returned 0 [0096.559] lstrlenA (lpString="*.bmp") returned 5 [0096.559] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePage.html", pszSpec="*.gif") returned 0 [0096.559] lstrlenA (lpString="*.gif") returned 5 [0096.559] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePage.html", pszSpec="*.png") returned 0 [0096.559] lstrlenA (lpString="*.png") returned 5 [0096.559] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePage.html", pszSpec="*.doc") returned 0 [0096.559] lstrlenA (lpString="*.doc") returned 5 [0096.559] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePage.html", pszSpec="*.docx") returned 0 [0096.559] lstrlenA (lpString="*.docx") returned 6 [0096.559] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePage.html", pszSpec="*.xls") returned 0 [0096.559] lstrlenA (lpString="*.xls") returned 5 [0096.559] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePage.html", pszSpec="*.xlsx") returned 0 [0096.559] lstrlenA (lpString="*.xlsx") returned 6 [0096.559] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePage.html", pszSpec="*.ppt") returned 0 [0096.559] lstrlenA (lpString="*.ppt") returned 5 [0096.559] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePage.html", pszSpec="*.pptx") returned 0 [0096.559] lstrlenA (lpString="*.pptx") returned 6 [0096.559] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePage.html", pszSpec="*.txt") returned 0 [0096.559] lstrlenA (lpString="*.txt") returned 5 [0096.559] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePage.html", pszSpec="*.pdf") returned 0 [0096.559] lstrlenA (lpString="*.pdf") returned 5 [0096.559] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePage.html", pszSpec="*.djvu") returned 0 [0096.559] lstrlenA (lpString="*.djvu") returned 6 [0096.559] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePage.html", pszSpec="*.htm") returned 0 [0096.559] lstrlenA (lpString="*.htm") returned 5 [0096.559] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePage.html", pszSpec="*.html") returned 1 [0096.559] lstrlenA (lpString="*.html") returned 6 [0096.559] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePage.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePage.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePage.html" [0096.559] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePage.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePage.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePage.html" [0096.559] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePage.html", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePage.html.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePage.html." [0096.559] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePage.html.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePage.html. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePage.html. " [0096.559] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePage.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formshomepage.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0096.560] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xd9c [0096.560] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9caf4500, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5291c2f0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9caf4500, dwHighDateTime=0x1c747ea)) returned 1 [0096.560] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0096.560] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0xd42, lpOverlapped=0x0) returned 1 [0096.561] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePage.html") returned="FormsHomePage.html" [0096.561] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0096.561] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0xd42, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0xd42, lpOverlapped=0x0) returned 1 [0096.561] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0096.561] CloseHandle (hObject=0x98) returned 1 [0096.561] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePage.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formshomepage.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePage.html. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formshomepage.html. ")) returned 1 [0096.562] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0096.562] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0096.562] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="FormsHomePageScript.js") returned -1 [0096.562] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FormsHomePageScript.js") returned 1 [0096.562] lstrcmpiA (lpString1="", lpString2="FormsHomePageScript.js") returned -1 [0096.562] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePage.html") returned="FormsHomePage.html" [0096.562] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="FormsHomePageScript.js" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageScript.js") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageScript.js" [0096.562] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageScript.js", pszSpec="*.zip") returned 0 [0096.562] lstrlenA (lpString="*.zip") returned 5 [0096.562] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageScript.js", pszSpec="*.rar") returned 0 [0096.562] lstrlenA (lpString="*.rar") returned 5 [0096.562] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageScript.js", pszSpec="*.7z") returned 0 [0096.562] lstrlenA (lpString="*.7z") returned 4 [0096.562] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageScript.js", pszSpec="*.tar") returned 0 [0096.562] lstrlenA (lpString="*.tar") returned 5 [0096.562] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageScript.js", pszSpec="*.gzip") returned 0 [0096.562] lstrlenA (lpString="*.gzip") returned 6 [0096.562] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageScript.js", pszSpec="*.jpg") returned 0 [0096.562] lstrlenA (lpString="*.jpg") returned 5 [0096.562] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageScript.js", pszSpec="*.jpeg") returned 0 [0096.562] lstrlenA (lpString="*.jpeg") returned 6 [0096.562] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageScript.js", pszSpec="*.psd") returned 0 [0096.562] lstrlenA (lpString="*.psd") returned 5 [0096.562] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageScript.js", pszSpec="*.cdr") returned 0 [0096.562] lstrlenA (lpString="*.cdr") returned 5 [0096.562] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageScript.js", pszSpec="*.dwg") returned 0 [0096.562] lstrlenA (lpString="*.dwg") returned 5 [0096.562] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageScript.js", pszSpec="*.max") returned 0 [0096.562] lstrlenA (lpString="*.max") returned 5 [0096.562] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageScript.js", pszSpec="*.bmp") returned 0 [0096.562] lstrlenA (lpString="*.bmp") returned 5 [0096.562] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageScript.js", pszSpec="*.gif") returned 0 [0096.562] lstrlenA (lpString="*.gif") returned 5 [0096.562] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageScript.js", pszSpec="*.png") returned 0 [0096.562] lstrlenA (lpString="*.png") returned 5 [0096.562] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageScript.js", pszSpec="*.doc") returned 0 [0096.562] lstrlenA (lpString="*.doc") returned 5 [0096.562] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageScript.js", pszSpec="*.docx") returned 0 [0096.562] lstrlenA (lpString="*.docx") returned 6 [0096.562] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageScript.js", pszSpec="*.xls") returned 0 [0096.562] lstrlenA (lpString="*.xls") returned 5 [0096.563] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageScript.js", pszSpec="*.xlsx") returned 0 [0096.563] lstrlenA (lpString="*.xlsx") returned 6 [0096.563] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageScript.js", pszSpec="*.ppt") returned 0 [0096.563] lstrlenA (lpString="*.ppt") returned 5 [0096.563] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageScript.js", pszSpec="*.pptx") returned 0 [0096.563] lstrlenA (lpString="*.pptx") returned 6 [0096.563] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageScript.js", pszSpec="*.txt") returned 0 [0096.563] lstrlenA (lpString="*.txt") returned 5 [0096.563] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageScript.js", pszSpec="*.pdf") returned 0 [0096.563] lstrlenA (lpString="*.pdf") returned 5 [0096.563] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageScript.js", pszSpec="*.djvu") returned 0 [0096.563] lstrlenA (lpString="*.djvu") returned 6 [0096.563] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageScript.js", pszSpec="*.htm") returned 0 [0096.563] lstrlenA (lpString="*.htm") returned 5 [0096.563] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageScript.js", pszSpec="*.html") returned 0 [0096.563] lstrlenA (lpString="*.html") returned 6 [0096.563] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageScript.js", pszSpec="*.mdb") returned 0 [0096.563] lstrlenA (lpString="*.mdb") returned 5 [0096.563] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageScript.js", pszSpec="*.cer") returned 0 [0096.563] lstrlenA (lpString="*.cer") returned 5 [0096.563] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageScript.js", pszSpec="*.p12") returned 0 [0096.563] lstrlenA (lpString="*.p12") returned 5 [0096.563] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageScript.js", pszSpec="*.pfx") returned 0 [0096.563] lstrlenA (lpString="*.pfx") returned 5 [0096.563] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageScript.js", pszSpec="*.kwm") returned 0 [0096.563] lstrlenA (lpString="*.kwm") returned 5 [0096.563] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageScript.js", pszSpec="*.pwm") returned 0 [0096.563] lstrlenA (lpString="*.pwm") returned 5 [0096.563] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageScript.js", pszSpec="*.1cd") returned 0 [0096.563] lstrlenA (lpString="*.1cd") returned 5 [0096.563] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageScript.js", pszSpec="*.md") returned 0 [0096.563] lstrlenA (lpString="*.md") returned 4 [0096.563] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageScript.js", pszSpec="*.mdf") returned 0 [0096.563] lstrlenA (lpString="*.mdf") returned 5 [0096.563] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageScript.js", pszSpec="*.dbf") returned 0 [0096.563] lstrlenA (lpString="*.dbf") returned 5 [0096.563] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageScript.js", pszSpec="*.odt") returned 0 [0096.563] lstrlenA (lpString="*.odt") returned 5 [0096.563] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageScript.js", pszSpec="*.vob") returned 0 [0096.563] lstrlenA (lpString="*.vob") returned 5 [0096.563] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageScript.js", pszSpec="*.ifo") returned 0 [0096.563] lstrlenA (lpString="*.ifo") returned 5 [0096.563] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageScript.js", pszSpec="*.lnk") returned 0 [0096.563] lstrlenA (lpString="*.lnk") returned 5 [0096.563] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageScript.js", pszSpec="*.torrent") returned 0 [0096.563] lstrlenA (lpString="*.torrent") returned 9 [0096.563] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageScript.js", pszSpec="*.mov") returned 0 [0096.563] lstrlenA (lpString="*.mov") returned 5 [0096.563] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageScript.js", pszSpec="*.m2v") returned 0 [0096.563] lstrlenA (lpString="*.m2v") returned 5 [0096.564] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageScript.js", pszSpec="*.3gp") returned 0 [0096.564] lstrlenA (lpString="*.3gp") returned 5 [0096.564] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageScript.js", pszSpec="*.mpeg") returned 0 [0096.564] lstrlenA (lpString="*.mpeg") returned 6 [0096.564] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageScript.js", pszSpec="*.mpg") returned 0 [0096.564] lstrlenA (lpString="*.mpg") returned 5 [0096.564] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageScript.js", pszSpec="*.flv") returned 0 [0096.564] lstrlenA (lpString="*.flv") returned 5 [0096.564] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageScript.js", pszSpec="*.avi") returned 0 [0096.564] lstrlenA (lpString="*.avi") returned 5 [0096.564] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageScript.js", pszSpec="*.mp4") returned 0 [0096.564] lstrlenA (lpString="*.mp4") returned 5 [0096.564] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageScript.js", pszSpec="*.wmv") returned 0 [0096.564] lstrlenA (lpString="*.wmv") returned 5 [0096.564] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageScript.js", pszSpec="*.divx") returned 0 [0096.564] lstrlenA (lpString="*.divx") returned 6 [0096.564] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageScript.js", pszSpec="*.mkv") returned 0 [0096.564] lstrlenA (lpString="*.mkv") returned 5 [0096.564] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageScript.js", pszSpec="*.mp3") returned 0 [0096.564] lstrlenA (lpString="*.mp3") returned 5 [0096.564] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageScript.js", pszSpec="*.wav") returned 0 [0096.564] lstrlenA (lpString="*.wav") returned 5 [0096.564] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageScript.js", pszSpec="*.flac") returned 0 [0096.564] lstrlenA (lpString="*.flac") returned 6 [0096.564] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageScript.js", pszSpec="*.ape") returned 0 [0096.564] lstrlenA (lpString="*.ape") returned 5 [0096.564] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageScript.js", pszSpec="*.wma") returned 0 [0096.564] lstrlenA (lpString="*.wma") returned 5 [0096.564] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageScript.js", pszSpec="*.ac3") returned 0 [0096.564] lstrlenA (lpString="*.ac3") returned 5 [0096.564] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0096.564] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0096.564] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="FormsHomePageStyle.css") returned -1 [0096.564] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FormsHomePageStyle.css") returned 1 [0096.564] lstrcmpiA (lpString1="", lpString2="FormsHomePageStyle.css") returned -1 [0096.564] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageScript.js") returned="FormsHomePageScript.js" [0096.564] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="FormsHomePageStyle.css" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageStyle.css") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageStyle.css" [0096.564] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageStyle.css", pszSpec="*.zip") returned 0 [0096.564] lstrlenA (lpString="*.zip") returned 5 [0096.564] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageStyle.css", pszSpec="*.rar") returned 0 [0096.564] lstrlenA (lpString="*.rar") returned 5 [0096.564] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageStyle.css", pszSpec="*.7z") returned 0 [0096.564] lstrlenA (lpString="*.7z") returned 4 [0096.564] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageStyle.css", pszSpec="*.tar") returned 0 [0096.564] lstrlenA (lpString="*.tar") returned 5 [0096.564] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageStyle.css", pszSpec="*.gzip") returned 0 [0096.564] lstrlenA (lpString="*.gzip") returned 6 [0096.564] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageStyle.css", pszSpec="*.jpg") returned 0 [0096.564] lstrlenA (lpString="*.jpg") returned 5 [0096.564] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageStyle.css", pszSpec="*.jpeg") returned 0 [0096.565] lstrlenA (lpString="*.jpeg") returned 6 [0096.565] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageStyle.css", pszSpec="*.psd") returned 0 [0096.565] lstrlenA (lpString="*.psd") returned 5 [0096.565] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageStyle.css", pszSpec="*.cdr") returned 0 [0096.565] lstrlenA (lpString="*.cdr") returned 5 [0096.565] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageStyle.css", pszSpec="*.dwg") returned 0 [0096.565] lstrlenA (lpString="*.dwg") returned 5 [0096.565] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageStyle.css", pszSpec="*.max") returned 0 [0096.565] lstrlenA (lpString="*.max") returned 5 [0096.565] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageStyle.css", pszSpec="*.bmp") returned 0 [0096.565] lstrlenA (lpString="*.bmp") returned 5 [0096.565] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageStyle.css", pszSpec="*.gif") returned 0 [0096.565] lstrlenA (lpString="*.gif") returned 5 [0096.565] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageStyle.css", pszSpec="*.png") returned 0 [0096.565] lstrlenA (lpString="*.png") returned 5 [0096.565] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageStyle.css", pszSpec="*.doc") returned 0 [0096.565] lstrlenA (lpString="*.doc") returned 5 [0096.565] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageStyle.css", pszSpec="*.docx") returned 0 [0096.565] lstrlenA (lpString="*.docx") returned 6 [0096.565] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageStyle.css", pszSpec="*.xls") returned 0 [0096.565] lstrlenA (lpString="*.xls") returned 5 [0096.565] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageStyle.css", pszSpec="*.xlsx") returned 0 [0096.565] lstrlenA (lpString="*.xlsx") returned 6 [0096.565] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageStyle.css", pszSpec="*.ppt") returned 0 [0096.565] lstrlenA (lpString="*.ppt") returned 5 [0096.565] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageStyle.css", pszSpec="*.pptx") returned 0 [0096.565] lstrlenA (lpString="*.pptx") returned 6 [0096.565] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageStyle.css", pszSpec="*.txt") returned 0 [0096.565] lstrlenA (lpString="*.txt") returned 5 [0096.565] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageStyle.css", pszSpec="*.pdf") returned 0 [0096.565] lstrlenA (lpString="*.pdf") returned 5 [0096.565] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageStyle.css", pszSpec="*.djvu") returned 0 [0096.565] lstrlenA (lpString="*.djvu") returned 6 [0096.565] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageStyle.css", pszSpec="*.htm") returned 0 [0096.565] lstrlenA (lpString="*.htm") returned 5 [0096.565] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageStyle.css", pszSpec="*.html") returned 0 [0096.565] lstrlenA (lpString="*.html") returned 6 [0096.565] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageStyle.css", pszSpec="*.mdb") returned 0 [0096.565] lstrlenA (lpString="*.mdb") returned 5 [0096.565] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageStyle.css", pszSpec="*.cer") returned 0 [0096.565] lstrlenA (lpString="*.cer") returned 5 [0096.565] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageStyle.css", pszSpec="*.p12") returned 0 [0096.565] lstrlenA (lpString="*.p12") returned 5 [0096.565] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageStyle.css", pszSpec="*.pfx") returned 0 [0096.566] lstrlenA (lpString="*.pfx") returned 5 [0096.566] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageStyle.css", pszSpec="*.kwm") returned 0 [0096.566] lstrlenA (lpString="*.kwm") returned 5 [0096.566] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageStyle.css", pszSpec="*.pwm") returned 0 [0096.566] lstrlenA (lpString="*.pwm") returned 5 [0096.566] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageStyle.css", pszSpec="*.1cd") returned 0 [0096.566] lstrlenA (lpString="*.1cd") returned 5 [0096.566] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageStyle.css", pszSpec="*.md") returned 0 [0096.566] lstrlenA (lpString="*.md") returned 4 [0096.566] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageStyle.css", pszSpec="*.mdf") returned 0 [0096.566] lstrlenA (lpString="*.mdf") returned 5 [0096.566] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageStyle.css", pszSpec="*.dbf") returned 0 [0096.566] lstrlenA (lpString="*.dbf") returned 5 [0096.566] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageStyle.css", pszSpec="*.odt") returned 0 [0096.566] lstrlenA (lpString="*.odt") returned 5 [0096.566] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageStyle.css", pszSpec="*.vob") returned 0 [0096.566] lstrlenA (lpString="*.vob") returned 5 [0096.566] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageStyle.css", pszSpec="*.ifo") returned 0 [0096.566] lstrlenA (lpString="*.ifo") returned 5 [0096.566] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageStyle.css", pszSpec="*.lnk") returned 0 [0096.566] lstrlenA (lpString="*.lnk") returned 5 [0096.566] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageStyle.css", pszSpec="*.torrent") returned 0 [0096.566] lstrlenA (lpString="*.torrent") returned 9 [0096.566] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageStyle.css", pszSpec="*.mov") returned 0 [0096.566] lstrlenA (lpString="*.mov") returned 5 [0096.566] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageStyle.css", pszSpec="*.m2v") returned 0 [0096.566] lstrlenA (lpString="*.m2v") returned 5 [0096.566] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageStyle.css", pszSpec="*.3gp") returned 0 [0096.566] lstrlenA (lpString="*.3gp") returned 5 [0096.566] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageStyle.css", pszSpec="*.mpeg") returned 0 [0096.566] lstrlenA (lpString="*.mpeg") returned 6 [0096.566] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageStyle.css", pszSpec="*.mpg") returned 0 [0096.566] lstrlenA (lpString="*.mpg") returned 5 [0096.566] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageStyle.css", pszSpec="*.flv") returned 0 [0096.566] lstrlenA (lpString="*.flv") returned 5 [0096.566] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageStyle.css", pszSpec="*.avi") returned 0 [0096.566] lstrlenA (lpString="*.avi") returned 5 [0096.566] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageStyle.css", pszSpec="*.mp4") returned 0 [0096.566] lstrlenA (lpString="*.mp4") returned 5 [0096.566] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageStyle.css", pszSpec="*.wmv") returned 0 [0096.566] lstrlenA (lpString="*.wmv") returned 5 [0096.566] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageStyle.css", pszSpec="*.divx") returned 0 [0096.566] lstrlenA (lpString="*.divx") returned 6 [0096.566] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageStyle.css", pszSpec="*.mkv") returned 0 [0096.566] lstrlenA (lpString="*.mkv") returned 5 [0096.566] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageStyle.css", pszSpec="*.mp3") returned 0 [0096.566] lstrlenA (lpString="*.mp3") returned 5 [0096.566] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageStyle.css", pszSpec="*.wav") returned 0 [0096.566] lstrlenA (lpString="*.wav") returned 5 [0096.566] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageStyle.css", pszSpec="*.flac") returned 0 [0096.566] lstrlenA (lpString="*.flac") returned 6 [0096.567] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageStyle.css", pszSpec="*.ape") returned 0 [0096.567] lstrlenA (lpString="*.ape") returned 5 [0096.567] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageStyle.css", pszSpec="*.wma") returned 0 [0096.567] lstrlenA (lpString="*.wma") returned 5 [0096.567] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageStyle.css", pszSpec="*.ac3") returned 0 [0096.567] lstrlenA (lpString="*.ac3") returned 5 [0096.567] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0096.567] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0096.567] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="FormsImageTemplate.html") returned -1 [0096.567] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FormsImageTemplate.html") returned 1 [0096.567] lstrcmpiA (lpString1="", lpString2="FormsImageTemplate.html") returned -1 [0096.567] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageStyle.css") returned="FormsHomePageStyle.css" [0096.567] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="FormsImageTemplate.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsImageTemplate.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsImageTemplate.html" [0096.567] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsImageTemplate.html", pszSpec="*.zip") returned 0 [0096.567] lstrlenA (lpString="*.zip") returned 5 [0096.567] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsImageTemplate.html", pszSpec="*.rar") returned 0 [0096.567] lstrlenA (lpString="*.rar") returned 5 [0096.567] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsImageTemplate.html", pszSpec="*.7z") returned 0 [0096.567] lstrlenA (lpString="*.7z") returned 4 [0096.567] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsImageTemplate.html", pszSpec="*.tar") returned 0 [0096.567] lstrlenA (lpString="*.tar") returned 5 [0096.567] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsImageTemplate.html", pszSpec="*.gzip") returned 0 [0096.567] lstrlenA (lpString="*.gzip") returned 6 [0096.567] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsImageTemplate.html", pszSpec="*.jpg") returned 0 [0096.567] lstrlenA (lpString="*.jpg") returned 5 [0096.567] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsImageTemplate.html", pszSpec="*.jpeg") returned 0 [0096.567] lstrlenA (lpString="*.jpeg") returned 6 [0096.567] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsImageTemplate.html", pszSpec="*.psd") returned 0 [0096.567] lstrlenA (lpString="*.psd") returned 5 [0096.567] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsImageTemplate.html", pszSpec="*.cdr") returned 0 [0096.567] lstrlenA (lpString="*.cdr") returned 5 [0096.567] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsImageTemplate.html", pszSpec="*.dwg") returned 0 [0096.567] lstrlenA (lpString="*.dwg") returned 5 [0096.567] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsImageTemplate.html", pszSpec="*.max") returned 0 [0096.567] lstrlenA (lpString="*.max") returned 5 [0096.567] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsImageTemplate.html", pszSpec="*.bmp") returned 0 [0096.567] lstrlenA (lpString="*.bmp") returned 5 [0096.567] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsImageTemplate.html", pszSpec="*.gif") returned 0 [0096.567] lstrlenA (lpString="*.gif") returned 5 [0096.567] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsImageTemplate.html", pszSpec="*.png") returned 0 [0096.567] lstrlenA (lpString="*.png") returned 5 [0096.567] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsImageTemplate.html", pszSpec="*.doc") returned 0 [0096.567] lstrlenA (lpString="*.doc") returned 5 [0096.567] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsImageTemplate.html", pszSpec="*.docx") returned 0 [0096.567] lstrlenA (lpString="*.docx") returned 6 [0096.567] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsImageTemplate.html", pszSpec="*.xls") returned 0 [0096.567] lstrlenA (lpString="*.xls") returned 5 [0096.568] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsImageTemplate.html", pszSpec="*.xlsx") returned 0 [0096.568] lstrlenA (lpString="*.xlsx") returned 6 [0096.568] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsImageTemplate.html", pszSpec="*.ppt") returned 0 [0096.568] lstrlenA (lpString="*.ppt") returned 5 [0096.568] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsImageTemplate.html", pszSpec="*.pptx") returned 0 [0096.568] lstrlenA (lpString="*.pptx") returned 6 [0096.568] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsImageTemplate.html", pszSpec="*.txt") returned 0 [0096.568] lstrlenA (lpString="*.txt") returned 5 [0096.568] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsImageTemplate.html", pszSpec="*.pdf") returned 0 [0096.568] lstrlenA (lpString="*.pdf") returned 5 [0096.568] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsImageTemplate.html", pszSpec="*.djvu") returned 0 [0096.568] lstrlenA (lpString="*.djvu") returned 6 [0096.568] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsImageTemplate.html", pszSpec="*.htm") returned 0 [0096.568] lstrlenA (lpString="*.htm") returned 5 [0096.568] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsImageTemplate.html", pszSpec="*.html") returned 1 [0096.568] lstrlenA (lpString="*.html") returned 6 [0096.568] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsImageTemplate.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsImageTemplate.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsImageTemplate.html" [0096.568] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsImageTemplate.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsImageTemplate.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsImageTemplate.html" [0096.568] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsImageTemplate.html", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsImageTemplate.html.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsImageTemplate.html." [0096.568] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsImageTemplate.html.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsImageTemplate.html. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsImageTemplate.html. " [0096.568] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsImageTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsimagetemplate.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0096.569] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x7f0 [0096.569] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9caf4500, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5291c2f0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9caf4500, dwHighDateTime=0x1c747ea)) returned 1 [0096.569] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0096.569] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x796, lpOverlapped=0x0) returned 1 [0096.595] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsImageTemplate.html") returned="FormsImageTemplate.html" [0096.595] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0096.595] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x796, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x796, lpOverlapped=0x0) returned 1 [0096.595] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0096.595] CloseHandle (hObject=0x98) returned 1 [0096.595] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsImageTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsimagetemplate.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsImageTemplate.html. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsimagetemplate.html. ")) returned 1 [0096.597] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0096.597] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0096.597] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="FormsMacroTemplate.html") returned -1 [0096.597] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FormsMacroTemplate.html") returned 1 [0096.597] lstrcmpiA (lpString1="", lpString2="FormsMacroTemplate.html") returned -1 [0096.597] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsImageTemplate.html") returned="FormsImageTemplate.html" [0096.597] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="FormsMacroTemplate.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsMacroTemplate.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsMacroTemplate.html" [0096.597] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsMacroTemplate.html", pszSpec="*.zip") returned 0 [0096.597] lstrlenA (lpString="*.zip") returned 5 [0096.597] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsMacroTemplate.html", pszSpec="*.rar") returned 0 [0096.597] lstrlenA (lpString="*.rar") returned 5 [0096.597] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsMacroTemplate.html", pszSpec="*.7z") returned 0 [0096.597] lstrlenA (lpString="*.7z") returned 4 [0096.597] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsMacroTemplate.html", pszSpec="*.tar") returned 0 [0096.597] lstrlenA (lpString="*.tar") returned 5 [0096.597] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsMacroTemplate.html", pszSpec="*.gzip") returned 0 [0096.597] lstrlenA (lpString="*.gzip") returned 6 [0096.597] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsMacroTemplate.html", pszSpec="*.jpg") returned 0 [0096.597] lstrlenA (lpString="*.jpg") returned 5 [0096.597] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsMacroTemplate.html", pszSpec="*.jpeg") returned 0 [0096.597] lstrlenA (lpString="*.jpeg") returned 6 [0096.597] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsMacroTemplate.html", pszSpec="*.psd") returned 0 [0096.597] lstrlenA (lpString="*.psd") returned 5 [0096.597] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsMacroTemplate.html", pszSpec="*.cdr") returned 0 [0096.597] lstrlenA (lpString="*.cdr") returned 5 [0096.597] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsMacroTemplate.html", pszSpec="*.dwg") returned 0 [0096.597] lstrlenA (lpString="*.dwg") returned 5 [0096.597] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsMacroTemplate.html", pszSpec="*.max") returned 0 [0096.597] lstrlenA (lpString="*.max") returned 5 [0096.597] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsMacroTemplate.html", pszSpec="*.bmp") returned 0 [0096.597] lstrlenA (lpString="*.bmp") returned 5 [0096.597] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsMacroTemplate.html", pszSpec="*.gif") returned 0 [0096.597] lstrlenA (lpString="*.gif") returned 5 [0096.597] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsMacroTemplate.html", pszSpec="*.png") returned 0 [0096.597] lstrlenA (lpString="*.png") returned 5 [0096.597] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsMacroTemplate.html", pszSpec="*.doc") returned 0 [0096.597] lstrlenA (lpString="*.doc") returned 5 [0096.597] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsMacroTemplate.html", pszSpec="*.docx") returned 0 [0096.597] lstrlenA (lpString="*.docx") returned 6 [0096.597] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsMacroTemplate.html", pszSpec="*.xls") returned 0 [0096.598] lstrlenA (lpString="*.xls") returned 5 [0096.598] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsMacroTemplate.html", pszSpec="*.xlsx") returned 0 [0096.598] lstrlenA (lpString="*.xlsx") returned 6 [0096.598] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsMacroTemplate.html", pszSpec="*.ppt") returned 0 [0096.598] lstrlenA (lpString="*.ppt") returned 5 [0096.598] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsMacroTemplate.html", pszSpec="*.pptx") returned 0 [0096.598] lstrlenA (lpString="*.pptx") returned 6 [0096.598] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsMacroTemplate.html", pszSpec="*.txt") returned 0 [0096.598] lstrlenA (lpString="*.txt") returned 5 [0096.598] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsMacroTemplate.html", pszSpec="*.pdf") returned 0 [0096.598] lstrlenA (lpString="*.pdf") returned 5 [0096.598] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsMacroTemplate.html", pszSpec="*.djvu") returned 0 [0096.598] lstrlenA (lpString="*.djvu") returned 6 [0096.598] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsMacroTemplate.html", pszSpec="*.htm") returned 0 [0096.598] lstrlenA (lpString="*.htm") returned 5 [0096.598] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsMacroTemplate.html", pszSpec="*.html") returned 1 [0096.598] lstrlenA (lpString="*.html") returned 6 [0096.598] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsMacroTemplate.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsMacroTemplate.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsMacroTemplate.html" [0096.598] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsMacroTemplate.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsMacroTemplate.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsMacroTemplate.html" [0096.598] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsMacroTemplate.html", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsMacroTemplate.html.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsMacroTemplate.html." [0096.598] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsMacroTemplate.html.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsMacroTemplate.html. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsMacroTemplate.html. " [0096.598] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsMacroTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsmacrotemplate.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0096.599] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x858 [0096.599] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9caf4500, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5291c2f0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9caf4500, dwHighDateTime=0x1c747ea)) returned 1 [0096.599] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0096.599] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x7fe, lpOverlapped=0x0) returned 1 [0096.630] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsMacroTemplate.html") returned="FormsMacroTemplate.html" [0096.630] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0096.630] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x7fe, lpOverlapped=0x0) returned 1 [0096.631] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0096.631] CloseHandle (hObject=0x98) returned 1 [0096.631] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsMacroTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsmacrotemplate.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsMacroTemplate.html. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsmacrotemplate.html. ")) returned 1 [0096.632] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0096.632] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0096.632] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="FormsPreviewTemplate.html") returned -1 [0096.632] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FormsPreviewTemplate.html") returned 1 [0096.632] lstrcmpiA (lpString1="", lpString2="FormsPreviewTemplate.html") returned -1 [0096.632] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsMacroTemplate.html") returned="FormsMacroTemplate.html" [0096.632] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="FormsPreviewTemplate.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPreviewTemplate.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPreviewTemplate.html" [0096.632] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPreviewTemplate.html", pszSpec="*.zip") returned 0 [0096.632] lstrlenA (lpString="*.zip") returned 5 [0096.632] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPreviewTemplate.html", pszSpec="*.rar") returned 0 [0096.632] lstrlenA (lpString="*.rar") returned 5 [0096.632] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPreviewTemplate.html", pszSpec="*.7z") returned 0 [0096.632] lstrlenA (lpString="*.7z") returned 4 [0096.632] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPreviewTemplate.html", pszSpec="*.tar") returned 0 [0096.632] lstrlenA (lpString="*.tar") returned 5 [0096.632] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPreviewTemplate.html", pszSpec="*.gzip") returned 0 [0096.632] lstrlenA (lpString="*.gzip") returned 6 [0096.632] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPreviewTemplate.html", pszSpec="*.jpg") returned 0 [0096.632] lstrlenA (lpString="*.jpg") returned 5 [0096.632] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPreviewTemplate.html", pszSpec="*.jpeg") returned 0 [0096.632] lstrlenA (lpString="*.jpeg") returned 6 [0096.632] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPreviewTemplate.html", pszSpec="*.psd") returned 0 [0096.632] lstrlenA (lpString="*.psd") returned 5 [0096.632] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPreviewTemplate.html", pszSpec="*.cdr") returned 0 [0096.632] lstrlenA (lpString="*.cdr") returned 5 [0096.632] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPreviewTemplate.html", pszSpec="*.dwg") returned 0 [0096.632] lstrlenA (lpString="*.dwg") returned 5 [0096.632] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPreviewTemplate.html", pszSpec="*.max") returned 0 [0096.632] lstrlenA (lpString="*.max") returned 5 [0096.632] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPreviewTemplate.html", pszSpec="*.bmp") returned 0 [0096.632] lstrlenA (lpString="*.bmp") returned 5 [0096.632] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPreviewTemplate.html", pszSpec="*.gif") returned 0 [0096.632] lstrlenA (lpString="*.gif") returned 5 [0096.632] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPreviewTemplate.html", pszSpec="*.png") returned 0 [0096.632] lstrlenA (lpString="*.png") returned 5 [0096.632] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPreviewTemplate.html", pszSpec="*.doc") returned 0 [0096.632] lstrlenA (lpString="*.doc") returned 5 [0096.632] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPreviewTemplate.html", pszSpec="*.docx") returned 0 [0096.632] lstrlenA (lpString="*.docx") returned 6 [0096.633] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPreviewTemplate.html", pszSpec="*.xls") returned 0 [0096.633] lstrlenA (lpString="*.xls") returned 5 [0096.633] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPreviewTemplate.html", pszSpec="*.xlsx") returned 0 [0096.633] lstrlenA (lpString="*.xlsx") returned 6 [0096.633] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPreviewTemplate.html", pszSpec="*.ppt") returned 0 [0096.633] lstrlenA (lpString="*.ppt") returned 5 [0096.633] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPreviewTemplate.html", pszSpec="*.pptx") returned 0 [0096.633] lstrlenA (lpString="*.pptx") returned 6 [0096.633] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPreviewTemplate.html", pszSpec="*.txt") returned 0 [0096.633] lstrlenA (lpString="*.txt") returned 5 [0096.633] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPreviewTemplate.html", pszSpec="*.pdf") returned 0 [0096.633] lstrlenA (lpString="*.pdf") returned 5 [0096.633] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPreviewTemplate.html", pszSpec="*.djvu") returned 0 [0096.633] lstrlenA (lpString="*.djvu") returned 6 [0096.633] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPreviewTemplate.html", pszSpec="*.htm") returned 0 [0096.633] lstrlenA (lpString="*.htm") returned 5 [0096.633] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPreviewTemplate.html", pszSpec="*.html") returned 1 [0096.633] lstrlenA (lpString="*.html") returned 6 [0096.633] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPreviewTemplate.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPreviewTemplate.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPreviewTemplate.html" [0096.633] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPreviewTemplate.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPreviewTemplate.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPreviewTemplate.html" [0096.633] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPreviewTemplate.html", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPreviewTemplate.html.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPreviewTemplate.html." [0096.633] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPreviewTemplate.html.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPreviewTemplate.html. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPreviewTemplate.html. " [0096.633] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPreviewTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formspreviewtemplate.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0096.634] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x46a3 [0096.634] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9caf4500, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x529685b0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9caf4500, dwHighDateTime=0x1c747ea)) returned 1 [0096.634] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0096.634] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x4649, lpOverlapped=0x0) returned 1 [0096.643] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPreviewTemplate.html") returned="FormsPreviewTemplate.html" [0096.643] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0096.643] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x4649, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x4649, lpOverlapped=0x0) returned 1 [0096.644] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0096.644] CloseHandle (hObject=0x98) returned 1 [0096.644] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPreviewTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formspreviewtemplate.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPreviewTemplate.html. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formspreviewtemplate.html. ")) returned 1 [0096.644] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0096.644] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0096.645] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="FormsPrintTemplate.html") returned -1 [0096.645] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FormsPrintTemplate.html") returned 1 [0096.645] lstrcmpiA (lpString1="", lpString2="FormsPrintTemplate.html") returned -1 [0096.645] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPreviewTemplate.html") returned="FormsPreviewTemplate.html" [0096.645] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="FormsPrintTemplate.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPrintTemplate.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPrintTemplate.html" [0096.645] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPrintTemplate.html", pszSpec="*.zip") returned 0 [0096.645] lstrlenA (lpString="*.zip") returned 5 [0096.645] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPrintTemplate.html", pszSpec="*.rar") returned 0 [0096.645] lstrlenA (lpString="*.rar") returned 5 [0096.645] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPrintTemplate.html", pszSpec="*.7z") returned 0 [0096.645] lstrlenA (lpString="*.7z") returned 4 [0096.645] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPrintTemplate.html", pszSpec="*.tar") returned 0 [0096.645] lstrlenA (lpString="*.tar") returned 5 [0096.645] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPrintTemplate.html", pszSpec="*.gzip") returned 0 [0096.645] lstrlenA (lpString="*.gzip") returned 6 [0096.645] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPrintTemplate.html", pszSpec="*.jpg") returned 0 [0096.645] lstrlenA (lpString="*.jpg") returned 5 [0096.645] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPrintTemplate.html", pszSpec="*.jpeg") returned 0 [0096.645] lstrlenA (lpString="*.jpeg") returned 6 [0096.645] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPrintTemplate.html", pszSpec="*.psd") returned 0 [0096.645] lstrlenA (lpString="*.psd") returned 5 [0096.645] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPrintTemplate.html", pszSpec="*.cdr") returned 0 [0096.645] lstrlenA (lpString="*.cdr") returned 5 [0096.645] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPrintTemplate.html", pszSpec="*.dwg") returned 0 [0096.645] lstrlenA (lpString="*.dwg") returned 5 [0096.645] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPrintTemplate.html", pszSpec="*.max") returned 0 [0096.645] lstrlenA (lpString="*.max") returned 5 [0096.645] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPrintTemplate.html", pszSpec="*.bmp") returned 0 [0096.645] lstrlenA (lpString="*.bmp") returned 5 [0096.645] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPrintTemplate.html", pszSpec="*.gif") returned 0 [0096.645] lstrlenA (lpString="*.gif") returned 5 [0096.645] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPrintTemplate.html", pszSpec="*.png") returned 0 [0096.645] lstrlenA (lpString="*.png") returned 5 [0096.645] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPrintTemplate.html", pszSpec="*.doc") returned 0 [0096.645] lstrlenA (lpString="*.doc") returned 5 [0096.645] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPrintTemplate.html", pszSpec="*.docx") returned 0 [0096.645] lstrlenA (lpString="*.docx") returned 6 [0096.645] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPrintTemplate.html", pszSpec="*.xls") returned 0 [0096.645] lstrlenA (lpString="*.xls") returned 5 [0096.645] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPrintTemplate.html", pszSpec="*.xlsx") returned 0 [0096.645] lstrlenA (lpString="*.xlsx") returned 6 [0096.645] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPrintTemplate.html", pszSpec="*.ppt") returned 0 [0096.645] lstrlenA (lpString="*.ppt") returned 5 [0096.645] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPrintTemplate.html", pszSpec="*.pptx") returned 0 [0096.646] lstrlenA (lpString="*.pptx") returned 6 [0096.646] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPrintTemplate.html", pszSpec="*.txt") returned 0 [0096.646] lstrlenA (lpString="*.txt") returned 5 [0096.646] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPrintTemplate.html", pszSpec="*.pdf") returned 0 [0096.646] lstrlenA (lpString="*.pdf") returned 5 [0096.646] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPrintTemplate.html", pszSpec="*.djvu") returned 0 [0096.646] lstrlenA (lpString="*.djvu") returned 6 [0096.646] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPrintTemplate.html", pszSpec="*.htm") returned 0 [0096.646] lstrlenA (lpString="*.htm") returned 5 [0096.646] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPrintTemplate.html", pszSpec="*.html") returned 1 [0096.646] lstrlenA (lpString="*.html") returned 6 [0096.646] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPrintTemplate.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPrintTemplate.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPrintTemplate.html" [0096.646] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPrintTemplate.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPrintTemplate.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPrintTemplate.html" [0096.646] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPrintTemplate.html", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPrintTemplate.html.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPrintTemplate.html." [0096.646] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPrintTemplate.html.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPrintTemplate.html. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPrintTemplate.html. " [0096.646] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPrintTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsprinttemplate.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0096.646] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x612 [0096.646] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9caf4500, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5298e710, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9caf4500, dwHighDateTime=0x1c747ea)) returned 1 [0096.647] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0096.647] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x5b8, lpOverlapped=0x0) returned 1 [0096.666] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPrintTemplate.html") returned="FormsPrintTemplate.html" [0096.666] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0096.666] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x5b8, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x5b8, lpOverlapped=0x0) returned 1 [0096.666] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0096.666] CloseHandle (hObject=0x98) returned 1 [0096.666] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPrintTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsprinttemplate.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPrintTemplate.html. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsprinttemplate.html. ")) returned 1 [0096.668] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0096.668] lstrcmpA (lpString1=".", lpString2="FormsStyles") returned -1 [0096.668] lstrcmpA (lpString1="..", lpString2="FormsStyles") returned -1 [0096.668] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPrintTemplate.html") returned="FormsPrintTemplate.html" [0096.668] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="FormsStyles" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles" [0096.668] lstrlenA (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles") returned 94 [0096.668] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\*.*", lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 0x5be1a0 [0096.671] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0096.671] FindNextFileA (in: hFindFile=0x5be1a0, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0096.672] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0096.672] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0096.672] FindNextFileA (in: hFindFile=0x5be1a0, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0096.672] PeekMessageA (in: lpMsg=0xaece4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaece4) returned 0 [0096.672] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Adobe.css") returned 1 [0096.672] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Adobe.css") returned 1 [0096.672] lstrcmpiA (lpString1="", lpString2="Adobe.css") returned -1 [0096.672] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\*.*") returned="*.*" [0096.672] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\", lpString2="Adobe.css" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Adobe.css") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Adobe.css" [0096.672] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Adobe.css", pszSpec="*.zip") returned 0 [0096.672] lstrlenA (lpString="*.zip") returned 5 [0096.672] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Adobe.css", pszSpec="*.rar") returned 0 [0096.672] lstrlenA (lpString="*.rar") returned 5 [0096.672] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Adobe.css", pszSpec="*.7z") returned 0 [0096.672] lstrlenA (lpString="*.7z") returned 4 [0096.672] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Adobe.css", pszSpec="*.tar") returned 0 [0096.672] lstrlenA (lpString="*.tar") returned 5 [0096.672] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Adobe.css", pszSpec="*.gzip") returned 0 [0096.672] lstrlenA (lpString="*.gzip") returned 6 [0096.673] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Adobe.css", pszSpec="*.jpg") returned 0 [0096.673] lstrlenA (lpString="*.jpg") returned 5 [0096.673] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Adobe.css", pszSpec="*.jpeg") returned 0 [0096.673] lstrlenA (lpString="*.jpeg") returned 6 [0096.673] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Adobe.css", pszSpec="*.psd") returned 0 [0096.673] lstrlenA (lpString="*.psd") returned 5 [0096.673] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Adobe.css", pszSpec="*.cdr") returned 0 [0096.673] lstrlenA (lpString="*.cdr") returned 5 [0096.673] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Adobe.css", pszSpec="*.dwg") returned 0 [0096.673] lstrlenA (lpString="*.dwg") returned 5 [0096.673] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Adobe.css", pszSpec="*.max") returned 0 [0096.673] lstrlenA (lpString="*.max") returned 5 [0096.673] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Adobe.css", pszSpec="*.bmp") returned 0 [0096.673] lstrlenA (lpString="*.bmp") returned 5 [0096.673] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Adobe.css", pszSpec="*.gif") returned 0 [0096.673] lstrlenA (lpString="*.gif") returned 5 [0096.673] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Adobe.css", pszSpec="*.png") returned 0 [0096.673] lstrlenA (lpString="*.png") returned 5 [0096.673] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Adobe.css", pszSpec="*.doc") returned 0 [0096.673] lstrlenA (lpString="*.doc") returned 5 [0096.673] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Adobe.css", pszSpec="*.docx") returned 0 [0096.673] lstrlenA (lpString="*.docx") returned 6 [0096.673] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Adobe.css", pszSpec="*.xls") returned 0 [0096.673] lstrlenA (lpString="*.xls") returned 5 [0096.673] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Adobe.css", pszSpec="*.xlsx") returned 0 [0096.673] lstrlenA (lpString="*.xlsx") returned 6 [0096.673] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Adobe.css", pszSpec="*.ppt") returned 0 [0096.673] lstrlenA (lpString="*.ppt") returned 5 [0096.673] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Adobe.css", pszSpec="*.pptx") returned 0 [0096.673] lstrlenA (lpString="*.pptx") returned 6 [0096.673] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Adobe.css", pszSpec="*.txt") returned 0 [0096.673] lstrlenA (lpString="*.txt") returned 5 [0096.673] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Adobe.css", pszSpec="*.pdf") returned 0 [0096.673] lstrlenA (lpString="*.pdf") returned 5 [0096.673] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Adobe.css", pszSpec="*.djvu") returned 0 [0096.673] lstrlenA (lpString="*.djvu") returned 6 [0096.673] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Adobe.css", pszSpec="*.htm") returned 0 [0096.673] lstrlenA (lpString="*.htm") returned 5 [0096.673] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Adobe.css", pszSpec="*.html") returned 0 [0096.673] lstrlenA (lpString="*.html") returned 6 [0096.673] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Adobe.css", pszSpec="*.mdb") returned 0 [0096.673] lstrlenA (lpString="*.mdb") returned 5 [0096.673] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Adobe.css", pszSpec="*.cer") returned 0 [0096.673] lstrlenA (lpString="*.cer") returned 5 [0096.673] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Adobe.css", pszSpec="*.p12") returned 0 [0096.673] lstrlenA (lpString="*.p12") returned 5 [0096.673] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Adobe.css", pszSpec="*.pfx") returned 0 [0096.674] lstrlenA (lpString="*.pfx") returned 5 [0096.674] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Adobe.css", pszSpec="*.kwm") returned 0 [0096.674] lstrlenA (lpString="*.kwm") returned 5 [0096.674] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Adobe.css", pszSpec="*.pwm") returned 0 [0096.674] lstrlenA (lpString="*.pwm") returned 5 [0096.674] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Adobe.css", pszSpec="*.1cd") returned 0 [0096.674] lstrlenA (lpString="*.1cd") returned 5 [0096.674] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Adobe.css", pszSpec="*.md") returned 0 [0096.674] lstrlenA (lpString="*.md") returned 4 [0096.674] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Adobe.css", pszSpec="*.mdf") returned 0 [0096.674] lstrlenA (lpString="*.mdf") returned 5 [0096.674] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Adobe.css", pszSpec="*.dbf") returned 0 [0096.674] lstrlenA (lpString="*.dbf") returned 5 [0096.674] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Adobe.css", pszSpec="*.odt") returned 0 [0096.674] lstrlenA (lpString="*.odt") returned 5 [0096.674] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Adobe.css", pszSpec="*.vob") returned 0 [0096.674] lstrlenA (lpString="*.vob") returned 5 [0096.674] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Adobe.css", pszSpec="*.ifo") returned 0 [0096.674] lstrlenA (lpString="*.ifo") returned 5 [0096.674] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Adobe.css", pszSpec="*.lnk") returned 0 [0096.674] lstrlenA (lpString="*.lnk") returned 5 [0096.674] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Adobe.css", pszSpec="*.torrent") returned 0 [0096.674] lstrlenA (lpString="*.torrent") returned 9 [0096.674] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Adobe.css", pszSpec="*.mov") returned 0 [0096.674] lstrlenA (lpString="*.mov") returned 5 [0096.674] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Adobe.css", pszSpec="*.m2v") returned 0 [0096.674] lstrlenA (lpString="*.m2v") returned 5 [0096.674] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Adobe.css", pszSpec="*.3gp") returned 0 [0096.674] lstrlenA (lpString="*.3gp") returned 5 [0096.674] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Adobe.css", pszSpec="*.mpeg") returned 0 [0096.674] lstrlenA (lpString="*.mpeg") returned 6 [0096.674] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Adobe.css", pszSpec="*.mpg") returned 0 [0096.674] lstrlenA (lpString="*.mpg") returned 5 [0096.674] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Adobe.css", pszSpec="*.flv") returned 0 [0096.674] lstrlenA (lpString="*.flv") returned 5 [0096.674] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Adobe.css", pszSpec="*.avi") returned 0 [0096.674] lstrlenA (lpString="*.avi") returned 5 [0096.674] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Adobe.css", pszSpec="*.mp4") returned 0 [0096.674] lstrlenA (lpString="*.mp4") returned 5 [0096.674] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Adobe.css", pszSpec="*.wmv") returned 0 [0096.674] lstrlenA (lpString="*.wmv") returned 5 [0096.675] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Adobe.css", pszSpec="*.divx") returned 0 [0096.675] lstrlenA (lpString="*.divx") returned 6 [0096.675] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Adobe.css", pszSpec="*.mkv") returned 0 [0096.675] lstrlenA (lpString="*.mkv") returned 5 [0096.675] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Adobe.css", pszSpec="*.mp3") returned 0 [0096.675] lstrlenA (lpString="*.mp3") returned 5 [0096.675] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Adobe.css", pszSpec="*.wav") returned 0 [0096.675] lstrlenA (lpString="*.wav") returned 5 [0096.675] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Adobe.css", pszSpec="*.flac") returned 0 [0096.675] lstrlenA (lpString="*.flac") returned 6 [0096.675] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Adobe.css", pszSpec="*.ape") returned 0 [0096.675] lstrlenA (lpString="*.ape") returned 5 [0096.675] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Adobe.css", pszSpec="*.wma") returned 0 [0096.675] lstrlenA (lpString="*.wma") returned 5 [0096.675] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Adobe.css", pszSpec="*.ac3") returned 0 [0096.675] lstrlenA (lpString="*.ac3") returned 5 [0096.675] FindNextFileA (in: hFindFile=0x5be1a0, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0096.675] lstrcmpA (lpString1=".", lpString2="Americana") returned -1 [0096.675] lstrcmpA (lpString1="..", lpString2="Americana") returned -1 [0096.675] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Adobe.css") returned="Adobe.css" [0096.675] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\", lpString2="Americana" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana" [0096.675] lstrlenA (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana") returned 104 [0096.675] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\*.*", lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 0x5be1e0 [0096.675] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0096.675] FindNextFileA (in: hFindFile=0x5be1e0, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 1 [0096.675] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0096.675] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0096.675] FindNextFileA (in: hFindFile=0x5be1e0, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 1 [0096.676] PeekMessageA (in: lpMsg=0xaeb94, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaeb94) returned 0 [0096.676] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="TAB_OFF.GIF") returned -1 [0096.676] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TAB_OFF.GIF") returned -1 [0096.676] lstrcmpiA (lpString1="", lpString2="TAB_OFF.GIF") returned -1 [0096.676] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\*.*") returned="*.*" [0096.676] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\", lpString2="TAB_OFF.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\TAB_OFF.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\TAB_OFF.GIF" [0096.676] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\TAB_OFF.GIF", pszSpec="*.zip") returned 0 [0096.676] lstrlenA (lpString="*.zip") returned 5 [0096.676] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\TAB_OFF.GIF", pszSpec="*.rar") returned 0 [0096.676] lstrlenA (lpString="*.rar") returned 5 [0096.676] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\TAB_OFF.GIF", pszSpec="*.7z") returned 0 [0096.676] lstrlenA (lpString="*.7z") returned 4 [0096.676] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\TAB_OFF.GIF", pszSpec="*.tar") returned 0 [0096.676] lstrlenA (lpString="*.tar") returned 5 [0096.676] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\TAB_OFF.GIF", pszSpec="*.gzip") returned 0 [0096.676] lstrlenA (lpString="*.gzip") returned 6 [0096.676] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\TAB_OFF.GIF", pszSpec="*.jpg") returned 0 [0096.676] lstrlenA (lpString="*.jpg") returned 5 [0096.676] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\TAB_OFF.GIF", pszSpec="*.jpeg") returned 0 [0096.676] lstrlenA (lpString="*.jpeg") returned 6 [0096.676] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\TAB_OFF.GIF", pszSpec="*.psd") returned 0 [0096.676] lstrlenA (lpString="*.psd") returned 5 [0096.676] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\TAB_OFF.GIF", pszSpec="*.cdr") returned 0 [0096.676] lstrlenA (lpString="*.cdr") returned 5 [0096.676] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\TAB_OFF.GIF", pszSpec="*.dwg") returned 0 [0096.676] lstrlenA (lpString="*.dwg") returned 5 [0096.676] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\TAB_OFF.GIF", pszSpec="*.max") returned 0 [0096.676] lstrlenA (lpString="*.max") returned 5 [0096.676] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\TAB_OFF.GIF", pszSpec="*.bmp") returned 0 [0096.676] lstrlenA (lpString="*.bmp") returned 5 [0096.676] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\TAB_OFF.GIF", pszSpec="*.gif") returned 1 [0096.676] lstrlenA (lpString="*.gif") returned 5 [0096.676] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\TAB_OFF.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\TAB_OFF.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\TAB_OFF.GIF" [0096.676] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\TAB_OFF.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\TAB_OFF.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\TAB_OFF.GIF" [0096.676] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\TAB_OFF.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\TAB_OFF.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\TAB_OFF.GIF." [0096.676] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\TAB_OFF.GIF.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\TAB_OFF.GIF. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\TAB_OFF.GIF. " [0096.676] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\americana\\tab_off.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0 [0096.677] GetFileSize (in: hFile=0xa0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x155 [0096.677] GetFileTime (in: hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9caf4500, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5133d8d0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9caf4500, dwHighDateTime=0x1c747ea)) returned 1 [0096.677] SetFilePointer (in: hFile=0xa0, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0096.677] ReadFile (in: hFile=0xa0, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0xfb, lpOverlapped=0x0) returned 1 [0096.678] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\TAB_OFF.GIF") returned="TAB_OFF.GIF" [0096.678] SetFilePointer (in: hFile=0xa0, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0096.678] WriteFile (in: hFile=0xa0, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0xfb, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0xfb, lpOverlapped=0x0) returned 1 [0096.678] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0096.678] CloseHandle (hObject=0xa0) returned 1 [0096.678] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\americana\\tab_off.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\TAB_OFF.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\americana\\tab_off.gif. ")) returned 1 [0096.679] FindNextFileA (in: hFindFile=0x5be1e0, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 1 [0096.679] PeekMessageA (in: lpMsg=0xaeb94, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaeb94) returned 0 [0096.679] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="TAB_ON.GIF") returned -1 [0096.679] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TAB_ON.GIF") returned -1 [0096.679] lstrcmpiA (lpString1="", lpString2="TAB_ON.GIF") returned -1 [0096.679] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\TAB_OFF.GIF") returned="TAB_OFF.GIF" [0096.679] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\", lpString2="TAB_ON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\TAB_ON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\TAB_ON.GIF" [0096.679] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\TAB_ON.GIF", pszSpec="*.zip") returned 0 [0096.679] lstrlenA (lpString="*.zip") returned 5 [0096.679] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\TAB_ON.GIF", pszSpec="*.rar") returned 0 [0096.679] lstrlenA (lpString="*.rar") returned 5 [0096.679] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\TAB_ON.GIF", pszSpec="*.7z") returned 0 [0096.679] lstrlenA (lpString="*.7z") returned 4 [0096.679] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\TAB_ON.GIF", pszSpec="*.tar") returned 0 [0096.679] lstrlenA (lpString="*.tar") returned 5 [0096.679] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\TAB_ON.GIF", pszSpec="*.gzip") returned 0 [0096.679] lstrlenA (lpString="*.gzip") returned 6 [0096.679] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\TAB_ON.GIF", pszSpec="*.jpg") returned 0 [0096.679] lstrlenA (lpString="*.jpg") returned 5 [0096.679] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\TAB_ON.GIF", pszSpec="*.jpeg") returned 0 [0096.680] lstrlenA (lpString="*.jpeg") returned 6 [0096.680] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\TAB_ON.GIF", pszSpec="*.psd") returned 0 [0096.680] lstrlenA (lpString="*.psd") returned 5 [0096.680] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\TAB_ON.GIF", pszSpec="*.cdr") returned 0 [0096.680] lstrlenA (lpString="*.cdr") returned 5 [0096.680] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\TAB_ON.GIF", pszSpec="*.dwg") returned 0 [0096.680] lstrlenA (lpString="*.dwg") returned 5 [0096.680] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\TAB_ON.GIF", pszSpec="*.max") returned 0 [0096.680] lstrlenA (lpString="*.max") returned 5 [0096.680] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\TAB_ON.GIF", pszSpec="*.bmp") returned 0 [0096.680] lstrlenA (lpString="*.bmp") returned 5 [0096.680] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\TAB_ON.GIF", pszSpec="*.gif") returned 1 [0096.680] lstrlenA (lpString="*.gif") returned 5 [0096.680] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\TAB_ON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\TAB_ON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\TAB_ON.GIF" [0096.680] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\TAB_ON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\TAB_ON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\TAB_ON.GIF" [0096.680] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\TAB_ON.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\TAB_ON.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\TAB_ON.GIF." [0096.680] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\TAB_ON.GIF.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\TAB_ON.GIF. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\TAB_ON.GIF. " [0096.680] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\americana\\tab_on.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0 [0096.681] GetFileSize (in: hFile=0xa0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xde [0096.681] GetFileTime (in: hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9caf4500, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5eb8e810, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9caf4500, dwHighDateTime=0x1c747ea)) returned 1 [0096.681] SetFilePointer (in: hFile=0xa0, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0096.681] ReadFile (in: hFile=0xa0, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x84, lpOverlapped=0x0) returned 1 [0096.682] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\TAB_ON.GIF") returned="TAB_ON.GIF" [0096.682] SetFilePointer (in: hFile=0xa0, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0096.682] WriteFile (in: hFile=0xa0, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x84, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x84, lpOverlapped=0x0) returned 1 [0096.682] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0096.682] CloseHandle (hObject=0xa0) returned 1 [0096.682] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\americana\\tab_on.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\TAB_ON.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\americana\\tab_on.gif. ")) returned 1 [0096.683] FindNextFileA (in: hFindFile=0x5be1e0, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 0 [0096.683] FindClose (in: hFindFile=0x5be1e0 | out: hFindFile=0x5be1e0) returned 1 [0096.683] FindNextFileA (in: hFindFile=0x5be1a0, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0096.683] PeekMessageA (in: lpMsg=0xaece4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaece4) returned 0 [0096.683] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Americana.css") returned 1 [0096.683] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Americana.css") returned 1 [0096.683] lstrcmpiA (lpString1="", lpString2="Americana.css") returned -1 [0096.683] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\*.*") returned="*.*" [0096.683] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\", lpString2="Americana.css" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana.css") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana.css" [0096.683] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana.css", pszSpec="*.zip") returned 0 [0096.683] lstrlenA (lpString="*.zip") returned 5 [0096.683] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana.css", pszSpec="*.rar") returned 0 [0096.683] lstrlenA (lpString="*.rar") returned 5 [0096.683] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana.css", pszSpec="*.7z") returned 0 [0096.683] lstrlenA (lpString="*.7z") returned 4 [0096.683] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana.css", pszSpec="*.tar") returned 0 [0096.683] lstrlenA (lpString="*.tar") returned 5 [0096.683] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana.css", pszSpec="*.gzip") returned 0 [0096.684] lstrlenA (lpString="*.gzip") returned 6 [0096.684] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana.css", pszSpec="*.jpg") returned 0 [0096.684] lstrlenA (lpString="*.jpg") returned 5 [0096.684] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana.css", pszSpec="*.jpeg") returned 0 [0096.684] lstrlenA (lpString="*.jpeg") returned 6 [0096.684] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana.css", pszSpec="*.psd") returned 0 [0096.684] lstrlenA (lpString="*.psd") returned 5 [0096.684] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana.css", pszSpec="*.cdr") returned 0 [0096.684] lstrlenA (lpString="*.cdr") returned 5 [0096.684] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana.css", pszSpec="*.dwg") returned 0 [0096.684] lstrlenA (lpString="*.dwg") returned 5 [0096.684] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana.css", pszSpec="*.max") returned 0 [0096.684] lstrlenA (lpString="*.max") returned 5 [0096.684] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana.css", pszSpec="*.bmp") returned 0 [0096.684] lstrlenA (lpString="*.bmp") returned 5 [0096.684] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana.css", pszSpec="*.gif") returned 0 [0096.684] lstrlenA (lpString="*.gif") returned 5 [0096.684] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana.css", pszSpec="*.png") returned 0 [0096.684] lstrlenA (lpString="*.png") returned 5 [0096.684] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana.css", pszSpec="*.doc") returned 0 [0096.684] lstrlenA (lpString="*.doc") returned 5 [0096.684] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana.css", pszSpec="*.docx") returned 0 [0096.684] lstrlenA (lpString="*.docx") returned 6 [0096.684] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana.css", pszSpec="*.xls") returned 0 [0096.684] lstrlenA (lpString="*.xls") returned 5 [0096.684] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana.css", pszSpec="*.xlsx") returned 0 [0096.684] lstrlenA (lpString="*.xlsx") returned 6 [0096.684] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana.css", pszSpec="*.ppt") returned 0 [0096.684] lstrlenA (lpString="*.ppt") returned 5 [0096.684] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana.css", pszSpec="*.pptx") returned 0 [0096.684] lstrlenA (lpString="*.pptx") returned 6 [0096.684] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana.css", pszSpec="*.txt") returned 0 [0096.684] lstrlenA (lpString="*.txt") returned 5 [0096.684] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana.css", pszSpec="*.pdf") returned 0 [0096.684] lstrlenA (lpString="*.pdf") returned 5 [0096.684] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana.css", pszSpec="*.djvu") returned 0 [0096.684] lstrlenA (lpString="*.djvu") returned 6 [0096.684] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana.css", pszSpec="*.htm") returned 0 [0096.684] lstrlenA (lpString="*.htm") returned 5 [0096.684] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana.css", pszSpec="*.html") returned 0 [0096.684] lstrlenA (lpString="*.html") returned 6 [0096.684] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana.css", pszSpec="*.mdb") returned 0 [0096.684] lstrlenA (lpString="*.mdb") returned 5 [0096.684] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana.css", pszSpec="*.cer") returned 0 [0096.684] lstrlenA (lpString="*.cer") returned 5 [0096.684] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana.css", pszSpec="*.p12") returned 0 [0096.684] lstrlenA (lpString="*.p12") returned 5 [0096.684] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana.css", pszSpec="*.pfx") returned 0 [0096.684] lstrlenA (lpString="*.pfx") returned 5 [0096.684] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana.css", pszSpec="*.kwm") returned 0 [0096.684] lstrlenA (lpString="*.kwm") returned 5 [0096.685] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana.css", pszSpec="*.pwm") returned 0 [0096.685] lstrlenA (lpString="*.pwm") returned 5 [0096.685] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana.css", pszSpec="*.1cd") returned 0 [0096.685] lstrlenA (lpString="*.1cd") returned 5 [0096.685] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana.css", pszSpec="*.md") returned 0 [0096.685] lstrlenA (lpString="*.md") returned 4 [0096.685] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana.css", pszSpec="*.mdf") returned 0 [0096.685] lstrlenA (lpString="*.mdf") returned 5 [0096.685] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana.css", pszSpec="*.dbf") returned 0 [0096.685] lstrlenA (lpString="*.dbf") returned 5 [0096.685] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana.css", pszSpec="*.odt") returned 0 [0096.685] lstrlenA (lpString="*.odt") returned 5 [0096.685] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana.css", pszSpec="*.vob") returned 0 [0096.685] lstrlenA (lpString="*.vob") returned 5 [0096.685] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana.css", pszSpec="*.ifo") returned 0 [0096.685] lstrlenA (lpString="*.ifo") returned 5 [0096.685] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana.css", pszSpec="*.lnk") returned 0 [0096.685] lstrlenA (lpString="*.lnk") returned 5 [0096.685] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana.css", pszSpec="*.torrent") returned 0 [0096.685] lstrlenA (lpString="*.torrent") returned 9 [0096.685] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana.css", pszSpec="*.mov") returned 0 [0096.685] lstrlenA (lpString="*.mov") returned 5 [0096.685] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana.css", pszSpec="*.m2v") returned 0 [0096.685] lstrlenA (lpString="*.m2v") returned 5 [0096.685] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana.css", pszSpec="*.3gp") returned 0 [0096.685] lstrlenA (lpString="*.3gp") returned 5 [0096.685] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana.css", pszSpec="*.mpeg") returned 0 [0096.685] lstrlenA (lpString="*.mpeg") returned 6 [0096.685] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana.css", pszSpec="*.mpg") returned 0 [0096.685] lstrlenA (lpString="*.mpg") returned 5 [0096.685] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana.css", pszSpec="*.flv") returned 0 [0096.685] lstrlenA (lpString="*.flv") returned 5 [0096.685] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana.css", pszSpec="*.avi") returned 0 [0096.685] lstrlenA (lpString="*.avi") returned 5 [0096.685] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana.css", pszSpec="*.mp4") returned 0 [0096.685] lstrlenA (lpString="*.mp4") returned 5 [0096.685] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana.css", pszSpec="*.wmv") returned 0 [0096.685] lstrlenA (lpString="*.wmv") returned 5 [0096.685] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana.css", pszSpec="*.divx") returned 0 [0096.685] lstrlenA (lpString="*.divx") returned 6 [0096.685] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana.css", pszSpec="*.mkv") returned 0 [0096.685] lstrlenA (lpString="*.mkv") returned 5 [0096.685] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana.css", pszSpec="*.mp3") returned 0 [0096.685] lstrlenA (lpString="*.mp3") returned 5 [0096.686] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana.css", pszSpec="*.wav") returned 0 [0096.686] lstrlenA (lpString="*.wav") returned 5 [0096.686] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana.css", pszSpec="*.flac") returned 0 [0096.686] lstrlenA (lpString="*.flac") returned 6 [0096.686] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana.css", pszSpec="*.ape") returned 0 [0096.686] lstrlenA (lpString="*.ape") returned 5 [0096.686] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana.css", pszSpec="*.wma") returned 0 [0096.686] lstrlenA (lpString="*.wma") returned 5 [0096.686] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana.css", pszSpec="*.ac3") returned 0 [0096.686] lstrlenA (lpString="*.ac3") returned 5 [0096.686] FindNextFileA (in: hFindFile=0x5be1a0, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0096.686] lstrcmpA (lpString1=".", lpString2="BabyBlue") returned -1 [0096.686] lstrcmpA (lpString1="..", lpString2="BabyBlue") returned -1 [0096.686] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana.css") returned="Americana.css" [0096.686] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\", lpString2="BabyBlue" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue" [0096.686] lstrlenA (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue") returned 103 [0096.686] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\*.*", lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 0x5be1e0 [0096.686] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0096.686] FindNextFileA (in: hFindFile=0x5be1e0, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 1 [0096.686] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0096.686] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0096.686] FindNextFileA (in: hFindFile=0x5be1e0, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 1 [0096.686] PeekMessageA (in: lpMsg=0xaeb94, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaeb94) returned 0 [0096.686] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BUTTON.GIF") returned 1 [0096.686] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BUTTON.GIF") returned 1 [0096.686] lstrcmpiA (lpString1="", lpString2="BUTTON.GIF") returned -1 [0096.686] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\*.*") returned="*.*" [0096.686] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\", lpString2="BUTTON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\BUTTON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\BUTTON.GIF" [0096.686] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\BUTTON.GIF", pszSpec="*.zip") returned 0 [0096.686] lstrlenA (lpString="*.zip") returned 5 [0096.687] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\BUTTON.GIF", pszSpec="*.rar") returned 0 [0096.687] lstrlenA (lpString="*.rar") returned 5 [0096.687] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\BUTTON.GIF", pszSpec="*.7z") returned 0 [0096.687] lstrlenA (lpString="*.7z") returned 4 [0096.687] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\BUTTON.GIF", pszSpec="*.tar") returned 0 [0096.687] lstrlenA (lpString="*.tar") returned 5 [0096.687] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\BUTTON.GIF", pszSpec="*.gzip") returned 0 [0096.687] lstrlenA (lpString="*.gzip") returned 6 [0096.687] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\BUTTON.GIF", pszSpec="*.jpg") returned 0 [0096.687] lstrlenA (lpString="*.jpg") returned 5 [0096.687] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\BUTTON.GIF", pszSpec="*.jpeg") returned 0 [0096.687] lstrlenA (lpString="*.jpeg") returned 6 [0096.687] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\BUTTON.GIF", pszSpec="*.psd") returned 0 [0096.687] lstrlenA (lpString="*.psd") returned 5 [0096.687] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\BUTTON.GIF", pszSpec="*.cdr") returned 0 [0096.687] lstrlenA (lpString="*.cdr") returned 5 [0096.687] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\BUTTON.GIF", pszSpec="*.dwg") returned 0 [0096.687] lstrlenA (lpString="*.dwg") returned 5 [0096.687] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\BUTTON.GIF", pszSpec="*.max") returned 0 [0096.687] lstrlenA (lpString="*.max") returned 5 [0096.687] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\BUTTON.GIF", pszSpec="*.bmp") returned 0 [0096.687] lstrlenA (lpString="*.bmp") returned 5 [0096.687] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\BUTTON.GIF", pszSpec="*.gif") returned 1 [0096.687] lstrlenA (lpString="*.gif") returned 5 [0096.687] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\BUTTON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\BUTTON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\BUTTON.GIF" [0096.687] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\BUTTON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\BUTTON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\BUTTON.GIF" [0096.687] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\BUTTON.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\BUTTON.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\BUTTON.GIF." [0096.687] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\BUTTON.GIF.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\BUTTON.GIF. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\BUTTON.GIF. " [0096.687] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\BUTTON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\babyblue\\button.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0 [0096.737] GetFileSize (in: hFile=0xa0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb9 [0096.737] GetFileTime (in: hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9de07200, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5f409670, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9de07200, dwHighDateTime=0x1c747ea)) returned 1 [0096.737] SetFilePointer (in: hFile=0xa0, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0096.737] ReadFile (in: hFile=0xa0, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x5f, lpOverlapped=0x0) returned 1 [0096.738] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\BUTTON.GIF") returned="BUTTON.GIF" [0096.738] SetFilePointer (in: hFile=0xa0, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0096.738] WriteFile (in: hFile=0xa0, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x5f, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x5f, lpOverlapped=0x0) returned 1 [0096.738] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0096.738] CloseHandle (hObject=0xa0) returned 1 [0096.738] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\BUTTON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\babyblue\\button.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\BUTTON.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\babyblue\\button.gif. ")) returned 1 [0096.740] FindNextFileA (in: hFindFile=0x5be1e0, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 1 [0096.740] PeekMessageA (in: lpMsg=0xaeb94, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaeb94) returned 0 [0096.740] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="HEADER.GIF") returned -1 [0096.740] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="HEADER.GIF") returned 1 [0096.740] lstrcmpiA (lpString1="", lpString2="HEADER.GIF") returned -1 [0096.740] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\BUTTON.GIF") returned="BUTTON.GIF" [0096.740] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\", lpString2="HEADER.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\HEADER.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\HEADER.GIF" [0096.740] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\HEADER.GIF", pszSpec="*.zip") returned 0 [0096.740] lstrlenA (lpString="*.zip") returned 5 [0096.740] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\HEADER.GIF", pszSpec="*.rar") returned 0 [0096.740] lstrlenA (lpString="*.rar") returned 5 [0096.740] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\HEADER.GIF", pszSpec="*.7z") returned 0 [0096.740] lstrlenA (lpString="*.7z") returned 4 [0096.740] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\HEADER.GIF", pszSpec="*.tar") returned 0 [0096.740] lstrlenA (lpString="*.tar") returned 5 [0096.740] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\HEADER.GIF", pszSpec="*.gzip") returned 0 [0096.740] lstrlenA (lpString="*.gzip") returned 6 [0096.740] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\HEADER.GIF", pszSpec="*.jpg") returned 0 [0096.740] lstrlenA (lpString="*.jpg") returned 5 [0096.740] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\HEADER.GIF", pszSpec="*.jpeg") returned 0 [0096.740] lstrlenA (lpString="*.jpeg") returned 6 [0096.740] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\HEADER.GIF", pszSpec="*.psd") returned 0 [0096.740] lstrlenA (lpString="*.psd") returned 5 [0096.740] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\HEADER.GIF", pszSpec="*.cdr") returned 0 [0096.740] lstrlenA (lpString="*.cdr") returned 5 [0096.740] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\HEADER.GIF", pszSpec="*.dwg") returned 0 [0096.740] lstrlenA (lpString="*.dwg") returned 5 [0096.740] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\HEADER.GIF", pszSpec="*.max") returned 0 [0096.740] lstrlenA (lpString="*.max") returned 5 [0096.740] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\HEADER.GIF", pszSpec="*.bmp") returned 0 [0096.740] lstrlenA (lpString="*.bmp") returned 5 [0096.740] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\HEADER.GIF", pszSpec="*.gif") returned 1 [0096.740] lstrlenA (lpString="*.gif") returned 5 [0096.740] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\HEADER.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\HEADER.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\HEADER.GIF" [0096.740] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\HEADER.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\HEADER.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\HEADER.GIF" [0096.740] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\HEADER.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\HEADER.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\HEADER.GIF." [0096.740] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\HEADER.GIF.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\HEADER.GIF. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\HEADER.GIF. " [0096.741] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\HEADER.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\babyblue\\header.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0 [0096.773] GetFileSize (in: hFile=0xa0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xff [0096.773] GetFileTime (in: hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9de07200, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x51767f50, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9de07200, dwHighDateTime=0x1c747ea)) returned 1 [0096.773] SetFilePointer (in: hFile=0xa0, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0096.773] ReadFile (in: hFile=0xa0, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0xa5, lpOverlapped=0x0) returned 1 [0096.774] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\HEADER.GIF") returned="HEADER.GIF" [0096.774] SetFilePointer (in: hFile=0xa0, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0096.774] WriteFile (in: hFile=0xa0, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0xa5, lpOverlapped=0x0) returned 1 [0096.774] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0096.774] CloseHandle (hObject=0xa0) returned 1 [0096.774] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\HEADER.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\babyblue\\header.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\HEADER.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\babyblue\\header.gif. ")) returned 1 [0096.775] FindNextFileA (in: hFindFile=0x5be1e0, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 1 [0096.775] PeekMessageA (in: lpMsg=0xaeb94, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaeb94) returned 0 [0096.775] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="TAB_OFF.GIF") returned -1 [0096.775] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TAB_OFF.GIF") returned -1 [0096.775] lstrcmpiA (lpString1="", lpString2="TAB_OFF.GIF") returned -1 [0096.775] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\HEADER.GIF") returned="HEADER.GIF" [0096.775] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\", lpString2="TAB_OFF.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_OFF.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_OFF.GIF" [0096.775] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_OFF.GIF", pszSpec="*.zip") returned 0 [0096.775] lstrlenA (lpString="*.zip") returned 5 [0096.775] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_OFF.GIF", pszSpec="*.rar") returned 0 [0096.775] lstrlenA (lpString="*.rar") returned 5 [0096.775] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_OFF.GIF", pszSpec="*.7z") returned 0 [0096.775] lstrlenA (lpString="*.7z") returned 4 [0096.775] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_OFF.GIF", pszSpec="*.tar") returned 0 [0096.775] lstrlenA (lpString="*.tar") returned 5 [0096.775] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_OFF.GIF", pszSpec="*.gzip") returned 0 [0096.775] lstrlenA (lpString="*.gzip") returned 6 [0096.775] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_OFF.GIF", pszSpec="*.jpg") returned 0 [0096.775] lstrlenA (lpString="*.jpg") returned 5 [0096.775] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_OFF.GIF", pszSpec="*.jpeg") returned 0 [0096.775] lstrlenA (lpString="*.jpeg") returned 6 [0096.775] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_OFF.GIF", pszSpec="*.psd") returned 0 [0096.775] lstrlenA (lpString="*.psd") returned 5 [0096.775] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_OFF.GIF", pszSpec="*.cdr") returned 0 [0096.775] lstrlenA (lpString="*.cdr") returned 5 [0096.775] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_OFF.GIF", pszSpec="*.dwg") returned 0 [0096.775] lstrlenA (lpString="*.dwg") returned 5 [0096.775] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_OFF.GIF", pszSpec="*.max") returned 0 [0096.775] lstrlenA (lpString="*.max") returned 5 [0096.775] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_OFF.GIF", pszSpec="*.bmp") returned 0 [0096.776] lstrlenA (lpString="*.bmp") returned 5 [0096.776] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_OFF.GIF", pszSpec="*.gif") returned 1 [0096.776] lstrlenA (lpString="*.gif") returned 5 [0096.776] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_OFF.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_OFF.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_OFF.GIF" [0096.776] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_OFF.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_OFF.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_OFF.GIF" [0096.776] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_OFF.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_OFF.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_OFF.GIF." [0096.776] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_OFF.GIF.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_OFF.GIF. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_OFF.GIF. " [0096.776] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\babyblue\\tab_off.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0 [0096.795] GetFileSize (in: hFile=0xa0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x155 [0096.796] GetFileTime (in: hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9de07200, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5f42f7d0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9de07200, dwHighDateTime=0x1c747ea)) returned 1 [0096.796] SetFilePointer (in: hFile=0xa0, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0096.796] ReadFile (in: hFile=0xa0, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0xfb, lpOverlapped=0x0) returned 1 [0096.796] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_OFF.GIF") returned="TAB_OFF.GIF" [0096.796] SetFilePointer (in: hFile=0xa0, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0096.796] WriteFile (in: hFile=0xa0, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0xfb, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0xfb, lpOverlapped=0x0) returned 1 [0096.796] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0096.796] CloseHandle (hObject=0xa0) returned 1 [0096.797] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\babyblue\\tab_off.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_OFF.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\babyblue\\tab_off.gif. ")) returned 1 [0096.825] FindNextFileA (in: hFindFile=0x5be1e0, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 1 [0096.825] PeekMessageA (in: lpMsg=0xaeb94, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaeb94) returned 0 [0096.825] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="TAB_ON.GIF") returned -1 [0096.825] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TAB_ON.GIF") returned -1 [0096.825] lstrcmpiA (lpString1="", lpString2="TAB_ON.GIF") returned -1 [0096.825] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_OFF.GIF") returned="TAB_OFF.GIF" [0096.825] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\", lpString2="TAB_ON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_ON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_ON.GIF" [0096.825] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_ON.GIF", pszSpec="*.zip") returned 0 [0096.825] lstrlenA (lpString="*.zip") returned 5 [0096.825] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_ON.GIF", pszSpec="*.rar") returned 0 [0096.825] lstrlenA (lpString="*.rar") returned 5 [0096.825] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_ON.GIF", pszSpec="*.7z") returned 0 [0096.825] lstrlenA (lpString="*.7z") returned 4 [0096.825] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_ON.GIF", pszSpec="*.tar") returned 0 [0096.825] lstrlenA (lpString="*.tar") returned 5 [0096.825] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_ON.GIF", pszSpec="*.gzip") returned 0 [0096.825] lstrlenA (lpString="*.gzip") returned 6 [0096.825] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_ON.GIF", pszSpec="*.jpg") returned 0 [0096.825] lstrlenA (lpString="*.jpg") returned 5 [0096.825] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_ON.GIF", pszSpec="*.jpeg") returned 0 [0096.826] lstrlenA (lpString="*.jpeg") returned 6 [0096.826] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_ON.GIF", pszSpec="*.psd") returned 0 [0096.826] lstrlenA (lpString="*.psd") returned 5 [0096.826] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_ON.GIF", pszSpec="*.cdr") returned 0 [0096.826] lstrlenA (lpString="*.cdr") returned 5 [0096.826] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_ON.GIF", pszSpec="*.dwg") returned 0 [0096.826] lstrlenA (lpString="*.dwg") returned 5 [0096.826] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_ON.GIF", pszSpec="*.max") returned 0 [0096.826] lstrlenA (lpString="*.max") returned 5 [0096.826] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_ON.GIF", pszSpec="*.bmp") returned 0 [0096.826] lstrlenA (lpString="*.bmp") returned 5 [0096.826] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_ON.GIF", pszSpec="*.gif") returned 1 [0096.826] lstrlenA (lpString="*.gif") returned 5 [0096.826] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_ON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_ON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_ON.GIF" [0096.826] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_ON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_ON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_ON.GIF" [0096.826] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_ON.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_ON.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_ON.GIF." [0096.826] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_ON.GIF.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_ON.GIF. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_ON.GIF. " [0096.826] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\babyblue\\tab_on.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0 [0096.826] GetFileSize (in: hFile=0xa0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xde [0096.827] GetFileTime (in: hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9de07200, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5178e0b0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9de07200, dwHighDateTime=0x1c747ea)) returned 1 [0096.827] SetFilePointer (in: hFile=0xa0, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0096.827] ReadFile (in: hFile=0xa0, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x84, lpOverlapped=0x0) returned 1 [0096.827] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_ON.GIF") returned="TAB_ON.GIF" [0096.827] SetFilePointer (in: hFile=0xa0, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0096.827] WriteFile (in: hFile=0xa0, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x84, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x84, lpOverlapped=0x0) returned 1 [0096.827] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0096.827] CloseHandle (hObject=0xa0) returned 1 [0096.828] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\babyblue\\tab_on.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_ON.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\babyblue\\tab_on.gif. ")) returned 1 [0096.828] FindNextFileA (in: hFindFile=0x5be1e0, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 0 [0096.828] FindClose (in: hFindFile=0x5be1e0 | out: hFindFile=0x5be1e0) returned 1 [0096.828] FindNextFileA (in: hFindFile=0x5be1a0, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0096.828] PeekMessageA (in: lpMsg=0xaece4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaece4) returned 0 [0096.828] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BabyBlue.css") returned 1 [0096.828] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BabyBlue.css") returned 1 [0096.828] lstrcmpiA (lpString1="", lpString2="BabyBlue.css") returned -1 [0096.828] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\*.*") returned="*.*" [0096.828] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\", lpString2="BabyBlue.css" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue.css") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue.css" [0096.828] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue.css", pszSpec="*.zip") returned 0 [0096.828] lstrlenA (lpString="*.zip") returned 5 [0096.828] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue.css", pszSpec="*.rar") returned 0 [0096.828] lstrlenA (lpString="*.rar") returned 5 [0096.828] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue.css", pszSpec="*.7z") returned 0 [0096.829] lstrlenA (lpString="*.7z") returned 4 [0096.829] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue.css", pszSpec="*.tar") returned 0 [0096.829] lstrlenA (lpString="*.tar") returned 5 [0096.829] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue.css", pszSpec="*.gzip") returned 0 [0096.829] lstrlenA (lpString="*.gzip") returned 6 [0096.829] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue.css", pszSpec="*.jpg") returned 0 [0096.829] lstrlenA (lpString="*.jpg") returned 5 [0096.829] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue.css", pszSpec="*.jpeg") returned 0 [0096.829] lstrlenA (lpString="*.jpeg") returned 6 [0096.829] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue.css", pszSpec="*.psd") returned 0 [0096.829] lstrlenA (lpString="*.psd") returned 5 [0096.829] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue.css", pszSpec="*.cdr") returned 0 [0096.829] lstrlenA (lpString="*.cdr") returned 5 [0096.829] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue.css", pszSpec="*.dwg") returned 0 [0096.829] lstrlenA (lpString="*.dwg") returned 5 [0096.829] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue.css", pszSpec="*.max") returned 0 [0096.829] lstrlenA (lpString="*.max") returned 5 [0096.829] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue.css", pszSpec="*.bmp") returned 0 [0096.829] lstrlenA (lpString="*.bmp") returned 5 [0096.829] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue.css", pszSpec="*.gif") returned 0 [0096.829] lstrlenA (lpString="*.gif") returned 5 [0096.829] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue.css", pszSpec="*.png") returned 0 [0096.829] lstrlenA (lpString="*.png") returned 5 [0096.829] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue.css", pszSpec="*.doc") returned 0 [0096.829] lstrlenA (lpString="*.doc") returned 5 [0096.829] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue.css", pszSpec="*.docx") returned 0 [0096.829] lstrlenA (lpString="*.docx") returned 6 [0096.829] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue.css", pszSpec="*.xls") returned 0 [0096.829] lstrlenA (lpString="*.xls") returned 5 [0096.829] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue.css", pszSpec="*.xlsx") returned 0 [0096.829] lstrlenA (lpString="*.xlsx") returned 6 [0096.829] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue.css", pszSpec="*.ppt") returned 0 [0096.829] lstrlenA (lpString="*.ppt") returned 5 [0096.829] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue.css", pszSpec="*.pptx") returned 0 [0096.829] lstrlenA (lpString="*.pptx") returned 6 [0096.829] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue.css", pszSpec="*.txt") returned 0 [0096.829] lstrlenA (lpString="*.txt") returned 5 [0096.829] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue.css", pszSpec="*.pdf") returned 0 [0096.829] lstrlenA (lpString="*.pdf") returned 5 [0096.829] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue.css", pszSpec="*.djvu") returned 0 [0096.829] lstrlenA (lpString="*.djvu") returned 6 [0096.829] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue.css", pszSpec="*.htm") returned 0 [0096.829] lstrlenA (lpString="*.htm") returned 5 [0096.829] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue.css", pszSpec="*.html") returned 0 [0096.829] lstrlenA (lpString="*.html") returned 6 [0096.829] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue.css", pszSpec="*.mdb") returned 0 [0096.829] lstrlenA (lpString="*.mdb") returned 5 [0096.829] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue.css", pszSpec="*.cer") returned 0 [0096.829] lstrlenA (lpString="*.cer") returned 5 [0096.830] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue.css", pszSpec="*.p12") returned 0 [0096.830] lstrlenA (lpString="*.p12") returned 5 [0096.830] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue.css", pszSpec="*.pfx") returned 0 [0096.830] lstrlenA (lpString="*.pfx") returned 5 [0096.830] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue.css", pszSpec="*.kwm") returned 0 [0096.830] lstrlenA (lpString="*.kwm") returned 5 [0096.830] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue.css", pszSpec="*.pwm") returned 0 [0096.830] lstrlenA (lpString="*.pwm") returned 5 [0096.830] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue.css", pszSpec="*.1cd") returned 0 [0096.830] lstrlenA (lpString="*.1cd") returned 5 [0096.830] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue.css", pszSpec="*.md") returned 0 [0096.830] lstrlenA (lpString="*.md") returned 4 [0096.830] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue.css", pszSpec="*.mdf") returned 0 [0096.830] lstrlenA (lpString="*.mdf") returned 5 [0096.830] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue.css", pszSpec="*.dbf") returned 0 [0096.830] lstrlenA (lpString="*.dbf") returned 5 [0096.830] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue.css", pszSpec="*.odt") returned 0 [0096.830] lstrlenA (lpString="*.odt") returned 5 [0096.830] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue.css", pszSpec="*.vob") returned 0 [0096.830] lstrlenA (lpString="*.vob") returned 5 [0096.830] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue.css", pszSpec="*.ifo") returned 0 [0096.830] lstrlenA (lpString="*.ifo") returned 5 [0096.830] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue.css", pszSpec="*.lnk") returned 0 [0096.830] lstrlenA (lpString="*.lnk") returned 5 [0096.830] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue.css", pszSpec="*.torrent") returned 0 [0096.830] lstrlenA (lpString="*.torrent") returned 9 [0096.830] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue.css", pszSpec="*.mov") returned 0 [0096.830] lstrlenA (lpString="*.mov") returned 5 [0096.830] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue.css", pszSpec="*.m2v") returned 0 [0096.830] lstrlenA (lpString="*.m2v") returned 5 [0096.830] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue.css", pszSpec="*.3gp") returned 0 [0096.830] lstrlenA (lpString="*.3gp") returned 5 [0096.830] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue.css", pszSpec="*.mpeg") returned 0 [0096.830] lstrlenA (lpString="*.mpeg") returned 6 [0096.830] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue.css", pszSpec="*.mpg") returned 0 [0096.830] lstrlenA (lpString="*.mpg") returned 5 [0096.830] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue.css", pszSpec="*.flv") returned 0 [0096.830] lstrlenA (lpString="*.flv") returned 5 [0096.830] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue.css", pszSpec="*.avi") returned 0 [0096.830] lstrlenA (lpString="*.avi") returned 5 [0096.830] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue.css", pszSpec="*.mp4") returned 0 [0096.830] lstrlenA (lpString="*.mp4") returned 5 [0096.830] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue.css", pszSpec="*.wmv") returned 0 [0096.830] lstrlenA (lpString="*.wmv") returned 5 [0096.830] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue.css", pszSpec="*.divx") returned 0 [0096.830] lstrlenA (lpString="*.divx") returned 6 [0096.830] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue.css", pszSpec="*.mkv") returned 0 [0096.831] lstrlenA (lpString="*.mkv") returned 5 [0096.831] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue.css", pszSpec="*.mp3") returned 0 [0096.831] lstrlenA (lpString="*.mp3") returned 5 [0096.831] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue.css", pszSpec="*.wav") returned 0 [0096.831] lstrlenA (lpString="*.wav") returned 5 [0096.831] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue.css", pszSpec="*.flac") returned 0 [0096.831] lstrlenA (lpString="*.flac") returned 6 [0096.831] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue.css", pszSpec="*.ape") returned 0 [0096.831] lstrlenA (lpString="*.ape") returned 5 [0096.831] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue.css", pszSpec="*.wma") returned 0 [0096.831] lstrlenA (lpString="*.wma") returned 5 [0096.831] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue.css", pszSpec="*.ac3") returned 0 [0096.831] lstrlenA (lpString="*.ac3") returned 5 [0096.831] FindNextFileA (in: hFindFile=0x5be1a0, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0096.831] lstrcmpA (lpString1=".", lpString2="Biscay") returned -1 [0096.831] lstrcmpA (lpString1="..", lpString2="Biscay") returned -1 [0096.831] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue.css") returned="BabyBlue.css" [0096.831] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\", lpString2="Biscay" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay" [0096.831] lstrlenA (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay") returned 101 [0096.831] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\*.*", lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 0x5be1e0 [0096.831] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0096.831] FindNextFileA (in: hFindFile=0x5be1e0, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 1 [0096.831] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0096.831] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0096.831] FindNextFileA (in: hFindFile=0x5be1e0, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 1 [0096.831] PeekMessageA (in: lpMsg=0xaeb94, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaeb94) returned 0 [0096.831] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="TAB_OFF.GIF") returned -1 [0096.831] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TAB_OFF.GIF") returned -1 [0096.831] lstrcmpiA (lpString1="", lpString2="TAB_OFF.GIF") returned -1 [0096.831] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\*.*") returned="*.*" [0096.831] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\", lpString2="TAB_OFF.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_OFF.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_OFF.GIF" [0096.831] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_OFF.GIF", pszSpec="*.zip") returned 0 [0096.831] lstrlenA (lpString="*.zip") returned 5 [0096.831] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_OFF.GIF", pszSpec="*.rar") returned 0 [0096.831] lstrlenA (lpString="*.rar") returned 5 [0096.831] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_OFF.GIF", pszSpec="*.7z") returned 0 [0096.832] lstrlenA (lpString="*.7z") returned 4 [0096.832] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_OFF.GIF", pszSpec="*.tar") returned 0 [0096.832] lstrlenA (lpString="*.tar") returned 5 [0096.832] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_OFF.GIF", pszSpec="*.gzip") returned 0 [0096.832] lstrlenA (lpString="*.gzip") returned 6 [0096.832] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_OFF.GIF", pszSpec="*.jpg") returned 0 [0096.832] lstrlenA (lpString="*.jpg") returned 5 [0096.832] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_OFF.GIF", pszSpec="*.jpeg") returned 0 [0096.832] lstrlenA (lpString="*.jpeg") returned 6 [0096.832] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_OFF.GIF", pszSpec="*.psd") returned 0 [0096.832] lstrlenA (lpString="*.psd") returned 5 [0096.832] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_OFF.GIF", pszSpec="*.cdr") returned 0 [0096.832] lstrlenA (lpString="*.cdr") returned 5 [0096.832] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_OFF.GIF", pszSpec="*.dwg") returned 0 [0096.832] lstrlenA (lpString="*.dwg") returned 5 [0096.832] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_OFF.GIF", pszSpec="*.max") returned 0 [0096.832] lstrlenA (lpString="*.max") returned 5 [0096.832] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_OFF.GIF", pszSpec="*.bmp") returned 0 [0096.832] lstrlenA (lpString="*.bmp") returned 5 [0096.832] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_OFF.GIF", pszSpec="*.gif") returned 1 [0096.832] lstrlenA (lpString="*.gif") returned 5 [0096.832] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_OFF.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_OFF.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_OFF.GIF" [0096.832] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_OFF.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_OFF.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_OFF.GIF" [0096.832] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_OFF.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_OFF.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_OFF.GIF." [0096.832] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_OFF.GIF.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_OFF.GIF. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_OFF.GIF. " [0096.832] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\biscay\\tab_off.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0 [0096.833] GetFileSize (in: hFile=0xa0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x155 [0096.833] GetFileTime (in: hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9de07200, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5f690dd0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9de07200, dwHighDateTime=0x1c747ea)) returned 1 [0096.833] SetFilePointer (in: hFile=0xa0, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0096.833] ReadFile (in: hFile=0xa0, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0xfb, lpOverlapped=0x0) returned 1 [0096.833] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_OFF.GIF") returned="TAB_OFF.GIF" [0096.833] SetFilePointer (in: hFile=0xa0, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0096.834] WriteFile (in: hFile=0xa0, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0xfb, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0xfb, lpOverlapped=0x0) returned 1 [0096.834] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0096.834] CloseHandle (hObject=0xa0) returned 1 [0096.834] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\biscay\\tab_off.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_OFF.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\biscay\\tab_off.gif. ")) returned 1 [0096.835] FindNextFileA (in: hFindFile=0x5be1e0, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 1 [0096.835] PeekMessageA (in: lpMsg=0xaeb94, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaeb94) returned 0 [0096.835] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="TAB_ON.GIF") returned -1 [0096.835] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TAB_ON.GIF") returned -1 [0096.835] lstrcmpiA (lpString1="", lpString2="TAB_ON.GIF") returned -1 [0096.835] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_OFF.GIF") returned="TAB_OFF.GIF" [0096.835] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\", lpString2="TAB_ON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_ON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_ON.GIF" [0096.835] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_ON.GIF", pszSpec="*.zip") returned 0 [0096.835] lstrlenA (lpString="*.zip") returned 5 [0096.835] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_ON.GIF", pszSpec="*.rar") returned 0 [0096.835] lstrlenA (lpString="*.rar") returned 5 [0096.835] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_ON.GIF", pszSpec="*.7z") returned 0 [0096.835] lstrlenA (lpString="*.7z") returned 4 [0096.835] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_ON.GIF", pszSpec="*.tar") returned 0 [0096.835] lstrlenA (lpString="*.tar") returned 5 [0096.835] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_ON.GIF", pszSpec="*.gzip") returned 0 [0096.835] lstrlenA (lpString="*.gzip") returned 6 [0096.835] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_ON.GIF", pszSpec="*.jpg") returned 0 [0096.835] lstrlenA (lpString="*.jpg") returned 5 [0096.835] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_ON.GIF", pszSpec="*.jpeg") returned 0 [0096.835] lstrlenA (lpString="*.jpeg") returned 6 [0096.835] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_ON.GIF", pszSpec="*.psd") returned 0 [0096.835] lstrlenA (lpString="*.psd") returned 5 [0096.835] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_ON.GIF", pszSpec="*.cdr") returned 0 [0096.835] lstrlenA (lpString="*.cdr") returned 5 [0096.835] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_ON.GIF", pszSpec="*.dwg") returned 0 [0096.835] lstrlenA (lpString="*.dwg") returned 5 [0096.835] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_ON.GIF", pszSpec="*.max") returned 0 [0096.835] lstrlenA (lpString="*.max") returned 5 [0096.835] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_ON.GIF", pszSpec="*.bmp") returned 0 [0096.835] lstrlenA (lpString="*.bmp") returned 5 [0096.835] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_ON.GIF", pszSpec="*.gif") returned 1 [0096.835] lstrlenA (lpString="*.gif") returned 5 [0096.835] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_ON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_ON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_ON.GIF" [0096.835] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_ON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_ON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_ON.GIF" [0096.835] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_ON.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_ON.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_ON.GIF." [0096.835] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_ON.GIF.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_ON.GIF. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_ON.GIF. " [0096.835] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\biscay\\tab_on.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0 [0096.836] GetFileSize (in: hFile=0xa0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xde [0096.836] GetFileTime (in: hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9de07200, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x519c9550, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9de07200, dwHighDateTime=0x1c747ea)) returned 1 [0096.836] SetFilePointer (in: hFile=0xa0, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0096.836] ReadFile (in: hFile=0xa0, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x84, lpOverlapped=0x0) returned 1 [0096.837] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_ON.GIF") returned="TAB_ON.GIF" [0096.837] SetFilePointer (in: hFile=0xa0, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0096.837] WriteFile (in: hFile=0xa0, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x84, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x84, lpOverlapped=0x0) returned 1 [0096.837] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0096.837] CloseHandle (hObject=0xa0) returned 1 [0096.837] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\biscay\\tab_on.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_ON.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\biscay\\tab_on.gif. ")) returned 1 [0096.838] FindNextFileA (in: hFindFile=0x5be1e0, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 0 [0096.838] FindClose (in: hFindFile=0x5be1e0 | out: hFindFile=0x5be1e0) returned 1 [0096.838] FindNextFileA (in: hFindFile=0x5be1a0, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0096.838] PeekMessageA (in: lpMsg=0xaece4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaece4) returned 0 [0096.838] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Biscay.css") returned 1 [0096.838] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Biscay.css") returned 1 [0096.838] lstrcmpiA (lpString1="", lpString2="Biscay.css") returned -1 [0096.838] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\*.*") returned="*.*" [0096.838] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\", lpString2="Biscay.css" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay.css") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay.css" [0096.838] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay.css", pszSpec="*.zip") returned 0 [0096.838] lstrlenA (lpString="*.zip") returned 5 [0096.838] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay.css", pszSpec="*.rar") returned 0 [0096.839] lstrlenA (lpString="*.rar") returned 5 [0096.839] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay.css", pszSpec="*.7z") returned 0 [0096.839] lstrlenA (lpString="*.7z") returned 4 [0096.839] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay.css", pszSpec="*.tar") returned 0 [0096.839] lstrlenA (lpString="*.tar") returned 5 [0096.839] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay.css", pszSpec="*.gzip") returned 0 [0096.839] lstrlenA (lpString="*.gzip") returned 6 [0096.839] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay.css", pszSpec="*.jpg") returned 0 [0096.839] lstrlenA (lpString="*.jpg") returned 5 [0096.839] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay.css", pszSpec="*.jpeg") returned 0 [0096.839] lstrlenA (lpString="*.jpeg") returned 6 [0096.839] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay.css", pszSpec="*.psd") returned 0 [0096.839] lstrlenA (lpString="*.psd") returned 5 [0096.839] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay.css", pszSpec="*.cdr") returned 0 [0096.839] lstrlenA (lpString="*.cdr") returned 5 [0096.839] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay.css", pszSpec="*.dwg") returned 0 [0096.839] lstrlenA (lpString="*.dwg") returned 5 [0096.839] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay.css", pszSpec="*.max") returned 0 [0096.839] lstrlenA (lpString="*.max") returned 5 [0096.839] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay.css", pszSpec="*.bmp") returned 0 [0096.839] lstrlenA (lpString="*.bmp") returned 5 [0096.839] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay.css", pszSpec="*.gif") returned 0 [0096.839] lstrlenA (lpString="*.gif") returned 5 [0096.839] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay.css", pszSpec="*.png") returned 0 [0096.839] lstrlenA (lpString="*.png") returned 5 [0096.839] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay.css", pszSpec="*.doc") returned 0 [0096.839] lstrlenA (lpString="*.doc") returned 5 [0096.839] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay.css", pszSpec="*.docx") returned 0 [0096.839] lstrlenA (lpString="*.docx") returned 6 [0096.839] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay.css", pszSpec="*.xls") returned 0 [0096.839] lstrlenA (lpString="*.xls") returned 5 [0096.839] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay.css", pszSpec="*.xlsx") returned 0 [0096.839] lstrlenA (lpString="*.xlsx") returned 6 [0096.839] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay.css", pszSpec="*.ppt") returned 0 [0096.839] lstrlenA (lpString="*.ppt") returned 5 [0096.839] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay.css", pszSpec="*.pptx") returned 0 [0096.839] lstrlenA (lpString="*.pptx") returned 6 [0096.839] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay.css", pszSpec="*.txt") returned 0 [0096.839] lstrlenA (lpString="*.txt") returned 5 [0096.839] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay.css", pszSpec="*.pdf") returned 0 [0096.839] lstrlenA (lpString="*.pdf") returned 5 [0096.839] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay.css", pszSpec="*.djvu") returned 0 [0096.839] lstrlenA (lpString="*.djvu") returned 6 [0096.839] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay.css", pszSpec="*.htm") returned 0 [0096.839] lstrlenA (lpString="*.htm") returned 5 [0096.839] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay.css", pszSpec="*.html") returned 0 [0096.840] lstrlenA (lpString="*.html") returned 6 [0096.840] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay.css", pszSpec="*.mdb") returned 0 [0096.840] lstrlenA (lpString="*.mdb") returned 5 [0096.840] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay.css", pszSpec="*.cer") returned 0 [0096.840] lstrlenA (lpString="*.cer") returned 5 [0096.840] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay.css", pszSpec="*.p12") returned 0 [0096.840] lstrlenA (lpString="*.p12") returned 5 [0096.840] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay.css", pszSpec="*.pfx") returned 0 [0096.840] lstrlenA (lpString="*.pfx") returned 5 [0096.840] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay.css", pszSpec="*.kwm") returned 0 [0096.840] lstrlenA (lpString="*.kwm") returned 5 [0096.840] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay.css", pszSpec="*.pwm") returned 0 [0096.840] lstrlenA (lpString="*.pwm") returned 5 [0096.840] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay.css", pszSpec="*.1cd") returned 0 [0096.840] lstrlenA (lpString="*.1cd") returned 5 [0096.840] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay.css", pszSpec="*.md") returned 0 [0096.840] lstrlenA (lpString="*.md") returned 4 [0096.840] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay.css", pszSpec="*.mdf") returned 0 [0096.840] lstrlenA (lpString="*.mdf") returned 5 [0096.840] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay.css", pszSpec="*.dbf") returned 0 [0096.840] lstrlenA (lpString="*.dbf") returned 5 [0096.840] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay.css", pszSpec="*.odt") returned 0 [0096.840] lstrlenA (lpString="*.odt") returned 5 [0096.840] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay.css", pszSpec="*.vob") returned 0 [0096.840] lstrlenA (lpString="*.vob") returned 5 [0096.840] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay.css", pszSpec="*.ifo") returned 0 [0096.840] lstrlenA (lpString="*.ifo") returned 5 [0096.840] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay.css", pszSpec="*.lnk") returned 0 [0096.840] lstrlenA (lpString="*.lnk") returned 5 [0096.840] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay.css", pszSpec="*.torrent") returned 0 [0096.840] lstrlenA (lpString="*.torrent") returned 9 [0096.840] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay.css", pszSpec="*.mov") returned 0 [0096.840] lstrlenA (lpString="*.mov") returned 5 [0096.840] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay.css", pszSpec="*.m2v") returned 0 [0096.840] lstrlenA (lpString="*.m2v") returned 5 [0096.840] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay.css", pszSpec="*.3gp") returned 0 [0096.840] lstrlenA (lpString="*.3gp") returned 5 [0096.840] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay.css", pszSpec="*.mpeg") returned 0 [0096.840] lstrlenA (lpString="*.mpeg") returned 6 [0096.840] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay.css", pszSpec="*.mpg") returned 0 [0096.840] lstrlenA (lpString="*.mpg") returned 5 [0096.840] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay.css", pszSpec="*.flv") returned 0 [0096.841] lstrlenA (lpString="*.flv") returned 5 [0096.841] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay.css", pszSpec="*.avi") returned 0 [0096.841] lstrlenA (lpString="*.avi") returned 5 [0096.841] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay.css", pszSpec="*.mp4") returned 0 [0096.841] lstrlenA (lpString="*.mp4") returned 5 [0096.841] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay.css", pszSpec="*.wmv") returned 0 [0096.841] lstrlenA (lpString="*.wmv") returned 5 [0096.841] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay.css", pszSpec="*.divx") returned 0 [0096.841] lstrlenA (lpString="*.divx") returned 6 [0096.841] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay.css", pszSpec="*.mkv") returned 0 [0096.841] lstrlenA (lpString="*.mkv") returned 5 [0096.841] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay.css", pszSpec="*.mp3") returned 0 [0096.841] lstrlenA (lpString="*.mp3") returned 5 [0096.841] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay.css", pszSpec="*.wav") returned 0 [0096.841] lstrlenA (lpString="*.wav") returned 5 [0096.841] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay.css", pszSpec="*.flac") returned 0 [0096.841] lstrlenA (lpString="*.flac") returned 6 [0096.841] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay.css", pszSpec="*.ape") returned 0 [0096.841] lstrlenA (lpString="*.ape") returned 5 [0096.841] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay.css", pszSpec="*.wma") returned 0 [0096.841] lstrlenA (lpString="*.wma") returned 5 [0096.841] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay.css", pszSpec="*.ac3") returned 0 [0096.841] lstrlenA (lpString="*.ac3") returned 5 [0096.841] FindNextFileA (in: hFindFile=0x5be1a0, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0096.841] lstrcmpA (lpString1=".", lpString2="BrightOrange") returned -1 [0096.841] lstrcmpA (lpString1="..", lpString2="BrightOrange") returned -1 [0096.841] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay.css") returned="Biscay.css" [0096.841] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\", lpString2="BrightOrange" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange" [0096.841] lstrlenA (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange") returned 107 [0096.841] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\*.*", lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 0x5be1e0 [0096.842] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0096.842] FindNextFileA (in: hFindFile=0x5be1e0, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 1 [0096.842] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0096.842] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0096.842] FindNextFileA (in: hFindFile=0x5be1e0, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 1 [0096.842] PeekMessageA (in: lpMsg=0xaeb94, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaeb94) returned 0 [0096.842] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="background.gif") returned 1 [0096.842] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="background.gif") returned 1 [0096.842] lstrcmpiA (lpString1="", lpString2="background.gif") returned -1 [0096.842] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\*.*") returned="*.*" [0096.842] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\", lpString2="background.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\background.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\background.gif" [0096.842] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\background.gif", pszSpec="*.zip") returned 0 [0096.842] lstrlenA (lpString="*.zip") returned 5 [0096.843] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\background.gif", pszSpec="*.rar") returned 0 [0096.843] lstrlenA (lpString="*.rar") returned 5 [0096.843] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\background.gif", pszSpec="*.7z") returned 0 [0096.843] lstrlenA (lpString="*.7z") returned 4 [0096.843] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\background.gif", pszSpec="*.tar") returned 0 [0096.843] lstrlenA (lpString="*.tar") returned 5 [0096.843] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\background.gif", pszSpec="*.gzip") returned 0 [0096.843] lstrlenA (lpString="*.gzip") returned 6 [0096.843] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\background.gif", pszSpec="*.jpg") returned 0 [0096.843] lstrlenA (lpString="*.jpg") returned 5 [0096.843] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\background.gif", pszSpec="*.jpeg") returned 0 [0096.843] lstrlenA (lpString="*.jpeg") returned 6 [0096.843] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\background.gif", pszSpec="*.psd") returned 0 [0096.843] lstrlenA (lpString="*.psd") returned 5 [0096.843] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\background.gif", pszSpec="*.cdr") returned 0 [0096.843] lstrlenA (lpString="*.cdr") returned 5 [0096.843] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\background.gif", pszSpec="*.dwg") returned 0 [0096.843] lstrlenA (lpString="*.dwg") returned 5 [0096.843] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\background.gif", pszSpec="*.max") returned 0 [0096.843] lstrlenA (lpString="*.max") returned 5 [0096.843] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\background.gif", pszSpec="*.bmp") returned 0 [0096.843] lstrlenA (lpString="*.bmp") returned 5 [0096.843] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\background.gif", pszSpec="*.gif") returned 1 [0096.843] lstrlenA (lpString="*.gif") returned 5 [0096.843] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\background.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\background.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\background.gif" [0096.843] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\background.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\background.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\background.gif" [0096.843] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\background.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\background.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\background.gif." [0096.843] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\background.gif.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\background.gif. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\background.gif. " [0096.843] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\background.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\brightorange\\background.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0 [0096.844] GetFileSize (in: hFile=0xa0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x143 [0096.844] GetFileTime (in: hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9de07200, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x6003c730, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9de07200, dwHighDateTime=0x1c747ea)) returned 1 [0096.844] SetFilePointer (in: hFile=0xa0, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0096.844] ReadFile (in: hFile=0xa0, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0xe9, lpOverlapped=0x0) returned 1 [0096.845] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\background.gif") returned="background.gif" [0096.845] SetFilePointer (in: hFile=0xa0, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0096.845] WriteFile (in: hFile=0xa0, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0xe9, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0xe9, lpOverlapped=0x0) returned 1 [0096.845] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0096.845] CloseHandle (hObject=0xa0) returned 1 [0096.845] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\background.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\brightorange\\background.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\background.gif. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\brightorange\\background.gif. ")) returned 1 [0096.846] FindNextFileA (in: hFindFile=0x5be1e0, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 1 [0096.846] PeekMessageA (in: lpMsg=0xaeb94, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaeb94) returned 0 [0096.846] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BUTTON.GIF") returned 1 [0096.846] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BUTTON.GIF") returned 1 [0096.846] lstrcmpiA (lpString1="", lpString2="BUTTON.GIF") returned -1 [0096.846] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\background.gif") returned="background.gif" [0096.846] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\", lpString2="BUTTON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\BUTTON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\BUTTON.GIF" [0096.846] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\BUTTON.GIF", pszSpec="*.zip") returned 0 [0096.846] lstrlenA (lpString="*.zip") returned 5 [0096.846] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\BUTTON.GIF", pszSpec="*.rar") returned 0 [0096.846] lstrlenA (lpString="*.rar") returned 5 [0096.846] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\BUTTON.GIF", pszSpec="*.7z") returned 0 [0096.846] lstrlenA (lpString="*.7z") returned 4 [0096.846] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\BUTTON.GIF", pszSpec="*.tar") returned 0 [0096.846] lstrlenA (lpString="*.tar") returned 5 [0096.846] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\BUTTON.GIF", pszSpec="*.gzip") returned 0 [0096.846] lstrlenA (lpString="*.gzip") returned 6 [0096.846] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\BUTTON.GIF", pszSpec="*.jpg") returned 0 [0096.846] lstrlenA (lpString="*.jpg") returned 5 [0096.846] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\BUTTON.GIF", pszSpec="*.jpeg") returned 0 [0096.846] lstrlenA (lpString="*.jpeg") returned 6 [0096.846] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\BUTTON.GIF", pszSpec="*.psd") returned 0 [0096.846] lstrlenA (lpString="*.psd") returned 5 [0096.846] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\BUTTON.GIF", pszSpec="*.cdr") returned 0 [0096.846] lstrlenA (lpString="*.cdr") returned 5 [0096.846] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\BUTTON.GIF", pszSpec="*.dwg") returned 0 [0096.846] lstrlenA (lpString="*.dwg") returned 5 [0096.846] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\BUTTON.GIF", pszSpec="*.max") returned 0 [0096.846] lstrlenA (lpString="*.max") returned 5 [0096.846] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\BUTTON.GIF", pszSpec="*.bmp") returned 0 [0096.846] lstrlenA (lpString="*.bmp") returned 5 [0096.846] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\BUTTON.GIF", pszSpec="*.gif") returned 1 [0096.846] lstrlenA (lpString="*.gif") returned 5 [0096.847] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\BUTTON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\BUTTON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\BUTTON.GIF" [0096.847] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\BUTTON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\BUTTON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\BUTTON.GIF" [0096.847] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\BUTTON.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\BUTTON.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\BUTTON.GIF." [0096.847] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\BUTTON.GIF.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\BUTTON.GIF. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\BUTTON.GIF. " [0096.847] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\BUTTON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\brightorange\\button.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0 [0096.847] GetFileSize (in: hFile=0xa0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb9 [0096.847] GetFileTime (in: hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9de07200, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x51a87c30, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9de07200, dwHighDateTime=0x1c747ea)) returned 1 [0096.847] SetFilePointer (in: hFile=0xa0, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0096.847] ReadFile (in: hFile=0xa0, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x5f, lpOverlapped=0x0) returned 1 [0096.848] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\BUTTON.GIF") returned="BUTTON.GIF" [0096.848] SetFilePointer (in: hFile=0xa0, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0096.848] WriteFile (in: hFile=0xa0, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x5f, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x5f, lpOverlapped=0x0) returned 1 [0096.848] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0096.848] CloseHandle (hObject=0xa0) returned 1 [0096.848] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\BUTTON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\brightorange\\button.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\BUTTON.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\brightorange\\button.gif. ")) returned 1 [0096.850] FindNextFileA (in: hFindFile=0x5be1e0, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 1 [0096.850] PeekMessageA (in: lpMsg=0xaeb94, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaeb94) returned 0 [0096.850] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="TAB_OFF.GIF") returned -1 [0096.850] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TAB_OFF.GIF") returned -1 [0096.850] lstrcmpiA (lpString1="", lpString2="TAB_OFF.GIF") returned -1 [0096.850] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\BUTTON.GIF") returned="BUTTON.GIF" [0096.850] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\", lpString2="TAB_OFF.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_OFF.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_OFF.GIF" [0096.850] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_OFF.GIF", pszSpec="*.zip") returned 0 [0096.850] lstrlenA (lpString="*.zip") returned 5 [0096.850] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_OFF.GIF", pszSpec="*.rar") returned 0 [0096.850] lstrlenA (lpString="*.rar") returned 5 [0096.850] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_OFF.GIF", pszSpec="*.7z") returned 0 [0096.850] lstrlenA (lpString="*.7z") returned 4 [0096.850] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_OFF.GIF", pszSpec="*.tar") returned 0 [0096.850] lstrlenA (lpString="*.tar") returned 5 [0096.851] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_OFF.GIF", pszSpec="*.gzip") returned 0 [0096.851] lstrlenA (lpString="*.gzip") returned 6 [0096.851] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_OFF.GIF", pszSpec="*.jpg") returned 0 [0096.851] lstrlenA (lpString="*.jpg") returned 5 [0096.851] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_OFF.GIF", pszSpec="*.jpeg") returned 0 [0096.851] lstrlenA (lpString="*.jpeg") returned 6 [0096.851] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_OFF.GIF", pszSpec="*.psd") returned 0 [0096.851] lstrlenA (lpString="*.psd") returned 5 [0096.851] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_OFF.GIF", pszSpec="*.cdr") returned 0 [0096.851] lstrlenA (lpString="*.cdr") returned 5 [0096.851] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_OFF.GIF", pszSpec="*.dwg") returned 0 [0096.851] lstrlenA (lpString="*.dwg") returned 5 [0096.851] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_OFF.GIF", pszSpec="*.max") returned 0 [0096.851] lstrlenA (lpString="*.max") returned 5 [0096.851] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_OFF.GIF", pszSpec="*.bmp") returned 0 [0096.851] lstrlenA (lpString="*.bmp") returned 5 [0096.851] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_OFF.GIF", pszSpec="*.gif") returned 1 [0096.851] lstrlenA (lpString="*.gif") returned 5 [0096.851] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_OFF.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_OFF.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_OFF.GIF" [0096.851] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_OFF.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_OFF.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_OFF.GIF" [0096.851] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_OFF.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_OFF.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_OFF.GIF." [0096.851] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_OFF.GIF.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_OFF.GIF. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_OFF.GIF. " [0096.851] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\brightorange\\tab_off.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0 [0096.852] GetFileSize (in: hFile=0xa0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x155 [0096.852] GetFileTime (in: hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9de07200, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x60062890, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9de07200, dwHighDateTime=0x1c747ea)) returned 1 [0096.852] SetFilePointer (in: hFile=0xa0, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0096.852] ReadFile (in: hFile=0xa0, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0xfb, lpOverlapped=0x0) returned 1 [0096.853] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_OFF.GIF") returned="TAB_OFF.GIF" [0096.853] SetFilePointer (in: hFile=0xa0, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0096.853] WriteFile (in: hFile=0xa0, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0xfb, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0xfb, lpOverlapped=0x0) returned 1 [0096.853] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0096.853] CloseHandle (hObject=0xa0) returned 1 [0096.853] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\brightorange\\tab_off.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_OFF.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\brightorange\\tab_off.gif. ")) returned 1 [0096.854] FindNextFileA (in: hFindFile=0x5be1e0, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 1 [0096.854] PeekMessageA (in: lpMsg=0xaeb94, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaeb94) returned 0 [0096.854] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="TAB_ON.GIF") returned -1 [0096.854] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TAB_ON.GIF") returned -1 [0096.854] lstrcmpiA (lpString1="", lpString2="TAB_ON.GIF") returned -1 [0096.854] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_OFF.GIF") returned="TAB_OFF.GIF" [0096.854] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\", lpString2="TAB_ON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_ON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_ON.GIF" [0096.854] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_ON.GIF", pszSpec="*.zip") returned 0 [0096.854] lstrlenA (lpString="*.zip") returned 5 [0096.854] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_ON.GIF", pszSpec="*.rar") returned 0 [0096.854] lstrlenA (lpString="*.rar") returned 5 [0096.854] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_ON.GIF", pszSpec="*.7z") returned 0 [0096.855] lstrlenA (lpString="*.7z") returned 4 [0096.855] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_ON.GIF", pszSpec="*.tar") returned 0 [0096.855] lstrlenA (lpString="*.tar") returned 5 [0096.855] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_ON.GIF", pszSpec="*.gzip") returned 0 [0096.855] lstrlenA (lpString="*.gzip") returned 6 [0096.855] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_ON.GIF", pszSpec="*.jpg") returned 0 [0096.855] lstrlenA (lpString="*.jpg") returned 5 [0096.855] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_ON.GIF", pszSpec="*.jpeg") returned 0 [0096.855] lstrlenA (lpString="*.jpeg") returned 6 [0096.855] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_ON.GIF", pszSpec="*.psd") returned 0 [0096.855] lstrlenA (lpString="*.psd") returned 5 [0096.855] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_ON.GIF", pszSpec="*.cdr") returned 0 [0096.855] lstrlenA (lpString="*.cdr") returned 5 [0096.855] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_ON.GIF", pszSpec="*.dwg") returned 0 [0096.855] lstrlenA (lpString="*.dwg") returned 5 [0096.855] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_ON.GIF", pszSpec="*.max") returned 0 [0096.855] lstrlenA (lpString="*.max") returned 5 [0096.855] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_ON.GIF", pszSpec="*.bmp") returned 0 [0096.855] lstrlenA (lpString="*.bmp") returned 5 [0096.855] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_ON.GIF", pszSpec="*.gif") returned 1 [0096.855] lstrlenA (lpString="*.gif") returned 5 [0096.855] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_ON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_ON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_ON.GIF" [0096.855] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_ON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_ON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_ON.GIF" [0096.855] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_ON.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_ON.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_ON.GIF." [0096.855] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_ON.GIF.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_ON.GIF. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_ON.GIF. " [0096.855] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\brightorange\\tab_on.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0 [0096.856] GetFileSize (in: hFile=0xa0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xde [0096.856] GetFileTime (in: hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9f119f00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x51a87c30, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9f119f00, dwHighDateTime=0x1c747ea)) returned 1 [0096.856] SetFilePointer (in: hFile=0xa0, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0096.856] ReadFile (in: hFile=0xa0, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x84, lpOverlapped=0x0) returned 1 [0096.856] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_ON.GIF") returned="TAB_ON.GIF" [0096.856] SetFilePointer (in: hFile=0xa0, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0096.857] WriteFile (in: hFile=0xa0, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x84, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x84, lpOverlapped=0x0) returned 1 [0096.857] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0096.857] CloseHandle (hObject=0xa0) returned 1 [0096.857] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\brightorange\\tab_on.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_ON.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\brightorange\\tab_on.gif. ")) returned 1 [0096.857] FindNextFileA (in: hFindFile=0x5be1e0, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 0 [0096.858] FindClose (in: hFindFile=0x5be1e0 | out: hFindFile=0x5be1e0) returned 1 [0096.858] FindNextFileA (in: hFindFile=0x5be1a0, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0096.858] PeekMessageA (in: lpMsg=0xaece4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaece4) returned 0 [0096.858] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BrightOrange.css") returned 1 [0096.858] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BrightOrange.css") returned 1 [0096.858] lstrcmpiA (lpString1="", lpString2="BrightOrange.css") returned -1 [0096.858] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\*.*") returned="*.*" [0096.858] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\", lpString2="BrightOrange.css" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange.css") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange.css" [0096.858] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange.css", pszSpec="*.zip") returned 0 [0096.858] lstrlenA (lpString="*.zip") returned 5 [0096.858] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange.css", pszSpec="*.rar") returned 0 [0096.858] lstrlenA (lpString="*.rar") returned 5 [0096.858] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange.css", pszSpec="*.7z") returned 0 [0096.858] lstrlenA (lpString="*.7z") returned 4 [0096.858] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange.css", pszSpec="*.tar") returned 0 [0096.858] lstrlenA (lpString="*.tar") returned 5 [0096.858] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange.css", pszSpec="*.gzip") returned 0 [0096.858] lstrlenA (lpString="*.gzip") returned 6 [0096.858] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange.css", pszSpec="*.jpg") returned 0 [0096.858] lstrlenA (lpString="*.jpg") returned 5 [0096.858] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange.css", pszSpec="*.jpeg") returned 0 [0096.858] lstrlenA (lpString="*.jpeg") returned 6 [0096.858] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange.css", pszSpec="*.psd") returned 0 [0096.858] lstrlenA (lpString="*.psd") returned 5 [0096.858] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange.css", pszSpec="*.cdr") returned 0 [0096.858] lstrlenA (lpString="*.cdr") returned 5 [0096.858] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange.css", pszSpec="*.dwg") returned 0 [0096.858] lstrlenA (lpString="*.dwg") returned 5 [0096.858] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange.css", pszSpec="*.max") returned 0 [0096.858] lstrlenA (lpString="*.max") returned 5 [0096.858] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange.css", pszSpec="*.bmp") returned 0 [0096.858] lstrlenA (lpString="*.bmp") returned 5 [0096.858] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange.css", pszSpec="*.gif") returned 0 [0096.858] lstrlenA (lpString="*.gif") returned 5 [0096.858] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange.css", pszSpec="*.png") returned 0 [0096.858] lstrlenA (lpString="*.png") returned 5 [0096.858] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange.css", pszSpec="*.doc") returned 0 [0096.858] lstrlenA (lpString="*.doc") returned 5 [0096.858] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange.css", pszSpec="*.docx") returned 0 [0096.858] lstrlenA (lpString="*.docx") returned 6 [0096.858] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange.css", pszSpec="*.xls") returned 0 [0096.858] lstrlenA (lpString="*.xls") returned 5 [0096.858] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange.css", pszSpec="*.xlsx") returned 0 [0096.858] lstrlenA (lpString="*.xlsx") returned 6 [0096.858] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange.css", pszSpec="*.ppt") returned 0 [0096.858] lstrlenA (lpString="*.ppt") returned 5 [0096.859] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange.css", pszSpec="*.pptx") returned 0 [0096.859] lstrlenA (lpString="*.pptx") returned 6 [0096.859] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange.css", pszSpec="*.txt") returned 0 [0096.859] lstrlenA (lpString="*.txt") returned 5 [0096.859] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange.css", pszSpec="*.pdf") returned 0 [0096.859] lstrlenA (lpString="*.pdf") returned 5 [0096.859] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange.css", pszSpec="*.djvu") returned 0 [0096.859] lstrlenA (lpString="*.djvu") returned 6 [0096.859] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange.css", pszSpec="*.htm") returned 0 [0096.859] lstrlenA (lpString="*.htm") returned 5 [0096.859] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange.css", pszSpec="*.html") returned 0 [0096.859] lstrlenA (lpString="*.html") returned 6 [0096.859] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange.css", pszSpec="*.mdb") returned 0 [0096.859] lstrlenA (lpString="*.mdb") returned 5 [0096.859] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange.css", pszSpec="*.cer") returned 0 [0096.859] lstrlenA (lpString="*.cer") returned 5 [0096.859] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange.css", pszSpec="*.p12") returned 0 [0096.859] lstrlenA (lpString="*.p12") returned 5 [0096.859] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange.css", pszSpec="*.pfx") returned 0 [0096.859] lstrlenA (lpString="*.pfx") returned 5 [0096.859] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange.css", pszSpec="*.kwm") returned 0 [0096.859] lstrlenA (lpString="*.kwm") returned 5 [0096.859] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange.css", pszSpec="*.pwm") returned 0 [0096.859] lstrlenA (lpString="*.pwm") returned 5 [0096.859] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange.css", pszSpec="*.1cd") returned 0 [0096.859] lstrlenA (lpString="*.1cd") returned 5 [0096.859] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange.css", pszSpec="*.md") returned 0 [0096.859] lstrlenA (lpString="*.md") returned 4 [0096.859] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange.css", pszSpec="*.mdf") returned 0 [0096.859] lstrlenA (lpString="*.mdf") returned 5 [0096.859] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange.css", pszSpec="*.dbf") returned 0 [0096.859] lstrlenA (lpString="*.dbf") returned 5 [0096.859] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange.css", pszSpec="*.odt") returned 0 [0096.859] lstrlenA (lpString="*.odt") returned 5 [0096.859] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange.css", pszSpec="*.vob") returned 0 [0096.859] lstrlenA (lpString="*.vob") returned 5 [0096.859] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange.css", pszSpec="*.ifo") returned 0 [0096.859] lstrlenA (lpString="*.ifo") returned 5 [0096.859] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange.css", pszSpec="*.lnk") returned 0 [0096.859] lstrlenA (lpString="*.lnk") returned 5 [0096.859] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange.css", pszSpec="*.torrent") returned 0 [0096.859] lstrlenA (lpString="*.torrent") returned 9 [0096.859] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange.css", pszSpec="*.mov") returned 0 [0096.859] lstrlenA (lpString="*.mov") returned 5 [0096.859] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange.css", pszSpec="*.m2v") returned 0 [0096.859] lstrlenA (lpString="*.m2v") returned 5 [0096.859] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange.css", pszSpec="*.3gp") returned 0 [0096.859] lstrlenA (lpString="*.3gp") returned 5 [0096.859] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange.css", pszSpec="*.mpeg") returned 0 [0096.860] lstrlenA (lpString="*.mpeg") returned 6 [0096.860] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange.css", pszSpec="*.mpg") returned 0 [0096.860] lstrlenA (lpString="*.mpg") returned 5 [0096.860] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange.css", pszSpec="*.flv") returned 0 [0096.860] lstrlenA (lpString="*.flv") returned 5 [0096.860] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange.css", pszSpec="*.avi") returned 0 [0096.860] lstrlenA (lpString="*.avi") returned 5 [0096.860] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange.css", pszSpec="*.mp4") returned 0 [0096.860] lstrlenA (lpString="*.mp4") returned 5 [0096.860] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange.css", pszSpec="*.wmv") returned 0 [0096.860] lstrlenA (lpString="*.wmv") returned 5 [0096.860] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange.css", pszSpec="*.divx") returned 0 [0096.860] lstrlenA (lpString="*.divx") returned 6 [0096.860] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange.css", pszSpec="*.mkv") returned 0 [0096.860] lstrlenA (lpString="*.mkv") returned 5 [0096.860] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange.css", pszSpec="*.mp3") returned 0 [0096.860] lstrlenA (lpString="*.mp3") returned 5 [0096.860] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange.css", pszSpec="*.wav") returned 0 [0096.860] lstrlenA (lpString="*.wav") returned 5 [0096.860] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange.css", pszSpec="*.flac") returned 0 [0096.860] lstrlenA (lpString="*.flac") returned 6 [0096.860] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange.css", pszSpec="*.ape") returned 0 [0096.860] lstrlenA (lpString="*.ape") returned 5 [0096.860] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange.css", pszSpec="*.wma") returned 0 [0096.860] lstrlenA (lpString="*.wma") returned 5 [0096.860] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange.css", pszSpec="*.ac3") returned 0 [0096.860] lstrlenA (lpString="*.ac3") returned 5 [0096.860] FindNextFileA (in: hFindFile=0x5be1a0, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0096.860] lstrcmpA (lpString1=".", lpString2="BrightYellow") returned -1 [0096.860] lstrcmpA (lpString1="..", lpString2="BrightYellow") returned -1 [0096.860] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange.css") returned="BrightOrange.css" [0096.860] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\", lpString2="BrightYellow" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow" [0096.860] lstrlenA (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow") returned 107 [0096.860] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\*.*", lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 0x5be1e0 [0096.861] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0096.861] FindNextFileA (in: hFindFile=0x5be1e0, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 1 [0096.861] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0096.861] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0096.861] FindNextFileA (in: hFindFile=0x5be1e0, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 1 [0096.861] PeekMessageA (in: lpMsg=0xaeb94, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaeb94) returned 0 [0096.861] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="HEADER.GIF") returned -1 [0096.861] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="HEADER.GIF") returned 1 [0096.861] lstrcmpiA (lpString1="", lpString2="HEADER.GIF") returned -1 [0096.862] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\*.*") returned="*.*" [0096.862] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\", lpString2="HEADER.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\HEADER.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\HEADER.GIF" [0096.862] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\HEADER.GIF", pszSpec="*.zip") returned 0 [0096.862] lstrlenA (lpString="*.zip") returned 5 [0096.862] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\HEADER.GIF", pszSpec="*.rar") returned 0 [0096.862] lstrlenA (lpString="*.rar") returned 5 [0096.862] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\HEADER.GIF", pszSpec="*.7z") returned 0 [0096.862] lstrlenA (lpString="*.7z") returned 4 [0096.862] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\HEADER.GIF", pszSpec="*.tar") returned 0 [0096.862] lstrlenA (lpString="*.tar") returned 5 [0096.862] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\HEADER.GIF", pszSpec="*.gzip") returned 0 [0096.862] lstrlenA (lpString="*.gzip") returned 6 [0096.862] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\HEADER.GIF", pszSpec="*.jpg") returned 0 [0096.862] lstrlenA (lpString="*.jpg") returned 5 [0096.862] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\HEADER.GIF", pszSpec="*.jpeg") returned 0 [0096.862] lstrlenA (lpString="*.jpeg") returned 6 [0096.862] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\HEADER.GIF", pszSpec="*.psd") returned 0 [0096.862] lstrlenA (lpString="*.psd") returned 5 [0096.862] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\HEADER.GIF", pszSpec="*.cdr") returned 0 [0096.862] lstrlenA (lpString="*.cdr") returned 5 [0096.862] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\HEADER.GIF", pszSpec="*.dwg") returned 0 [0096.862] lstrlenA (lpString="*.dwg") returned 5 [0096.862] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\HEADER.GIF", pszSpec="*.max") returned 0 [0096.862] lstrlenA (lpString="*.max") returned 5 [0096.862] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\HEADER.GIF", pszSpec="*.bmp") returned 0 [0096.862] lstrlenA (lpString="*.bmp") returned 5 [0096.862] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\HEADER.GIF", pszSpec="*.gif") returned 1 [0096.862] lstrlenA (lpString="*.gif") returned 5 [0096.862] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\HEADER.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\HEADER.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\HEADER.GIF" [0096.862] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\HEADER.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\HEADER.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\HEADER.GIF" [0096.862] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\HEADER.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\HEADER.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\HEADER.GIF." [0096.862] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\HEADER.GIF.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\HEADER.GIF. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\HEADER.GIF. " [0096.862] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\HEADER.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\brightyellow\\header.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0 [0096.863] GetFileSize (in: hFile=0xa0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x16f [0096.863] GetFileTime (in: hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9f119f00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x60062890, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9f119f00, dwHighDateTime=0x1c747ea)) returned 1 [0096.863] SetFilePointer (in: hFile=0xa0, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0096.863] ReadFile (in: hFile=0xa0, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x115, lpOverlapped=0x0) returned 1 [0096.864] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\HEADER.GIF") returned="HEADER.GIF" [0096.864] SetFilePointer (in: hFile=0xa0, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0096.864] WriteFile (in: hFile=0xa0, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x115, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x115, lpOverlapped=0x0) returned 1 [0096.864] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0096.864] CloseHandle (hObject=0xa0) returned 1 [0096.864] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\HEADER.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\brightyellow\\header.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\HEADER.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\brightyellow\\header.gif. ")) returned 1 [0096.865] FindNextFileA (in: hFindFile=0x5be1e0, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 1 [0096.865] PeekMessageA (in: lpMsg=0xaeb94, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaeb94) returned 0 [0096.865] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="TAB_OFF.GIF") returned -1 [0096.865] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TAB_OFF.GIF") returned -1 [0096.865] lstrcmpiA (lpString1="", lpString2="TAB_OFF.GIF") returned -1 [0096.865] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\HEADER.GIF") returned="HEADER.GIF" [0096.865] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\", lpString2="TAB_OFF.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_OFF.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_OFF.GIF" [0096.865] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_OFF.GIF", pszSpec="*.zip") returned 0 [0096.865] lstrlenA (lpString="*.zip") returned 5 [0096.865] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_OFF.GIF", pszSpec="*.rar") returned 0 [0096.865] lstrlenA (lpString="*.rar") returned 5 [0096.865] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_OFF.GIF", pszSpec="*.7z") returned 0 [0096.865] lstrlenA (lpString="*.7z") returned 4 [0096.865] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_OFF.GIF", pszSpec="*.tar") returned 0 [0096.865] lstrlenA (lpString="*.tar") returned 5 [0096.865] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_OFF.GIF", pszSpec="*.gzip") returned 0 [0096.865] lstrlenA (lpString="*.gzip") returned 6 [0096.865] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_OFF.GIF", pszSpec="*.jpg") returned 0 [0096.865] lstrlenA (lpString="*.jpg") returned 5 [0096.865] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_OFF.GIF", pszSpec="*.jpeg") returned 0 [0096.866] lstrlenA (lpString="*.jpeg") returned 6 [0096.866] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_OFF.GIF", pszSpec="*.psd") returned 0 [0096.866] lstrlenA (lpString="*.psd") returned 5 [0096.866] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_OFF.GIF", pszSpec="*.cdr") returned 0 [0096.866] lstrlenA (lpString="*.cdr") returned 5 [0096.866] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_OFF.GIF", pszSpec="*.dwg") returned 0 [0096.866] lstrlenA (lpString="*.dwg") returned 5 [0096.866] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_OFF.GIF", pszSpec="*.max") returned 0 [0096.866] lstrlenA (lpString="*.max") returned 5 [0096.866] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_OFF.GIF", pszSpec="*.bmp") returned 0 [0096.866] lstrlenA (lpString="*.bmp") returned 5 [0096.866] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_OFF.GIF", pszSpec="*.gif") returned 1 [0096.866] lstrlenA (lpString="*.gif") returned 5 [0096.866] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_OFF.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_OFF.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_OFF.GIF" [0096.866] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_OFF.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_OFF.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_OFF.GIF" [0096.866] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_OFF.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_OFF.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_OFF.GIF." [0096.866] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_OFF.GIF.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_OFF.GIF. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_OFF.GIF. " [0096.866] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\brightyellow\\tab_off.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0 [0096.867] GetFileSize (in: hFile=0xa0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x155 [0096.867] GetFileTime (in: hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9f119f00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x51a87c30, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9f119f00, dwHighDateTime=0x1c747ea)) returned 1 [0096.867] SetFilePointer (in: hFile=0xa0, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0096.867] ReadFile (in: hFile=0xa0, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0xfb, lpOverlapped=0x0) returned 1 [0096.868] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_OFF.GIF") returned="TAB_OFF.GIF" [0096.868] SetFilePointer (in: hFile=0xa0, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0096.868] WriteFile (in: hFile=0xa0, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0xfb, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0xfb, lpOverlapped=0x0) returned 1 [0096.868] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0096.868] CloseHandle (hObject=0xa0) returned 1 [0096.868] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\brightyellow\\tab_off.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_OFF.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\brightyellow\\tab_off.gif. ")) returned 1 [0096.869] FindNextFileA (in: hFindFile=0x5be1e0, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 1 [0096.869] PeekMessageA (in: lpMsg=0xaeb94, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaeb94) returned 0 [0096.869] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="TAB_ON.GIF") returned -1 [0096.869] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TAB_ON.GIF") returned -1 [0096.869] lstrcmpiA (lpString1="", lpString2="TAB_ON.GIF") returned -1 [0096.869] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_OFF.GIF") returned="TAB_OFF.GIF" [0096.869] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\", lpString2="TAB_ON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_ON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_ON.GIF" [0096.869] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_ON.GIF", pszSpec="*.zip") returned 0 [0096.869] lstrlenA (lpString="*.zip") returned 5 [0096.869] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_ON.GIF", pszSpec="*.rar") returned 0 [0096.869] lstrlenA (lpString="*.rar") returned 5 [0096.869] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_ON.GIF", pszSpec="*.7z") returned 0 [0096.869] lstrlenA (lpString="*.7z") returned 4 [0096.869] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_ON.GIF", pszSpec="*.tar") returned 0 [0096.869] lstrlenA (lpString="*.tar") returned 5 [0096.869] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_ON.GIF", pszSpec="*.gzip") returned 0 [0096.869] lstrlenA (lpString="*.gzip") returned 6 [0096.869] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_ON.GIF", pszSpec="*.jpg") returned 0 [0096.869] lstrlenA (lpString="*.jpg") returned 5 [0096.869] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_ON.GIF", pszSpec="*.jpeg") returned 0 [0096.869] lstrlenA (lpString="*.jpeg") returned 6 [0096.869] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_ON.GIF", pszSpec="*.psd") returned 0 [0096.869] lstrlenA (lpString="*.psd") returned 5 [0096.869] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_ON.GIF", pszSpec="*.cdr") returned 0 [0096.869] lstrlenA (lpString="*.cdr") returned 5 [0096.869] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_ON.GIF", pszSpec="*.dwg") returned 0 [0096.869] lstrlenA (lpString="*.dwg") returned 5 [0096.869] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_ON.GIF", pszSpec="*.max") returned 0 [0096.869] lstrlenA (lpString="*.max") returned 5 [0096.870] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_ON.GIF", pszSpec="*.bmp") returned 0 [0096.870] lstrlenA (lpString="*.bmp") returned 5 [0096.870] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_ON.GIF", pszSpec="*.gif") returned 1 [0096.870] lstrlenA (lpString="*.gif") returned 5 [0096.870] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_ON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_ON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_ON.GIF" [0096.870] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_ON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_ON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_ON.GIF" [0096.870] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_ON.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_ON.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_ON.GIF." [0096.870] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_ON.GIF.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_ON.GIF. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_ON.GIF. " [0096.870] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\brightyellow\\tab_on.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0 [0096.870] GetFileSize (in: hFile=0xa0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xde [0096.870] GetFileTime (in: hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9f119f00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x60062890, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9f119f00, dwHighDateTime=0x1c747ea)) returned 1 [0096.870] SetFilePointer (in: hFile=0xa0, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0096.870] ReadFile (in: hFile=0xa0, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x84, lpOverlapped=0x0) returned 1 [0096.871] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_ON.GIF") returned="TAB_ON.GIF" [0096.871] SetFilePointer (in: hFile=0xa0, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0096.871] WriteFile (in: hFile=0xa0, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x84, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x84, lpOverlapped=0x0) returned 1 [0096.871] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0096.871] CloseHandle (hObject=0xa0) returned 1 [0096.871] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\brightyellow\\tab_on.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_ON.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\brightyellow\\tab_on.gif. ")) returned 1 [0096.887] FindNextFileA (in: hFindFile=0x5be1e0, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 0 [0096.887] FindClose (in: hFindFile=0x5be1e0 | out: hFindFile=0x5be1e0) returned 1 [0096.887] FindNextFileA (in: hFindFile=0x5be1a0, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0096.887] PeekMessageA (in: lpMsg=0xaece4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaece4) returned 0 [0096.887] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BrightYellow.css") returned 1 [0096.887] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BrightYellow.css") returned 1 [0096.887] lstrcmpiA (lpString1="", lpString2="BrightYellow.css") returned -1 [0096.887] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\*.*") returned="*.*" [0096.887] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\", lpString2="BrightYellow.css" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow.css") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow.css" [0096.887] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow.css", pszSpec="*.zip") returned 0 [0096.887] lstrlenA (lpString="*.zip") returned 5 [0096.887] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow.css", pszSpec="*.rar") returned 0 [0096.887] lstrlenA (lpString="*.rar") returned 5 [0096.887] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow.css", pszSpec="*.7z") returned 0 [0096.887] lstrlenA (lpString="*.7z") returned 4 [0096.887] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow.css", pszSpec="*.tar") returned 0 [0096.887] lstrlenA (lpString="*.tar") returned 5 [0096.887] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow.css", pszSpec="*.gzip") returned 0 [0096.887] lstrlenA (lpString="*.gzip") returned 6 [0096.887] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow.css", pszSpec="*.jpg") returned 0 [0096.887] lstrlenA (lpString="*.jpg") returned 5 [0096.887] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow.css", pszSpec="*.jpeg") returned 0 [0096.887] lstrlenA (lpString="*.jpeg") returned 6 [0096.887] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow.css", pszSpec="*.psd") returned 0 [0096.887] lstrlenA (lpString="*.psd") returned 5 [0096.888] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow.css", pszSpec="*.cdr") returned 0 [0096.888] lstrlenA (lpString="*.cdr") returned 5 [0096.888] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow.css", pszSpec="*.dwg") returned 0 [0096.888] lstrlenA (lpString="*.dwg") returned 5 [0096.888] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow.css", pszSpec="*.max") returned 0 [0096.888] lstrlenA (lpString="*.max") returned 5 [0096.888] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow.css", pszSpec="*.bmp") returned 0 [0096.888] lstrlenA (lpString="*.bmp") returned 5 [0096.888] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow.css", pszSpec="*.gif") returned 0 [0096.888] lstrlenA (lpString="*.gif") returned 5 [0096.888] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow.css", pszSpec="*.png") returned 0 [0096.888] lstrlenA (lpString="*.png") returned 5 [0096.888] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow.css", pszSpec="*.doc") returned 0 [0096.888] lstrlenA (lpString="*.doc") returned 5 [0096.888] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow.css", pszSpec="*.docx") returned 0 [0096.888] lstrlenA (lpString="*.docx") returned 6 [0096.888] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow.css", pszSpec="*.xls") returned 0 [0096.888] lstrlenA (lpString="*.xls") returned 5 [0096.888] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow.css", pszSpec="*.xlsx") returned 0 [0096.888] lstrlenA (lpString="*.xlsx") returned 6 [0096.888] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow.css", pszSpec="*.ppt") returned 0 [0096.888] lstrlenA (lpString="*.ppt") returned 5 [0096.888] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow.css", pszSpec="*.pptx") returned 0 [0096.888] lstrlenA (lpString="*.pptx") returned 6 [0096.888] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow.css", pszSpec="*.txt") returned 0 [0096.888] lstrlenA (lpString="*.txt") returned 5 [0096.888] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow.css", pszSpec="*.pdf") returned 0 [0096.888] lstrlenA (lpString="*.pdf") returned 5 [0096.888] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow.css", pszSpec="*.djvu") returned 0 [0096.888] lstrlenA (lpString="*.djvu") returned 6 [0096.888] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow.css", pszSpec="*.htm") returned 0 [0096.888] lstrlenA (lpString="*.htm") returned 5 [0096.888] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow.css", pszSpec="*.html") returned 0 [0096.888] lstrlenA (lpString="*.html") returned 6 [0096.888] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow.css", pszSpec="*.mdb") returned 0 [0096.888] lstrlenA (lpString="*.mdb") returned 5 [0096.888] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow.css", pszSpec="*.cer") returned 0 [0096.889] lstrlenA (lpString="*.cer") returned 5 [0096.889] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow.css", pszSpec="*.p12") returned 0 [0096.889] lstrlenA (lpString="*.p12") returned 5 [0096.889] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow.css", pszSpec="*.pfx") returned 0 [0096.889] lstrlenA (lpString="*.pfx") returned 5 [0096.889] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow.css", pszSpec="*.kwm") returned 0 [0096.889] lstrlenA (lpString="*.kwm") returned 5 [0096.889] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow.css", pszSpec="*.pwm") returned 0 [0096.889] lstrlenA (lpString="*.pwm") returned 5 [0096.889] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow.css", pszSpec="*.1cd") returned 0 [0096.889] lstrlenA (lpString="*.1cd") returned 5 [0096.889] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow.css", pszSpec="*.md") returned 0 [0096.889] lstrlenA (lpString="*.md") returned 4 [0096.889] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow.css", pszSpec="*.mdf") returned 0 [0096.889] lstrlenA (lpString="*.mdf") returned 5 [0096.889] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow.css", pszSpec="*.dbf") returned 0 [0096.889] lstrlenA (lpString="*.dbf") returned 5 [0096.889] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow.css", pszSpec="*.odt") returned 0 [0096.889] lstrlenA (lpString="*.odt") returned 5 [0096.889] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow.css", pszSpec="*.vob") returned 0 [0096.889] lstrlenA (lpString="*.vob") returned 5 [0096.889] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow.css", pszSpec="*.ifo") returned 0 [0096.889] lstrlenA (lpString="*.ifo") returned 5 [0096.889] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow.css", pszSpec="*.lnk") returned 0 [0096.889] lstrlenA (lpString="*.lnk") returned 5 [0096.889] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow.css", pszSpec="*.torrent") returned 0 [0096.889] lstrlenA (lpString="*.torrent") returned 9 [0096.889] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow.css", pszSpec="*.mov") returned 0 [0096.889] lstrlenA (lpString="*.mov") returned 5 [0096.889] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow.css", pszSpec="*.m2v") returned 0 [0096.889] lstrlenA (lpString="*.m2v") returned 5 [0096.889] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow.css", pszSpec="*.3gp") returned 0 [0096.889] lstrlenA (lpString="*.3gp") returned 5 [0096.889] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow.css", pszSpec="*.mpeg") returned 0 [0096.889] lstrlenA (lpString="*.mpeg") returned 6 [0096.889] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow.css", pszSpec="*.mpg") returned 0 [0096.889] lstrlenA (lpString="*.mpg") returned 5 [0096.890] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow.css", pszSpec="*.flv") returned 0 [0096.890] lstrlenA (lpString="*.flv") returned 5 [0096.890] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow.css", pszSpec="*.avi") returned 0 [0096.890] lstrlenA (lpString="*.avi") returned 5 [0096.890] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow.css", pszSpec="*.mp4") returned 0 [0096.890] lstrlenA (lpString="*.mp4") returned 5 [0096.890] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow.css", pszSpec="*.wmv") returned 0 [0096.890] lstrlenA (lpString="*.wmv") returned 5 [0096.890] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow.css", pszSpec="*.divx") returned 0 [0096.890] lstrlenA (lpString="*.divx") returned 6 [0096.890] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow.css", pszSpec="*.mkv") returned 0 [0096.890] lstrlenA (lpString="*.mkv") returned 5 [0096.890] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow.css", pszSpec="*.mp3") returned 0 [0096.890] lstrlenA (lpString="*.mp3") returned 5 [0096.890] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow.css", pszSpec="*.wav") returned 0 [0096.890] lstrlenA (lpString="*.wav") returned 5 [0096.890] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow.css", pszSpec="*.flac") returned 0 [0096.890] lstrlenA (lpString="*.flac") returned 6 [0096.890] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow.css", pszSpec="*.ape") returned 0 [0096.890] lstrlenA (lpString="*.ape") returned 5 [0096.890] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow.css", pszSpec="*.wma") returned 0 [0096.890] lstrlenA (lpString="*.wma") returned 5 [0096.890] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow.css", pszSpec="*.ac3") returned 0 [0096.890] lstrlenA (lpString="*.ac3") returned 5 [0096.890] FindNextFileA (in: hFindFile=0x5be1a0, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0096.890] PeekMessageA (in: lpMsg=0xaece4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaece4) returned 0 [0096.890] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Casual.css") returned 1 [0096.890] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Casual.css") returned 1 [0096.890] lstrcmpiA (lpString1="", lpString2="Casual.css") returned -1 [0096.890] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow.css") returned="BrightYellow.css" [0096.890] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\", lpString2="Casual.css" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Casual.css") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Casual.css" [0096.890] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Casual.css", pszSpec="*.zip") returned 0 [0096.890] lstrlenA (lpString="*.zip") returned 5 [0096.890] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Casual.css", pszSpec="*.rar") returned 0 [0096.890] lstrlenA (lpString="*.rar") returned 5 [0096.890] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Casual.css", pszSpec="*.7z") returned 0 [0096.890] lstrlenA (lpString="*.7z") returned 4 [0096.890] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Casual.css", pszSpec="*.tar") returned 0 [0096.890] lstrlenA (lpString="*.tar") returned 5 [0096.891] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Casual.css", pszSpec="*.gzip") returned 0 [0096.891] lstrlenA (lpString="*.gzip") returned 6 [0096.891] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Casual.css", pszSpec="*.jpg") returned 0 [0096.891] lstrlenA (lpString="*.jpg") returned 5 [0096.891] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Casual.css", pszSpec="*.jpeg") returned 0 [0096.891] lstrlenA (lpString="*.jpeg") returned 6 [0096.891] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Casual.css", pszSpec="*.psd") returned 0 [0096.891] lstrlenA (lpString="*.psd") returned 5 [0096.891] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Casual.css", pszSpec="*.cdr") returned 0 [0096.891] lstrlenA (lpString="*.cdr") returned 5 [0096.891] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Casual.css", pszSpec="*.dwg") returned 0 [0096.891] lstrlenA (lpString="*.dwg") returned 5 [0096.891] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Casual.css", pszSpec="*.max") returned 0 [0096.891] lstrlenA (lpString="*.max") returned 5 [0096.891] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Casual.css", pszSpec="*.bmp") returned 0 [0096.891] lstrlenA (lpString="*.bmp") returned 5 [0096.891] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Casual.css", pszSpec="*.gif") returned 0 [0096.891] lstrlenA (lpString="*.gif") returned 5 [0096.891] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Casual.css", pszSpec="*.png") returned 0 [0096.891] lstrlenA (lpString="*.png") returned 5 [0096.891] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Casual.css", pszSpec="*.doc") returned 0 [0096.891] lstrlenA (lpString="*.doc") returned 5 [0096.891] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Casual.css", pszSpec="*.docx") returned 0 [0096.891] lstrlenA (lpString="*.docx") returned 6 [0096.891] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Casual.css", pszSpec="*.xls") returned 0 [0096.891] lstrlenA (lpString="*.xls") returned 5 [0096.891] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Casual.css", pszSpec="*.xlsx") returned 0 [0096.891] lstrlenA (lpString="*.xlsx") returned 6 [0096.891] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Casual.css", pszSpec="*.ppt") returned 0 [0096.891] lstrlenA (lpString="*.ppt") returned 5 [0096.891] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Casual.css", pszSpec="*.pptx") returned 0 [0096.891] lstrlenA (lpString="*.pptx") returned 6 [0096.891] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Casual.css", pszSpec="*.txt") returned 0 [0096.891] lstrlenA (lpString="*.txt") returned 5 [0096.891] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Casual.css", pszSpec="*.pdf") returned 0 [0096.891] lstrlenA (lpString="*.pdf") returned 5 [0096.891] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Casual.css", pszSpec="*.djvu") returned 0 [0096.891] lstrlenA (lpString="*.djvu") returned 6 [0096.891] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Casual.css", pszSpec="*.htm") returned 0 [0096.891] lstrlenA (lpString="*.htm") returned 5 [0096.891] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Casual.css", pszSpec="*.html") returned 0 [0096.892] lstrlenA (lpString="*.html") returned 6 [0096.892] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Casual.css", pszSpec="*.mdb") returned 0 [0096.892] lstrlenA (lpString="*.mdb") returned 5 [0096.892] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Casual.css", pszSpec="*.cer") returned 0 [0096.892] lstrlenA (lpString="*.cer") returned 5 [0096.892] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Casual.css", pszSpec="*.p12") returned 0 [0096.892] lstrlenA (lpString="*.p12") returned 5 [0096.892] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Casual.css", pszSpec="*.pfx") returned 0 [0096.892] lstrlenA (lpString="*.pfx") returned 5 [0096.892] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Casual.css", pszSpec="*.kwm") returned 0 [0096.892] lstrlenA (lpString="*.kwm") returned 5 [0096.892] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Casual.css", pszSpec="*.pwm") returned 0 [0096.892] lstrlenA (lpString="*.pwm") returned 5 [0096.892] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Casual.css", pszSpec="*.1cd") returned 0 [0096.892] lstrlenA (lpString="*.1cd") returned 5 [0096.892] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Casual.css", pszSpec="*.md") returned 0 [0096.892] lstrlenA (lpString="*.md") returned 4 [0096.892] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Casual.css", pszSpec="*.mdf") returned 0 [0096.892] lstrlenA (lpString="*.mdf") returned 5 [0096.892] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Casual.css", pszSpec="*.dbf") returned 0 [0096.892] lstrlenA (lpString="*.dbf") returned 5 [0096.892] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Casual.css", pszSpec="*.odt") returned 0 [0096.892] lstrlenA (lpString="*.odt") returned 5 [0096.892] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Casual.css", pszSpec="*.vob") returned 0 [0096.892] lstrlenA (lpString="*.vob") returned 5 [0096.892] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Casual.css", pszSpec="*.ifo") returned 0 [0096.892] lstrlenA (lpString="*.ifo") returned 5 [0096.892] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Casual.css", pszSpec="*.lnk") returned 0 [0096.892] lstrlenA (lpString="*.lnk") returned 5 [0096.892] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Casual.css", pszSpec="*.torrent") returned 0 [0096.892] lstrlenA (lpString="*.torrent") returned 9 [0096.896] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Casual.css", pszSpec="*.mov") returned 0 [0096.896] lstrlenA (lpString="*.mov") returned 5 [0096.896] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Casual.css", pszSpec="*.m2v") returned 0 [0096.896] lstrlenA (lpString="*.m2v") returned 5 [0096.896] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Casual.css", pszSpec="*.3gp") returned 0 [0096.896] lstrlenA (lpString="*.3gp") returned 5 [0096.896] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Casual.css", pszSpec="*.mpeg") returned 0 [0096.896] lstrlenA (lpString="*.mpeg") returned 6 [0096.896] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Casual.css", pszSpec="*.mpg") returned 0 [0096.896] lstrlenA (lpString="*.mpg") returned 5 [0096.896] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Casual.css", pszSpec="*.flv") returned 0 [0096.896] lstrlenA (lpString="*.flv") returned 5 [0096.896] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Casual.css", pszSpec="*.avi") returned 0 [0096.896] lstrlenA (lpString="*.avi") returned 5 [0096.896] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Casual.css", pszSpec="*.mp4") returned 0 [0096.896] lstrlenA (lpString="*.mp4") returned 5 [0096.896] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Casual.css", pszSpec="*.wmv") returned 0 [0096.896] lstrlenA (lpString="*.wmv") returned 5 [0096.896] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Casual.css", pszSpec="*.divx") returned 0 [0096.896] lstrlenA (lpString="*.divx") returned 6 [0096.896] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Casual.css", pszSpec="*.mkv") returned 0 [0096.896] lstrlenA (lpString="*.mkv") returned 5 [0096.896] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Casual.css", pszSpec="*.mp3") returned 0 [0096.896] lstrlenA (lpString="*.mp3") returned 5 [0096.896] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Casual.css", pszSpec="*.wav") returned 0 [0096.896] lstrlenA (lpString="*.wav") returned 5 [0096.896] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Casual.css", pszSpec="*.flac") returned 0 [0096.896] lstrlenA (lpString="*.flac") returned 6 [0096.897] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Casual.css", pszSpec="*.ape") returned 0 [0096.897] lstrlenA (lpString="*.ape") returned 5 [0096.897] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Casual.css", pszSpec="*.wma") returned 0 [0096.897] lstrlenA (lpString="*.wma") returned 5 [0096.897] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Casual.css", pszSpec="*.ac3") returned 0 [0096.897] lstrlenA (lpString="*.ac3") returned 5 [0096.897] FindNextFileA (in: hFindFile=0x5be1a0, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0096.897] PeekMessageA (in: lpMsg=0xaece4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaece4) returned 0 [0096.897] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Country.css") returned 1 [0096.897] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Country.css") returned 1 [0096.897] lstrcmpiA (lpString1="", lpString2="Country.css") returned -1 [0096.897] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Casual.css") returned="Casual.css" [0096.897] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\", lpString2="Country.css" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Country.css") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Country.css" [0096.897] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Country.css", pszSpec="*.zip") returned 0 [0096.897] lstrlenA (lpString="*.zip") returned 5 [0096.897] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Country.css", pszSpec="*.rar") returned 0 [0096.897] lstrlenA (lpString="*.rar") returned 5 [0096.897] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Country.css", pszSpec="*.7z") returned 0 [0096.897] lstrlenA (lpString="*.7z") returned 4 [0096.897] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Country.css", pszSpec="*.tar") returned 0 [0096.897] lstrlenA (lpString="*.tar") returned 5 [0096.897] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Country.css", pszSpec="*.gzip") returned 0 [0096.897] lstrlenA (lpString="*.gzip") returned 6 [0096.897] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Country.css", pszSpec="*.jpg") returned 0 [0096.897] lstrlenA (lpString="*.jpg") returned 5 [0096.897] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Country.css", pszSpec="*.jpeg") returned 0 [0096.897] lstrlenA (lpString="*.jpeg") returned 6 [0096.897] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Country.css", pszSpec="*.psd") returned 0 [0096.897] lstrlenA (lpString="*.psd") returned 5 [0096.897] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Country.css", pszSpec="*.cdr") returned 0 [0096.897] lstrlenA (lpString="*.cdr") returned 5 [0096.897] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Country.css", pszSpec="*.dwg") returned 0 [0096.897] lstrlenA (lpString="*.dwg") returned 5 [0096.897] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Country.css", pszSpec="*.max") returned 0 [0096.897] lstrlenA (lpString="*.max") returned 5 [0096.897] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Country.css", pszSpec="*.bmp") returned 0 [0096.897] lstrlenA (lpString="*.bmp") returned 5 [0096.897] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Country.css", pszSpec="*.gif") returned 0 [0096.897] lstrlenA (lpString="*.gif") returned 5 [0096.897] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Country.css", pszSpec="*.png") returned 0 [0096.897] lstrlenA (lpString="*.png") returned 5 [0096.897] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Country.css", pszSpec="*.doc") returned 0 [0096.897] lstrlenA (lpString="*.doc") returned 5 [0096.897] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Country.css", pszSpec="*.docx") returned 0 [0096.897] lstrlenA (lpString="*.docx") returned 6 [0096.897] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Country.css", pszSpec="*.xls") returned 0 [0096.898] lstrlenA (lpString="*.xls") returned 5 [0096.898] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Country.css", pszSpec="*.xlsx") returned 0 [0096.898] lstrlenA (lpString="*.xlsx") returned 6 [0096.898] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Country.css", pszSpec="*.ppt") returned 0 [0096.898] lstrlenA (lpString="*.ppt") returned 5 [0096.898] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Country.css", pszSpec="*.pptx") returned 0 [0096.898] lstrlenA (lpString="*.pptx") returned 6 [0096.898] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Country.css", pszSpec="*.txt") returned 0 [0096.898] lstrlenA (lpString="*.txt") returned 5 [0096.898] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Country.css", pszSpec="*.pdf") returned 0 [0096.898] lstrlenA (lpString="*.pdf") returned 5 [0096.898] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Country.css", pszSpec="*.djvu") returned 0 [0096.898] lstrlenA (lpString="*.djvu") returned 6 [0096.898] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Country.css", pszSpec="*.htm") returned 0 [0096.898] lstrlenA (lpString="*.htm") returned 5 [0096.898] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Country.css", pszSpec="*.html") returned 0 [0096.898] lstrlenA (lpString="*.html") returned 6 [0096.898] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Country.css", pszSpec="*.mdb") returned 0 [0096.898] lstrlenA (lpString="*.mdb") returned 5 [0096.898] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Country.css", pszSpec="*.cer") returned 0 [0096.898] lstrlenA (lpString="*.cer") returned 5 [0096.898] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Country.css", pszSpec="*.p12") returned 0 [0096.898] lstrlenA (lpString="*.p12") returned 5 [0096.898] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Country.css", pszSpec="*.pfx") returned 0 [0096.898] lstrlenA (lpString="*.pfx") returned 5 [0096.898] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Country.css", pszSpec="*.kwm") returned 0 [0096.898] lstrlenA (lpString="*.kwm") returned 5 [0096.898] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Country.css", pszSpec="*.pwm") returned 0 [0096.898] lstrlenA (lpString="*.pwm") returned 5 [0096.898] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Country.css", pszSpec="*.1cd") returned 0 [0096.898] lstrlenA (lpString="*.1cd") returned 5 [0096.898] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Country.css", pszSpec="*.md") returned 0 [0096.898] lstrlenA (lpString="*.md") returned 4 [0096.898] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Country.css", pszSpec="*.mdf") returned 0 [0096.898] lstrlenA (lpString="*.mdf") returned 5 [0096.898] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Country.css", pszSpec="*.dbf") returned 0 [0096.898] lstrlenA (lpString="*.dbf") returned 5 [0096.898] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Country.css", pszSpec="*.odt") returned 0 [0096.898] lstrlenA (lpString="*.odt") returned 5 [0096.898] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Country.css", pszSpec="*.vob") returned 0 [0096.898] lstrlenA (lpString="*.vob") returned 5 [0096.898] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Country.css", pszSpec="*.ifo") returned 0 [0096.898] lstrlenA (lpString="*.ifo") returned 5 [0096.898] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Country.css", pszSpec="*.lnk") returned 0 [0096.899] lstrlenA (lpString="*.lnk") returned 5 [0096.899] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Country.css", pszSpec="*.torrent") returned 0 [0096.899] lstrlenA (lpString="*.torrent") returned 9 [0096.899] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Country.css", pszSpec="*.mov") returned 0 [0096.899] lstrlenA (lpString="*.mov") returned 5 [0096.899] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Country.css", pszSpec="*.m2v") returned 0 [0096.899] lstrlenA (lpString="*.m2v") returned 5 [0096.899] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Country.css", pszSpec="*.3gp") returned 0 [0096.899] lstrlenA (lpString="*.3gp") returned 5 [0096.899] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Country.css", pszSpec="*.mpeg") returned 0 [0096.899] lstrlenA (lpString="*.mpeg") returned 6 [0096.899] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Country.css", pszSpec="*.mpg") returned 0 [0096.899] lstrlenA (lpString="*.mpg") returned 5 [0096.899] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Country.css", pszSpec="*.flv") returned 0 [0096.899] lstrlenA (lpString="*.flv") returned 5 [0096.899] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Country.css", pszSpec="*.avi") returned 0 [0096.899] lstrlenA (lpString="*.avi") returned 5 [0096.899] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Country.css", pszSpec="*.mp4") returned 0 [0096.899] lstrlenA (lpString="*.mp4") returned 5 [0096.899] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Country.css", pszSpec="*.wmv") returned 0 [0096.899] lstrlenA (lpString="*.wmv") returned 5 [0096.899] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Country.css", pszSpec="*.divx") returned 0 [0096.899] lstrlenA (lpString="*.divx") returned 6 [0096.899] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Country.css", pszSpec="*.mkv") returned 0 [0096.899] lstrlenA (lpString="*.mkv") returned 5 [0096.899] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Country.css", pszSpec="*.mp3") returned 0 [0096.899] lstrlenA (lpString="*.mp3") returned 5 [0096.899] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Country.css", pszSpec="*.wav") returned 0 [0096.899] lstrlenA (lpString="*.wav") returned 5 [0096.899] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Country.css", pszSpec="*.flac") returned 0 [0096.899] lstrlenA (lpString="*.flac") returned 6 [0096.899] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Country.css", pszSpec="*.ape") returned 0 [0096.899] lstrlenA (lpString="*.ape") returned 5 [0096.899] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Country.css", pszSpec="*.wma") returned 0 [0096.899] lstrlenA (lpString="*.wma") returned 5 [0096.899] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Country.css", pszSpec="*.ac3") returned 0 [0096.900] lstrlenA (lpString="*.ac3") returned 5 [0096.900] FindNextFileA (in: hFindFile=0x5be1a0, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0096.900] lstrcmpA (lpString1=".", lpString2="Desert") returned -1 [0096.900] lstrcmpA (lpString1="..", lpString2="Desert") returned -1 [0096.900] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Country.css") returned="Country.css" [0096.900] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\", lpString2="Desert" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert" [0096.900] lstrlenA (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert") returned 101 [0096.900] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\*.*", lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 0x5be1e0 [0096.925] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0096.925] FindNextFileA (in: hFindFile=0x5be1e0, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 1 [0096.925] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0096.925] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0096.925] FindNextFileA (in: hFindFile=0x5be1e0, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 1 [0096.925] PeekMessageA (in: lpMsg=0xaeb94, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaeb94) returned 0 [0096.925] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="HEADER.GIF") returned -1 [0096.925] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="HEADER.GIF") returned 1 [0096.925] lstrcmpiA (lpString1="", lpString2="HEADER.GIF") returned -1 [0096.925] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\*.*") returned="*.*" [0096.925] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\", lpString2="HEADER.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\HEADER.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\HEADER.GIF" [0096.925] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\HEADER.GIF", pszSpec="*.zip") returned 0 [0096.925] lstrlenA (lpString="*.zip") returned 5 [0096.925] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\HEADER.GIF", pszSpec="*.rar") returned 0 [0096.925] lstrlenA (lpString="*.rar") returned 5 [0096.925] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\HEADER.GIF", pszSpec="*.7z") returned 0 [0096.925] lstrlenA (lpString="*.7z") returned 4 [0096.925] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\HEADER.GIF", pszSpec="*.tar") returned 0 [0096.925] lstrlenA (lpString="*.tar") returned 5 [0096.925] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\HEADER.GIF", pszSpec="*.gzip") returned 0 [0096.925] lstrlenA (lpString="*.gzip") returned 6 [0096.925] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\HEADER.GIF", pszSpec="*.jpg") returned 0 [0096.925] lstrlenA (lpString="*.jpg") returned 5 [0096.925] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\HEADER.GIF", pszSpec="*.jpeg") returned 0 [0096.925] lstrlenA (lpString="*.jpeg") returned 6 [0096.925] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\HEADER.GIF", pszSpec="*.psd") returned 0 [0096.925] lstrlenA (lpString="*.psd") returned 5 [0096.926] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\HEADER.GIF", pszSpec="*.cdr") returned 0 [0096.926] lstrlenA (lpString="*.cdr") returned 5 [0096.926] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\HEADER.GIF", pszSpec="*.dwg") returned 0 [0096.926] lstrlenA (lpString="*.dwg") returned 5 [0096.926] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\HEADER.GIF", pszSpec="*.max") returned 0 [0096.926] lstrlenA (lpString="*.max") returned 5 [0096.926] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\HEADER.GIF", pszSpec="*.bmp") returned 0 [0096.926] lstrlenA (lpString="*.bmp") returned 5 [0096.926] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\HEADER.GIF", pszSpec="*.gif") returned 1 [0096.926] lstrlenA (lpString="*.gif") returned 5 [0096.926] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\HEADER.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\HEADER.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\HEADER.GIF" [0096.926] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\HEADER.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\HEADER.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\HEADER.GIF" [0096.926] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\HEADER.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\HEADER.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\HEADER.GIF." [0096.926] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\HEADER.GIF.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\HEADER.GIF. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\HEADER.GIF. " [0096.926] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\HEADER.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\desert\\header.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0 [0096.927] GetFileSize (in: hFile=0xa0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x94 [0096.927] GetFileTime (in: hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9f119f00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x51da7910, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9f119f00, dwHighDateTime=0x1c747ea)) returned 1 [0096.927] SetFilePointer (in: hFile=0xa0, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0096.927] ReadFile (in: hFile=0xa0, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x3a, lpOverlapped=0x0) returned 1 [0096.928] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\HEADER.GIF") returned="HEADER.GIF" [0096.928] SetFilePointer (in: hFile=0xa0, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0096.928] WriteFile (in: hFile=0xa0, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x3a, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x3a, lpOverlapped=0x0) returned 1 [0096.928] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0096.929] CloseHandle (hObject=0xa0) returned 1 [0096.930] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\HEADER.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\desert\\header.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\HEADER.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\desert\\header.gif. ")) returned 1 [0096.931] FindNextFileA (in: hFindFile=0x5be1e0, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 1 [0096.931] PeekMessageA (in: lpMsg=0xaeb94, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaeb94) returned 0 [0096.931] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="TAB_OFF.GIF") returned -1 [0096.931] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TAB_OFF.GIF") returned -1 [0096.931] lstrcmpiA (lpString1="", lpString2="TAB_OFF.GIF") returned -1 [0096.931] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\HEADER.GIF") returned="HEADER.GIF" [0096.931] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\", lpString2="TAB_OFF.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_OFF.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_OFF.GIF" [0096.931] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_OFF.GIF", pszSpec="*.zip") returned 0 [0096.931] lstrlenA (lpString="*.zip") returned 5 [0096.931] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_OFF.GIF", pszSpec="*.rar") returned 0 [0096.931] lstrlenA (lpString="*.rar") returned 5 [0096.931] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_OFF.GIF", pszSpec="*.7z") returned 0 [0096.931] lstrlenA (lpString="*.7z") returned 4 [0096.931] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_OFF.GIF", pszSpec="*.tar") returned 0 [0096.932] lstrlenA (lpString="*.tar") returned 5 [0096.932] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_OFF.GIF", pszSpec="*.gzip") returned 0 [0096.932] lstrlenA (lpString="*.gzip") returned 6 [0096.932] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_OFF.GIF", pszSpec="*.jpg") returned 0 [0096.932] lstrlenA (lpString="*.jpg") returned 5 [0096.932] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_OFF.GIF", pszSpec="*.jpeg") returned 0 [0096.932] lstrlenA (lpString="*.jpeg") returned 6 [0096.932] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_OFF.GIF", pszSpec="*.psd") returned 0 [0096.932] lstrlenA (lpString="*.psd") returned 5 [0096.932] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_OFF.GIF", pszSpec="*.cdr") returned 0 [0096.932] lstrlenA (lpString="*.cdr") returned 5 [0096.932] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_OFF.GIF", pszSpec="*.dwg") returned 0 [0096.932] lstrlenA (lpString="*.dwg") returned 5 [0096.932] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_OFF.GIF", pszSpec="*.max") returned 0 [0096.932] lstrlenA (lpString="*.max") returned 5 [0096.932] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_OFF.GIF", pszSpec="*.bmp") returned 0 [0096.932] lstrlenA (lpString="*.bmp") returned 5 [0096.932] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_OFF.GIF", pszSpec="*.gif") returned 1 [0096.932] lstrlenA (lpString="*.gif") returned 5 [0096.932] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_OFF.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_OFF.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_OFF.GIF" [0096.932] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_OFF.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_OFF.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_OFF.GIF" [0096.932] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_OFF.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_OFF.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_OFF.GIF." [0096.932] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_OFF.GIF.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_OFF.GIF. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_OFF.GIF. " [0096.932] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\desert\\tab_off.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0 [0096.933] GetFileSize (in: hFile=0xa0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1f0 [0096.933] GetFileTime (in: hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9f119f00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x51da7910, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9f119f00, dwHighDateTime=0x1c747ea)) returned 1 [0096.933] SetFilePointer (in: hFile=0xa0, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0096.933] ReadFile (in: hFile=0xa0, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x196, lpOverlapped=0x0) returned 1 [0096.934] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_OFF.GIF") returned="TAB_OFF.GIF" [0096.934] SetFilePointer (in: hFile=0xa0, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0096.934] WriteFile (in: hFile=0xa0, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x196, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x196, lpOverlapped=0x0) returned 1 [0096.934] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0096.934] CloseHandle (hObject=0xa0) returned 1 [0096.934] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\desert\\tab_off.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_OFF.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\desert\\tab_off.gif. ")) returned 1 [0096.935] FindNextFileA (in: hFindFile=0x5be1e0, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 1 [0096.935] PeekMessageA (in: lpMsg=0xaeb94, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaeb94) returned 0 [0096.935] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="TAB_ON.GIF") returned -1 [0096.935] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TAB_ON.GIF") returned -1 [0096.935] lstrcmpiA (lpString1="", lpString2="TAB_ON.GIF") returned -1 [0096.935] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_OFF.GIF") returned="TAB_OFF.GIF" [0096.935] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\", lpString2="TAB_ON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_ON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_ON.GIF" [0096.935] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_ON.GIF", pszSpec="*.zip") returned 0 [0096.935] lstrlenA (lpString="*.zip") returned 5 [0096.935] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_ON.GIF", pszSpec="*.rar") returned 0 [0096.935] lstrlenA (lpString="*.rar") returned 5 [0096.935] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_ON.GIF", pszSpec="*.7z") returned 0 [0096.935] lstrlenA (lpString="*.7z") returned 4 [0096.936] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_ON.GIF", pszSpec="*.tar") returned 0 [0096.936] lstrlenA (lpString="*.tar") returned 5 [0096.936] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_ON.GIF", pszSpec="*.gzip") returned 0 [0096.936] lstrlenA (lpString="*.gzip") returned 6 [0096.936] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_ON.GIF", pszSpec="*.jpg") returned 0 [0096.936] lstrlenA (lpString="*.jpg") returned 5 [0096.936] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_ON.GIF", pszSpec="*.jpeg") returned 0 [0096.936] lstrlenA (lpString="*.jpeg") returned 6 [0096.936] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_ON.GIF", pszSpec="*.psd") returned 0 [0096.936] lstrlenA (lpString="*.psd") returned 5 [0096.936] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_ON.GIF", pszSpec="*.cdr") returned 0 [0096.936] lstrlenA (lpString="*.cdr") returned 5 [0096.936] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_ON.GIF", pszSpec="*.dwg") returned 0 [0096.936] lstrlenA (lpString="*.dwg") returned 5 [0096.936] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_ON.GIF", pszSpec="*.max") returned 0 [0096.936] lstrlenA (lpString="*.max") returned 5 [0096.936] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_ON.GIF", pszSpec="*.bmp") returned 0 [0096.936] lstrlenA (lpString="*.bmp") returned 5 [0096.936] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_ON.GIF", pszSpec="*.gif") returned 1 [0096.936] lstrlenA (lpString="*.gif") returned 5 [0096.936] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_ON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_ON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_ON.GIF" [0096.936] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_ON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_ON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_ON.GIF" [0096.936] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_ON.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_ON.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_ON.GIF." [0096.936] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_ON.GIF.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_ON.GIF. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_ON.GIF. " [0096.936] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\desert\\tab_on.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0 [0096.952] GetFileSize (in: hFile=0xa0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x401 [0096.952] GetFileTime (in: hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x9f119f00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x60760930, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9f119f00, dwHighDateTime=0x1c747ea)) returned 1 [0096.952] SetFilePointer (in: hFile=0xa0, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0096.952] ReadFile (in: hFile=0xa0, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x3a7, lpOverlapped=0x0) returned 1 [0096.980] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_ON.GIF") returned="TAB_ON.GIF" [0096.980] SetFilePointer (in: hFile=0xa0, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0096.980] WriteFile (in: hFile=0xa0, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x3a7, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x3a7, lpOverlapped=0x0) returned 1 [0096.980] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0096.980] CloseHandle (hObject=0xa0) returned 1 [0096.980] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\desert\\tab_on.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_ON.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\desert\\tab_on.gif. ")) returned 1 [0096.981] FindNextFileA (in: hFindFile=0x5be1e0, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 0 [0096.981] FindClose (in: hFindFile=0x5be1e0 | out: hFindFile=0x5be1e0) returned 1 [0096.982] FindNextFileA (in: hFindFile=0x5be1a0, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0096.982] PeekMessageA (in: lpMsg=0xaece4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaece4) returned 0 [0096.982] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Desert.css") returned 1 [0096.982] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Desert.css") returned 1 [0096.982] lstrcmpiA (lpString1="", lpString2="Desert.css") returned -1 [0096.982] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\*.*") returned="*.*" [0096.982] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\", lpString2="Desert.css" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert.css") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert.css" [0096.982] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert.css", pszSpec="*.zip") returned 0 [0096.982] lstrlenA (lpString="*.zip") returned 5 [0096.982] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert.css", pszSpec="*.rar") returned 0 [0096.982] lstrlenA (lpString="*.rar") returned 5 [0096.982] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert.css", pszSpec="*.7z") returned 0 [0096.982] lstrlenA (lpString="*.7z") returned 4 [0096.982] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert.css", pszSpec="*.tar") returned 0 [0096.982] lstrlenA (lpString="*.tar") returned 5 [0096.982] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert.css", pszSpec="*.gzip") returned 0 [0096.982] lstrlenA (lpString="*.gzip") returned 6 [0096.982] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert.css", pszSpec="*.jpg") returned 0 [0096.982] lstrlenA (lpString="*.jpg") returned 5 [0096.982] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert.css", pszSpec="*.jpeg") returned 0 [0096.982] lstrlenA (lpString="*.jpeg") returned 6 [0096.982] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert.css", pszSpec="*.psd") returned 0 [0096.982] lstrlenA (lpString="*.psd") returned 5 [0096.982] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert.css", pszSpec="*.cdr") returned 0 [0096.982] lstrlenA (lpString="*.cdr") returned 5 [0096.982] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert.css", pszSpec="*.dwg") returned 0 [0096.982] lstrlenA (lpString="*.dwg") returned 5 [0096.982] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert.css", pszSpec="*.max") returned 0 [0096.982] lstrlenA (lpString="*.max") returned 5 [0096.982] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert.css", pszSpec="*.bmp") returned 0 [0096.982] lstrlenA (lpString="*.bmp") returned 5 [0096.982] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert.css", pszSpec="*.gif") returned 0 [0096.982] lstrlenA (lpString="*.gif") returned 5 [0096.982] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert.css", pszSpec="*.png") returned 0 [0096.982] lstrlenA (lpString="*.png") returned 5 [0096.982] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert.css", pszSpec="*.doc") returned 0 [0096.982] lstrlenA (lpString="*.doc") returned 5 [0096.982] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert.css", pszSpec="*.docx") returned 0 [0096.982] lstrlenA (lpString="*.docx") returned 6 [0096.982] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert.css", pszSpec="*.xls") returned 0 [0096.982] lstrlenA (lpString="*.xls") returned 5 [0096.982] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert.css", pszSpec="*.xlsx") returned 0 [0096.982] lstrlenA (lpString="*.xlsx") returned 6 [0096.982] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert.css", pszSpec="*.ppt") returned 0 [0096.983] lstrlenA (lpString="*.ppt") returned 5 [0096.983] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert.css", pszSpec="*.pptx") returned 0 [0096.983] lstrlenA (lpString="*.pptx") returned 6 [0096.983] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert.css", pszSpec="*.txt") returned 0 [0096.983] lstrlenA (lpString="*.txt") returned 5 [0096.983] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert.css", pszSpec="*.pdf") returned 0 [0096.983] lstrlenA (lpString="*.pdf") returned 5 [0096.983] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert.css", pszSpec="*.djvu") returned 0 [0096.983] lstrlenA (lpString="*.djvu") returned 6 [0096.983] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert.css", pszSpec="*.htm") returned 0 [0096.983] lstrlenA (lpString="*.htm") returned 5 [0096.983] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert.css", pszSpec="*.html") returned 0 [0096.983] lstrlenA (lpString="*.html") returned 6 [0096.983] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert.css", pszSpec="*.mdb") returned 0 [0096.983] lstrlenA (lpString="*.mdb") returned 5 [0096.983] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert.css", pszSpec="*.cer") returned 0 [0096.983] lstrlenA (lpString="*.cer") returned 5 [0096.983] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert.css", pszSpec="*.p12") returned 0 [0096.983] lstrlenA (lpString="*.p12") returned 5 [0096.983] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert.css", pszSpec="*.pfx") returned 0 [0096.983] lstrlenA (lpString="*.pfx") returned 5 [0096.983] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert.css", pszSpec="*.kwm") returned 0 [0096.983] lstrlenA (lpString="*.kwm") returned 5 [0096.983] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert.css", pszSpec="*.pwm") returned 0 [0096.983] lstrlenA (lpString="*.pwm") returned 5 [0096.983] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert.css", pszSpec="*.1cd") returned 0 [0096.983] lstrlenA (lpString="*.1cd") returned 5 [0096.983] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert.css", pszSpec="*.md") returned 0 [0096.983] lstrlenA (lpString="*.md") returned 4 [0096.983] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert.css", pszSpec="*.mdf") returned 0 [0096.983] lstrlenA (lpString="*.mdf") returned 5 [0096.983] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert.css", pszSpec="*.dbf") returned 0 [0096.983] lstrlenA (lpString="*.dbf") returned 5 [0096.983] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert.css", pszSpec="*.odt") returned 0 [0096.983] lstrlenA (lpString="*.odt") returned 5 [0096.983] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert.css", pszSpec="*.vob") returned 0 [0096.983] lstrlenA (lpString="*.vob") returned 5 [0096.983] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert.css", pszSpec="*.ifo") returned 0 [0096.983] lstrlenA (lpString="*.ifo") returned 5 [0096.983] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert.css", pszSpec="*.lnk") returned 0 [0096.983] lstrlenA (lpString="*.lnk") returned 5 [0096.983] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert.css", pszSpec="*.torrent") returned 0 [0096.983] lstrlenA (lpString="*.torrent") returned 9 [0096.983] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert.css", pszSpec="*.mov") returned 0 [0096.983] lstrlenA (lpString="*.mov") returned 5 [0096.983] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert.css", pszSpec="*.m2v") returned 0 [0096.983] lstrlenA (lpString="*.m2v") returned 5 [0096.983] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert.css", pszSpec="*.3gp") returned 0 [0096.983] lstrlenA (lpString="*.3gp") returned 5 [0096.983] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert.css", pszSpec="*.mpeg") returned 0 [0096.983] lstrlenA (lpString="*.mpeg") returned 6 [0096.984] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert.css", pszSpec="*.mpg") returned 0 [0096.984] lstrlenA (lpString="*.mpg") returned 5 [0096.984] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert.css", pszSpec="*.flv") returned 0 [0096.984] lstrlenA (lpString="*.flv") returned 5 [0096.984] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert.css", pszSpec="*.avi") returned 0 [0096.984] lstrlenA (lpString="*.avi") returned 5 [0096.984] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert.css", pszSpec="*.mp4") returned 0 [0096.984] lstrlenA (lpString="*.mp4") returned 5 [0096.984] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert.css", pszSpec="*.wmv") returned 0 [0096.984] lstrlenA (lpString="*.wmv") returned 5 [0096.984] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert.css", pszSpec="*.divx") returned 0 [0096.984] lstrlenA (lpString="*.divx") returned 6 [0096.984] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert.css", pszSpec="*.mkv") returned 0 [0096.984] lstrlenA (lpString="*.mkv") returned 5 [0096.984] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert.css", pszSpec="*.mp3") returned 0 [0096.984] lstrlenA (lpString="*.mp3") returned 5 [0096.984] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert.css", pszSpec="*.wav") returned 0 [0096.984] lstrlenA (lpString="*.wav") returned 5 [0096.984] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert.css", pszSpec="*.flac") returned 0 [0096.984] lstrlenA (lpString="*.flac") returned 6 [0096.984] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert.css", pszSpec="*.ape") returned 0 [0096.984] lstrlenA (lpString="*.ape") returned 5 [0096.984] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert.css", pszSpec="*.wma") returned 0 [0096.984] lstrlenA (lpString="*.wma") returned 5 [0096.984] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert.css", pszSpec="*.ac3") returned 0 [0096.984] lstrlenA (lpString="*.ac3") returned 5 [0096.984] FindNextFileA (in: hFindFile=0x5be1a0, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0096.984] PeekMessageA (in: lpMsg=0xaece4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaece4) returned 0 [0096.984] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Earthy.css") returned -1 [0096.984] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Earthy.css") returned 1 [0096.984] lstrcmpiA (lpString1="", lpString2="Earthy.css") returned -1 [0096.984] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert.css") returned="Desert.css" [0096.984] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\", lpString2="Earthy.css" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Earthy.css") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Earthy.css" [0096.984] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Earthy.css", pszSpec="*.zip") returned 0 [0096.984] lstrlenA (lpString="*.zip") returned 5 [0096.984] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Earthy.css", pszSpec="*.rar") returned 0 [0096.984] lstrlenA (lpString="*.rar") returned 5 [0096.984] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Earthy.css", pszSpec="*.7z") returned 0 [0096.984] lstrlenA (lpString="*.7z") returned 4 [0096.984] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Earthy.css", pszSpec="*.tar") returned 0 [0096.984] lstrlenA (lpString="*.tar") returned 5 [0096.984] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Earthy.css", pszSpec="*.gzip") returned 0 [0096.984] lstrlenA (lpString="*.gzip") returned 6 [0096.984] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Earthy.css", pszSpec="*.jpg") returned 0 [0096.984] lstrlenA (lpString="*.jpg") returned 5 [0096.984] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Earthy.css", pszSpec="*.jpeg") returned 0 [0096.984] lstrlenA (lpString="*.jpeg") returned 6 [0096.984] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Earthy.css", pszSpec="*.psd") returned 0 [0096.984] lstrlenA (lpString="*.psd") returned 5 [0096.985] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Earthy.css", pszSpec="*.cdr") returned 0 [0096.985] lstrlenA (lpString="*.cdr") returned 5 [0096.985] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Earthy.css", pszSpec="*.dwg") returned 0 [0096.985] lstrlenA (lpString="*.dwg") returned 5 [0096.985] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Earthy.css", pszSpec="*.max") returned 0 [0096.985] lstrlenA (lpString="*.max") returned 5 [0096.985] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Earthy.css", pszSpec="*.bmp") returned 0 [0096.985] lstrlenA (lpString="*.bmp") returned 5 [0096.985] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Earthy.css", pszSpec="*.gif") returned 0 [0096.985] lstrlenA (lpString="*.gif") returned 5 [0096.985] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Earthy.css", pszSpec="*.png") returned 0 [0096.985] lstrlenA (lpString="*.png") returned 5 [0096.985] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Earthy.css", pszSpec="*.doc") returned 0 [0096.985] lstrlenA (lpString="*.doc") returned 5 [0096.985] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Earthy.css", pszSpec="*.docx") returned 0 [0096.985] lstrlenA (lpString="*.docx") returned 6 [0096.985] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Earthy.css", pszSpec="*.xls") returned 0 [0096.985] lstrlenA (lpString="*.xls") returned 5 [0096.985] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Earthy.css", pszSpec="*.xlsx") returned 0 [0096.985] lstrlenA (lpString="*.xlsx") returned 6 [0096.985] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Earthy.css", pszSpec="*.ppt") returned 0 [0096.985] lstrlenA (lpString="*.ppt") returned 5 [0096.985] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Earthy.css", pszSpec="*.pptx") returned 0 [0096.985] lstrlenA (lpString="*.pptx") returned 6 [0096.985] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Earthy.css", pszSpec="*.txt") returned 0 [0096.985] lstrlenA (lpString="*.txt") returned 5 [0096.985] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Earthy.css", pszSpec="*.pdf") returned 0 [0096.985] lstrlenA (lpString="*.pdf") returned 5 [0096.985] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Earthy.css", pszSpec="*.djvu") returned 0 [0096.985] lstrlenA (lpString="*.djvu") returned 6 [0096.985] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Earthy.css", pszSpec="*.htm") returned 0 [0096.985] lstrlenA (lpString="*.htm") returned 5 [0096.985] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Earthy.css", pszSpec="*.html") returned 0 [0096.985] lstrlenA (lpString="*.html") returned 6 [0096.985] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Earthy.css", pszSpec="*.mdb") returned 0 [0096.985] lstrlenA (lpString="*.mdb") returned 5 [0096.985] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Earthy.css", pszSpec="*.cer") returned 0 [0096.985] lstrlenA (lpString="*.cer") returned 5 [0096.985] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Earthy.css", pszSpec="*.p12") returned 0 [0096.985] lstrlenA (lpString="*.p12") returned 5 [0096.985] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Earthy.css", pszSpec="*.pfx") returned 0 [0096.985] lstrlenA (lpString="*.pfx") returned 5 [0096.985] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Earthy.css", pszSpec="*.kwm") returned 0 [0096.985] lstrlenA (lpString="*.kwm") returned 5 [0096.985] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Earthy.css", pszSpec="*.pwm") returned 0 [0096.985] lstrlenA (lpString="*.pwm") returned 5 [0096.985] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Earthy.css", pszSpec="*.1cd") returned 0 [0096.985] lstrlenA (lpString="*.1cd") returned 5 [0096.985] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Earthy.css", pszSpec="*.md") returned 0 [0096.985] lstrlenA (lpString="*.md") returned 4 [0096.986] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Earthy.css", pszSpec="*.mdf") returned 0 [0096.986] lstrlenA (lpString="*.mdf") returned 5 [0096.986] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Earthy.css", pszSpec="*.dbf") returned 0 [0096.986] lstrlenA (lpString="*.dbf") returned 5 [0096.986] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Earthy.css", pszSpec="*.odt") returned 0 [0096.986] lstrlenA (lpString="*.odt") returned 5 [0096.986] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Earthy.css", pszSpec="*.vob") returned 0 [0096.986] lstrlenA (lpString="*.vob") returned 5 [0096.986] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Earthy.css", pszSpec="*.ifo") returned 0 [0096.986] lstrlenA (lpString="*.ifo") returned 5 [0096.986] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Earthy.css", pszSpec="*.lnk") returned 0 [0096.986] lstrlenA (lpString="*.lnk") returned 5 [0096.986] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Earthy.css", pszSpec="*.torrent") returned 0 [0096.986] lstrlenA (lpString="*.torrent") returned 9 [0096.986] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Earthy.css", pszSpec="*.mov") returned 0 [0096.986] lstrlenA (lpString="*.mov") returned 5 [0096.986] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Earthy.css", pszSpec="*.m2v") returned 0 [0096.986] lstrlenA (lpString="*.m2v") returned 5 [0096.986] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Earthy.css", pszSpec="*.3gp") returned 0 [0096.986] lstrlenA (lpString="*.3gp") returned 5 [0096.986] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Earthy.css", pszSpec="*.mpeg") returned 0 [0096.986] lstrlenA (lpString="*.mpeg") returned 6 [0096.986] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Earthy.css", pszSpec="*.mpg") returned 0 [0096.986] lstrlenA (lpString="*.mpg") returned 5 [0096.986] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Earthy.css", pszSpec="*.flv") returned 0 [0096.986] lstrlenA (lpString="*.flv") returned 5 [0096.986] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Earthy.css", pszSpec="*.avi") returned 0 [0096.986] lstrlenA (lpString="*.avi") returned 5 [0096.986] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Earthy.css", pszSpec="*.mp4") returned 0 [0096.986] lstrlenA (lpString="*.mp4") returned 5 [0096.986] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Earthy.css", pszSpec="*.wmv") returned 0 [0096.986] lstrlenA (lpString="*.wmv") returned 5 [0096.986] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Earthy.css", pszSpec="*.divx") returned 0 [0096.986] lstrlenA (lpString="*.divx") returned 6 [0096.986] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Earthy.css", pszSpec="*.mkv") returned 0 [0096.986] lstrlenA (lpString="*.mkv") returned 5 [0096.986] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Earthy.css", pszSpec="*.mp3") returned 0 [0096.986] lstrlenA (lpString="*.mp3") returned 5 [0096.986] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Earthy.css", pszSpec="*.wav") returned 0 [0096.986] lstrlenA (lpString="*.wav") returned 5 [0096.986] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Earthy.css", pszSpec="*.flac") returned 0 [0096.986] lstrlenA (lpString="*.flac") returned 6 [0096.986] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Earthy.css", pszSpec="*.ape") returned 0 [0096.986] lstrlenA (lpString="*.ape") returned 5 [0096.986] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Earthy.css", pszSpec="*.wma") returned 0 [0096.986] lstrlenA (lpString="*.wma") returned 5 [0096.986] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Earthy.css", pszSpec="*.ac3") returned 0 [0096.986] lstrlenA (lpString="*.ac3") returned 5 [0096.987] FindNextFileA (in: hFindFile=0x5be1a0, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0096.987] lstrcmpA (lpString1=".", lpString2="GrayCheck") returned -1 [0096.987] lstrcmpA (lpString1="..", lpString2="GrayCheck") returned -1 [0096.987] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Earthy.css") returned="Earthy.css" [0096.987] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\", lpString2="GrayCheck" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck" [0096.987] lstrlenA (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck") returned 104 [0096.987] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\*.*", lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 0x5be1e0 [0096.987] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0096.987] FindNextFileA (in: hFindFile=0x5be1e0, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 1 [0096.987] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0096.987] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0096.987] FindNextFileA (in: hFindFile=0x5be1e0, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 1 [0096.987] PeekMessageA (in: lpMsg=0xaeb94, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaeb94) returned 0 [0096.987] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="HEADER.GIF") returned -1 [0096.987] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="HEADER.GIF") returned 1 [0096.988] lstrcmpiA (lpString1="", lpString2="HEADER.GIF") returned -1 [0096.988] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\*.*") returned="*.*" [0096.988] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\", lpString2="HEADER.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\HEADER.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\HEADER.GIF" [0096.988] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\HEADER.GIF", pszSpec="*.zip") returned 0 [0096.988] lstrlenA (lpString="*.zip") returned 5 [0096.988] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\HEADER.GIF", pszSpec="*.rar") returned 0 [0096.988] lstrlenA (lpString="*.rar") returned 5 [0096.988] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\HEADER.GIF", pszSpec="*.7z") returned 0 [0096.988] lstrlenA (lpString="*.7z") returned 4 [0096.988] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\HEADER.GIF", pszSpec="*.tar") returned 0 [0096.988] lstrlenA (lpString="*.tar") returned 5 [0096.988] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\HEADER.GIF", pszSpec="*.gzip") returned 0 [0096.988] lstrlenA (lpString="*.gzip") returned 6 [0096.988] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\HEADER.GIF", pszSpec="*.jpg") returned 0 [0096.988] lstrlenA (lpString="*.jpg") returned 5 [0096.988] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\HEADER.GIF", pszSpec="*.jpeg") returned 0 [0096.988] lstrlenA (lpString="*.jpeg") returned 6 [0096.988] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\HEADER.GIF", pszSpec="*.psd") returned 0 [0096.988] lstrlenA (lpString="*.psd") returned 5 [0096.988] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\HEADER.GIF", pszSpec="*.cdr") returned 0 [0096.988] lstrlenA (lpString="*.cdr") returned 5 [0096.988] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\HEADER.GIF", pszSpec="*.dwg") returned 0 [0096.988] lstrlenA (lpString="*.dwg") returned 5 [0096.988] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\HEADER.GIF", pszSpec="*.max") returned 0 [0096.988] lstrlenA (lpString="*.max") returned 5 [0096.988] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\HEADER.GIF", pszSpec="*.bmp") returned 0 [0096.988] lstrlenA (lpString="*.bmp") returned 5 [0096.988] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\HEADER.GIF", pszSpec="*.gif") returned 1 [0096.988] lstrlenA (lpString="*.gif") returned 5 [0096.988] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\HEADER.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\HEADER.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\HEADER.GIF" [0096.988] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\HEADER.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\HEADER.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\HEADER.GIF" [0096.988] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\HEADER.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\HEADER.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\HEADER.GIF." [0096.988] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\HEADER.GIF.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\HEADER.GIF. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\HEADER.GIF. " [0096.988] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\HEADER.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\graycheck\\header.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0 [0096.989] GetFileSize (in: hFile=0xa0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1b8 [0096.989] GetFileTime (in: hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xa042cc00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x52c3bfd0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xa042cc00, dwHighDateTime=0x1c747ea)) returned 1 [0096.989] SetFilePointer (in: hFile=0xa0, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0096.990] ReadFile (in: hFile=0xa0, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x15e, lpOverlapped=0x0) returned 1 [0096.990] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\HEADER.GIF") returned="HEADER.GIF" [0096.990] SetFilePointer (in: hFile=0xa0, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0096.990] WriteFile (in: hFile=0xa0, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x15e, lpOverlapped=0x0) returned 1 [0096.990] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0096.990] CloseHandle (hObject=0xa0) returned 1 [0096.990] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\HEADER.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\graycheck\\header.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\HEADER.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\graycheck\\header.gif. ")) returned 1 [0096.992] FindNextFileA (in: hFindFile=0x5be1e0, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 1 [0096.992] PeekMessageA (in: lpMsg=0xaeb94, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaeb94) returned 0 [0096.992] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="TAB_OFF.GIF") returned -1 [0096.992] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TAB_OFF.GIF") returned -1 [0096.992] lstrcmpiA (lpString1="", lpString2="TAB_OFF.GIF") returned -1 [0096.992] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\HEADER.GIF") returned="HEADER.GIF" [0096.992] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\", lpString2="TAB_OFF.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_OFF.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_OFF.GIF" [0096.992] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_OFF.GIF", pszSpec="*.zip") returned 0 [0096.992] lstrlenA (lpString="*.zip") returned 5 [0096.992] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_OFF.GIF", pszSpec="*.rar") returned 0 [0096.992] lstrlenA (lpString="*.rar") returned 5 [0096.992] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_OFF.GIF", pszSpec="*.7z") returned 0 [0096.992] lstrlenA (lpString="*.7z") returned 4 [0096.992] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_OFF.GIF", pszSpec="*.tar") returned 0 [0096.992] lstrlenA (lpString="*.tar") returned 5 [0096.992] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_OFF.GIF", pszSpec="*.gzip") returned 0 [0096.992] lstrlenA (lpString="*.gzip") returned 6 [0096.992] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_OFF.GIF", pszSpec="*.jpg") returned 0 [0096.992] lstrlenA (lpString="*.jpg") returned 5 [0096.992] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_OFF.GIF", pszSpec="*.jpeg") returned 0 [0096.992] lstrlenA (lpString="*.jpeg") returned 6 [0096.992] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_OFF.GIF", pszSpec="*.psd") returned 0 [0096.992] lstrlenA (lpString="*.psd") returned 5 [0096.992] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_OFF.GIF", pszSpec="*.cdr") returned 0 [0096.992] lstrlenA (lpString="*.cdr") returned 5 [0096.992] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_OFF.GIF", pszSpec="*.dwg") returned 0 [0096.992] lstrlenA (lpString="*.dwg") returned 5 [0096.992] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_OFF.GIF", pszSpec="*.max") returned 0 [0096.992] lstrlenA (lpString="*.max") returned 5 [0096.992] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_OFF.GIF", pszSpec="*.bmp") returned 0 [0096.992] lstrlenA (lpString="*.bmp") returned 5 [0096.992] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_OFF.GIF", pszSpec="*.gif") returned 1 [0096.992] lstrlenA (lpString="*.gif") returned 5 [0096.993] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_OFF.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_OFF.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_OFF.GIF" [0096.993] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_OFF.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_OFF.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_OFF.GIF" [0096.993] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_OFF.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_OFF.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_OFF.GIF." [0096.993] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_OFF.GIF.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_OFF.GIF. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_OFF.GIF. " [0096.993] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\graycheck\\tab_off.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0 [0096.997] GetFileSize (in: hFile=0xa0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x155 [0096.997] GetFileTime (in: hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xa042cc00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x61ab7bf0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xa042cc00, dwHighDateTime=0x1c747ea)) returned 1 [0096.997] SetFilePointer (in: hFile=0xa0, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0096.997] ReadFile (in: hFile=0xa0, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0xfb, lpOverlapped=0x0) returned 1 [0096.998] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_OFF.GIF") returned="TAB_OFF.GIF" [0096.998] SetFilePointer (in: hFile=0xa0, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0096.998] WriteFile (in: hFile=0xa0, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0xfb, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0xfb, lpOverlapped=0x0) returned 1 [0096.998] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0096.998] CloseHandle (hObject=0xa0) returned 1 [0096.998] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\graycheck\\tab_off.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_OFF.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\graycheck\\tab_off.gif. ")) returned 1 [0097.000] FindNextFileA (in: hFindFile=0x5be1e0, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 1 [0097.000] PeekMessageA (in: lpMsg=0xaeb94, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaeb94) returned 0 [0097.000] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="TAB_ON.GIF") returned -1 [0097.000] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TAB_ON.GIF") returned -1 [0097.000] lstrcmpiA (lpString1="", lpString2="TAB_ON.GIF") returned -1 [0097.000] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_OFF.GIF") returned="TAB_OFF.GIF" [0097.000] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\", lpString2="TAB_ON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_ON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_ON.GIF" [0097.000] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_ON.GIF", pszSpec="*.zip") returned 0 [0097.000] lstrlenA (lpString="*.zip") returned 5 [0097.000] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_ON.GIF", pszSpec="*.rar") returned 0 [0097.000] lstrlenA (lpString="*.rar") returned 5 [0097.000] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_ON.GIF", pszSpec="*.7z") returned 0 [0097.000] lstrlenA (lpString="*.7z") returned 4 [0097.000] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_ON.GIF", pszSpec="*.tar") returned 0 [0097.000] lstrlenA (lpString="*.tar") returned 5 [0097.000] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_ON.GIF", pszSpec="*.gzip") returned 0 [0097.000] lstrlenA (lpString="*.gzip") returned 6 [0097.000] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_ON.GIF", pszSpec="*.jpg") returned 0 [0097.000] lstrlenA (lpString="*.jpg") returned 5 [0097.000] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_ON.GIF", pszSpec="*.jpeg") returned 0 [0097.000] lstrlenA (lpString="*.jpeg") returned 6 [0097.000] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_ON.GIF", pszSpec="*.psd") returned 0 [0097.000] lstrlenA (lpString="*.psd") returned 5 [0097.000] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_ON.GIF", pszSpec="*.cdr") returned 0 [0097.001] lstrlenA (lpString="*.cdr") returned 5 [0097.001] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_ON.GIF", pszSpec="*.dwg") returned 0 [0097.001] lstrlenA (lpString="*.dwg") returned 5 [0097.001] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_ON.GIF", pszSpec="*.max") returned 0 [0097.001] lstrlenA (lpString="*.max") returned 5 [0097.001] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_ON.GIF", pszSpec="*.bmp") returned 0 [0097.001] lstrlenA (lpString="*.bmp") returned 5 [0097.001] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_ON.GIF", pszSpec="*.gif") returned 1 [0097.001] lstrlenA (lpString="*.gif") returned 5 [0097.001] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_ON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_ON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_ON.GIF" [0097.001] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_ON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_ON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_ON.GIF" [0097.001] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_ON.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_ON.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_ON.GIF." [0097.001] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_ON.GIF.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_ON.GIF. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_ON.GIF. " [0097.001] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\graycheck\\tab_on.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0 [0097.003] GetFileSize (in: hFile=0xa0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xde [0097.003] GetFileTime (in: hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xa042cc00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x61ab7bf0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xa042cc00, dwHighDateTime=0x1c747ea)) returned 1 [0097.003] SetFilePointer (in: hFile=0xa0, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0097.003] ReadFile (in: hFile=0xa0, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x84, lpOverlapped=0x0) returned 1 [0097.004] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_ON.GIF") returned="TAB_ON.GIF" [0097.004] SetFilePointer (in: hFile=0xa0, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0097.004] WriteFile (in: hFile=0xa0, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x84, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x84, lpOverlapped=0x0) returned 1 [0097.004] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0097.004] CloseHandle (hObject=0xa0) returned 1 [0097.004] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\graycheck\\tab_on.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_ON.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\graycheck\\tab_on.gif. ")) returned 1 [0097.015] FindNextFileA (in: hFindFile=0x5be1e0, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 0 [0097.015] FindClose (in: hFindFile=0x5be1e0 | out: hFindFile=0x5be1e0) returned 1 [0097.015] FindNextFileA (in: hFindFile=0x5be1a0, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0097.015] PeekMessageA (in: lpMsg=0xaece4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaece4) returned 0 [0097.015] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="GrayCheck.css") returned -1 [0097.015] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="GrayCheck.css") returned 1 [0097.015] lstrcmpiA (lpString1="", lpString2="GrayCheck.css") returned -1 [0097.015] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\*.*") returned="*.*" [0097.015] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\", lpString2="GrayCheck.css" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck.css") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck.css" [0097.016] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck.css", pszSpec="*.zip") returned 0 [0097.016] lstrlenA (lpString="*.zip") returned 5 [0097.016] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck.css", pszSpec="*.rar") returned 0 [0097.016] lstrlenA (lpString="*.rar") returned 5 [0097.016] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck.css", pszSpec="*.7z") returned 0 [0097.016] lstrlenA (lpString="*.7z") returned 4 [0097.016] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck.css", pszSpec="*.tar") returned 0 [0097.016] lstrlenA (lpString="*.tar") returned 5 [0097.016] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck.css", pszSpec="*.gzip") returned 0 [0097.016] lstrlenA (lpString="*.gzip") returned 6 [0097.016] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck.css", pszSpec="*.jpg") returned 0 [0097.016] lstrlenA (lpString="*.jpg") returned 5 [0097.016] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck.css", pszSpec="*.jpeg") returned 0 [0097.016] lstrlenA (lpString="*.jpeg") returned 6 [0097.016] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck.css", pszSpec="*.psd") returned 0 [0097.016] lstrlenA (lpString="*.psd") returned 5 [0097.016] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck.css", pszSpec="*.cdr") returned 0 [0097.016] lstrlenA (lpString="*.cdr") returned 5 [0097.016] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck.css", pszSpec="*.dwg") returned 0 [0097.016] lstrlenA (lpString="*.dwg") returned 5 [0097.016] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck.css", pszSpec="*.max") returned 0 [0097.016] lstrlenA (lpString="*.max") returned 5 [0097.016] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck.css", pszSpec="*.bmp") returned 0 [0097.016] lstrlenA (lpString="*.bmp") returned 5 [0097.016] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck.css", pszSpec="*.gif") returned 0 [0097.016] lstrlenA (lpString="*.gif") returned 5 [0097.016] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck.css", pszSpec="*.png") returned 0 [0097.016] lstrlenA (lpString="*.png") returned 5 [0097.016] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck.css", pszSpec="*.doc") returned 0 [0097.016] lstrlenA (lpString="*.doc") returned 5 [0097.016] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck.css", pszSpec="*.docx") returned 0 [0097.016] lstrlenA (lpString="*.docx") returned 6 [0097.016] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck.css", pszSpec="*.xls") returned 0 [0097.016] lstrlenA (lpString="*.xls") returned 5 [0097.016] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck.css", pszSpec="*.xlsx") returned 0 [0097.016] lstrlenA (lpString="*.xlsx") returned 6 [0097.016] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck.css", pszSpec="*.ppt") returned 0 [0097.016] lstrlenA (lpString="*.ppt") returned 5 [0097.016] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck.css", pszSpec="*.pptx") returned 0 [0097.016] lstrlenA (lpString="*.pptx") returned 6 [0097.016] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck.css", pszSpec="*.txt") returned 0 [0097.017] lstrlenA (lpString="*.txt") returned 5 [0097.017] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck.css", pszSpec="*.pdf") returned 0 [0097.017] lstrlenA (lpString="*.pdf") returned 5 [0097.017] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck.css", pszSpec="*.djvu") returned 0 [0097.017] lstrlenA (lpString="*.djvu") returned 6 [0097.017] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck.css", pszSpec="*.htm") returned 0 [0097.017] lstrlenA (lpString="*.htm") returned 5 [0097.017] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck.css", pszSpec="*.html") returned 0 [0097.017] lstrlenA (lpString="*.html") returned 6 [0097.017] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck.css", pszSpec="*.mdb") returned 0 [0097.017] lstrlenA (lpString="*.mdb") returned 5 [0097.017] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck.css", pszSpec="*.cer") returned 0 [0097.017] lstrlenA (lpString="*.cer") returned 5 [0097.017] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck.css", pszSpec="*.p12") returned 0 [0097.017] lstrlenA (lpString="*.p12") returned 5 [0097.017] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck.css", pszSpec="*.pfx") returned 0 [0097.017] lstrlenA (lpString="*.pfx") returned 5 [0097.017] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck.css", pszSpec="*.kwm") returned 0 [0097.017] lstrlenA (lpString="*.kwm") returned 5 [0097.017] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck.css", pszSpec="*.pwm") returned 0 [0097.017] lstrlenA (lpString="*.pwm") returned 5 [0097.017] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck.css", pszSpec="*.1cd") returned 0 [0097.017] lstrlenA (lpString="*.1cd") returned 5 [0097.017] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck.css", pszSpec="*.md") returned 0 [0097.017] lstrlenA (lpString="*.md") returned 4 [0097.017] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck.css", pszSpec="*.mdf") returned 0 [0097.017] lstrlenA (lpString="*.mdf") returned 5 [0097.017] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck.css", pszSpec="*.dbf") returned 0 [0097.017] lstrlenA (lpString="*.dbf") returned 5 [0097.017] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck.css", pszSpec="*.odt") returned 0 [0097.017] lstrlenA (lpString="*.odt") returned 5 [0097.017] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck.css", pszSpec="*.vob") returned 0 [0097.017] lstrlenA (lpString="*.vob") returned 5 [0097.017] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck.css", pszSpec="*.ifo") returned 0 [0097.017] lstrlenA (lpString="*.ifo") returned 5 [0097.017] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck.css", pszSpec="*.lnk") returned 0 [0097.017] lstrlenA (lpString="*.lnk") returned 5 [0097.017] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck.css", pszSpec="*.torrent") returned 0 [0097.017] lstrlenA (lpString="*.torrent") returned 9 [0097.018] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck.css", pszSpec="*.mov") returned 0 [0097.018] lstrlenA (lpString="*.mov") returned 5 [0097.018] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck.css", pszSpec="*.m2v") returned 0 [0097.018] lstrlenA (lpString="*.m2v") returned 5 [0097.018] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck.css", pszSpec="*.3gp") returned 0 [0097.018] lstrlenA (lpString="*.3gp") returned 5 [0097.018] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck.css", pszSpec="*.mpeg") returned 0 [0097.018] lstrlenA (lpString="*.mpeg") returned 6 [0097.018] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck.css", pszSpec="*.mpg") returned 0 [0097.018] lstrlenA (lpString="*.mpg") returned 5 [0097.018] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck.css", pszSpec="*.flv") returned 0 [0097.018] lstrlenA (lpString="*.flv") returned 5 [0097.018] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck.css", pszSpec="*.avi") returned 0 [0097.018] lstrlenA (lpString="*.avi") returned 5 [0097.018] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck.css", pszSpec="*.mp4") returned 0 [0097.018] lstrlenA (lpString="*.mp4") returned 5 [0097.018] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck.css", pszSpec="*.wmv") returned 0 [0097.018] lstrlenA (lpString="*.wmv") returned 5 [0097.018] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck.css", pszSpec="*.divx") returned 0 [0097.018] lstrlenA (lpString="*.divx") returned 6 [0097.018] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck.css", pszSpec="*.mkv") returned 0 [0097.018] lstrlenA (lpString="*.mkv") returned 5 [0097.018] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck.css", pszSpec="*.mp3") returned 0 [0097.018] lstrlenA (lpString="*.mp3") returned 5 [0097.018] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck.css", pszSpec="*.wav") returned 0 [0097.018] lstrlenA (lpString="*.wav") returned 5 [0097.018] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck.css", pszSpec="*.flac") returned 0 [0097.018] lstrlenA (lpString="*.flac") returned 6 [0097.018] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck.css", pszSpec="*.ape") returned 0 [0097.018] lstrlenA (lpString="*.ape") returned 5 [0097.018] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck.css", pszSpec="*.wma") returned 0 [0097.018] lstrlenA (lpString="*.wma") returned 5 [0097.018] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck.css", pszSpec="*.ac3") returned 0 [0097.018] lstrlenA (lpString="*.ac3") returned 5 [0097.018] FindNextFileA (in: hFindFile=0x5be1a0, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0097.018] PeekMessageA (in: lpMsg=0xaece4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaece4) returned 0 [0097.018] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="GreenTea.css") returned -1 [0097.018] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="GreenTea.css") returned 1 [0097.018] lstrcmpiA (lpString1="", lpString2="GreenTea.css") returned -1 [0097.018] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck.css") returned="GrayCheck.css" [0097.019] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\", lpString2="GreenTea.css" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GreenTea.css") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GreenTea.css" [0097.019] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GreenTea.css", pszSpec="*.zip") returned 0 [0097.019] lstrlenA (lpString="*.zip") returned 5 [0097.019] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GreenTea.css", pszSpec="*.rar") returned 0 [0097.019] lstrlenA (lpString="*.rar") returned 5 [0097.019] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GreenTea.css", pszSpec="*.7z") returned 0 [0097.019] lstrlenA (lpString="*.7z") returned 4 [0097.019] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GreenTea.css", pszSpec="*.tar") returned 0 [0097.019] lstrlenA (lpString="*.tar") returned 5 [0097.019] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GreenTea.css", pszSpec="*.gzip") returned 0 [0097.019] lstrlenA (lpString="*.gzip") returned 6 [0097.019] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GreenTea.css", pszSpec="*.jpg") returned 0 [0097.019] lstrlenA (lpString="*.jpg") returned 5 [0097.019] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GreenTea.css", pszSpec="*.jpeg") returned 0 [0097.019] lstrlenA (lpString="*.jpeg") returned 6 [0097.019] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GreenTea.css", pszSpec="*.psd") returned 0 [0097.019] lstrlenA (lpString="*.psd") returned 5 [0097.019] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GreenTea.css", pszSpec="*.cdr") returned 0 [0097.019] lstrlenA (lpString="*.cdr") returned 5 [0097.019] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GreenTea.css", pszSpec="*.dwg") returned 0 [0097.019] lstrlenA (lpString="*.dwg") returned 5 [0097.019] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GreenTea.css", pszSpec="*.max") returned 0 [0097.019] lstrlenA (lpString="*.max") returned 5 [0097.019] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GreenTea.css", pszSpec="*.bmp") returned 0 [0097.019] lstrlenA (lpString="*.bmp") returned 5 [0097.019] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GreenTea.css", pszSpec="*.gif") returned 0 [0097.019] lstrlenA (lpString="*.gif") returned 5 [0097.019] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GreenTea.css", pszSpec="*.png") returned 0 [0097.019] lstrlenA (lpString="*.png") returned 5 [0097.019] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GreenTea.css", pszSpec="*.doc") returned 0 [0097.019] lstrlenA (lpString="*.doc") returned 5 [0097.019] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GreenTea.css", pszSpec="*.docx") returned 0 [0097.019] lstrlenA (lpString="*.docx") returned 6 [0097.019] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GreenTea.css", pszSpec="*.xls") returned 0 [0097.019] lstrlenA (lpString="*.xls") returned 5 [0097.019] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GreenTea.css", pszSpec="*.xlsx") returned 0 [0097.019] lstrlenA (lpString="*.xlsx") returned 6 [0097.019] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GreenTea.css", pszSpec="*.ppt") returned 0 [0097.019] lstrlenA (lpString="*.ppt") returned 5 [0097.019] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GreenTea.css", pszSpec="*.pptx") returned 0 [0097.019] lstrlenA (lpString="*.pptx") returned 6 [0097.019] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GreenTea.css", pszSpec="*.txt") returned 0 [0097.019] lstrlenA (lpString="*.txt") returned 5 [0097.020] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GreenTea.css", pszSpec="*.pdf") returned 0 [0097.020] lstrlenA (lpString="*.pdf") returned 5 [0097.020] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GreenTea.css", pszSpec="*.djvu") returned 0 [0097.020] lstrlenA (lpString="*.djvu") returned 6 [0097.020] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GreenTea.css", pszSpec="*.htm") returned 0 [0097.020] lstrlenA (lpString="*.htm") returned 5 [0097.020] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GreenTea.css", pszSpec="*.html") returned 0 [0097.020] lstrlenA (lpString="*.html") returned 6 [0097.020] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GreenTea.css", pszSpec="*.mdb") returned 0 [0097.020] lstrlenA (lpString="*.mdb") returned 5 [0097.020] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GreenTea.css", pszSpec="*.cer") returned 0 [0097.020] lstrlenA (lpString="*.cer") returned 5 [0097.020] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GreenTea.css", pszSpec="*.p12") returned 0 [0097.020] lstrlenA (lpString="*.p12") returned 5 [0097.020] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GreenTea.css", pszSpec="*.pfx") returned 0 [0097.020] lstrlenA (lpString="*.pfx") returned 5 [0097.020] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GreenTea.css", pszSpec="*.kwm") returned 0 [0097.020] lstrlenA (lpString="*.kwm") returned 5 [0097.020] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GreenTea.css", pszSpec="*.pwm") returned 0 [0097.020] lstrlenA (lpString="*.pwm") returned 5 [0097.020] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GreenTea.css", pszSpec="*.1cd") returned 0 [0097.020] lstrlenA (lpString="*.1cd") returned 5 [0097.020] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GreenTea.css", pszSpec="*.md") returned 0 [0097.020] lstrlenA (lpString="*.md") returned 4 [0097.020] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GreenTea.css", pszSpec="*.mdf") returned 0 [0097.020] lstrlenA (lpString="*.mdf") returned 5 [0097.020] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GreenTea.css", pszSpec="*.dbf") returned 0 [0097.020] lstrlenA (lpString="*.dbf") returned 5 [0097.020] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GreenTea.css", pszSpec="*.odt") returned 0 [0097.020] lstrlenA (lpString="*.odt") returned 5 [0097.020] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GreenTea.css", pszSpec="*.vob") returned 0 [0097.020] lstrlenA (lpString="*.vob") returned 5 [0097.020] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GreenTea.css", pszSpec="*.ifo") returned 0 [0097.020] lstrlenA (lpString="*.ifo") returned 5 [0097.020] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GreenTea.css", pszSpec="*.lnk") returned 0 [0097.020] lstrlenA (lpString="*.lnk") returned 5 [0097.020] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GreenTea.css", pszSpec="*.torrent") returned 0 [0097.020] lstrlenA (lpString="*.torrent") returned 9 [0097.020] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GreenTea.css", pszSpec="*.mov") returned 0 [0097.020] lstrlenA (lpString="*.mov") returned 5 [0097.020] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GreenTea.css", pszSpec="*.m2v") returned 0 [0097.020] lstrlenA (lpString="*.m2v") returned 5 [0097.020] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GreenTea.css", pszSpec="*.3gp") returned 0 [0097.020] lstrlenA (lpString="*.3gp") returned 5 [0097.020] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GreenTea.css", pszSpec="*.mpeg") returned 0 [0097.020] lstrlenA (lpString="*.mpeg") returned 6 [0097.020] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GreenTea.css", pszSpec="*.mpg") returned 0 [0097.020] lstrlenA (lpString="*.mpg") returned 5 [0097.021] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GreenTea.css", pszSpec="*.flv") returned 0 [0097.021] lstrlenA (lpString="*.flv") returned 5 [0097.021] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GreenTea.css", pszSpec="*.avi") returned 0 [0097.021] lstrlenA (lpString="*.avi") returned 5 [0097.021] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GreenTea.css", pszSpec="*.mp4") returned 0 [0097.021] lstrlenA (lpString="*.mp4") returned 5 [0097.021] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GreenTea.css", pszSpec="*.wmv") returned 0 [0097.021] lstrlenA (lpString="*.wmv") returned 5 [0097.021] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GreenTea.css", pszSpec="*.divx") returned 0 [0097.021] lstrlenA (lpString="*.divx") returned 6 [0097.021] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GreenTea.css", pszSpec="*.mkv") returned 0 [0097.021] lstrlenA (lpString="*.mkv") returned 5 [0097.021] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GreenTea.css", pszSpec="*.mp3") returned 0 [0097.021] lstrlenA (lpString="*.mp3") returned 5 [0097.021] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GreenTea.css", pszSpec="*.wav") returned 0 [0097.021] lstrlenA (lpString="*.wav") returned 5 [0097.021] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GreenTea.css", pszSpec="*.flac") returned 0 [0097.021] lstrlenA (lpString="*.flac") returned 6 [0097.021] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GreenTea.css", pszSpec="*.ape") returned 0 [0097.021] lstrlenA (lpString="*.ape") returned 5 [0097.021] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GreenTea.css", pszSpec="*.wma") returned 0 [0097.021] lstrlenA (lpString="*.wma") returned 5 [0097.021] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GreenTea.css", pszSpec="*.ac3") returned 0 [0097.021] lstrlenA (lpString="*.ac3") returned 5 [0097.021] FindNextFileA (in: hFindFile=0x5be1a0, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0097.021] PeekMessageA (in: lpMsg=0xaece4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaece4) returned 0 [0097.021] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="LightSpirit.css") returned -1 [0097.021] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="LightSpirit.css") returned -1 [0097.021] lstrcmpiA (lpString1="", lpString2="LightSpirit.css") returned -1 [0097.021] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GreenTea.css") returned="GreenTea.css" [0097.021] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\", lpString2="LightSpirit.css" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\LightSpirit.css") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\LightSpirit.css" [0097.021] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\LightSpirit.css", pszSpec="*.zip") returned 0 [0097.021] lstrlenA (lpString="*.zip") returned 5 [0097.021] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\LightSpirit.css", pszSpec="*.rar") returned 0 [0097.021] lstrlenA (lpString="*.rar") returned 5 [0097.021] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\LightSpirit.css", pszSpec="*.7z") returned 0 [0097.021] lstrlenA (lpString="*.7z") returned 4 [0097.021] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\LightSpirit.css", pszSpec="*.tar") returned 0 [0097.021] lstrlenA (lpString="*.tar") returned 5 [0097.021] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\LightSpirit.css", pszSpec="*.gzip") returned 0 [0097.021] lstrlenA (lpString="*.gzip") returned 6 [0097.021] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\LightSpirit.css", pszSpec="*.jpg") returned 0 [0097.021] lstrlenA (lpString="*.jpg") returned 5 [0097.021] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\LightSpirit.css", pszSpec="*.jpeg") returned 0 [0097.021] lstrlenA (lpString="*.jpeg") returned 6 [0097.021] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\LightSpirit.css", pszSpec="*.psd") returned 0 [0097.021] lstrlenA (lpString="*.psd") returned 5 [0097.021] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\LightSpirit.css", pszSpec="*.cdr") returned 0 [0097.022] lstrlenA (lpString="*.cdr") returned 5 [0097.022] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\LightSpirit.css", pszSpec="*.dwg") returned 0 [0097.022] lstrlenA (lpString="*.dwg") returned 5 [0097.022] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\LightSpirit.css", pszSpec="*.max") returned 0 [0097.022] lstrlenA (lpString="*.max") returned 5 [0097.022] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\LightSpirit.css", pszSpec="*.bmp") returned 0 [0097.022] lstrlenA (lpString="*.bmp") returned 5 [0097.022] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\LightSpirit.css", pszSpec="*.gif") returned 0 [0097.022] lstrlenA (lpString="*.gif") returned 5 [0097.022] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\LightSpirit.css", pszSpec="*.png") returned 0 [0097.022] lstrlenA (lpString="*.png") returned 5 [0097.022] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\LightSpirit.css", pszSpec="*.doc") returned 0 [0097.022] lstrlenA (lpString="*.doc") returned 5 [0097.022] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\LightSpirit.css", pszSpec="*.docx") returned 0 [0097.022] lstrlenA (lpString="*.docx") returned 6 [0097.022] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\LightSpirit.css", pszSpec="*.xls") returned 0 [0097.022] lstrlenA (lpString="*.xls") returned 5 [0097.022] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\LightSpirit.css", pszSpec="*.xlsx") returned 0 [0097.022] lstrlenA (lpString="*.xlsx") returned 6 [0097.022] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\LightSpirit.css", pszSpec="*.ppt") returned 0 [0097.022] lstrlenA (lpString="*.ppt") returned 5 [0097.022] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\LightSpirit.css", pszSpec="*.pptx") returned 0 [0097.022] lstrlenA (lpString="*.pptx") returned 6 [0097.022] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\LightSpirit.css", pszSpec="*.txt") returned 0 [0097.022] lstrlenA (lpString="*.txt") returned 5 [0097.022] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\LightSpirit.css", pszSpec="*.pdf") returned 0 [0097.022] lstrlenA (lpString="*.pdf") returned 5 [0097.022] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\LightSpirit.css", pszSpec="*.djvu") returned 0 [0097.022] lstrlenA (lpString="*.djvu") returned 6 [0097.022] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\LightSpirit.css", pszSpec="*.htm") returned 0 [0097.022] lstrlenA (lpString="*.htm") returned 5 [0097.022] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\LightSpirit.css", pszSpec="*.html") returned 0 [0097.022] lstrlenA (lpString="*.html") returned 6 [0097.022] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\LightSpirit.css", pszSpec="*.mdb") returned 0 [0097.022] lstrlenA (lpString="*.mdb") returned 5 [0097.022] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\LightSpirit.css", pszSpec="*.cer") returned 0 [0097.022] lstrlenA (lpString="*.cer") returned 5 [0097.022] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\LightSpirit.css", pszSpec="*.p12") returned 0 [0097.022] lstrlenA (lpString="*.p12") returned 5 [0097.022] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\LightSpirit.css", pszSpec="*.pfx") returned 0 [0097.022] lstrlenA (lpString="*.pfx") returned 5 [0097.022] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\LightSpirit.css", pszSpec="*.kwm") returned 0 [0097.022] lstrlenA (lpString="*.kwm") returned 5 [0097.022] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\LightSpirit.css", pszSpec="*.pwm") returned 0 [0097.023] lstrlenA (lpString="*.pwm") returned 5 [0097.023] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\LightSpirit.css", pszSpec="*.1cd") returned 0 [0097.023] lstrlenA (lpString="*.1cd") returned 5 [0097.023] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\LightSpirit.css", pszSpec="*.md") returned 0 [0097.023] lstrlenA (lpString="*.md") returned 4 [0097.023] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\LightSpirit.css", pszSpec="*.mdf") returned 0 [0097.023] lstrlenA (lpString="*.mdf") returned 5 [0097.023] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\LightSpirit.css", pszSpec="*.dbf") returned 0 [0097.023] lstrlenA (lpString="*.dbf") returned 5 [0097.023] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\LightSpirit.css", pszSpec="*.odt") returned 0 [0097.023] lstrlenA (lpString="*.odt") returned 5 [0097.023] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\LightSpirit.css", pszSpec="*.vob") returned 0 [0097.023] lstrlenA (lpString="*.vob") returned 5 [0097.023] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\LightSpirit.css", pszSpec="*.ifo") returned 0 [0097.023] lstrlenA (lpString="*.ifo") returned 5 [0097.023] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\LightSpirit.css", pszSpec="*.lnk") returned 0 [0097.023] lstrlenA (lpString="*.lnk") returned 5 [0097.023] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\LightSpirit.css", pszSpec="*.torrent") returned 0 [0097.023] lstrlenA (lpString="*.torrent") returned 9 [0097.023] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\LightSpirit.css", pszSpec="*.mov") returned 0 [0097.023] lstrlenA (lpString="*.mov") returned 5 [0097.023] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\LightSpirit.css", pszSpec="*.m2v") returned 0 [0097.023] lstrlenA (lpString="*.m2v") returned 5 [0097.023] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\LightSpirit.css", pszSpec="*.3gp") returned 0 [0097.023] lstrlenA (lpString="*.3gp") returned 5 [0097.023] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\LightSpirit.css", pszSpec="*.mpeg") returned 0 [0097.023] lstrlenA (lpString="*.mpeg") returned 6 [0097.023] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\LightSpirit.css", pszSpec="*.mpg") returned 0 [0097.023] lstrlenA (lpString="*.mpg") returned 5 [0097.023] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\LightSpirit.css", pszSpec="*.flv") returned 0 [0097.023] lstrlenA (lpString="*.flv") returned 5 [0097.023] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\LightSpirit.css", pszSpec="*.avi") returned 0 [0097.023] lstrlenA (lpString="*.avi") returned 5 [0097.023] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\LightSpirit.css", pszSpec="*.mp4") returned 0 [0097.023] lstrlenA (lpString="*.mp4") returned 5 [0097.023] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\LightSpirit.css", pszSpec="*.wmv") returned 0 [0097.023] lstrlenA (lpString="*.wmv") returned 5 [0097.023] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\LightSpirit.css", pszSpec="*.divx") returned 0 [0097.024] lstrlenA (lpString="*.divx") returned 6 [0097.024] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\LightSpirit.css", pszSpec="*.mkv") returned 0 [0097.024] lstrlenA (lpString="*.mkv") returned 5 [0097.024] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\LightSpirit.css", pszSpec="*.mp3") returned 0 [0097.024] lstrlenA (lpString="*.mp3") returned 5 [0097.024] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\LightSpirit.css", pszSpec="*.wav") returned 0 [0097.024] lstrlenA (lpString="*.wav") returned 5 [0097.024] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\LightSpirit.css", pszSpec="*.flac") returned 0 [0097.024] lstrlenA (lpString="*.flac") returned 6 [0097.024] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\LightSpirit.css", pszSpec="*.ape") returned 0 [0097.024] lstrlenA (lpString="*.ape") returned 5 [0097.024] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\LightSpirit.css", pszSpec="*.wma") returned 0 [0097.024] lstrlenA (lpString="*.wma") returned 5 [0097.024] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\LightSpirit.css", pszSpec="*.ac3") returned 0 [0097.024] lstrlenA (lpString="*.ac3") returned 5 [0097.024] FindNextFileA (in: hFindFile=0x5be1a0, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0097.024] lstrcmpA (lpString1=".", lpString2="Lime") returned -1 [0097.024] lstrcmpA (lpString1="..", lpString2="Lime") returned -1 [0097.024] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\LightSpirit.css") returned="LightSpirit.css" [0097.024] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\", lpString2="Lime" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime" [0097.024] lstrlenA (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime") returned 99 [0097.024] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\*.*", lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 0x5be1e0 [0097.024] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0097.024] FindNextFileA (in: hFindFile=0x5be1e0, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 1 [0097.025] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0097.025] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0097.025] FindNextFileA (in: hFindFile=0x5be1e0, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 1 [0097.025] PeekMessageA (in: lpMsg=0xaeb94, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaeb94) returned 0 [0097.025] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="TAB_OFF.GIF") returned -1 [0097.025] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TAB_OFF.GIF") returned -1 [0097.025] lstrcmpiA (lpString1="", lpString2="TAB_OFF.GIF") returned -1 [0097.025] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\*.*") returned="*.*" [0097.025] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\", lpString2="TAB_OFF.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_OFF.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_OFF.GIF" [0097.025] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_OFF.GIF", pszSpec="*.zip") returned 0 [0097.025] lstrlenA (lpString="*.zip") returned 5 [0097.025] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_OFF.GIF", pszSpec="*.rar") returned 0 [0097.025] lstrlenA (lpString="*.rar") returned 5 [0097.025] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_OFF.GIF", pszSpec="*.7z") returned 0 [0097.025] lstrlenA (lpString="*.7z") returned 4 [0097.025] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_OFF.GIF", pszSpec="*.tar") returned 0 [0097.025] lstrlenA (lpString="*.tar") returned 5 [0097.025] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_OFF.GIF", pszSpec="*.gzip") returned 0 [0097.025] lstrlenA (lpString="*.gzip") returned 6 [0097.025] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_OFF.GIF", pszSpec="*.jpg") returned 0 [0097.025] lstrlenA (lpString="*.jpg") returned 5 [0097.025] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_OFF.GIF", pszSpec="*.jpeg") returned 0 [0097.025] lstrlenA (lpString="*.jpeg") returned 6 [0097.025] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_OFF.GIF", pszSpec="*.psd") returned 0 [0097.025] lstrlenA (lpString="*.psd") returned 5 [0097.025] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_OFF.GIF", pszSpec="*.cdr") returned 0 [0097.025] lstrlenA (lpString="*.cdr") returned 5 [0097.025] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_OFF.GIF", pszSpec="*.dwg") returned 0 [0097.025] lstrlenA (lpString="*.dwg") returned 5 [0097.025] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_OFF.GIF", pszSpec="*.max") returned 0 [0097.025] lstrlenA (lpString="*.max") returned 5 [0097.025] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_OFF.GIF", pszSpec="*.bmp") returned 0 [0097.025] lstrlenA (lpString="*.bmp") returned 5 [0097.025] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_OFF.GIF", pszSpec="*.gif") returned 1 [0097.025] lstrlenA (lpString="*.gif") returned 5 [0097.026] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_OFF.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_OFF.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_OFF.GIF" [0097.026] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_OFF.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_OFF.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_OFF.GIF" [0097.026] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_OFF.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_OFF.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_OFF.GIF." [0097.026] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_OFF.GIF.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_OFF.GIF. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_OFF.GIF. " [0097.026] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\lime\\tab_off.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0 [0097.027] GetFileSize (in: hFile=0xa0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1ce [0097.027] GetFileTime (in: hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xa042cc00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x66293410, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xa042cc00, dwHighDateTime=0x1c747ea)) returned 1 [0097.027] SetFilePointer (in: hFile=0xa0, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0097.027] ReadFile (in: hFile=0xa0, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x174, lpOverlapped=0x0) returned 1 [0097.028] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_OFF.GIF") returned="TAB_OFF.GIF" [0097.028] SetFilePointer (in: hFile=0xa0, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0097.028] WriteFile (in: hFile=0xa0, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x174, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x174, lpOverlapped=0x0) returned 1 [0097.028] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0097.028] CloseHandle (hObject=0xa0) returned 1 [0097.028] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\lime\\tab_off.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_OFF.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\lime\\tab_off.gif. ")) returned 1 [0097.029] FindNextFileA (in: hFindFile=0x5be1e0, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 1 [0097.029] PeekMessageA (in: lpMsg=0xaeb94, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaeb94) returned 0 [0097.029] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="TAB_ON.GIF") returned -1 [0097.029] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TAB_ON.GIF") returned -1 [0097.029] lstrcmpiA (lpString1="", lpString2="TAB_ON.GIF") returned -1 [0097.029] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_OFF.GIF") returned="TAB_OFF.GIF" [0097.029] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\", lpString2="TAB_ON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_ON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_ON.GIF" [0097.029] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_ON.GIF", pszSpec="*.zip") returned 0 [0097.029] lstrlenA (lpString="*.zip") returned 5 [0097.029] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_ON.GIF", pszSpec="*.rar") returned 0 [0097.029] lstrlenA (lpString="*.rar") returned 5 [0097.029] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_ON.GIF", pszSpec="*.7z") returned 0 [0097.029] lstrlenA (lpString="*.7z") returned 4 [0097.029] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_ON.GIF", pszSpec="*.tar") returned 0 [0097.029] lstrlenA (lpString="*.tar") returned 5 [0097.029] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_ON.GIF", pszSpec="*.gzip") returned 0 [0097.030] lstrlenA (lpString="*.gzip") returned 6 [0097.030] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_ON.GIF", pszSpec="*.jpg") returned 0 [0097.030] lstrlenA (lpString="*.jpg") returned 5 [0097.030] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_ON.GIF", pszSpec="*.jpeg") returned 0 [0097.030] lstrlenA (lpString="*.jpeg") returned 6 [0097.030] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_ON.GIF", pszSpec="*.psd") returned 0 [0097.030] lstrlenA (lpString="*.psd") returned 5 [0097.030] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_ON.GIF", pszSpec="*.cdr") returned 0 [0097.030] lstrlenA (lpString="*.cdr") returned 5 [0097.030] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_ON.GIF", pszSpec="*.dwg") returned 0 [0097.030] lstrlenA (lpString="*.dwg") returned 5 [0097.030] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_ON.GIF", pszSpec="*.max") returned 0 [0097.030] lstrlenA (lpString="*.max") returned 5 [0097.030] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_ON.GIF", pszSpec="*.bmp") returned 0 [0097.030] lstrlenA (lpString="*.bmp") returned 5 [0097.030] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_ON.GIF", pszSpec="*.gif") returned 1 [0097.030] lstrlenA (lpString="*.gif") returned 5 [0097.030] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_ON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_ON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_ON.GIF" [0097.030] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_ON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_ON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_ON.GIF" [0097.030] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_ON.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_ON.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_ON.GIF." [0097.030] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_ON.GIF.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_ON.GIF. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_ON.GIF. " [0097.030] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\lime\\tab_on.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0 [0097.031] GetFileSize (in: hFile=0xa0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x10b [0097.031] GetFileTime (in: hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xa042cc00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x568309f0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xa042cc00, dwHighDateTime=0x1c747ea)) returned 1 [0097.031] SetFilePointer (in: hFile=0xa0, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0097.031] ReadFile (in: hFile=0xa0, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0xb1, lpOverlapped=0x0) returned 1 [0097.032] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_ON.GIF") returned="TAB_ON.GIF" [0097.032] SetFilePointer (in: hFile=0xa0, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0097.032] WriteFile (in: hFile=0xa0, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0xb1, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0xb1, lpOverlapped=0x0) returned 1 [0097.032] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0097.032] CloseHandle (hObject=0xa0) returned 1 [0097.032] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\lime\\tab_on.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_ON.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\lime\\tab_on.gif. ")) returned 1 [0097.034] FindNextFileA (in: hFindFile=0x5be1e0, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 0 [0097.034] FindClose (in: hFindFile=0x5be1e0 | out: hFindFile=0x5be1e0) returned 1 [0097.034] FindNextFileA (in: hFindFile=0x5be1a0, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0097.034] PeekMessageA (in: lpMsg=0xaece4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaece4) returned 0 [0097.034] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Lime.css") returned -1 [0097.034] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Lime.css") returned -1 [0097.034] lstrcmpiA (lpString1="", lpString2="Lime.css") returned -1 [0097.034] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\*.*") returned="*.*" [0097.034] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\", lpString2="Lime.css" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime.css") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime.css" [0097.034] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime.css", pszSpec="*.zip") returned 0 [0097.034] lstrlenA (lpString="*.zip") returned 5 [0097.035] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime.css", pszSpec="*.rar") returned 0 [0097.035] lstrlenA (lpString="*.rar") returned 5 [0097.035] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime.css", pszSpec="*.7z") returned 0 [0097.035] lstrlenA (lpString="*.7z") returned 4 [0097.035] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime.css", pszSpec="*.tar") returned 0 [0097.035] lstrlenA (lpString="*.tar") returned 5 [0097.035] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime.css", pszSpec="*.gzip") returned 0 [0097.035] lstrlenA (lpString="*.gzip") returned 6 [0097.035] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime.css", pszSpec="*.jpg") returned 0 [0097.035] lstrlenA (lpString="*.jpg") returned 5 [0097.035] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime.css", pszSpec="*.jpeg") returned 0 [0097.035] lstrlenA (lpString="*.jpeg") returned 6 [0097.035] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime.css", pszSpec="*.psd") returned 0 [0097.035] lstrlenA (lpString="*.psd") returned 5 [0097.035] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime.css", pszSpec="*.cdr") returned 0 [0097.035] lstrlenA (lpString="*.cdr") returned 5 [0097.035] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime.css", pszSpec="*.dwg") returned 0 [0097.035] lstrlenA (lpString="*.dwg") returned 5 [0097.035] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime.css", pszSpec="*.max") returned 0 [0097.035] lstrlenA (lpString="*.max") returned 5 [0097.035] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime.css", pszSpec="*.bmp") returned 0 [0097.035] lstrlenA (lpString="*.bmp") returned 5 [0097.035] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime.css", pszSpec="*.gif") returned 0 [0097.035] lstrlenA (lpString="*.gif") returned 5 [0097.035] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime.css", pszSpec="*.png") returned 0 [0097.035] lstrlenA (lpString="*.png") returned 5 [0097.035] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime.css", pszSpec="*.doc") returned 0 [0097.035] lstrlenA (lpString="*.doc") returned 5 [0097.035] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime.css", pszSpec="*.docx") returned 0 [0097.035] lstrlenA (lpString="*.docx") returned 6 [0097.035] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime.css", pszSpec="*.xls") returned 0 [0097.035] lstrlenA (lpString="*.xls") returned 5 [0097.035] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime.css", pszSpec="*.xlsx") returned 0 [0097.035] lstrlenA (lpString="*.xlsx") returned 6 [0097.035] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime.css", pszSpec="*.ppt") returned 0 [0097.035] lstrlenA (lpString="*.ppt") returned 5 [0097.035] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime.css", pszSpec="*.pptx") returned 0 [0097.036] lstrlenA (lpString="*.pptx") returned 6 [0097.036] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime.css", pszSpec="*.txt") returned 0 [0097.036] lstrlenA (lpString="*.txt") returned 5 [0097.036] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime.css", pszSpec="*.pdf") returned 0 [0097.036] lstrlenA (lpString="*.pdf") returned 5 [0097.036] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime.css", pszSpec="*.djvu") returned 0 [0097.036] lstrlenA (lpString="*.djvu") returned 6 [0097.036] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime.css", pszSpec="*.htm") returned 0 [0097.036] lstrlenA (lpString="*.htm") returned 5 [0097.036] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime.css", pszSpec="*.html") returned 0 [0097.036] lstrlenA (lpString="*.html") returned 6 [0097.036] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime.css", pszSpec="*.mdb") returned 0 [0097.036] lstrlenA (lpString="*.mdb") returned 5 [0097.036] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime.css", pszSpec="*.cer") returned 0 [0097.036] lstrlenA (lpString="*.cer") returned 5 [0097.036] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime.css", pszSpec="*.p12") returned 0 [0097.036] lstrlenA (lpString="*.p12") returned 5 [0097.036] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime.css", pszSpec="*.pfx") returned 0 [0097.036] lstrlenA (lpString="*.pfx") returned 5 [0097.036] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime.css", pszSpec="*.kwm") returned 0 [0097.036] lstrlenA (lpString="*.kwm") returned 5 [0097.036] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime.css", pszSpec="*.pwm") returned 0 [0097.036] lstrlenA (lpString="*.pwm") returned 5 [0097.036] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime.css", pszSpec="*.1cd") returned 0 [0097.036] lstrlenA (lpString="*.1cd") returned 5 [0097.036] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime.css", pszSpec="*.md") returned 0 [0097.036] lstrlenA (lpString="*.md") returned 4 [0097.036] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime.css", pszSpec="*.mdf") returned 0 [0097.036] lstrlenA (lpString="*.mdf") returned 5 [0097.036] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime.css", pszSpec="*.dbf") returned 0 [0097.036] lstrlenA (lpString="*.dbf") returned 5 [0097.036] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime.css", pszSpec="*.odt") returned 0 [0097.036] lstrlenA (lpString="*.odt") returned 5 [0097.036] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime.css", pszSpec="*.vob") returned 0 [0097.036] lstrlenA (lpString="*.vob") returned 5 [0097.036] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime.css", pszSpec="*.ifo") returned 0 [0097.036] lstrlenA (lpString="*.ifo") returned 5 [0097.036] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime.css", pszSpec="*.lnk") returned 0 [0097.036] lstrlenA (lpString="*.lnk") returned 5 [0097.037] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime.css", pszSpec="*.torrent") returned 0 [0097.037] lstrlenA (lpString="*.torrent") returned 9 [0097.037] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime.css", pszSpec="*.mov") returned 0 [0097.037] lstrlenA (lpString="*.mov") returned 5 [0097.037] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime.css", pszSpec="*.m2v") returned 0 [0097.037] lstrlenA (lpString="*.m2v") returned 5 [0097.037] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime.css", pszSpec="*.3gp") returned 0 [0097.037] lstrlenA (lpString="*.3gp") returned 5 [0097.037] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime.css", pszSpec="*.mpeg") returned 0 [0097.037] lstrlenA (lpString="*.mpeg") returned 6 [0097.037] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime.css", pszSpec="*.mpg") returned 0 [0097.037] lstrlenA (lpString="*.mpg") returned 5 [0097.037] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime.css", pszSpec="*.flv") returned 0 [0097.037] lstrlenA (lpString="*.flv") returned 5 [0097.037] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime.css", pszSpec="*.avi") returned 0 [0097.037] lstrlenA (lpString="*.avi") returned 5 [0097.037] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime.css", pszSpec="*.mp4") returned 0 [0097.037] lstrlenA (lpString="*.mp4") returned 5 [0097.037] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime.css", pszSpec="*.wmv") returned 0 [0097.037] lstrlenA (lpString="*.wmv") returned 5 [0097.037] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime.css", pszSpec="*.divx") returned 0 [0097.037] lstrlenA (lpString="*.divx") returned 6 [0097.037] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime.css", pszSpec="*.mkv") returned 0 [0097.037] lstrlenA (lpString="*.mkv") returned 5 [0097.037] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime.css", pszSpec="*.mp3") returned 0 [0097.037] lstrlenA (lpString="*.mp3") returned 5 [0097.037] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime.css", pszSpec="*.wav") returned 0 [0097.037] lstrlenA (lpString="*.wav") returned 5 [0097.037] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime.css", pszSpec="*.flac") returned 0 [0097.037] lstrlenA (lpString="*.flac") returned 6 [0097.037] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime.css", pszSpec="*.ape") returned 0 [0097.037] lstrlenA (lpString="*.ape") returned 5 [0097.037] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime.css", pszSpec="*.wma") returned 0 [0097.037] lstrlenA (lpString="*.wma") returned 5 [0097.037] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime.css", pszSpec="*.ac3") returned 0 [0097.037] lstrlenA (lpString="*.ac3") returned 5 [0097.037] FindNextFileA (in: hFindFile=0x5be1a0, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0097.037] PeekMessageA (in: lpMsg=0xaece4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaece4) returned 0 [0097.037] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Maroon.css") returned -1 [0097.037] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Maroon.css") returned -1 [0097.038] lstrcmpiA (lpString1="", lpString2="Maroon.css") returned -1 [0097.038] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime.css") returned="Lime.css" [0097.038] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\", lpString2="Maroon.css" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Maroon.css") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Maroon.css" [0097.038] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Maroon.css", pszSpec="*.zip") returned 0 [0097.038] lstrlenA (lpString="*.zip") returned 5 [0097.038] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Maroon.css", pszSpec="*.rar") returned 0 [0097.038] lstrlenA (lpString="*.rar") returned 5 [0097.038] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Maroon.css", pszSpec="*.7z") returned 0 [0097.038] lstrlenA (lpString="*.7z") returned 4 [0097.038] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Maroon.css", pszSpec="*.tar") returned 0 [0097.038] lstrlenA (lpString="*.tar") returned 5 [0097.038] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Maroon.css", pszSpec="*.gzip") returned 0 [0097.038] lstrlenA (lpString="*.gzip") returned 6 [0097.038] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Maroon.css", pszSpec="*.jpg") returned 0 [0097.038] lstrlenA (lpString="*.jpg") returned 5 [0097.038] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Maroon.css", pszSpec="*.jpeg") returned 0 [0097.038] lstrlenA (lpString="*.jpeg") returned 6 [0097.038] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Maroon.css", pszSpec="*.psd") returned 0 [0097.038] lstrlenA (lpString="*.psd") returned 5 [0097.038] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Maroon.css", pszSpec="*.cdr") returned 0 [0097.038] lstrlenA (lpString="*.cdr") returned 5 [0097.038] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Maroon.css", pszSpec="*.dwg") returned 0 [0097.038] lstrlenA (lpString="*.dwg") returned 5 [0097.038] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Maroon.css", pszSpec="*.max") returned 0 [0097.038] lstrlenA (lpString="*.max") returned 5 [0097.038] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Maroon.css", pszSpec="*.bmp") returned 0 [0097.038] lstrlenA (lpString="*.bmp") returned 5 [0097.038] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Maroon.css", pszSpec="*.gif") returned 0 [0097.038] lstrlenA (lpString="*.gif") returned 5 [0097.038] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Maroon.css", pszSpec="*.png") returned 0 [0097.038] lstrlenA (lpString="*.png") returned 5 [0097.038] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Maroon.css", pszSpec="*.doc") returned 0 [0097.038] lstrlenA (lpString="*.doc") returned 5 [0097.038] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Maroon.css", pszSpec="*.docx") returned 0 [0097.038] lstrlenA (lpString="*.docx") returned 6 [0097.038] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Maroon.css", pszSpec="*.xls") returned 0 [0097.039] lstrlenA (lpString="*.xls") returned 5 [0097.039] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Maroon.css", pszSpec="*.xlsx") returned 0 [0097.039] lstrlenA (lpString="*.xlsx") returned 6 [0097.039] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Maroon.css", pszSpec="*.ppt") returned 0 [0097.039] lstrlenA (lpString="*.ppt") returned 5 [0097.039] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Maroon.css", pszSpec="*.pptx") returned 0 [0097.039] lstrlenA (lpString="*.pptx") returned 6 [0097.039] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Maroon.css", pszSpec="*.txt") returned 0 [0097.039] lstrlenA (lpString="*.txt") returned 5 [0097.039] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Maroon.css", pszSpec="*.pdf") returned 0 [0097.039] lstrlenA (lpString="*.pdf") returned 5 [0097.039] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Maroon.css", pszSpec="*.djvu") returned 0 [0097.039] lstrlenA (lpString="*.djvu") returned 6 [0097.039] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Maroon.css", pszSpec="*.htm") returned 0 [0097.039] lstrlenA (lpString="*.htm") returned 5 [0097.039] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Maroon.css", pszSpec="*.html") returned 0 [0097.039] lstrlenA (lpString="*.html") returned 6 [0097.039] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Maroon.css", pszSpec="*.mdb") returned 0 [0097.039] lstrlenA (lpString="*.mdb") returned 5 [0097.039] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Maroon.css", pszSpec="*.cer") returned 0 [0097.039] lstrlenA (lpString="*.cer") returned 5 [0097.039] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Maroon.css", pszSpec="*.p12") returned 0 [0097.039] lstrlenA (lpString="*.p12") returned 5 [0097.039] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Maroon.css", pszSpec="*.pfx") returned 0 [0097.039] lstrlenA (lpString="*.pfx") returned 5 [0097.039] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Maroon.css", pszSpec="*.kwm") returned 0 [0097.039] lstrlenA (lpString="*.kwm") returned 5 [0097.039] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Maroon.css", pszSpec="*.pwm") returned 0 [0097.039] lstrlenA (lpString="*.pwm") returned 5 [0097.039] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Maroon.css", pszSpec="*.1cd") returned 0 [0097.039] lstrlenA (lpString="*.1cd") returned 5 [0097.039] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Maroon.css", pszSpec="*.md") returned 0 [0097.039] lstrlenA (lpString="*.md") returned 4 [0097.039] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Maroon.css", pszSpec="*.mdf") returned 0 [0097.039] lstrlenA (lpString="*.mdf") returned 5 [0097.039] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Maroon.css", pszSpec="*.dbf") returned 0 [0097.039] lstrlenA (lpString="*.dbf") returned 5 [0097.039] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Maroon.css", pszSpec="*.odt") returned 0 [0097.039] lstrlenA (lpString="*.odt") returned 5 [0097.040] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Maroon.css", pszSpec="*.vob") returned 0 [0097.040] lstrlenA (lpString="*.vob") returned 5 [0097.040] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Maroon.css", pszSpec="*.ifo") returned 0 [0097.040] lstrlenA (lpString="*.ifo") returned 5 [0097.040] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Maroon.css", pszSpec="*.lnk") returned 0 [0097.040] lstrlenA (lpString="*.lnk") returned 5 [0097.040] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Maroon.css", pszSpec="*.torrent") returned 0 [0097.040] lstrlenA (lpString="*.torrent") returned 9 [0097.040] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Maroon.css", pszSpec="*.mov") returned 0 [0097.040] lstrlenA (lpString="*.mov") returned 5 [0097.040] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Maroon.css", pszSpec="*.m2v") returned 0 [0097.040] lstrlenA (lpString="*.m2v") returned 5 [0097.040] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Maroon.css", pszSpec="*.3gp") returned 0 [0097.040] lstrlenA (lpString="*.3gp") returned 5 [0097.040] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Maroon.css", pszSpec="*.mpeg") returned 0 [0097.040] lstrlenA (lpString="*.mpeg") returned 6 [0097.040] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Maroon.css", pszSpec="*.mpg") returned 0 [0097.040] lstrlenA (lpString="*.mpg") returned 5 [0097.040] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Maroon.css", pszSpec="*.flv") returned 0 [0097.040] lstrlenA (lpString="*.flv") returned 5 [0097.040] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Maroon.css", pszSpec="*.avi") returned 0 [0097.040] lstrlenA (lpString="*.avi") returned 5 [0097.040] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Maroon.css", pszSpec="*.mp4") returned 0 [0097.040] lstrlenA (lpString="*.mp4") returned 5 [0097.040] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Maroon.css", pszSpec="*.wmv") returned 0 [0097.040] lstrlenA (lpString="*.wmv") returned 5 [0097.040] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Maroon.css", pszSpec="*.divx") returned 0 [0097.040] lstrlenA (lpString="*.divx") returned 6 [0097.040] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Maroon.css", pszSpec="*.mkv") returned 0 [0097.040] lstrlenA (lpString="*.mkv") returned 5 [0097.040] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Maroon.css", pszSpec="*.mp3") returned 0 [0097.040] lstrlenA (lpString="*.mp3") returned 5 [0097.040] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Maroon.css", pszSpec="*.wav") returned 0 [0097.040] lstrlenA (lpString="*.wav") returned 5 [0097.040] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Maroon.css", pszSpec="*.flac") returned 0 [0097.040] lstrlenA (lpString="*.flac") returned 6 [0097.040] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Maroon.css", pszSpec="*.ape") returned 0 [0097.040] lstrlenA (lpString="*.ape") returned 5 [0097.041] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Maroon.css", pszSpec="*.wma") returned 0 [0097.041] lstrlenA (lpString="*.wma") returned 5 [0097.041] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Maroon.css", pszSpec="*.ac3") returned 0 [0097.041] lstrlenA (lpString="*.ac3") returned 5 [0097.041] FindNextFileA (in: hFindFile=0x5be1a0, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0097.041] lstrcmpA (lpString1=".", lpString2="Oasis") returned -1 [0097.041] lstrcmpA (lpString1="..", lpString2="Oasis") returned -1 [0097.041] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Maroon.css") returned="Maroon.css" [0097.041] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\", lpString2="Oasis" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis" [0097.041] lstrlenA (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis") returned 100 [0097.041] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\*.*", lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 0x5be1e0 [0097.042] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0097.042] FindNextFileA (in: hFindFile=0x5be1e0, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 1 [0097.042] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0097.042] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0097.042] FindNextFileA (in: hFindFile=0x5be1e0, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 1 [0097.042] PeekMessageA (in: lpMsg=0xaeb94, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaeb94) returned 0 [0097.042] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="HEADER.GIF") returned -1 [0097.042] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="HEADER.GIF") returned 1 [0097.042] lstrcmpiA (lpString1="", lpString2="HEADER.GIF") returned -1 [0097.042] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\*.*") returned="*.*" [0097.042] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\", lpString2="HEADER.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\HEADER.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\HEADER.GIF" [0097.042] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\HEADER.GIF", pszSpec="*.zip") returned 0 [0097.042] lstrlenA (lpString="*.zip") returned 5 [0097.042] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\HEADER.GIF", pszSpec="*.rar") returned 0 [0097.042] lstrlenA (lpString="*.rar") returned 5 [0097.042] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\HEADER.GIF", pszSpec="*.7z") returned 0 [0097.042] lstrlenA (lpString="*.7z") returned 4 [0097.042] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\HEADER.GIF", pszSpec="*.tar") returned 0 [0097.042] lstrlenA (lpString="*.tar") returned 5 [0097.042] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\HEADER.GIF", pszSpec="*.gzip") returned 0 [0097.043] lstrlenA (lpString="*.gzip") returned 6 [0097.043] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\HEADER.GIF", pszSpec="*.jpg") returned 0 [0097.043] lstrlenA (lpString="*.jpg") returned 5 [0097.043] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\HEADER.GIF", pszSpec="*.jpeg") returned 0 [0097.043] lstrlenA (lpString="*.jpeg") returned 6 [0097.043] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\HEADER.GIF", pszSpec="*.psd") returned 0 [0097.043] lstrlenA (lpString="*.psd") returned 5 [0097.043] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\HEADER.GIF", pszSpec="*.cdr") returned 0 [0097.043] lstrlenA (lpString="*.cdr") returned 5 [0097.043] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\HEADER.GIF", pszSpec="*.dwg") returned 0 [0097.043] lstrlenA (lpString="*.dwg") returned 5 [0097.043] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\HEADER.GIF", pszSpec="*.max") returned 0 [0097.043] lstrlenA (lpString="*.max") returned 5 [0097.043] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\HEADER.GIF", pszSpec="*.bmp") returned 0 [0097.043] lstrlenA (lpString="*.bmp") returned 5 [0097.043] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\HEADER.GIF", pszSpec="*.gif") returned 1 [0097.043] lstrlenA (lpString="*.gif") returned 5 [0097.043] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\HEADER.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\HEADER.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\HEADER.GIF" [0097.043] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\HEADER.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\HEADER.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\HEADER.GIF" [0097.043] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\HEADER.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\HEADER.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\HEADER.GIF." [0097.043] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\HEADER.GIF.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\HEADER.GIF. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\HEADER.GIF. " [0097.043] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\HEADER.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\oasis\\header.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0 [0097.044] GetFileSize (in: hFile=0xa0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x86c [0097.044] GetFileTime (in: hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xa042cc00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5969b6f0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xa042cc00, dwHighDateTime=0x1c747ea)) returned 1 [0097.044] SetFilePointer (in: hFile=0xa0, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0097.044] ReadFile (in: hFile=0xa0, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x812, lpOverlapped=0x0) returned 1 [0097.057] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\HEADER.GIF") returned="HEADER.GIF" [0097.057] SetFilePointer (in: hFile=0xa0, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0097.057] WriteFile (in: hFile=0xa0, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x812, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x812, lpOverlapped=0x0) returned 1 [0097.057] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0097.057] CloseHandle (hObject=0xa0) returned 1 [0097.057] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\HEADER.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\oasis\\header.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\HEADER.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\oasis\\header.gif. ")) returned 1 [0097.058] FindNextFileA (in: hFindFile=0x5be1e0, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 1 [0097.058] PeekMessageA (in: lpMsg=0xaeb94, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaeb94) returned 0 [0097.058] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="TAB_OFF.GIF") returned -1 [0097.058] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TAB_OFF.GIF") returned -1 [0097.058] lstrcmpiA (lpString1="", lpString2="TAB_OFF.GIF") returned -1 [0097.058] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\HEADER.GIF") returned="HEADER.GIF" [0097.058] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\", lpString2="TAB_OFF.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_OFF.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_OFF.GIF" [0097.058] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_OFF.GIF", pszSpec="*.zip") returned 0 [0097.058] lstrlenA (lpString="*.zip") returned 5 [0097.059] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_OFF.GIF", pszSpec="*.rar") returned 0 [0097.059] lstrlenA (lpString="*.rar") returned 5 [0097.059] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_OFF.GIF", pszSpec="*.7z") returned 0 [0097.059] lstrlenA (lpString="*.7z") returned 4 [0097.059] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_OFF.GIF", pszSpec="*.tar") returned 0 [0097.059] lstrlenA (lpString="*.tar") returned 5 [0097.059] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_OFF.GIF", pszSpec="*.gzip") returned 0 [0097.059] lstrlenA (lpString="*.gzip") returned 6 [0097.059] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_OFF.GIF", pszSpec="*.jpg") returned 0 [0097.059] lstrlenA (lpString="*.jpg") returned 5 [0097.059] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_OFF.GIF", pszSpec="*.jpeg") returned 0 [0097.059] lstrlenA (lpString="*.jpeg") returned 6 [0097.059] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_OFF.GIF", pszSpec="*.psd") returned 0 [0097.059] lstrlenA (lpString="*.psd") returned 5 [0097.059] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_OFF.GIF", pszSpec="*.cdr") returned 0 [0097.059] lstrlenA (lpString="*.cdr") returned 5 [0097.059] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_OFF.GIF", pszSpec="*.dwg") returned 0 [0097.059] lstrlenA (lpString="*.dwg") returned 5 [0097.059] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_OFF.GIF", pszSpec="*.max") returned 0 [0097.059] lstrlenA (lpString="*.max") returned 5 [0097.059] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_OFF.GIF", pszSpec="*.bmp") returned 0 [0097.059] lstrlenA (lpString="*.bmp") returned 5 [0097.059] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_OFF.GIF", pszSpec="*.gif") returned 1 [0097.059] lstrlenA (lpString="*.gif") returned 5 [0097.059] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_OFF.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_OFF.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_OFF.GIF" [0097.059] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_OFF.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_OFF.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_OFF.GIF" [0097.059] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_OFF.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_OFF.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_OFF.GIF." [0097.059] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_OFF.GIF.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_OFF.GIF. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_OFF.GIF. " [0097.059] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\oasis\\tab_off.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0 [0097.061] GetFileSize (in: hFile=0xa0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1f0 [0097.061] GetFileTime (in: hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xa042cc00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x6b22b3b0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xa042cc00, dwHighDateTime=0x1c747ea)) returned 1 [0097.061] SetFilePointer (in: hFile=0xa0, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0097.061] ReadFile (in: hFile=0xa0, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x196, lpOverlapped=0x0) returned 1 [0097.062] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_OFF.GIF") returned="TAB_OFF.GIF" [0097.062] SetFilePointer (in: hFile=0xa0, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0097.062] WriteFile (in: hFile=0xa0, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x196, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x196, lpOverlapped=0x0) returned 1 [0097.062] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0097.062] CloseHandle (hObject=0xa0) returned 1 [0097.062] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\oasis\\tab_off.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_OFF.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\oasis\\tab_off.gif. ")) returned 1 [0097.063] FindNextFileA (in: hFindFile=0x5be1e0, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 1 [0097.063] PeekMessageA (in: lpMsg=0xaeb94, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaeb94) returned 0 [0097.063] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="TAB_ON.GIF") returned -1 [0097.063] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TAB_ON.GIF") returned -1 [0097.063] lstrcmpiA (lpString1="", lpString2="TAB_ON.GIF") returned -1 [0097.063] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_OFF.GIF") returned="TAB_OFF.GIF" [0097.063] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\", lpString2="TAB_ON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_ON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_ON.GIF" [0097.063] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_ON.GIF", pszSpec="*.zip") returned 0 [0097.063] lstrlenA (lpString="*.zip") returned 5 [0097.063] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_ON.GIF", pszSpec="*.rar") returned 0 [0097.063] lstrlenA (lpString="*.rar") returned 5 [0097.063] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_ON.GIF", pszSpec="*.7z") returned 0 [0097.063] lstrlenA (lpString="*.7z") returned 4 [0097.063] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_ON.GIF", pszSpec="*.tar") returned 0 [0097.063] lstrlenA (lpString="*.tar") returned 5 [0097.063] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_ON.GIF", pszSpec="*.gzip") returned 0 [0097.063] lstrlenA (lpString="*.gzip") returned 6 [0097.063] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_ON.GIF", pszSpec="*.jpg") returned 0 [0097.063] lstrlenA (lpString="*.jpg") returned 5 [0097.063] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_ON.GIF", pszSpec="*.jpeg") returned 0 [0097.063] lstrlenA (lpString="*.jpeg") returned 6 [0097.063] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_ON.GIF", pszSpec="*.psd") returned 0 [0097.063] lstrlenA (lpString="*.psd") returned 5 [0097.063] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_ON.GIF", pszSpec="*.cdr") returned 0 [0097.063] lstrlenA (lpString="*.cdr") returned 5 [0097.063] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_ON.GIF", pszSpec="*.dwg") returned 0 [0097.063] lstrlenA (lpString="*.dwg") returned 5 [0097.063] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_ON.GIF", pszSpec="*.max") returned 0 [0097.063] lstrlenA (lpString="*.max") returned 5 [0097.063] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_ON.GIF", pszSpec="*.bmp") returned 0 [0097.063] lstrlenA (lpString="*.bmp") returned 5 [0097.063] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_ON.GIF", pszSpec="*.gif") returned 1 [0097.063] lstrlenA (lpString="*.gif") returned 5 [0097.064] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_ON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_ON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_ON.GIF" [0097.064] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_ON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_ON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_ON.GIF" [0097.064] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_ON.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_ON.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_ON.GIF." [0097.064] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_ON.GIF.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_ON.GIF. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_ON.GIF. " [0097.064] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\oasis\\tab_on.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0 [0097.064] GetFileSize (in: hFile=0xa0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x401 [0097.064] GetFileTime (in: hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xa042cc00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5969b6f0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xa042cc00, dwHighDateTime=0x1c747ea)) returned 1 [0097.064] SetFilePointer (in: hFile=0xa0, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0097.064] ReadFile (in: hFile=0xa0, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x3a7, lpOverlapped=0x0) returned 1 [0097.066] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_ON.GIF") returned="TAB_ON.GIF" [0097.066] SetFilePointer (in: hFile=0xa0, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0097.066] WriteFile (in: hFile=0xa0, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x3a7, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x3a7, lpOverlapped=0x0) returned 1 [0097.066] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0097.066] CloseHandle (hObject=0xa0) returned 1 [0097.066] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\oasis\\tab_on.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_ON.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\oasis\\tab_on.gif. ")) returned 1 [0097.067] FindNextFileA (in: hFindFile=0x5be1e0, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 0 [0097.067] FindClose (in: hFindFile=0x5be1e0 | out: hFindFile=0x5be1e0) returned 1 [0097.067] FindNextFileA (in: hFindFile=0x5be1a0, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0097.067] PeekMessageA (in: lpMsg=0xaece4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaece4) returned 0 [0097.067] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Oasis.css") returned -1 [0097.067] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Oasis.css") returned -1 [0097.067] lstrcmpiA (lpString1="", lpString2="Oasis.css") returned -1 [0097.067] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\*.*") returned="*.*" [0097.067] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\", lpString2="Oasis.css" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis.css") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis.css" [0097.067] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis.css", pszSpec="*.zip") returned 0 [0097.067] lstrlenA (lpString="*.zip") returned 5 [0097.067] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis.css", pszSpec="*.rar") returned 0 [0097.067] lstrlenA (lpString="*.rar") returned 5 [0097.067] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis.css", pszSpec="*.7z") returned 0 [0097.067] lstrlenA (lpString="*.7z") returned 4 [0097.068] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis.css", pszSpec="*.tar") returned 0 [0097.068] lstrlenA (lpString="*.tar") returned 5 [0097.068] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis.css", pszSpec="*.gzip") returned 0 [0097.068] lstrlenA (lpString="*.gzip") returned 6 [0097.068] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis.css", pszSpec="*.jpg") returned 0 [0097.068] lstrlenA (lpString="*.jpg") returned 5 [0097.068] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis.css", pszSpec="*.jpeg") returned 0 [0097.068] lstrlenA (lpString="*.jpeg") returned 6 [0097.068] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis.css", pszSpec="*.psd") returned 0 [0097.068] lstrlenA (lpString="*.psd") returned 5 [0097.068] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis.css", pszSpec="*.cdr") returned 0 [0097.068] lstrlenA (lpString="*.cdr") returned 5 [0097.068] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis.css", pszSpec="*.dwg") returned 0 [0097.068] lstrlenA (lpString="*.dwg") returned 5 [0097.068] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis.css", pszSpec="*.max") returned 0 [0097.068] lstrlenA (lpString="*.max") returned 5 [0097.068] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis.css", pszSpec="*.bmp") returned 0 [0097.068] lstrlenA (lpString="*.bmp") returned 5 [0097.068] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis.css", pszSpec="*.gif") returned 0 [0097.068] lstrlenA (lpString="*.gif") returned 5 [0097.068] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis.css", pszSpec="*.png") returned 0 [0097.068] lstrlenA (lpString="*.png") returned 5 [0097.068] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis.css", pszSpec="*.doc") returned 0 [0097.068] lstrlenA (lpString="*.doc") returned 5 [0097.068] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis.css", pszSpec="*.docx") returned 0 [0097.068] lstrlenA (lpString="*.docx") returned 6 [0097.068] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis.css", pszSpec="*.xls") returned 0 [0097.068] lstrlenA (lpString="*.xls") returned 5 [0097.068] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis.css", pszSpec="*.xlsx") returned 0 [0097.068] lstrlenA (lpString="*.xlsx") returned 6 [0097.068] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis.css", pszSpec="*.ppt") returned 0 [0097.068] lstrlenA (lpString="*.ppt") returned 5 [0097.068] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis.css", pszSpec="*.pptx") returned 0 [0097.068] lstrlenA (lpString="*.pptx") returned 6 [0097.068] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis.css", pszSpec="*.txt") returned 0 [0097.068] lstrlenA (lpString="*.txt") returned 5 [0097.068] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis.css", pszSpec="*.pdf") returned 0 [0097.068] lstrlenA (lpString="*.pdf") returned 5 [0097.068] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis.css", pszSpec="*.djvu") returned 0 [0097.068] lstrlenA (lpString="*.djvu") returned 6 [0097.068] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis.css", pszSpec="*.htm") returned 0 [0097.068] lstrlenA (lpString="*.htm") returned 5 [0097.068] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis.css", pszSpec="*.html") returned 0 [0097.068] lstrlenA (lpString="*.html") returned 6 [0097.068] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis.css", pszSpec="*.mdb") returned 0 [0097.068] lstrlenA (lpString="*.mdb") returned 5 [0097.068] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis.css", pszSpec="*.cer") returned 0 [0097.068] lstrlenA (lpString="*.cer") returned 5 [0097.068] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis.css", pszSpec="*.p12") returned 0 [0097.069] lstrlenA (lpString="*.p12") returned 5 [0097.069] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis.css", pszSpec="*.pfx") returned 0 [0097.069] lstrlenA (lpString="*.pfx") returned 5 [0097.069] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis.css", pszSpec="*.kwm") returned 0 [0097.069] lstrlenA (lpString="*.kwm") returned 5 [0097.069] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis.css", pszSpec="*.pwm") returned 0 [0097.069] lstrlenA (lpString="*.pwm") returned 5 [0097.069] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis.css", pszSpec="*.1cd") returned 0 [0097.069] lstrlenA (lpString="*.1cd") returned 5 [0097.069] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis.css", pszSpec="*.md") returned 0 [0097.069] lstrlenA (lpString="*.md") returned 4 [0097.069] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis.css", pszSpec="*.mdf") returned 0 [0097.069] lstrlenA (lpString="*.mdf") returned 5 [0097.069] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis.css", pszSpec="*.dbf") returned 0 [0097.069] lstrlenA (lpString="*.dbf") returned 5 [0097.069] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis.css", pszSpec="*.odt") returned 0 [0097.069] lstrlenA (lpString="*.odt") returned 5 [0097.069] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis.css", pszSpec="*.vob") returned 0 [0097.069] lstrlenA (lpString="*.vob") returned 5 [0097.069] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis.css", pszSpec="*.ifo") returned 0 [0097.069] lstrlenA (lpString="*.ifo") returned 5 [0097.069] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis.css", pszSpec="*.lnk") returned 0 [0097.069] lstrlenA (lpString="*.lnk") returned 5 [0097.069] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis.css", pszSpec="*.torrent") returned 0 [0097.069] lstrlenA (lpString="*.torrent") returned 9 [0097.069] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis.css", pszSpec="*.mov") returned 0 [0097.069] lstrlenA (lpString="*.mov") returned 5 [0097.069] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis.css", pszSpec="*.m2v") returned 0 [0097.069] lstrlenA (lpString="*.m2v") returned 5 [0097.069] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis.css", pszSpec="*.3gp") returned 0 [0097.069] lstrlenA (lpString="*.3gp") returned 5 [0097.069] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis.css", pszSpec="*.mpeg") returned 0 [0097.069] lstrlenA (lpString="*.mpeg") returned 6 [0097.069] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis.css", pszSpec="*.mpg") returned 0 [0097.069] lstrlenA (lpString="*.mpg") returned 5 [0097.069] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis.css", pszSpec="*.flv") returned 0 [0097.069] lstrlenA (lpString="*.flv") returned 5 [0097.069] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis.css", pszSpec="*.avi") returned 0 [0097.069] lstrlenA (lpString="*.avi") returned 5 [0097.069] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis.css", pszSpec="*.mp4") returned 0 [0097.069] lstrlenA (lpString="*.mp4") returned 5 [0097.069] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis.css", pszSpec="*.wmv") returned 0 [0097.069] lstrlenA (lpString="*.wmv") returned 5 [0097.069] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis.css", pszSpec="*.divx") returned 0 [0097.069] lstrlenA (lpString="*.divx") returned 6 [0097.069] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis.css", pszSpec="*.mkv") returned 0 [0097.069] lstrlenA (lpString="*.mkv") returned 5 [0097.069] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis.css", pszSpec="*.mp3") returned 0 [0097.070] lstrlenA (lpString="*.mp3") returned 5 [0097.070] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis.css", pszSpec="*.wav") returned 0 [0097.070] lstrlenA (lpString="*.wav") returned 5 [0097.070] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis.css", pszSpec="*.flac") returned 0 [0097.070] lstrlenA (lpString="*.flac") returned 6 [0097.070] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis.css", pszSpec="*.ape") returned 0 [0097.070] lstrlenA (lpString="*.ape") returned 5 [0097.070] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis.css", pszSpec="*.wma") returned 0 [0097.070] lstrlenA (lpString="*.wma") returned 5 [0097.070] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis.css", pszSpec="*.ac3") returned 0 [0097.070] lstrlenA (lpString="*.ac3") returned 5 [0097.070] FindNextFileA (in: hFindFile=0x5be1a0, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0097.070] PeekMessageA (in: lpMsg=0xaece4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaece4) returned 0 [0097.070] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="OliveGreen.css") returned -1 [0097.070] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OliveGreen.css") returned -1 [0097.070] lstrcmpiA (lpString1="", lpString2="OliveGreen.css") returned -1 [0097.070] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis.css") returned="Oasis.css" [0097.070] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\", lpString2="OliveGreen.css" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\OliveGreen.css") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\OliveGreen.css" [0097.070] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\OliveGreen.css", pszSpec="*.zip") returned 0 [0097.070] lstrlenA (lpString="*.zip") returned 5 [0097.070] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\OliveGreen.css", pszSpec="*.rar") returned 0 [0097.070] lstrlenA (lpString="*.rar") returned 5 [0097.070] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\OliveGreen.css", pszSpec="*.7z") returned 0 [0097.070] lstrlenA (lpString="*.7z") returned 4 [0097.070] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\OliveGreen.css", pszSpec="*.tar") returned 0 [0097.070] lstrlenA (lpString="*.tar") returned 5 [0097.070] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\OliveGreen.css", pszSpec="*.gzip") returned 0 [0097.070] lstrlenA (lpString="*.gzip") returned 6 [0097.070] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\OliveGreen.css", pszSpec="*.jpg") returned 0 [0097.070] lstrlenA (lpString="*.jpg") returned 5 [0097.070] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\OliveGreen.css", pszSpec="*.jpeg") returned 0 [0097.070] lstrlenA (lpString="*.jpeg") returned 6 [0097.070] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\OliveGreen.css", pszSpec="*.psd") returned 0 [0097.070] lstrlenA (lpString="*.psd") returned 5 [0097.070] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\OliveGreen.css", pszSpec="*.cdr") returned 0 [0097.070] lstrlenA (lpString="*.cdr") returned 5 [0097.070] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\OliveGreen.css", pszSpec="*.dwg") returned 0 [0097.070] lstrlenA (lpString="*.dwg") returned 5 [0097.070] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\OliveGreen.css", pszSpec="*.max") returned 0 [0097.070] lstrlenA (lpString="*.max") returned 5 [0097.070] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\OliveGreen.css", pszSpec="*.bmp") returned 0 [0097.070] lstrlenA (lpString="*.bmp") returned 5 [0097.070] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\OliveGreen.css", pszSpec="*.gif") returned 0 [0097.070] lstrlenA (lpString="*.gif") returned 5 [0097.070] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\OliveGreen.css", pszSpec="*.png") returned 0 [0097.070] lstrlenA (lpString="*.png") returned 5 [0097.070] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\OliveGreen.css", pszSpec="*.doc") returned 0 [0097.070] lstrlenA (lpString="*.doc") returned 5 [0097.071] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\OliveGreen.css", pszSpec="*.docx") returned 0 [0097.071] lstrlenA (lpString="*.docx") returned 6 [0097.071] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\OliveGreen.css", pszSpec="*.xls") returned 0 [0097.071] lstrlenA (lpString="*.xls") returned 5 [0097.071] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\OliveGreen.css", pszSpec="*.xlsx") returned 0 [0097.071] lstrlenA (lpString="*.xlsx") returned 6 [0097.071] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\OliveGreen.css", pszSpec="*.ppt") returned 0 [0097.071] lstrlenA (lpString="*.ppt") returned 5 [0097.071] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\OliveGreen.css", pszSpec="*.pptx") returned 0 [0097.071] lstrlenA (lpString="*.pptx") returned 6 [0097.071] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\OliveGreen.css", pszSpec="*.txt") returned 0 [0097.071] lstrlenA (lpString="*.txt") returned 5 [0097.071] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\OliveGreen.css", pszSpec="*.pdf") returned 0 [0097.071] lstrlenA (lpString="*.pdf") returned 5 [0097.071] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\OliveGreen.css", pszSpec="*.djvu") returned 0 [0097.071] lstrlenA (lpString="*.djvu") returned 6 [0097.071] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\OliveGreen.css", pszSpec="*.htm") returned 0 [0097.071] lstrlenA (lpString="*.htm") returned 5 [0097.071] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\OliveGreen.css", pszSpec="*.html") returned 0 [0097.071] lstrlenA (lpString="*.html") returned 6 [0097.071] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\OliveGreen.css", pszSpec="*.mdb") returned 0 [0097.071] lstrlenA (lpString="*.mdb") returned 5 [0097.071] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\OliveGreen.css", pszSpec="*.cer") returned 0 [0097.071] lstrlenA (lpString="*.cer") returned 5 [0097.071] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\OliveGreen.css", pszSpec="*.p12") returned 0 [0097.071] lstrlenA (lpString="*.p12") returned 5 [0097.071] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\OliveGreen.css", pszSpec="*.pfx") returned 0 [0097.071] lstrlenA (lpString="*.pfx") returned 5 [0097.071] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\OliveGreen.css", pszSpec="*.kwm") returned 0 [0097.071] lstrlenA (lpString="*.kwm") returned 5 [0097.071] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\OliveGreen.css", pszSpec="*.pwm") returned 0 [0097.071] lstrlenA (lpString="*.pwm") returned 5 [0097.071] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\OliveGreen.css", pszSpec="*.1cd") returned 0 [0097.071] lstrlenA (lpString="*.1cd") returned 5 [0097.071] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\OliveGreen.css", pszSpec="*.md") returned 0 [0097.071] lstrlenA (lpString="*.md") returned 4 [0097.071] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\OliveGreen.css", pszSpec="*.mdf") returned 0 [0097.071] lstrlenA (lpString="*.mdf") returned 5 [0097.071] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\OliveGreen.css", pszSpec="*.dbf") returned 0 [0097.071] lstrlenA (lpString="*.dbf") returned 5 [0097.071] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\OliveGreen.css", pszSpec="*.odt") returned 0 [0097.071] lstrlenA (lpString="*.odt") returned 5 [0097.071] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\OliveGreen.css", pszSpec="*.vob") returned 0 [0097.071] lstrlenA (lpString="*.vob") returned 5 [0097.071] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\OliveGreen.css", pszSpec="*.ifo") returned 0 [0097.071] lstrlenA (lpString="*.ifo") returned 5 [0097.071] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\OliveGreen.css", pszSpec="*.lnk") returned 0 [0097.071] lstrlenA (lpString="*.lnk") returned 5 [0097.071] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\OliveGreen.css", pszSpec="*.torrent") returned 0 [0097.071] lstrlenA (lpString="*.torrent") returned 9 [0097.072] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\OliveGreen.css", pszSpec="*.mov") returned 0 [0097.072] lstrlenA (lpString="*.mov") returned 5 [0097.072] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\OliveGreen.css", pszSpec="*.m2v") returned 0 [0097.072] lstrlenA (lpString="*.m2v") returned 5 [0097.072] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\OliveGreen.css", pszSpec="*.3gp") returned 0 [0097.072] lstrlenA (lpString="*.3gp") returned 5 [0097.072] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\OliveGreen.css", pszSpec="*.mpeg") returned 0 [0097.072] lstrlenA (lpString="*.mpeg") returned 6 [0097.072] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\OliveGreen.css", pszSpec="*.mpg") returned 0 [0097.072] lstrlenA (lpString="*.mpg") returned 5 [0097.072] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\OliveGreen.css", pszSpec="*.flv") returned 0 [0097.072] lstrlenA (lpString="*.flv") returned 5 [0097.072] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\OliveGreen.css", pszSpec="*.avi") returned 0 [0097.072] lstrlenA (lpString="*.avi") returned 5 [0097.072] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\OliveGreen.css", pszSpec="*.mp4") returned 0 [0097.072] lstrlenA (lpString="*.mp4") returned 5 [0097.072] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\OliveGreen.css", pszSpec="*.wmv") returned 0 [0097.072] lstrlenA (lpString="*.wmv") returned 5 [0097.072] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\OliveGreen.css", pszSpec="*.divx") returned 0 [0097.072] lstrlenA (lpString="*.divx") returned 6 [0097.072] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\OliveGreen.css", pszSpec="*.mkv") returned 0 [0097.072] lstrlenA (lpString="*.mkv") returned 5 [0097.072] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\OliveGreen.css", pszSpec="*.mp3") returned 0 [0097.072] lstrlenA (lpString="*.mp3") returned 5 [0097.072] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\OliveGreen.css", pszSpec="*.wav") returned 0 [0097.072] lstrlenA (lpString="*.wav") returned 5 [0097.072] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\OliveGreen.css", pszSpec="*.flac") returned 0 [0097.072] lstrlenA (lpString="*.flac") returned 6 [0097.072] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\OliveGreen.css", pszSpec="*.ape") returned 0 [0097.072] lstrlenA (lpString="*.ape") returned 5 [0097.072] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\OliveGreen.css", pszSpec="*.wma") returned 0 [0097.072] lstrlenA (lpString="*.wma") returned 5 [0097.072] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\OliveGreen.css", pszSpec="*.ac3") returned 0 [0097.072] lstrlenA (lpString="*.ac3") returned 5 [0097.072] FindNextFileA (in: hFindFile=0x5be1a0, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0097.072] PeekMessageA (in: lpMsg=0xaece4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaece4) returned 0 [0097.072] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Premium.css") returned -1 [0097.072] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Premium.css") returned -1 [0097.072] lstrcmpiA (lpString1="", lpString2="Premium.css") returned -1 [0097.072] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\OliveGreen.css") returned="OliveGreen.css" [0097.072] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\", lpString2="Premium.css" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Premium.css") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Premium.css" [0097.072] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Premium.css", pszSpec="*.zip") returned 0 [0097.072] lstrlenA (lpString="*.zip") returned 5 [0097.072] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Premium.css", pszSpec="*.rar") returned 0 [0097.072] lstrlenA (lpString="*.rar") returned 5 [0097.072] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Premium.css", pszSpec="*.7z") returned 0 [0097.072] lstrlenA (lpString="*.7z") returned 4 [0097.072] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Premium.css", pszSpec="*.tar") returned 0 [0097.072] lstrlenA (lpString="*.tar") returned 5 [0097.073] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Premium.css", pszSpec="*.gzip") returned 0 [0097.073] lstrlenA (lpString="*.gzip") returned 6 [0097.073] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Premium.css", pszSpec="*.jpg") returned 0 [0097.073] lstrlenA (lpString="*.jpg") returned 5 [0097.073] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Premium.css", pszSpec="*.jpeg") returned 0 [0097.073] lstrlenA (lpString="*.jpeg") returned 6 [0097.073] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Premium.css", pszSpec="*.psd") returned 0 [0097.073] lstrlenA (lpString="*.psd") returned 5 [0097.073] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Premium.css", pszSpec="*.cdr") returned 0 [0097.073] lstrlenA (lpString="*.cdr") returned 5 [0097.073] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Premium.css", pszSpec="*.dwg") returned 0 [0097.073] lstrlenA (lpString="*.dwg") returned 5 [0097.073] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Premium.css", pszSpec="*.max") returned 0 [0097.073] lstrlenA (lpString="*.max") returned 5 [0097.073] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Premium.css", pszSpec="*.bmp") returned 0 [0097.073] lstrlenA (lpString="*.bmp") returned 5 [0097.073] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Premium.css", pszSpec="*.gif") returned 0 [0097.073] lstrlenA (lpString="*.gif") returned 5 [0097.073] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Premium.css", pszSpec="*.png") returned 0 [0097.073] lstrlenA (lpString="*.png") returned 5 [0097.073] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Premium.css", pszSpec="*.doc") returned 0 [0097.073] lstrlenA (lpString="*.doc") returned 5 [0097.073] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Premium.css", pszSpec="*.docx") returned 0 [0097.073] lstrlenA (lpString="*.docx") returned 6 [0097.073] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Premium.css", pszSpec="*.xls") returned 0 [0097.073] lstrlenA (lpString="*.xls") returned 5 [0097.073] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Premium.css", pszSpec="*.xlsx") returned 0 [0097.073] lstrlenA (lpString="*.xlsx") returned 6 [0097.073] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Premium.css", pszSpec="*.ppt") returned 0 [0097.073] lstrlenA (lpString="*.ppt") returned 5 [0097.073] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Premium.css", pszSpec="*.pptx") returned 0 [0097.073] lstrlenA (lpString="*.pptx") returned 6 [0097.073] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Premium.css", pszSpec="*.txt") returned 0 [0097.073] lstrlenA (lpString="*.txt") returned 5 [0097.073] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Premium.css", pszSpec="*.pdf") returned 0 [0097.073] lstrlenA (lpString="*.pdf") returned 5 [0097.073] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Premium.css", pszSpec="*.djvu") returned 0 [0097.073] lstrlenA (lpString="*.djvu") returned 6 [0097.073] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Premium.css", pszSpec="*.htm") returned 0 [0097.073] lstrlenA (lpString="*.htm") returned 5 [0097.073] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Premium.css", pszSpec="*.html") returned 0 [0097.073] lstrlenA (lpString="*.html") returned 6 [0097.073] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Premium.css", pszSpec="*.mdb") returned 0 [0097.073] lstrlenA (lpString="*.mdb") returned 5 [0097.073] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Premium.css", pszSpec="*.cer") returned 0 [0097.073] lstrlenA (lpString="*.cer") returned 5 [0097.073] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Premium.css", pszSpec="*.p12") returned 0 [0097.073] lstrlenA (lpString="*.p12") returned 5 [0097.073] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Premium.css", pszSpec="*.pfx") returned 0 [0097.073] lstrlenA (lpString="*.pfx") returned 5 [0097.074] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Premium.css", pszSpec="*.kwm") returned 0 [0097.074] lstrlenA (lpString="*.kwm") returned 5 [0097.074] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Premium.css", pszSpec="*.pwm") returned 0 [0097.074] lstrlenA (lpString="*.pwm") returned 5 [0097.074] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Premium.css", pszSpec="*.1cd") returned 0 [0097.074] lstrlenA (lpString="*.1cd") returned 5 [0097.074] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Premium.css", pszSpec="*.md") returned 0 [0097.074] lstrlenA (lpString="*.md") returned 4 [0097.074] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Premium.css", pszSpec="*.mdf") returned 0 [0097.074] lstrlenA (lpString="*.mdf") returned 5 [0097.074] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Premium.css", pszSpec="*.dbf") returned 0 [0097.074] lstrlenA (lpString="*.dbf") returned 5 [0097.074] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Premium.css", pszSpec="*.odt") returned 0 [0097.074] lstrlenA (lpString="*.odt") returned 5 [0097.074] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Premium.css", pszSpec="*.vob") returned 0 [0097.074] lstrlenA (lpString="*.vob") returned 5 [0097.074] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Premium.css", pszSpec="*.ifo") returned 0 [0097.074] lstrlenA (lpString="*.ifo") returned 5 [0097.074] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Premium.css", pszSpec="*.lnk") returned 0 [0097.074] lstrlenA (lpString="*.lnk") returned 5 [0097.074] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Premium.css", pszSpec="*.torrent") returned 0 [0097.074] lstrlenA (lpString="*.torrent") returned 9 [0097.074] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Premium.css", pszSpec="*.mov") returned 0 [0097.074] lstrlenA (lpString="*.mov") returned 5 [0097.074] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Premium.css", pszSpec="*.m2v") returned 0 [0097.074] lstrlenA (lpString="*.m2v") returned 5 [0097.074] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Premium.css", pszSpec="*.3gp") returned 0 [0097.074] lstrlenA (lpString="*.3gp") returned 5 [0097.074] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Premium.css", pszSpec="*.mpeg") returned 0 [0097.074] lstrlenA (lpString="*.mpeg") returned 6 [0097.074] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Premium.css", pszSpec="*.mpg") returned 0 [0097.074] lstrlenA (lpString="*.mpg") returned 5 [0097.074] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Premium.css", pszSpec="*.flv") returned 0 [0097.074] lstrlenA (lpString="*.flv") returned 5 [0097.074] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Premium.css", pszSpec="*.avi") returned 0 [0097.074] lstrlenA (lpString="*.avi") returned 5 [0097.074] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Premium.css", pszSpec="*.mp4") returned 0 [0097.074] lstrlenA (lpString="*.mp4") returned 5 [0097.074] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Premium.css", pszSpec="*.wmv") returned 0 [0097.074] lstrlenA (lpString="*.wmv") returned 5 [0097.074] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Premium.css", pszSpec="*.divx") returned 0 [0097.074] lstrlenA (lpString="*.divx") returned 6 [0097.074] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Premium.css", pszSpec="*.mkv") returned 0 [0097.074] lstrlenA (lpString="*.mkv") returned 5 [0097.074] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Premium.css", pszSpec="*.mp3") returned 0 [0097.074] lstrlenA (lpString="*.mp3") returned 5 [0097.074] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Premium.css", pszSpec="*.wav") returned 0 [0097.075] lstrlenA (lpString="*.wav") returned 5 [0097.075] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Premium.css", pszSpec="*.flac") returned 0 [0097.075] lstrlenA (lpString="*.flac") returned 6 [0097.075] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Premium.css", pszSpec="*.ape") returned 0 [0097.075] lstrlenA (lpString="*.ape") returned 5 [0097.075] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Premium.css", pszSpec="*.wma") returned 0 [0097.075] lstrlenA (lpString="*.wma") returned 5 [0097.075] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Premium.css", pszSpec="*.ac3") returned 0 [0097.075] lstrlenA (lpString="*.ac3") returned 5 [0097.075] FindNextFileA (in: hFindFile=0x5be1a0, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0097.075] lstrcmpA (lpString1=".", lpString2="Slate") returned -1 [0097.075] lstrcmpA (lpString1="..", lpString2="Slate") returned -1 [0097.075] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Premium.css") returned="Premium.css" [0097.075] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\", lpString2="Slate" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate" [0097.075] lstrlenA (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate") returned 100 [0097.075] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\*.*", lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 0x5be1e0 [0097.076] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0097.076] FindNextFileA (in: hFindFile=0x5be1e0, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 1 [0097.076] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0097.076] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0097.076] FindNextFileA (in: hFindFile=0x5be1e0, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 1 [0097.076] PeekMessageA (in: lpMsg=0xaeb94, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaeb94) returned 0 [0097.076] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="TAB_OFF.GIF") returned -1 [0097.076] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TAB_OFF.GIF") returned -1 [0097.076] lstrcmpiA (lpString1="", lpString2="TAB_OFF.GIF") returned -1 [0097.076] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\*.*") returned="*.*" [0097.076] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\", lpString2="TAB_OFF.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_OFF.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_OFF.GIF" [0097.076] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_OFF.GIF", pszSpec="*.zip") returned 0 [0097.076] lstrlenA (lpString="*.zip") returned 5 [0097.076] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_OFF.GIF", pszSpec="*.rar") returned 0 [0097.076] lstrlenA (lpString="*.rar") returned 5 [0097.076] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_OFF.GIF", pszSpec="*.7z") returned 0 [0097.076] lstrlenA (lpString="*.7z") returned 4 [0097.077] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_OFF.GIF", pszSpec="*.tar") returned 0 [0097.077] lstrlenA (lpString="*.tar") returned 5 [0097.077] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_OFF.GIF", pszSpec="*.gzip") returned 0 [0097.077] lstrlenA (lpString="*.gzip") returned 6 [0097.077] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_OFF.GIF", pszSpec="*.jpg") returned 0 [0097.077] lstrlenA (lpString="*.jpg") returned 5 [0097.077] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_OFF.GIF", pszSpec="*.jpeg") returned 0 [0097.077] lstrlenA (lpString="*.jpeg") returned 6 [0097.077] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_OFF.GIF", pszSpec="*.psd") returned 0 [0097.077] lstrlenA (lpString="*.psd") returned 5 [0097.077] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_OFF.GIF", pszSpec="*.cdr") returned 0 [0097.077] lstrlenA (lpString="*.cdr") returned 5 [0097.077] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_OFF.GIF", pszSpec="*.dwg") returned 0 [0097.077] lstrlenA (lpString="*.dwg") returned 5 [0097.077] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_OFF.GIF", pszSpec="*.max") returned 0 [0097.077] lstrlenA (lpString="*.max") returned 5 [0097.077] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_OFF.GIF", pszSpec="*.bmp") returned 0 [0097.077] lstrlenA (lpString="*.bmp") returned 5 [0097.077] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_OFF.GIF", pszSpec="*.gif") returned 1 [0097.077] lstrlenA (lpString="*.gif") returned 5 [0097.077] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_OFF.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_OFF.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_OFF.GIF" [0097.077] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_OFF.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_OFF.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_OFF.GIF" [0097.077] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_OFF.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_OFF.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_OFF.GIF." [0097.077] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_OFF.GIF.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_OFF.GIF. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_OFF.GIF. " [0097.077] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\slate\\tab_off.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0 [0097.079] GetFileSize (in: hFile=0xa0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x16c [0097.079] GetFileTime (in: hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xa173f900, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x6d2e6230, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xa173f900, dwHighDateTime=0x1c747ea)) returned 1 [0097.079] SetFilePointer (in: hFile=0xa0, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0097.079] ReadFile (in: hFile=0xa0, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x112, lpOverlapped=0x0) returned 1 [0097.080] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_OFF.GIF") returned="TAB_OFF.GIF" [0097.080] SetFilePointer (in: hFile=0xa0, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0097.080] WriteFile (in: hFile=0xa0, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x112, lpOverlapped=0x0) returned 1 [0097.080] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0097.080] CloseHandle (hObject=0xa0) returned 1 [0097.081] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\slate\\tab_off.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_OFF.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\slate\\tab_off.gif. ")) returned 1 [0097.082] FindNextFileA (in: hFindFile=0x5be1e0, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 1 [0097.082] PeekMessageA (in: lpMsg=0xaeb94, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaeb94) returned 0 [0097.082] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="TAB_ON.GIF") returned -1 [0097.082] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TAB_ON.GIF") returned -1 [0097.082] lstrcmpiA (lpString1="", lpString2="TAB_ON.GIF") returned -1 [0097.082] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_OFF.GIF") returned="TAB_OFF.GIF" [0097.082] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\", lpString2="TAB_ON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_ON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_ON.GIF" [0097.082] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_ON.GIF", pszSpec="*.zip") returned 0 [0097.082] lstrlenA (lpString="*.zip") returned 5 [0097.082] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_ON.GIF", pszSpec="*.rar") returned 0 [0097.082] lstrlenA (lpString="*.rar") returned 5 [0097.082] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_ON.GIF", pszSpec="*.7z") returned 0 [0097.082] lstrlenA (lpString="*.7z") returned 4 [0097.082] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_ON.GIF", pszSpec="*.tar") returned 0 [0097.082] lstrlenA (lpString="*.tar") returned 5 [0097.082] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_ON.GIF", pszSpec="*.gzip") returned 0 [0097.082] lstrlenA (lpString="*.gzip") returned 6 [0097.082] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_ON.GIF", pszSpec="*.jpg") returned 0 [0097.082] lstrlenA (lpString="*.jpg") returned 5 [0097.082] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_ON.GIF", pszSpec="*.jpeg") returned 0 [0097.082] lstrlenA (lpString="*.jpeg") returned 6 [0097.082] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_ON.GIF", pszSpec="*.psd") returned 0 [0097.082] lstrlenA (lpString="*.psd") returned 5 [0097.082] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_ON.GIF", pszSpec="*.cdr") returned 0 [0097.082] lstrlenA (lpString="*.cdr") returned 5 [0097.082] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_ON.GIF", pszSpec="*.dwg") returned 0 [0097.082] lstrlenA (lpString="*.dwg") returned 5 [0097.082] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_ON.GIF", pszSpec="*.max") returned 0 [0097.082] lstrlenA (lpString="*.max") returned 5 [0097.082] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_ON.GIF", pszSpec="*.bmp") returned 0 [0097.082] lstrlenA (lpString="*.bmp") returned 5 [0097.083] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_ON.GIF", pszSpec="*.gif") returned 1 [0097.083] lstrlenA (lpString="*.gif") returned 5 [0097.083] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_ON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_ON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_ON.GIF" [0097.083] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_ON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_ON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_ON.GIF" [0097.083] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_ON.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_ON.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_ON.GIF." [0097.083] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_ON.GIF.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_ON.GIF. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_ON.GIF. " [0097.083] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\slate\\tab_on.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0 [0097.083] GetFileSize (in: hFile=0xa0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x16c [0097.084] GetFileTime (in: hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xa173f900, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5a9f29b0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xa173f900, dwHighDateTime=0x1c747ea)) returned 1 [0097.084] SetFilePointer (in: hFile=0xa0, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0097.084] ReadFile (in: hFile=0xa0, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x112, lpOverlapped=0x0) returned 1 [0097.084] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_ON.GIF") returned="TAB_ON.GIF" [0097.085] SetFilePointer (in: hFile=0xa0, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0097.085] WriteFile (in: hFile=0xa0, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x112, lpOverlapped=0x0) returned 1 [0097.085] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0097.085] CloseHandle (hObject=0xa0) returned 1 [0097.085] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\slate\\tab_on.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_ON.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\slate\\tab_on.gif. ")) returned 1 [0097.086] FindNextFileA (in: hFindFile=0x5be1e0, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 0 [0097.086] FindClose (in: hFindFile=0x5be1e0 | out: hFindFile=0x5be1e0) returned 1 [0097.086] FindNextFileA (in: hFindFile=0x5be1a0, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0097.086] PeekMessageA (in: lpMsg=0xaece4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaece4) returned 0 [0097.086] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Slate.css") returned -1 [0097.086] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Slate.css") returned -1 [0097.086] lstrcmpiA (lpString1="", lpString2="Slate.css") returned -1 [0097.086] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\*.*") returned="*.*" [0097.086] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\", lpString2="Slate.css" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate.css") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate.css" [0097.086] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate.css", pszSpec="*.zip") returned 0 [0097.086] lstrlenA (lpString="*.zip") returned 5 [0097.086] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate.css", pszSpec="*.rar") returned 0 [0097.086] lstrlenA (lpString="*.rar") returned 5 [0097.086] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate.css", pszSpec="*.7z") returned 0 [0097.086] lstrlenA (lpString="*.7z") returned 4 [0097.086] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate.css", pszSpec="*.tar") returned 0 [0097.086] lstrlenA (lpString="*.tar") returned 5 [0097.086] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate.css", pszSpec="*.gzip") returned 0 [0097.087] lstrlenA (lpString="*.gzip") returned 6 [0097.087] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate.css", pszSpec="*.jpg") returned 0 [0097.087] lstrlenA (lpString="*.jpg") returned 5 [0097.087] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate.css", pszSpec="*.jpeg") returned 0 [0097.087] lstrlenA (lpString="*.jpeg") returned 6 [0097.087] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate.css", pszSpec="*.psd") returned 0 [0097.087] lstrlenA (lpString="*.psd") returned 5 [0097.087] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate.css", pszSpec="*.cdr") returned 0 [0097.087] lstrlenA (lpString="*.cdr") returned 5 [0097.087] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate.css", pszSpec="*.dwg") returned 0 [0097.087] lstrlenA (lpString="*.dwg") returned 5 [0097.087] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate.css", pszSpec="*.max") returned 0 [0097.087] lstrlenA (lpString="*.max") returned 5 [0097.087] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate.css", pszSpec="*.bmp") returned 0 [0097.087] lstrlenA (lpString="*.bmp") returned 5 [0097.087] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate.css", pszSpec="*.gif") returned 0 [0097.087] lstrlenA (lpString="*.gif") returned 5 [0097.087] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate.css", pszSpec="*.png") returned 0 [0097.087] lstrlenA (lpString="*.png") returned 5 [0097.087] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate.css", pszSpec="*.doc") returned 0 [0097.087] lstrlenA (lpString="*.doc") returned 5 [0097.087] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate.css", pszSpec="*.docx") returned 0 [0097.087] lstrlenA (lpString="*.docx") returned 6 [0097.087] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate.css", pszSpec="*.xls") returned 0 [0097.087] lstrlenA (lpString="*.xls") returned 5 [0097.087] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate.css", pszSpec="*.xlsx") returned 0 [0097.087] lstrlenA (lpString="*.xlsx") returned 6 [0097.087] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate.css", pszSpec="*.ppt") returned 0 [0097.087] lstrlenA (lpString="*.ppt") returned 5 [0097.087] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate.css", pszSpec="*.pptx") returned 0 [0097.087] lstrlenA (lpString="*.pptx") returned 6 [0097.087] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate.css", pszSpec="*.txt") returned 0 [0097.087] lstrlenA (lpString="*.txt") returned 5 [0097.087] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate.css", pszSpec="*.pdf") returned 0 [0097.087] lstrlenA (lpString="*.pdf") returned 5 [0097.088] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate.css", pszSpec="*.djvu") returned 0 [0097.088] lstrlenA (lpString="*.djvu") returned 6 [0097.088] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate.css", pszSpec="*.htm") returned 0 [0097.088] lstrlenA (lpString="*.htm") returned 5 [0097.088] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate.css", pszSpec="*.html") returned 0 [0097.088] lstrlenA (lpString="*.html") returned 6 [0097.088] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate.css", pszSpec="*.mdb") returned 0 [0097.088] lstrlenA (lpString="*.mdb") returned 5 [0097.088] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate.css", pszSpec="*.cer") returned 0 [0097.088] lstrlenA (lpString="*.cer") returned 5 [0097.088] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate.css", pszSpec="*.p12") returned 0 [0097.088] lstrlenA (lpString="*.p12") returned 5 [0097.088] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate.css", pszSpec="*.pfx") returned 0 [0097.088] lstrlenA (lpString="*.pfx") returned 5 [0097.088] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate.css", pszSpec="*.kwm") returned 0 [0097.088] lstrlenA (lpString="*.kwm") returned 5 [0097.088] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate.css", pszSpec="*.pwm") returned 0 [0097.088] lstrlenA (lpString="*.pwm") returned 5 [0097.088] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate.css", pszSpec="*.1cd") returned 0 [0097.088] lstrlenA (lpString="*.1cd") returned 5 [0097.088] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate.css", pszSpec="*.md") returned 0 [0097.088] lstrlenA (lpString="*.md") returned 4 [0097.088] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate.css", pszSpec="*.mdf") returned 0 [0097.088] lstrlenA (lpString="*.mdf") returned 5 [0097.088] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate.css", pszSpec="*.dbf") returned 0 [0097.088] lstrlenA (lpString="*.dbf") returned 5 [0097.088] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate.css", pszSpec="*.odt") returned 0 [0097.088] lstrlenA (lpString="*.odt") returned 5 [0097.088] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate.css", pszSpec="*.vob") returned 0 [0097.088] lstrlenA (lpString="*.vob") returned 5 [0097.088] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate.css", pszSpec="*.ifo") returned 0 [0097.088] lstrlenA (lpString="*.ifo") returned 5 [0097.088] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate.css", pszSpec="*.lnk") returned 0 [0097.088] lstrlenA (lpString="*.lnk") returned 5 [0097.088] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate.css", pszSpec="*.torrent") returned 0 [0097.089] lstrlenA (lpString="*.torrent") returned 9 [0097.089] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate.css", pszSpec="*.mov") returned 0 [0097.089] lstrlenA (lpString="*.mov") returned 5 [0097.089] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate.css", pszSpec="*.m2v") returned 0 [0097.089] lstrlenA (lpString="*.m2v") returned 5 [0097.089] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate.css", pszSpec="*.3gp") returned 0 [0097.089] lstrlenA (lpString="*.3gp") returned 5 [0097.089] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate.css", pszSpec="*.mpeg") returned 0 [0097.089] lstrlenA (lpString="*.mpeg") returned 6 [0097.089] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate.css", pszSpec="*.mpg") returned 0 [0097.089] lstrlenA (lpString="*.mpg") returned 5 [0097.089] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate.css", pszSpec="*.flv") returned 0 [0097.089] lstrlenA (lpString="*.flv") returned 5 [0097.089] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate.css", pszSpec="*.avi") returned 0 [0097.089] lstrlenA (lpString="*.avi") returned 5 [0097.089] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate.css", pszSpec="*.mp4") returned 0 [0097.089] lstrlenA (lpString="*.mp4") returned 5 [0097.089] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate.css", pszSpec="*.wmv") returned 0 [0097.089] lstrlenA (lpString="*.wmv") returned 5 [0097.089] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate.css", pszSpec="*.divx") returned 0 [0097.089] lstrlenA (lpString="*.divx") returned 6 [0097.089] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate.css", pszSpec="*.mkv") returned 0 [0097.089] lstrlenA (lpString="*.mkv") returned 5 [0097.089] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate.css", pszSpec="*.mp3") returned 0 [0097.089] lstrlenA (lpString="*.mp3") returned 5 [0097.089] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate.css", pszSpec="*.wav") returned 0 [0097.089] lstrlenA (lpString="*.wav") returned 5 [0097.089] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate.css", pszSpec="*.flac") returned 0 [0097.089] lstrlenA (lpString="*.flac") returned 6 [0097.089] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate.css", pszSpec="*.ape") returned 0 [0097.089] lstrlenA (lpString="*.ape") returned 5 [0097.089] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate.css", pszSpec="*.wma") returned 0 [0097.089] lstrlenA (lpString="*.wma") returned 5 [0097.090] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate.css", pszSpec="*.ac3") returned 0 [0097.090] lstrlenA (lpString="*.ac3") returned 5 [0097.090] FindNextFileA (in: hFindFile=0x5be1a0, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0097.090] PeekMessageA (in: lpMsg=0xaece4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaece4) returned 0 [0097.090] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="SlateBlue.css") returned -1 [0097.090] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SlateBlue.css") returned -1 [0097.090] lstrcmpiA (lpString1="", lpString2="SlateBlue.css") returned -1 [0097.090] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate.css") returned="Slate.css" [0097.090] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\", lpString2="SlateBlue.css" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SlateBlue.css") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SlateBlue.css" [0097.090] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SlateBlue.css", pszSpec="*.zip") returned 0 [0097.090] lstrlenA (lpString="*.zip") returned 5 [0097.090] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SlateBlue.css", pszSpec="*.rar") returned 0 [0097.090] lstrlenA (lpString="*.rar") returned 5 [0097.090] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SlateBlue.css", pszSpec="*.7z") returned 0 [0097.090] lstrlenA (lpString="*.7z") returned 4 [0097.090] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SlateBlue.css", pszSpec="*.tar") returned 0 [0097.090] lstrlenA (lpString="*.tar") returned 5 [0097.090] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SlateBlue.css", pszSpec="*.gzip") returned 0 [0097.090] lstrlenA (lpString="*.gzip") returned 6 [0097.090] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SlateBlue.css", pszSpec="*.jpg") returned 0 [0097.090] lstrlenA (lpString="*.jpg") returned 5 [0097.090] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SlateBlue.css", pszSpec="*.jpeg") returned 0 [0097.090] lstrlenA (lpString="*.jpeg") returned 6 [0097.090] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SlateBlue.css", pszSpec="*.psd") returned 0 [0097.090] lstrlenA (lpString="*.psd") returned 5 [0097.090] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SlateBlue.css", pszSpec="*.cdr") returned 0 [0097.090] lstrlenA (lpString="*.cdr") returned 5 [0097.090] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SlateBlue.css", pszSpec="*.dwg") returned 0 [0097.090] lstrlenA (lpString="*.dwg") returned 5 [0097.090] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SlateBlue.css", pszSpec="*.max") returned 0 [0097.090] lstrlenA (lpString="*.max") returned 5 [0097.090] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SlateBlue.css", pszSpec="*.bmp") returned 0 [0097.090] lstrlenA (lpString="*.bmp") returned 5 [0097.090] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SlateBlue.css", pszSpec="*.gif") returned 0 [0097.091] lstrlenA (lpString="*.gif") returned 5 [0097.091] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SlateBlue.css", pszSpec="*.png") returned 0 [0097.091] lstrlenA (lpString="*.png") returned 5 [0097.091] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SlateBlue.css", pszSpec="*.doc") returned 0 [0097.091] lstrlenA (lpString="*.doc") returned 5 [0097.091] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SlateBlue.css", pszSpec="*.docx") returned 0 [0097.091] lstrlenA (lpString="*.docx") returned 6 [0097.091] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SlateBlue.css", pszSpec="*.xls") returned 0 [0097.091] lstrlenA (lpString="*.xls") returned 5 [0097.091] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SlateBlue.css", pszSpec="*.xlsx") returned 0 [0097.091] lstrlenA (lpString="*.xlsx") returned 6 [0097.091] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SlateBlue.css", pszSpec="*.ppt") returned 0 [0097.091] lstrlenA (lpString="*.ppt") returned 5 [0097.091] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SlateBlue.css", pszSpec="*.pptx") returned 0 [0097.091] lstrlenA (lpString="*.pptx") returned 6 [0097.091] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SlateBlue.css", pszSpec="*.txt") returned 0 [0097.091] lstrlenA (lpString="*.txt") returned 5 [0097.091] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SlateBlue.css", pszSpec="*.pdf") returned 0 [0097.091] lstrlenA (lpString="*.pdf") returned 5 [0097.091] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SlateBlue.css", pszSpec="*.djvu") returned 0 [0097.091] lstrlenA (lpString="*.djvu") returned 6 [0097.091] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SlateBlue.css", pszSpec="*.htm") returned 0 [0097.091] lstrlenA (lpString="*.htm") returned 5 [0097.091] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SlateBlue.css", pszSpec="*.html") returned 0 [0097.091] lstrlenA (lpString="*.html") returned 6 [0097.091] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SlateBlue.css", pszSpec="*.mdb") returned 0 [0097.091] lstrlenA (lpString="*.mdb") returned 5 [0097.091] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SlateBlue.css", pszSpec="*.cer") returned 0 [0097.091] lstrlenA (lpString="*.cer") returned 5 [0097.091] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SlateBlue.css", pszSpec="*.p12") returned 0 [0097.091] lstrlenA (lpString="*.p12") returned 5 [0097.091] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SlateBlue.css", pszSpec="*.pfx") returned 0 [0097.091] lstrlenA (lpString="*.pfx") returned 5 [0097.091] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SlateBlue.css", pszSpec="*.kwm") returned 0 [0097.091] lstrlenA (lpString="*.kwm") returned 5 [0097.091] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SlateBlue.css", pszSpec="*.pwm") returned 0 [0097.092] lstrlenA (lpString="*.pwm") returned 5 [0097.092] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SlateBlue.css", pszSpec="*.1cd") returned 0 [0097.092] lstrlenA (lpString="*.1cd") returned 5 [0097.092] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SlateBlue.css", pszSpec="*.md") returned 0 [0097.092] lstrlenA (lpString="*.md") returned 4 [0097.092] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SlateBlue.css", pszSpec="*.mdf") returned 0 [0097.092] lstrlenA (lpString="*.mdf") returned 5 [0097.092] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SlateBlue.css", pszSpec="*.dbf") returned 0 [0097.092] lstrlenA (lpString="*.dbf") returned 5 [0097.092] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SlateBlue.css", pszSpec="*.odt") returned 0 [0097.092] lstrlenA (lpString="*.odt") returned 5 [0097.092] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SlateBlue.css", pszSpec="*.vob") returned 0 [0097.092] lstrlenA (lpString="*.vob") returned 5 [0097.092] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SlateBlue.css", pszSpec="*.ifo") returned 0 [0097.092] lstrlenA (lpString="*.ifo") returned 5 [0097.092] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SlateBlue.css", pszSpec="*.lnk") returned 0 [0097.092] lstrlenA (lpString="*.lnk") returned 5 [0097.092] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SlateBlue.css", pszSpec="*.torrent") returned 0 [0097.092] lstrlenA (lpString="*.torrent") returned 9 [0097.092] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SlateBlue.css", pszSpec="*.mov") returned 0 [0097.092] lstrlenA (lpString="*.mov") returned 5 [0097.092] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SlateBlue.css", pszSpec="*.m2v") returned 0 [0097.092] lstrlenA (lpString="*.m2v") returned 5 [0097.092] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SlateBlue.css", pszSpec="*.3gp") returned 0 [0097.092] lstrlenA (lpString="*.3gp") returned 5 [0097.092] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SlateBlue.css", pszSpec="*.mpeg") returned 0 [0097.092] lstrlenA (lpString="*.mpeg") returned 6 [0097.092] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SlateBlue.css", pszSpec="*.mpg") returned 0 [0097.092] lstrlenA (lpString="*.mpg") returned 5 [0097.092] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SlateBlue.css", pszSpec="*.flv") returned 0 [0097.092] lstrlenA (lpString="*.flv") returned 5 [0097.092] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SlateBlue.css", pszSpec="*.avi") returned 0 [0097.092] lstrlenA (lpString="*.avi") returned 5 [0097.092] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SlateBlue.css", pszSpec="*.mp4") returned 0 [0097.092] lstrlenA (lpString="*.mp4") returned 5 [0097.093] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SlateBlue.css", pszSpec="*.wmv") returned 0 [0097.093] lstrlenA (lpString="*.wmv") returned 5 [0097.093] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SlateBlue.css", pszSpec="*.divx") returned 0 [0097.093] lstrlenA (lpString="*.divx") returned 6 [0097.093] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SlateBlue.css", pszSpec="*.mkv") returned 0 [0097.093] lstrlenA (lpString="*.mkv") returned 5 [0097.093] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SlateBlue.css", pszSpec="*.mp3") returned 0 [0097.093] lstrlenA (lpString="*.mp3") returned 5 [0097.093] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SlateBlue.css", pszSpec="*.wav") returned 0 [0097.093] lstrlenA (lpString="*.wav") returned 5 [0097.093] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SlateBlue.css", pszSpec="*.flac") returned 0 [0097.093] lstrlenA (lpString="*.flac") returned 6 [0097.093] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SlateBlue.css", pszSpec="*.ape") returned 0 [0097.093] lstrlenA (lpString="*.ape") returned 5 [0097.093] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SlateBlue.css", pszSpec="*.wma") returned 0 [0097.093] lstrlenA (lpString="*.wma") returned 5 [0097.093] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SlateBlue.css", pszSpec="*.ac3") returned 0 [0097.093] lstrlenA (lpString="*.ac3") returned 5 [0097.093] FindNextFileA (in: hFindFile=0x5be1a0, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0097.093] lstrcmpA (lpString1=".", lpString2="SoftBlue") returned -1 [0097.093] lstrcmpA (lpString1="..", lpString2="SoftBlue") returned -1 [0097.093] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SlateBlue.css") returned="SlateBlue.css" [0097.093] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\", lpString2="SoftBlue" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue" [0097.093] lstrlenA (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue") returned 103 [0097.093] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\*.*", lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 0x5be1e0 [0097.094] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0097.094] FindNextFileA (in: hFindFile=0x5be1e0, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 1 [0097.094] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0097.094] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0097.094] FindNextFileA (in: hFindFile=0x5be1e0, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 1 [0097.094] PeekMessageA (in: lpMsg=0xaeb94, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaeb94) returned 0 [0097.094] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="background.gif") returned 1 [0097.094] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="background.gif") returned 1 [0097.094] lstrcmpiA (lpString1="", lpString2="background.gif") returned -1 [0097.094] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\*.*") returned="*.*" [0097.094] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\", lpString2="background.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\background.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\background.gif" [0097.094] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\background.gif", pszSpec="*.zip") returned 0 [0097.094] lstrlenA (lpString="*.zip") returned 5 [0097.094] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\background.gif", pszSpec="*.rar") returned 0 [0097.094] lstrlenA (lpString="*.rar") returned 5 [0097.094] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\background.gif", pszSpec="*.7z") returned 0 [0097.094] lstrlenA (lpString="*.7z") returned 4 [0097.094] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\background.gif", pszSpec="*.tar") returned 0 [0097.094] lstrlenA (lpString="*.tar") returned 5 [0097.094] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\background.gif", pszSpec="*.gzip") returned 0 [0097.094] lstrlenA (lpString="*.gzip") returned 6 [0097.094] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\background.gif", pszSpec="*.jpg") returned 0 [0097.094] lstrlenA (lpString="*.jpg") returned 5 [0097.094] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\background.gif", pszSpec="*.jpeg") returned 0 [0097.094] lstrlenA (lpString="*.jpeg") returned 6 [0097.094] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\background.gif", pszSpec="*.psd") returned 0 [0097.094] lstrlenA (lpString="*.psd") returned 5 [0097.094] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\background.gif", pszSpec="*.cdr") returned 0 [0097.094] lstrlenA (lpString="*.cdr") returned 5 [0097.094] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\background.gif", pszSpec="*.dwg") returned 0 [0097.095] lstrlenA (lpString="*.dwg") returned 5 [0097.095] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\background.gif", pszSpec="*.max") returned 0 [0097.095] lstrlenA (lpString="*.max") returned 5 [0097.095] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\background.gif", pszSpec="*.bmp") returned 0 [0097.095] lstrlenA (lpString="*.bmp") returned 5 [0097.095] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\background.gif", pszSpec="*.gif") returned 1 [0097.095] lstrlenA (lpString="*.gif") returned 5 [0097.095] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\background.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\background.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\background.gif" [0097.095] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\background.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\background.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\background.gif" [0097.095] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\background.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\background.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\background.gif." [0097.095] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\background.gif.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\background.gif. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\background.gif. " [0097.095] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\background.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\softblue\\background.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0 [0097.096] GetFileSize (in: hFile=0xa0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1afa [0097.096] GetFileTime (in: hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xa173f900, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x6d37e7b0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xa173f900, dwHighDateTime=0x1c747ea)) returned 1 [0097.096] SetFilePointer (in: hFile=0xa0, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0097.096] ReadFile (in: hFile=0xa0, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x1aa0, lpOverlapped=0x0) returned 1 [0097.117] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\background.gif") returned="background.gif" [0097.117] SetFilePointer (in: hFile=0xa0, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0097.117] WriteFile (in: hFile=0xa0, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x1aa0, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x1aa0, lpOverlapped=0x0) returned 1 [0097.117] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0097.117] CloseHandle (hObject=0xa0) returned 1 [0097.117] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\background.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\softblue\\background.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\background.gif. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\softblue\\background.gif. ")) returned 1 [0097.118] FindNextFileA (in: hFindFile=0x5be1e0, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 1 [0097.118] PeekMessageA (in: lpMsg=0xaeb94, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaeb94) returned 0 [0097.118] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="TAB_OFF.GIF") returned -1 [0097.118] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TAB_OFF.GIF") returned -1 [0097.118] lstrcmpiA (lpString1="", lpString2="TAB_OFF.GIF") returned -1 [0097.118] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\background.gif") returned="background.gif" [0097.118] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\", lpString2="TAB_OFF.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_OFF.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_OFF.GIF" [0097.118] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_OFF.GIF", pszSpec="*.zip") returned 0 [0097.118] lstrlenA (lpString="*.zip") returned 5 [0097.119] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_OFF.GIF", pszSpec="*.rar") returned 0 [0097.119] lstrlenA (lpString="*.rar") returned 5 [0097.119] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_OFF.GIF", pszSpec="*.7z") returned 0 [0097.119] lstrlenA (lpString="*.7z") returned 4 [0097.119] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_OFF.GIF", pszSpec="*.tar") returned 0 [0097.119] lstrlenA (lpString="*.tar") returned 5 [0097.119] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_OFF.GIF", pszSpec="*.gzip") returned 0 [0097.119] lstrlenA (lpString="*.gzip") returned 6 [0097.119] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_OFF.GIF", pszSpec="*.jpg") returned 0 [0097.119] lstrlenA (lpString="*.jpg") returned 5 [0097.119] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_OFF.GIF", pszSpec="*.jpeg") returned 0 [0097.119] lstrlenA (lpString="*.jpeg") returned 6 [0097.119] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_OFF.GIF", pszSpec="*.psd") returned 0 [0097.119] lstrlenA (lpString="*.psd") returned 5 [0097.119] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_OFF.GIF", pszSpec="*.cdr") returned 0 [0097.119] lstrlenA (lpString="*.cdr") returned 5 [0097.119] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_OFF.GIF", pszSpec="*.dwg") returned 0 [0097.119] lstrlenA (lpString="*.dwg") returned 5 [0097.119] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_OFF.GIF", pszSpec="*.max") returned 0 [0097.119] lstrlenA (lpString="*.max") returned 5 [0097.119] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_OFF.GIF", pszSpec="*.bmp") returned 0 [0097.119] lstrlenA (lpString="*.bmp") returned 5 [0097.119] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_OFF.GIF", pszSpec="*.gif") returned 1 [0097.119] lstrlenA (lpString="*.gif") returned 5 [0097.119] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_OFF.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_OFF.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_OFF.GIF" [0097.119] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_OFF.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_OFF.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_OFF.GIF" [0097.119] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_OFF.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_OFF.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_OFF.GIF." [0097.119] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_OFF.GIF.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_OFF.GIF. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_OFF.GIF. " [0097.119] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\softblue\\tab_off.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0 [0097.120] GetFileSize (in: hFile=0xa0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x155 [0097.120] GetFileTime (in: hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xa173f900, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x6d3a4910, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xa173f900, dwHighDateTime=0x1c747ea)) returned 1 [0097.120] SetFilePointer (in: hFile=0xa0, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0097.120] ReadFile (in: hFile=0xa0, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0xfb, lpOverlapped=0x0) returned 1 [0097.121] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_OFF.GIF") returned="TAB_OFF.GIF" [0097.121] SetFilePointer (in: hFile=0xa0, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0097.121] WriteFile (in: hFile=0xa0, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0xfb, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0xfb, lpOverlapped=0x0) returned 1 [0097.121] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0097.121] CloseHandle (hObject=0xa0) returned 1 [0097.121] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\softblue\\tab_off.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_OFF.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\softblue\\tab_off.gif. ")) returned 1 [0097.122] FindNextFileA (in: hFindFile=0x5be1e0, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 1 [0097.122] PeekMessageA (in: lpMsg=0xaeb94, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaeb94) returned 0 [0097.122] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="TAB_ON.GIF") returned -1 [0097.122] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TAB_ON.GIF") returned -1 [0097.122] lstrcmpiA (lpString1="", lpString2="TAB_ON.GIF") returned -1 [0097.122] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_OFF.GIF") returned="TAB_OFF.GIF" [0097.122] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\", lpString2="TAB_ON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_ON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_ON.GIF" [0097.122] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_ON.GIF", pszSpec="*.zip") returned 0 [0097.122] lstrlenA (lpString="*.zip") returned 5 [0097.122] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_ON.GIF", pszSpec="*.rar") returned 0 [0097.122] lstrlenA (lpString="*.rar") returned 5 [0097.122] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_ON.GIF", pszSpec="*.7z") returned 0 [0097.122] lstrlenA (lpString="*.7z") returned 4 [0097.123] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_ON.GIF", pszSpec="*.tar") returned 0 [0097.123] lstrlenA (lpString="*.tar") returned 5 [0097.123] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_ON.GIF", pszSpec="*.gzip") returned 0 [0097.123] lstrlenA (lpString="*.gzip") returned 6 [0097.123] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_ON.GIF", pszSpec="*.jpg") returned 0 [0097.123] lstrlenA (lpString="*.jpg") returned 5 [0097.123] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_ON.GIF", pszSpec="*.jpeg") returned 0 [0097.123] lstrlenA (lpString="*.jpeg") returned 6 [0097.123] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_ON.GIF", pszSpec="*.psd") returned 0 [0097.123] lstrlenA (lpString="*.psd") returned 5 [0097.123] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_ON.GIF", pszSpec="*.cdr") returned 0 [0097.123] lstrlenA (lpString="*.cdr") returned 5 [0097.123] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_ON.GIF", pszSpec="*.dwg") returned 0 [0097.123] lstrlenA (lpString="*.dwg") returned 5 [0097.123] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_ON.GIF", pszSpec="*.max") returned 0 [0097.123] lstrlenA (lpString="*.max") returned 5 [0097.123] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_ON.GIF", pszSpec="*.bmp") returned 0 [0097.123] lstrlenA (lpString="*.bmp") returned 5 [0097.123] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_ON.GIF", pszSpec="*.gif") returned 1 [0097.123] lstrlenA (lpString="*.gif") returned 5 [0097.123] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_ON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_ON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_ON.GIF" [0097.123] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_ON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_ON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_ON.GIF" [0097.123] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_ON.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_ON.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_ON.GIF." [0097.123] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_ON.GIF.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_ON.GIF. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_ON.GIF. " [0097.123] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\softblue\\tab_on.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0 [0097.124] GetFileSize (in: hFile=0xa0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xde [0097.124] GetFileTime (in: hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xa173f900, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5aad71f0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xa173f900, dwHighDateTime=0x1c747ea)) returned 1 [0097.124] SetFilePointer (in: hFile=0xa0, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0097.124] ReadFile (in: hFile=0xa0, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x84, lpOverlapped=0x0) returned 1 [0097.125] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_ON.GIF") returned="TAB_ON.GIF" [0097.125] SetFilePointer (in: hFile=0xa0, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0097.125] WriteFile (in: hFile=0xa0, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x84, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x84, lpOverlapped=0x0) returned 1 [0097.125] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0097.125] CloseHandle (hObject=0xa0) returned 1 [0097.125] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\softblue\\tab_on.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_ON.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\softblue\\tab_on.gif. ")) returned 1 [0097.126] FindNextFileA (in: hFindFile=0x5be1e0, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 0 [0097.126] FindClose (in: hFindFile=0x5be1e0 | out: hFindFile=0x5be1e0) returned 1 [0097.126] FindNextFileA (in: hFindFile=0x5be1a0, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0097.126] PeekMessageA (in: lpMsg=0xaece4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaece4) returned 0 [0097.126] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="SoftBlue.css") returned -1 [0097.126] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SoftBlue.css") returned -1 [0097.126] lstrcmpiA (lpString1="", lpString2="SoftBlue.css") returned -1 [0097.126] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\*.*") returned="*.*" [0097.126] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\", lpString2="SoftBlue.css" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue.css") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue.css" [0097.126] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue.css", pszSpec="*.zip") returned 0 [0097.126] lstrlenA (lpString="*.zip") returned 5 [0097.126] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue.css", pszSpec="*.rar") returned 0 [0097.126] lstrlenA (lpString="*.rar") returned 5 [0097.126] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue.css", pszSpec="*.7z") returned 0 [0097.126] lstrlenA (lpString="*.7z") returned 4 [0097.126] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue.css", pszSpec="*.tar") returned 0 [0097.126] lstrlenA (lpString="*.tar") returned 5 [0097.126] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue.css", pszSpec="*.gzip") returned 0 [0097.126] lstrlenA (lpString="*.gzip") returned 6 [0097.126] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue.css", pszSpec="*.jpg") returned 0 [0097.126] lstrlenA (lpString="*.jpg") returned 5 [0097.126] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue.css", pszSpec="*.jpeg") returned 0 [0097.126] lstrlenA (lpString="*.jpeg") returned 6 [0097.126] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue.css", pszSpec="*.psd") returned 0 [0097.126] lstrlenA (lpString="*.psd") returned 5 [0097.126] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue.css", pszSpec="*.cdr") returned 0 [0097.126] lstrlenA (lpString="*.cdr") returned 5 [0097.126] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue.css", pszSpec="*.dwg") returned 0 [0097.126] lstrlenA (lpString="*.dwg") returned 5 [0097.126] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue.css", pszSpec="*.max") returned 0 [0097.126] lstrlenA (lpString="*.max") returned 5 [0097.126] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue.css", pszSpec="*.bmp") returned 0 [0097.126] lstrlenA (lpString="*.bmp") returned 5 [0097.127] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue.css", pszSpec="*.gif") returned 0 [0097.127] lstrlenA (lpString="*.gif") returned 5 [0097.127] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue.css", pszSpec="*.png") returned 0 [0097.127] lstrlenA (lpString="*.png") returned 5 [0097.127] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue.css", pszSpec="*.doc") returned 0 [0097.127] lstrlenA (lpString="*.doc") returned 5 [0097.127] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue.css", pszSpec="*.docx") returned 0 [0097.127] lstrlenA (lpString="*.docx") returned 6 [0097.127] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue.css", pszSpec="*.xls") returned 0 [0097.127] lstrlenA (lpString="*.xls") returned 5 [0097.127] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue.css", pszSpec="*.xlsx") returned 0 [0097.127] lstrlenA (lpString="*.xlsx") returned 6 [0097.127] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue.css", pszSpec="*.ppt") returned 0 [0097.127] lstrlenA (lpString="*.ppt") returned 5 [0097.127] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue.css", pszSpec="*.pptx") returned 0 [0097.127] lstrlenA (lpString="*.pptx") returned 6 [0097.127] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue.css", pszSpec="*.txt") returned 0 [0097.127] lstrlenA (lpString="*.txt") returned 5 [0097.127] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue.css", pszSpec="*.pdf") returned 0 [0097.127] lstrlenA (lpString="*.pdf") returned 5 [0097.127] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue.css", pszSpec="*.djvu") returned 0 [0097.127] lstrlenA (lpString="*.djvu") returned 6 [0097.127] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue.css", pszSpec="*.htm") returned 0 [0097.127] lstrlenA (lpString="*.htm") returned 5 [0097.127] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue.css", pszSpec="*.html") returned 0 [0097.127] lstrlenA (lpString="*.html") returned 6 [0097.127] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue.css", pszSpec="*.mdb") returned 0 [0097.127] lstrlenA (lpString="*.mdb") returned 5 [0097.127] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue.css", pszSpec="*.cer") returned 0 [0097.127] lstrlenA (lpString="*.cer") returned 5 [0097.127] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue.css", pszSpec="*.p12") returned 0 [0097.127] lstrlenA (lpString="*.p12") returned 5 [0097.127] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue.css", pszSpec="*.pfx") returned 0 [0097.127] lstrlenA (lpString="*.pfx") returned 5 [0097.127] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue.css", pszSpec="*.kwm") returned 0 [0097.127] lstrlenA (lpString="*.kwm") returned 5 [0097.127] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue.css", pszSpec="*.pwm") returned 0 [0097.127] lstrlenA (lpString="*.pwm") returned 5 [0097.127] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue.css", pszSpec="*.1cd") returned 0 [0097.127] lstrlenA (lpString="*.1cd") returned 5 [0097.127] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue.css", pszSpec="*.md") returned 0 [0097.127] lstrlenA (lpString="*.md") returned 4 [0097.127] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue.css", pszSpec="*.mdf") returned 0 [0097.127] lstrlenA (lpString="*.mdf") returned 5 [0097.128] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue.css", pszSpec="*.dbf") returned 0 [0097.128] lstrlenA (lpString="*.dbf") returned 5 [0097.128] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue.css", pszSpec="*.odt") returned 0 [0097.128] lstrlenA (lpString="*.odt") returned 5 [0097.128] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue.css", pszSpec="*.vob") returned 0 [0097.128] lstrlenA (lpString="*.vob") returned 5 [0097.128] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue.css", pszSpec="*.ifo") returned 0 [0097.128] lstrlenA (lpString="*.ifo") returned 5 [0097.128] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue.css", pszSpec="*.lnk") returned 0 [0097.128] lstrlenA (lpString="*.lnk") returned 5 [0097.128] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue.css", pszSpec="*.torrent") returned 0 [0097.128] lstrlenA (lpString="*.torrent") returned 9 [0097.128] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue.css", pszSpec="*.mov") returned 0 [0097.128] lstrlenA (lpString="*.mov") returned 5 [0097.128] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue.css", pszSpec="*.m2v") returned 0 [0097.128] lstrlenA (lpString="*.m2v") returned 5 [0097.128] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue.css", pszSpec="*.3gp") returned 0 [0097.128] lstrlenA (lpString="*.3gp") returned 5 [0097.128] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue.css", pszSpec="*.mpeg") returned 0 [0097.128] lstrlenA (lpString="*.mpeg") returned 6 [0097.128] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue.css", pszSpec="*.mpg") returned 0 [0097.128] lstrlenA (lpString="*.mpg") returned 5 [0097.128] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue.css", pszSpec="*.flv") returned 0 [0097.128] lstrlenA (lpString="*.flv") returned 5 [0097.128] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue.css", pszSpec="*.avi") returned 0 [0097.128] lstrlenA (lpString="*.avi") returned 5 [0097.128] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue.css", pszSpec="*.mp4") returned 0 [0097.128] lstrlenA (lpString="*.mp4") returned 5 [0097.128] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue.css", pszSpec="*.wmv") returned 0 [0097.128] lstrlenA (lpString="*.wmv") returned 5 [0097.128] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue.css", pszSpec="*.divx") returned 0 [0097.128] lstrlenA (lpString="*.divx") returned 6 [0097.128] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue.css", pszSpec="*.mkv") returned 0 [0097.128] lstrlenA (lpString="*.mkv") returned 5 [0097.128] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue.css", pszSpec="*.mp3") returned 0 [0097.128] lstrlenA (lpString="*.mp3") returned 5 [0097.128] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue.css", pszSpec="*.wav") returned 0 [0097.128] lstrlenA (lpString="*.wav") returned 5 [0097.128] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue.css", pszSpec="*.flac") returned 0 [0097.128] lstrlenA (lpString="*.flac") returned 6 [0097.128] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue.css", pszSpec="*.ape") returned 0 [0097.128] lstrlenA (lpString="*.ape") returned 5 [0097.128] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue.css", pszSpec="*.wma") returned 0 [0097.128] lstrlenA (lpString="*.wma") returned 5 [0097.128] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue.css", pszSpec="*.ac3") returned 0 [0097.128] lstrlenA (lpString="*.ac3") returned 5 [0097.129] FindNextFileA (in: hFindFile=0x5be1a0, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0097.129] lstrcmpA (lpString1=".", lpString2="SpringGreen") returned -1 [0097.129] lstrcmpA (lpString1="..", lpString2="SpringGreen") returned -1 [0097.129] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue.css") returned="SoftBlue.css" [0097.129] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\", lpString2="SpringGreen" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen" [0097.129] lstrlenA (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen") returned 106 [0097.129] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\*.*", lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 0x5be1e0 [0097.151] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0097.151] FindNextFileA (in: hFindFile=0x5be1e0, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 1 [0097.151] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0097.151] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0097.151] FindNextFileA (in: hFindFile=0x5be1e0, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 1 [0097.151] PeekMessageA (in: lpMsg=0xaeb94, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaeb94) returned 0 [0097.151] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BUTTON.GIF") returned 1 [0097.152] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BUTTON.GIF") returned 1 [0097.152] lstrcmpiA (lpString1="", lpString2="BUTTON.GIF") returned -1 [0097.152] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\*.*") returned="*.*" [0097.152] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\", lpString2="BUTTON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\BUTTON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\BUTTON.GIF" [0097.152] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\BUTTON.GIF", pszSpec="*.zip") returned 0 [0097.152] lstrlenA (lpString="*.zip") returned 5 [0097.152] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\BUTTON.GIF", pszSpec="*.rar") returned 0 [0097.152] lstrlenA (lpString="*.rar") returned 5 [0097.152] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\BUTTON.GIF", pszSpec="*.7z") returned 0 [0097.152] lstrlenA (lpString="*.7z") returned 4 [0097.152] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\BUTTON.GIF", pszSpec="*.tar") returned 0 [0097.152] lstrlenA (lpString="*.tar") returned 5 [0097.152] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\BUTTON.GIF", pszSpec="*.gzip") returned 0 [0097.152] lstrlenA (lpString="*.gzip") returned 6 [0097.152] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\BUTTON.GIF", pszSpec="*.jpg") returned 0 [0097.152] lstrlenA (lpString="*.jpg") returned 5 [0097.152] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\BUTTON.GIF", pszSpec="*.jpeg") returned 0 [0097.152] lstrlenA (lpString="*.jpeg") returned 6 [0097.152] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\BUTTON.GIF", pszSpec="*.psd") returned 0 [0097.152] lstrlenA (lpString="*.psd") returned 5 [0097.152] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\BUTTON.GIF", pszSpec="*.cdr") returned 0 [0097.152] lstrlenA (lpString="*.cdr") returned 5 [0097.152] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\BUTTON.GIF", pszSpec="*.dwg") returned 0 [0097.152] lstrlenA (lpString="*.dwg") returned 5 [0097.152] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\BUTTON.GIF", pszSpec="*.max") returned 0 [0097.152] lstrlenA (lpString="*.max") returned 5 [0097.152] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\BUTTON.GIF", pszSpec="*.bmp") returned 0 [0097.152] lstrlenA (lpString="*.bmp") returned 5 [0097.152] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\BUTTON.GIF", pszSpec="*.gif") returned 1 [0097.152] lstrlenA (lpString="*.gif") returned 5 [0097.152] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\BUTTON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\BUTTON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\BUTTON.GIF" [0097.152] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\BUTTON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\BUTTON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\BUTTON.GIF" [0097.152] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\BUTTON.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\BUTTON.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\BUTTON.GIF." [0097.152] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\BUTTON.GIF.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\BUTTON.GIF. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\BUTTON.GIF. " [0097.152] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\BUTTON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\springgreen\\button.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0 [0097.154] GetFileSize (in: hFile=0xa0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1ac [0097.154] GetFileTime (in: hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xa173f900, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x6d3a4910, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xa173f900, dwHighDateTime=0x1c747ea)) returned 1 [0097.154] SetFilePointer (in: hFile=0xa0, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0097.154] ReadFile (in: hFile=0xa0, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x152, lpOverlapped=0x0) returned 1 [0097.155] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\BUTTON.GIF") returned="BUTTON.GIF" [0097.155] SetFilePointer (in: hFile=0xa0, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0097.155] WriteFile (in: hFile=0xa0, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x152, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x152, lpOverlapped=0x0) returned 1 [0097.155] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0097.156] CloseHandle (hObject=0xa0) returned 1 [0097.156] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\BUTTON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\springgreen\\button.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\BUTTON.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\springgreen\\button.gif. ")) returned 1 [0097.157] FindNextFileA (in: hFindFile=0x5be1e0, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 1 [0097.157] PeekMessageA (in: lpMsg=0xaeb94, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaeb94) returned 0 [0097.157] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="TAB_OFF.GIF") returned -1 [0097.157] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TAB_OFF.GIF") returned -1 [0097.157] lstrcmpiA (lpString1="", lpString2="TAB_OFF.GIF") returned -1 [0097.157] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\BUTTON.GIF") returned="BUTTON.GIF" [0097.157] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\", lpString2="TAB_OFF.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_OFF.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_OFF.GIF" [0097.157] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_OFF.GIF", pszSpec="*.zip") returned 0 [0097.158] lstrlenA (lpString="*.zip") returned 5 [0097.158] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_OFF.GIF", pszSpec="*.rar") returned 0 [0097.158] lstrlenA (lpString="*.rar") returned 5 [0097.158] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_OFF.GIF", pszSpec="*.7z") returned 0 [0097.158] lstrlenA (lpString="*.7z") returned 4 [0097.158] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_OFF.GIF", pszSpec="*.tar") returned 0 [0097.158] lstrlenA (lpString="*.tar") returned 5 [0097.158] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_OFF.GIF", pszSpec="*.gzip") returned 0 [0097.158] lstrlenA (lpString="*.gzip") returned 6 [0097.158] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_OFF.GIF", pszSpec="*.jpg") returned 0 [0097.158] lstrlenA (lpString="*.jpg") returned 5 [0097.158] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_OFF.GIF", pszSpec="*.jpeg") returned 0 [0097.158] lstrlenA (lpString="*.jpeg") returned 6 [0097.158] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_OFF.GIF", pszSpec="*.psd") returned 0 [0097.158] lstrlenA (lpString="*.psd") returned 5 [0097.158] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_OFF.GIF", pszSpec="*.cdr") returned 0 [0097.158] lstrlenA (lpString="*.cdr") returned 5 [0097.158] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_OFF.GIF", pszSpec="*.dwg") returned 0 [0097.158] lstrlenA (lpString="*.dwg") returned 5 [0097.158] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_OFF.GIF", pszSpec="*.max") returned 0 [0097.158] lstrlenA (lpString="*.max") returned 5 [0097.158] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_OFF.GIF", pszSpec="*.bmp") returned 0 [0097.158] lstrlenA (lpString="*.bmp") returned 5 [0097.158] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_OFF.GIF", pszSpec="*.gif") returned 1 [0097.158] lstrlenA (lpString="*.gif") returned 5 [0097.158] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_OFF.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_OFF.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_OFF.GIF" [0097.158] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_OFF.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_OFF.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_OFF.GIF" [0097.158] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_OFF.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_OFF.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_OFF.GIF." [0097.158] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_OFF.GIF.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_OFF.GIF. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_OFF.GIF. " [0097.158] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\springgreen\\tab_off.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0 [0097.159] GetFileSize (in: hFile=0xa0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x155 [0097.159] GetFileTime (in: hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xa2a52600, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5ab49610, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xa2a52600, dwHighDateTime=0x1c747ea)) returned 1 [0097.159] SetFilePointer (in: hFile=0xa0, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0097.159] ReadFile (in: hFile=0xa0, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0xfb, lpOverlapped=0x0) returned 1 [0097.160] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_OFF.GIF") returned="TAB_OFF.GIF" [0097.160] SetFilePointer (in: hFile=0xa0, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0097.160] WriteFile (in: hFile=0xa0, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0xfb, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0xfb, lpOverlapped=0x0) returned 1 [0097.160] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0097.160] CloseHandle (hObject=0xa0) returned 1 [0097.160] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\springgreen\\tab_off.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_OFF.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\springgreen\\tab_off.gif. ")) returned 1 [0097.161] FindNextFileA (in: hFindFile=0x5be1e0, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 1 [0097.161] PeekMessageA (in: lpMsg=0xaeb94, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaeb94) returned 0 [0097.161] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="TAB_ON.GIF") returned -1 [0097.162] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TAB_ON.GIF") returned -1 [0097.162] lstrcmpiA (lpString1="", lpString2="TAB_ON.GIF") returned -1 [0097.162] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_OFF.GIF") returned="TAB_OFF.GIF" [0097.162] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\", lpString2="TAB_ON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_ON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_ON.GIF" [0097.162] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_ON.GIF", pszSpec="*.zip") returned 0 [0097.162] lstrlenA (lpString="*.zip") returned 5 [0097.162] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_ON.GIF", pszSpec="*.rar") returned 0 [0097.162] lstrlenA (lpString="*.rar") returned 5 [0097.162] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_ON.GIF", pszSpec="*.7z") returned 0 [0097.162] lstrlenA (lpString="*.7z") returned 4 [0097.162] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_ON.GIF", pszSpec="*.tar") returned 0 [0097.162] lstrlenA (lpString="*.tar") returned 5 [0097.162] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_ON.GIF", pszSpec="*.gzip") returned 0 [0097.162] lstrlenA (lpString="*.gzip") returned 6 [0097.162] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_ON.GIF", pszSpec="*.jpg") returned 0 [0097.162] lstrlenA (lpString="*.jpg") returned 5 [0097.162] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_ON.GIF", pszSpec="*.jpeg") returned 0 [0097.162] lstrlenA (lpString="*.jpeg") returned 6 [0097.162] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_ON.GIF", pszSpec="*.psd") returned 0 [0097.162] lstrlenA (lpString="*.psd") returned 5 [0097.162] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_ON.GIF", pszSpec="*.cdr") returned 0 [0097.162] lstrlenA (lpString="*.cdr") returned 5 [0097.162] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_ON.GIF", pszSpec="*.dwg") returned 0 [0097.162] lstrlenA (lpString="*.dwg") returned 5 [0097.162] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_ON.GIF", pszSpec="*.max") returned 0 [0097.162] lstrlenA (lpString="*.max") returned 5 [0097.162] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_ON.GIF", pszSpec="*.bmp") returned 0 [0097.162] lstrlenA (lpString="*.bmp") returned 5 [0097.162] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_ON.GIF", pszSpec="*.gif") returned 1 [0097.162] lstrlenA (lpString="*.gif") returned 5 [0097.162] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_ON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_ON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_ON.GIF" [0097.162] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_ON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_ON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_ON.GIF" [0097.162] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_ON.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_ON.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_ON.GIF." [0097.162] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_ON.GIF.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_ON.GIF. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_ON.GIF. " [0097.162] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\springgreen\\tab_on.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0 [0097.163] GetFileSize (in: hFile=0xa0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xde [0097.163] GetFileTime (in: hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xa2a52600, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5ab49610, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xa2a52600, dwHighDateTime=0x1c747ea)) returned 1 [0097.163] SetFilePointer (in: hFile=0xa0, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0097.163] ReadFile (in: hFile=0xa0, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x84, lpOverlapped=0x0) returned 1 [0097.164] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_ON.GIF") returned="TAB_ON.GIF" [0097.164] SetFilePointer (in: hFile=0xa0, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0097.164] WriteFile (in: hFile=0xa0, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x84, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x84, lpOverlapped=0x0) returned 1 [0097.165] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0097.165] CloseHandle (hObject=0xa0) returned 1 [0097.165] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\springgreen\\tab_on.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_ON.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\springgreen\\tab_on.gif. ")) returned 1 [0097.179] FindNextFileA (in: hFindFile=0x5be1e0, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 0 [0097.179] FindClose (in: hFindFile=0x5be1e0 | out: hFindFile=0x5be1e0) returned 1 [0097.180] FindNextFileA (in: hFindFile=0x5be1a0, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0097.180] PeekMessageA (in: lpMsg=0xaece4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaece4) returned 0 [0097.180] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="SpringGreen.css") returned -1 [0097.180] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SpringGreen.css") returned -1 [0097.180] lstrcmpiA (lpString1="", lpString2="SpringGreen.css") returned -1 [0097.180] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\*.*") returned="*.*" [0097.180] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\", lpString2="SpringGreen.css" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen.css") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen.css" [0097.180] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen.css", pszSpec="*.zip") returned 0 [0097.180] lstrlenA (lpString="*.zip") returned 5 [0097.180] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen.css", pszSpec="*.rar") returned 0 [0097.180] lstrlenA (lpString="*.rar") returned 5 [0097.180] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen.css", pszSpec="*.7z") returned 0 [0097.180] lstrlenA (lpString="*.7z") returned 4 [0097.180] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen.css", pszSpec="*.tar") returned 0 [0097.180] lstrlenA (lpString="*.tar") returned 5 [0097.180] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen.css", pszSpec="*.gzip") returned 0 [0097.180] lstrlenA (lpString="*.gzip") returned 6 [0097.180] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen.css", pszSpec="*.jpg") returned 0 [0097.180] lstrlenA (lpString="*.jpg") returned 5 [0097.180] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen.css", pszSpec="*.jpeg") returned 0 [0097.180] lstrlenA (lpString="*.jpeg") returned 6 [0097.180] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen.css", pszSpec="*.psd") returned 0 [0097.180] lstrlenA (lpString="*.psd") returned 5 [0097.180] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen.css", pszSpec="*.cdr") returned 0 [0097.180] lstrlenA (lpString="*.cdr") returned 5 [0097.180] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen.css", pszSpec="*.dwg") returned 0 [0097.180] lstrlenA (lpString="*.dwg") returned 5 [0097.180] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen.css", pszSpec="*.max") returned 0 [0097.180] lstrlenA (lpString="*.max") returned 5 [0097.180] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen.css", pszSpec="*.bmp") returned 0 [0097.180] lstrlenA (lpString="*.bmp") returned 5 [0097.180] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen.css", pszSpec="*.gif") returned 0 [0097.180] lstrlenA (lpString="*.gif") returned 5 [0097.180] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen.css", pszSpec="*.png") returned 0 [0097.180] lstrlenA (lpString="*.png") returned 5 [0097.180] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen.css", pszSpec="*.doc") returned 0 [0097.180] lstrlenA (lpString="*.doc") returned 5 [0097.180] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen.css", pszSpec="*.docx") returned 0 [0097.180] lstrlenA (lpString="*.docx") returned 6 [0097.180] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen.css", pszSpec="*.xls") returned 0 [0097.181] lstrlenA (lpString="*.xls") returned 5 [0097.181] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen.css", pszSpec="*.xlsx") returned 0 [0097.181] lstrlenA (lpString="*.xlsx") returned 6 [0097.181] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen.css", pszSpec="*.ppt") returned 0 [0097.181] lstrlenA (lpString="*.ppt") returned 5 [0097.181] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen.css", pszSpec="*.pptx") returned 0 [0097.181] lstrlenA (lpString="*.pptx") returned 6 [0097.181] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen.css", pszSpec="*.txt") returned 0 [0097.181] lstrlenA (lpString="*.txt") returned 5 [0097.181] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen.css", pszSpec="*.pdf") returned 0 [0097.181] lstrlenA (lpString="*.pdf") returned 5 [0097.181] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen.css", pszSpec="*.djvu") returned 0 [0097.181] lstrlenA (lpString="*.djvu") returned 6 [0097.181] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen.css", pszSpec="*.htm") returned 0 [0097.181] lstrlenA (lpString="*.htm") returned 5 [0097.181] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen.css", pszSpec="*.html") returned 0 [0097.181] lstrlenA (lpString="*.html") returned 6 [0097.181] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen.css", pszSpec="*.mdb") returned 0 [0097.181] lstrlenA (lpString="*.mdb") returned 5 [0097.181] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen.css", pszSpec="*.cer") returned 0 [0097.181] lstrlenA (lpString="*.cer") returned 5 [0097.181] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen.css", pszSpec="*.p12") returned 0 [0097.181] lstrlenA (lpString="*.p12") returned 5 [0097.181] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen.css", pszSpec="*.pfx") returned 0 [0097.181] lstrlenA (lpString="*.pfx") returned 5 [0097.181] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen.css", pszSpec="*.kwm") returned 0 [0097.181] lstrlenA (lpString="*.kwm") returned 5 [0097.181] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen.css", pszSpec="*.pwm") returned 0 [0097.181] lstrlenA (lpString="*.pwm") returned 5 [0097.181] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen.css", pszSpec="*.1cd") returned 0 [0097.181] lstrlenA (lpString="*.1cd") returned 5 [0097.181] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen.css", pszSpec="*.md") returned 0 [0097.181] lstrlenA (lpString="*.md") returned 4 [0097.181] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen.css", pszSpec="*.mdf") returned 0 [0097.181] lstrlenA (lpString="*.mdf") returned 5 [0097.181] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen.css", pszSpec="*.dbf") returned 0 [0097.181] lstrlenA (lpString="*.dbf") returned 5 [0097.181] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen.css", pszSpec="*.odt") returned 0 [0097.181] lstrlenA (lpString="*.odt") returned 5 [0097.181] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen.css", pszSpec="*.vob") returned 0 [0097.181] lstrlenA (lpString="*.vob") returned 5 [0097.182] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen.css", pszSpec="*.ifo") returned 0 [0097.182] lstrlenA (lpString="*.ifo") returned 5 [0097.182] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen.css", pszSpec="*.lnk") returned 0 [0097.182] lstrlenA (lpString="*.lnk") returned 5 [0097.182] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen.css", pszSpec="*.torrent") returned 0 [0097.182] lstrlenA (lpString="*.torrent") returned 9 [0097.182] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen.css", pszSpec="*.mov") returned 0 [0097.182] lstrlenA (lpString="*.mov") returned 5 [0097.182] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen.css", pszSpec="*.m2v") returned 0 [0097.182] lstrlenA (lpString="*.m2v") returned 5 [0097.182] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen.css", pszSpec="*.3gp") returned 0 [0097.182] lstrlenA (lpString="*.3gp") returned 5 [0097.182] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen.css", pszSpec="*.mpeg") returned 0 [0097.182] lstrlenA (lpString="*.mpeg") returned 6 [0097.182] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen.css", pszSpec="*.mpg") returned 0 [0097.182] lstrlenA (lpString="*.mpg") returned 5 [0097.182] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen.css", pszSpec="*.flv") returned 0 [0097.182] lstrlenA (lpString="*.flv") returned 5 [0097.182] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen.css", pszSpec="*.avi") returned 0 [0097.182] lstrlenA (lpString="*.avi") returned 5 [0097.182] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen.css", pszSpec="*.mp4") returned 0 [0097.182] lstrlenA (lpString="*.mp4") returned 5 [0097.182] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen.css", pszSpec="*.wmv") returned 0 [0097.182] lstrlenA (lpString="*.wmv") returned 5 [0097.182] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen.css", pszSpec="*.divx") returned 0 [0097.182] lstrlenA (lpString="*.divx") returned 6 [0097.182] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen.css", pszSpec="*.mkv") returned 0 [0097.182] lstrlenA (lpString="*.mkv") returned 5 [0097.182] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen.css", pszSpec="*.mp3") returned 0 [0097.182] lstrlenA (lpString="*.mp3") returned 5 [0097.182] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen.css", pszSpec="*.wav") returned 0 [0097.182] lstrlenA (lpString="*.wav") returned 5 [0097.182] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen.css", pszSpec="*.flac") returned 0 [0097.182] lstrlenA (lpString="*.flac") returned 6 [0097.182] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen.css", pszSpec="*.ape") returned 0 [0097.182] lstrlenA (lpString="*.ape") returned 5 [0097.182] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen.css", pszSpec="*.wma") returned 0 [0097.182] lstrlenA (lpString="*.wma") returned 5 [0097.182] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen.css", pszSpec="*.ac3") returned 0 [0097.182] lstrlenA (lpString="*.ac3") returned 5 [0097.182] FindNextFileA (in: hFindFile=0x5be1a0, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0097.183] PeekMessageA (in: lpMsg=0xaece4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaece4) returned 0 [0097.183] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Sts.css") returned -1 [0097.183] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Sts.css") returned -1 [0097.183] lstrcmpiA (lpString1="", lpString2="Sts.css") returned -1 [0097.183] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen.css") returned="SpringGreen.css" [0097.183] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\", lpString2="Sts.css" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts.css") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts.css" [0097.183] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts.css", pszSpec="*.zip") returned 0 [0097.183] lstrlenA (lpString="*.zip") returned 5 [0097.183] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts.css", pszSpec="*.rar") returned 0 [0097.183] lstrlenA (lpString="*.rar") returned 5 [0097.183] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts.css", pszSpec="*.7z") returned 0 [0097.183] lstrlenA (lpString="*.7z") returned 4 [0097.183] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts.css", pszSpec="*.tar") returned 0 [0097.183] lstrlenA (lpString="*.tar") returned 5 [0097.183] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts.css", pszSpec="*.gzip") returned 0 [0097.183] lstrlenA (lpString="*.gzip") returned 6 [0097.183] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts.css", pszSpec="*.jpg") returned 0 [0097.183] lstrlenA (lpString="*.jpg") returned 5 [0097.183] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts.css", pszSpec="*.jpeg") returned 0 [0097.183] lstrlenA (lpString="*.jpeg") returned 6 [0097.183] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts.css", pszSpec="*.psd") returned 0 [0097.183] lstrlenA (lpString="*.psd") returned 5 [0097.183] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts.css", pszSpec="*.cdr") returned 0 [0097.183] lstrlenA (lpString="*.cdr") returned 5 [0097.183] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts.css", pszSpec="*.dwg") returned 0 [0097.183] lstrlenA (lpString="*.dwg") returned 5 [0097.183] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts.css", pszSpec="*.max") returned 0 [0097.183] lstrlenA (lpString="*.max") returned 5 [0097.183] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts.css", pszSpec="*.bmp") returned 0 [0097.183] lstrlenA (lpString="*.bmp") returned 5 [0097.183] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts.css", pszSpec="*.gif") returned 0 [0097.183] lstrlenA (lpString="*.gif") returned 5 [0097.183] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts.css", pszSpec="*.png") returned 0 [0097.183] lstrlenA (lpString="*.png") returned 5 [0097.183] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts.css", pszSpec="*.doc") returned 0 [0097.183] lstrlenA (lpString="*.doc") returned 5 [0097.183] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts.css", pszSpec="*.docx") returned 0 [0097.183] lstrlenA (lpString="*.docx") returned 6 [0097.183] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts.css", pszSpec="*.xls") returned 0 [0097.183] lstrlenA (lpString="*.xls") returned 5 [0097.184] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts.css", pszSpec="*.xlsx") returned 0 [0097.184] lstrlenA (lpString="*.xlsx") returned 6 [0097.184] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts.css", pszSpec="*.ppt") returned 0 [0097.184] lstrlenA (lpString="*.ppt") returned 5 [0097.184] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts.css", pszSpec="*.pptx") returned 0 [0097.184] lstrlenA (lpString="*.pptx") returned 6 [0097.184] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts.css", pszSpec="*.txt") returned 0 [0097.184] lstrlenA (lpString="*.txt") returned 5 [0097.184] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts.css", pszSpec="*.pdf") returned 0 [0097.184] lstrlenA (lpString="*.pdf") returned 5 [0097.184] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts.css", pszSpec="*.djvu") returned 0 [0097.184] lstrlenA (lpString="*.djvu") returned 6 [0097.184] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts.css", pszSpec="*.htm") returned 0 [0097.184] lstrlenA (lpString="*.htm") returned 5 [0097.184] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts.css", pszSpec="*.html") returned 0 [0097.184] lstrlenA (lpString="*.html") returned 6 [0097.184] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts.css", pszSpec="*.mdb") returned 0 [0097.184] lstrlenA (lpString="*.mdb") returned 5 [0097.184] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts.css", pszSpec="*.cer") returned 0 [0097.184] lstrlenA (lpString="*.cer") returned 5 [0097.184] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts.css", pszSpec="*.p12") returned 0 [0097.184] lstrlenA (lpString="*.p12") returned 5 [0097.184] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts.css", pszSpec="*.pfx") returned 0 [0097.184] lstrlenA (lpString="*.pfx") returned 5 [0097.184] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts.css", pszSpec="*.kwm") returned 0 [0097.184] lstrlenA (lpString="*.kwm") returned 5 [0097.184] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts.css", pszSpec="*.pwm") returned 0 [0097.184] lstrlenA (lpString="*.pwm") returned 5 [0097.184] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts.css", pszSpec="*.1cd") returned 0 [0097.184] lstrlenA (lpString="*.1cd") returned 5 [0097.184] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts.css", pszSpec="*.md") returned 0 [0097.184] lstrlenA (lpString="*.md") returned 4 [0097.184] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts.css", pszSpec="*.mdf") returned 0 [0097.184] lstrlenA (lpString="*.mdf") returned 5 [0097.184] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts.css", pszSpec="*.dbf") returned 0 [0097.184] lstrlenA (lpString="*.dbf") returned 5 [0097.184] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts.css", pszSpec="*.odt") returned 0 [0097.184] lstrlenA (lpString="*.odt") returned 5 [0097.184] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts.css", pszSpec="*.vob") returned 0 [0097.184] lstrlenA (lpString="*.vob") returned 5 [0097.184] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts.css", pszSpec="*.ifo") returned 0 [0097.184] lstrlenA (lpString="*.ifo") returned 5 [0097.185] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts.css", pszSpec="*.lnk") returned 0 [0097.185] lstrlenA (lpString="*.lnk") returned 5 [0097.185] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts.css", pszSpec="*.torrent") returned 0 [0097.185] lstrlenA (lpString="*.torrent") returned 9 [0097.185] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts.css", pszSpec="*.mov") returned 0 [0097.185] lstrlenA (lpString="*.mov") returned 5 [0097.185] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts.css", pszSpec="*.m2v") returned 0 [0097.185] lstrlenA (lpString="*.m2v") returned 5 [0097.185] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts.css", pszSpec="*.3gp") returned 0 [0097.185] lstrlenA (lpString="*.3gp") returned 5 [0097.185] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts.css", pszSpec="*.mpeg") returned 0 [0097.185] lstrlenA (lpString="*.mpeg") returned 6 [0097.185] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts.css", pszSpec="*.mpg") returned 0 [0097.185] lstrlenA (lpString="*.mpg") returned 5 [0097.185] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts.css", pszSpec="*.flv") returned 0 [0097.185] lstrlenA (lpString="*.flv") returned 5 [0097.185] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts.css", pszSpec="*.avi") returned 0 [0097.185] lstrlenA (lpString="*.avi") returned 5 [0097.185] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts.css", pszSpec="*.mp4") returned 0 [0097.185] lstrlenA (lpString="*.mp4") returned 5 [0097.185] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts.css", pszSpec="*.wmv") returned 0 [0097.185] lstrlenA (lpString="*.wmv") returned 5 [0097.185] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts.css", pszSpec="*.divx") returned 0 [0097.185] lstrlenA (lpString="*.divx") returned 6 [0097.185] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts.css", pszSpec="*.mkv") returned 0 [0097.185] lstrlenA (lpString="*.mkv") returned 5 [0097.185] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts.css", pszSpec="*.mp3") returned 0 [0097.185] lstrlenA (lpString="*.mp3") returned 5 [0097.185] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts.css", pszSpec="*.wav") returned 0 [0097.185] lstrlenA (lpString="*.wav") returned 5 [0097.185] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts.css", pszSpec="*.flac") returned 0 [0097.185] lstrlenA (lpString="*.flac") returned 6 [0097.185] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts.css", pszSpec="*.ape") returned 0 [0097.185] lstrlenA (lpString="*.ape") returned 5 [0097.185] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts.css", pszSpec="*.wma") returned 0 [0097.185] lstrlenA (lpString="*.wma") returned 5 [0097.186] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts.css", pszSpec="*.ac3") returned 0 [0097.186] lstrlenA (lpString="*.ac3") returned 5 [0097.186] FindNextFileA (in: hFindFile=0x5be1a0, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0097.186] lstrcmpA (lpString1=".", lpString2="STS2") returned -1 [0097.186] lstrcmpA (lpString1="..", lpString2="STS2") returned -1 [0097.186] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts.css") returned="Sts.css" [0097.186] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\", lpString2="STS2" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2" [0097.186] lstrlenA (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2") returned 99 [0097.186] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\*.*", lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 0x5be1e0 [0097.227] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0097.227] FindNextFileA (in: hFindFile=0x5be1e0, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 1 [0097.227] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0097.227] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0097.227] FindNextFileA (in: hFindFile=0x5be1e0, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 1 [0097.227] PeekMessageA (in: lpMsg=0xaeb94, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaeb94) returned 0 [0097.227] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="background.gif") returned 1 [0097.227] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="background.gif") returned 1 [0097.227] lstrcmpiA (lpString1="", lpString2="background.gif") returned -1 [0097.227] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\*.*") returned="*.*" [0097.227] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\", lpString2="background.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\background.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\background.gif" [0097.227] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\background.gif", pszSpec="*.zip") returned 0 [0097.227] lstrlenA (lpString="*.zip") returned 5 [0097.227] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\background.gif", pszSpec="*.rar") returned 0 [0097.227] lstrlenA (lpString="*.rar") returned 5 [0097.227] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\background.gif", pszSpec="*.7z") returned 0 [0097.227] lstrlenA (lpString="*.7z") returned 4 [0097.227] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\background.gif", pszSpec="*.tar") returned 0 [0097.227] lstrlenA (lpString="*.tar") returned 5 [0097.227] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\background.gif", pszSpec="*.gzip") returned 0 [0097.227] lstrlenA (lpString="*.gzip") returned 6 [0097.227] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\background.gif", pszSpec="*.jpg") returned 0 [0097.227] lstrlenA (lpString="*.jpg") returned 5 [0097.228] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\background.gif", pszSpec="*.jpeg") returned 0 [0097.228] lstrlenA (lpString="*.jpeg") returned 6 [0097.228] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\background.gif", pszSpec="*.psd") returned 0 [0097.228] lstrlenA (lpString="*.psd") returned 5 [0097.228] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\background.gif", pszSpec="*.cdr") returned 0 [0097.228] lstrlenA (lpString="*.cdr") returned 5 [0097.228] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\background.gif", pszSpec="*.dwg") returned 0 [0097.228] lstrlenA (lpString="*.dwg") returned 5 [0097.228] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\background.gif", pszSpec="*.max") returned 0 [0097.228] lstrlenA (lpString="*.max") returned 5 [0097.228] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\background.gif", pszSpec="*.bmp") returned 0 [0097.228] lstrlenA (lpString="*.bmp") returned 5 [0097.228] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\background.gif", pszSpec="*.gif") returned 1 [0097.228] lstrlenA (lpString="*.gif") returned 5 [0097.228] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\background.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\background.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\background.gif" [0097.228] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\background.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\background.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\background.gif" [0097.228] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\background.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\background.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\background.gif." [0097.228] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\background.gif.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\background.gif. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\background.gif. " [0097.228] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\background.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\sts2\\background.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0 [0097.230] GetFileSize (in: hFile=0xa0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xe9 [0097.230] GetFileTime (in: hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xa2a52600, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x6d416d30, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xa2a52600, dwHighDateTime=0x1c747ea)) returned 1 [0097.230] SetFilePointer (in: hFile=0xa0, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0097.230] ReadFile (in: hFile=0xa0, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x8f, lpOverlapped=0x0) returned 1 [0097.231] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\background.gif") returned="background.gif" [0097.231] SetFilePointer (in: hFile=0xa0, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0097.231] WriteFile (in: hFile=0xa0, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x8f, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x8f, lpOverlapped=0x0) returned 1 [0097.231] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0097.231] CloseHandle (hObject=0xa0) returned 1 [0097.231] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\background.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\sts2\\background.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\background.gif. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\sts2\\background.gif. ")) returned 1 [0097.232] FindNextFileA (in: hFindFile=0x5be1e0, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 1 [0097.232] PeekMessageA (in: lpMsg=0xaeb94, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaeb94) returned 0 [0097.232] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="HEADER.GIF") returned -1 [0097.232] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="HEADER.GIF") returned 1 [0097.232] lstrcmpiA (lpString1="", lpString2="HEADER.GIF") returned -1 [0097.232] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\background.gif") returned="background.gif" [0097.232] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\", lpString2="HEADER.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\HEADER.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\HEADER.GIF" [0097.232] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\HEADER.GIF", pszSpec="*.zip") returned 0 [0097.232] lstrlenA (lpString="*.zip") returned 5 [0097.232] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\HEADER.GIF", pszSpec="*.rar") returned 0 [0097.232] lstrlenA (lpString="*.rar") returned 5 [0097.232] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\HEADER.GIF", pszSpec="*.7z") returned 0 [0097.232] lstrlenA (lpString="*.7z") returned 4 [0097.232] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\HEADER.GIF", pszSpec="*.tar") returned 0 [0097.232] lstrlenA (lpString="*.tar") returned 5 [0097.232] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\HEADER.GIF", pszSpec="*.gzip") returned 0 [0097.232] lstrlenA (lpString="*.gzip") returned 6 [0097.233] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\HEADER.GIF", pszSpec="*.jpg") returned 0 [0097.233] lstrlenA (lpString="*.jpg") returned 5 [0097.233] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\HEADER.GIF", pszSpec="*.jpeg") returned 0 [0097.233] lstrlenA (lpString="*.jpeg") returned 6 [0097.233] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\HEADER.GIF", pszSpec="*.psd") returned 0 [0097.233] lstrlenA (lpString="*.psd") returned 5 [0097.233] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\HEADER.GIF", pszSpec="*.cdr") returned 0 [0097.233] lstrlenA (lpString="*.cdr") returned 5 [0097.233] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\HEADER.GIF", pszSpec="*.dwg") returned 0 [0097.233] lstrlenA (lpString="*.dwg") returned 5 [0097.233] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\HEADER.GIF", pszSpec="*.max") returned 0 [0097.233] lstrlenA (lpString="*.max") returned 5 [0097.233] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\HEADER.GIF", pszSpec="*.bmp") returned 0 [0097.233] lstrlenA (lpString="*.bmp") returned 5 [0097.233] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\HEADER.GIF", pszSpec="*.gif") returned 1 [0097.233] lstrlenA (lpString="*.gif") returned 5 [0097.233] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\HEADER.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\HEADER.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\HEADER.GIF" [0097.233] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\HEADER.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\HEADER.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\HEADER.GIF" [0097.233] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\HEADER.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\HEADER.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\HEADER.GIF." [0097.233] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\HEADER.GIF.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\HEADER.GIF. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\HEADER.GIF. " [0097.233] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\HEADER.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\sts2\\header.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0 [0097.234] GetFileSize (in: hFile=0xa0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xcbd [0097.234] GetFileTime (in: hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xa2a52600, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x6d416d30, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xa2a52600, dwHighDateTime=0x1c747ea)) returned 1 [0097.234] SetFilePointer (in: hFile=0xa0, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0097.234] ReadFile (in: hFile=0xa0, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0xc63, lpOverlapped=0x0) returned 1 [0097.257] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\HEADER.GIF") returned="HEADER.GIF" [0097.257] SetFilePointer (in: hFile=0xa0, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0097.257] WriteFile (in: hFile=0xa0, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0xc63, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0xc63, lpOverlapped=0x0) returned 1 [0097.258] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0097.258] CloseHandle (hObject=0xa0) returned 1 [0097.258] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\HEADER.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\sts2\\header.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\HEADER.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\sts2\\header.gif. ")) returned 1 [0097.259] FindNextFileA (in: hFindFile=0x5be1e0, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 1 [0097.259] PeekMessageA (in: lpMsg=0xaeb94, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaeb94) returned 0 [0097.259] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="TAB_OFF.GIF") returned -1 [0097.259] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TAB_OFF.GIF") returned -1 [0097.259] lstrcmpiA (lpString1="", lpString2="TAB_OFF.GIF") returned -1 [0097.259] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\HEADER.GIF") returned="HEADER.GIF" [0097.259] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\", lpString2="TAB_OFF.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_OFF.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_OFF.GIF" [0097.259] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_OFF.GIF", pszSpec="*.zip") returned 0 [0097.259] lstrlenA (lpString="*.zip") returned 5 [0097.259] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_OFF.GIF", pszSpec="*.rar") returned 0 [0097.259] lstrlenA (lpString="*.rar") returned 5 [0097.259] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_OFF.GIF", pszSpec="*.7z") returned 0 [0097.259] lstrlenA (lpString="*.7z") returned 4 [0097.260] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_OFF.GIF", pszSpec="*.tar") returned 0 [0097.260] lstrlenA (lpString="*.tar") returned 5 [0097.260] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_OFF.GIF", pszSpec="*.gzip") returned 0 [0097.260] lstrlenA (lpString="*.gzip") returned 6 [0097.260] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_OFF.GIF", pszSpec="*.jpg") returned 0 [0097.260] lstrlenA (lpString="*.jpg") returned 5 [0097.260] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_OFF.GIF", pszSpec="*.jpeg") returned 0 [0097.260] lstrlenA (lpString="*.jpeg") returned 6 [0097.260] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_OFF.GIF", pszSpec="*.psd") returned 0 [0097.260] lstrlenA (lpString="*.psd") returned 5 [0097.260] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_OFF.GIF", pszSpec="*.cdr") returned 0 [0097.260] lstrlenA (lpString="*.cdr") returned 5 [0097.260] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_OFF.GIF", pszSpec="*.dwg") returned 0 [0097.260] lstrlenA (lpString="*.dwg") returned 5 [0097.260] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_OFF.GIF", pszSpec="*.max") returned 0 [0097.260] lstrlenA (lpString="*.max") returned 5 [0097.260] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_OFF.GIF", pszSpec="*.bmp") returned 0 [0097.260] lstrlenA (lpString="*.bmp") returned 5 [0097.260] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_OFF.GIF", pszSpec="*.gif") returned 1 [0097.260] lstrlenA (lpString="*.gif") returned 5 [0097.260] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_OFF.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_OFF.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_OFF.GIF" [0097.260] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_OFF.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_OFF.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_OFF.GIF" [0097.260] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_OFF.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_OFF.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_OFF.GIF." [0097.260] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_OFF.GIF.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_OFF.GIF. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_OFF.GIF. " [0097.260] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\sts2\\tab_off.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0 [0097.262] GetFileSize (in: hFile=0xa0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1ce [0097.262] GetFileTime (in: hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xa2a52600, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5ac07cf0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xa2a52600, dwHighDateTime=0x1c747ea)) returned 1 [0097.262] SetFilePointer (in: hFile=0xa0, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0097.262] ReadFile (in: hFile=0xa0, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x174, lpOverlapped=0x0) returned 1 [0097.263] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_OFF.GIF") returned="TAB_OFF.GIF" [0097.263] SetFilePointer (in: hFile=0xa0, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0097.263] WriteFile (in: hFile=0xa0, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x174, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x174, lpOverlapped=0x0) returned 1 [0097.263] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0097.263] CloseHandle (hObject=0xa0) returned 1 [0097.263] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\sts2\\tab_off.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_OFF.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\sts2\\tab_off.gif. ")) returned 1 [0097.307] FindNextFileA (in: hFindFile=0x5be1e0, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 1 [0097.307] PeekMessageA (in: lpMsg=0xaeb94, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaeb94) returned 0 [0097.307] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="TAB_ON.GIF") returned -1 [0097.307] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TAB_ON.GIF") returned -1 [0097.307] lstrcmpiA (lpString1="", lpString2="TAB_ON.GIF") returned -1 [0097.307] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_OFF.GIF") returned="TAB_OFF.GIF" [0097.307] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\", lpString2="TAB_ON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_ON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_ON.GIF" [0097.307] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_ON.GIF", pszSpec="*.zip") returned 0 [0097.307] lstrlenA (lpString="*.zip") returned 5 [0097.307] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_ON.GIF", pszSpec="*.rar") returned 0 [0097.307] lstrlenA (lpString="*.rar") returned 5 [0097.307] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_ON.GIF", pszSpec="*.7z") returned 0 [0097.307] lstrlenA (lpString="*.7z") returned 4 [0097.307] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_ON.GIF", pszSpec="*.tar") returned 0 [0097.307] lstrlenA (lpString="*.tar") returned 5 [0097.307] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_ON.GIF", pszSpec="*.gzip") returned 0 [0097.307] lstrlenA (lpString="*.gzip") returned 6 [0097.307] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_ON.GIF", pszSpec="*.jpg") returned 0 [0097.307] lstrlenA (lpString="*.jpg") returned 5 [0097.307] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_ON.GIF", pszSpec="*.jpeg") returned 0 [0097.307] lstrlenA (lpString="*.jpeg") returned 6 [0097.307] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_ON.GIF", pszSpec="*.psd") returned 0 [0097.307] lstrlenA (lpString="*.psd") returned 5 [0097.307] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_ON.GIF", pszSpec="*.cdr") returned 0 [0097.307] lstrlenA (lpString="*.cdr") returned 5 [0097.307] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_ON.GIF", pszSpec="*.dwg") returned 0 [0097.307] lstrlenA (lpString="*.dwg") returned 5 [0097.307] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_ON.GIF", pszSpec="*.max") returned 0 [0097.307] lstrlenA (lpString="*.max") returned 5 [0097.307] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_ON.GIF", pszSpec="*.bmp") returned 0 [0097.308] lstrlenA (lpString="*.bmp") returned 5 [0097.308] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_ON.GIF", pszSpec="*.gif") returned 1 [0097.308] lstrlenA (lpString="*.gif") returned 5 [0097.308] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_ON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_ON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_ON.GIF" [0097.308] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_ON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_ON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_ON.GIF" [0097.308] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_ON.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_ON.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_ON.GIF." [0097.308] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_ON.GIF.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_ON.GIF. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_ON.GIF. " [0097.308] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\sts2\\tab_on.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0 [0097.309] GetFileSize (in: hFile=0xa0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x108 [0097.309] GetFileTime (in: hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xa2a52600, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5ac07cf0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xa2a52600, dwHighDateTime=0x1c747ea)) returned 1 [0097.309] SetFilePointer (in: hFile=0xa0, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0097.309] ReadFile (in: hFile=0xa0, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0xae, lpOverlapped=0x0) returned 1 [0097.310] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_ON.GIF") returned="TAB_ON.GIF" [0097.310] SetFilePointer (in: hFile=0xa0, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0097.310] WriteFile (in: hFile=0xa0, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0xae, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0xae, lpOverlapped=0x0) returned 1 [0097.310] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0097.310] CloseHandle (hObject=0xa0) returned 1 [0097.310] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\sts2\\tab_on.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_ON.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\sts2\\tab_on.gif. ")) returned 1 [0097.312] FindNextFileA (in: hFindFile=0x5be1e0, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 0 [0097.312] FindClose (in: hFindFile=0x5be1e0 | out: hFindFile=0x5be1e0) returned 1 [0097.312] FindNextFileA (in: hFindFile=0x5be1a0, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0097.312] PeekMessageA (in: lpMsg=0xaece4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaece4) returned 0 [0097.312] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Sts2.css") returned -1 [0097.312] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Sts2.css") returned -1 [0097.312] lstrcmpiA (lpString1="", lpString2="Sts2.css") returned -1 [0097.312] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\*.*") returned="*.*" [0097.312] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\", lpString2="Sts2.css" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts2.css") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts2.css" [0097.312] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts2.css", pszSpec="*.zip") returned 0 [0097.312] lstrlenA (lpString="*.zip") returned 5 [0097.312] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts2.css", pszSpec="*.rar") returned 0 [0097.312] lstrlenA (lpString="*.rar") returned 5 [0097.312] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts2.css", pszSpec="*.7z") returned 0 [0097.312] lstrlenA (lpString="*.7z") returned 4 [0097.312] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts2.css", pszSpec="*.tar") returned 0 [0097.312] lstrlenA (lpString="*.tar") returned 5 [0097.312] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts2.css", pszSpec="*.gzip") returned 0 [0097.312] lstrlenA (lpString="*.gzip") returned 6 [0097.312] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts2.css", pszSpec="*.jpg") returned 0 [0097.312] lstrlenA (lpString="*.jpg") returned 5 [0097.312] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts2.css", pszSpec="*.jpeg") returned 0 [0097.312] lstrlenA (lpString="*.jpeg") returned 6 [0097.312] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts2.css", pszSpec="*.psd") returned 0 [0097.312] lstrlenA (lpString="*.psd") returned 5 [0097.312] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts2.css", pszSpec="*.cdr") returned 0 [0097.312] lstrlenA (lpString="*.cdr") returned 5 [0097.312] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts2.css", pszSpec="*.dwg") returned 0 [0097.312] lstrlenA (lpString="*.dwg") returned 5 [0097.312] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts2.css", pszSpec="*.max") returned 0 [0097.312] lstrlenA (lpString="*.max") returned 5 [0097.312] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts2.css", pszSpec="*.bmp") returned 0 [0097.312] lstrlenA (lpString="*.bmp") returned 5 [0097.312] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts2.css", pszSpec="*.gif") returned 0 [0097.312] lstrlenA (lpString="*.gif") returned 5 [0097.312] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts2.css", pszSpec="*.png") returned 0 [0097.312] lstrlenA (lpString="*.png") returned 5 [0097.313] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts2.css", pszSpec="*.doc") returned 0 [0097.313] lstrlenA (lpString="*.doc") returned 5 [0097.313] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts2.css", pszSpec="*.docx") returned 0 [0097.313] lstrlenA (lpString="*.docx") returned 6 [0097.313] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts2.css", pszSpec="*.xls") returned 0 [0097.313] lstrlenA (lpString="*.xls") returned 5 [0097.313] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts2.css", pszSpec="*.xlsx") returned 0 [0097.313] lstrlenA (lpString="*.xlsx") returned 6 [0097.313] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts2.css", pszSpec="*.ppt") returned 0 [0097.313] lstrlenA (lpString="*.ppt") returned 5 [0097.313] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts2.css", pszSpec="*.pptx") returned 0 [0097.313] lstrlenA (lpString="*.pptx") returned 6 [0097.313] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts2.css", pszSpec="*.txt") returned 0 [0097.313] lstrlenA (lpString="*.txt") returned 5 [0097.313] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts2.css", pszSpec="*.pdf") returned 0 [0097.313] lstrlenA (lpString="*.pdf") returned 5 [0097.313] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts2.css", pszSpec="*.djvu") returned 0 [0097.313] lstrlenA (lpString="*.djvu") returned 6 [0097.313] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts2.css", pszSpec="*.htm") returned 0 [0097.313] lstrlenA (lpString="*.htm") returned 5 [0097.313] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts2.css", pszSpec="*.html") returned 0 [0097.313] lstrlenA (lpString="*.html") returned 6 [0097.313] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts2.css", pszSpec="*.mdb") returned 0 [0097.313] lstrlenA (lpString="*.mdb") returned 5 [0097.313] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts2.css", pszSpec="*.cer") returned 0 [0097.313] lstrlenA (lpString="*.cer") returned 5 [0097.313] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts2.css", pszSpec="*.p12") returned 0 [0097.313] lstrlenA (lpString="*.p12") returned 5 [0097.313] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts2.css", pszSpec="*.pfx") returned 0 [0097.313] lstrlenA (lpString="*.pfx") returned 5 [0097.313] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts2.css", pszSpec="*.kwm") returned 0 [0097.313] lstrlenA (lpString="*.kwm") returned 5 [0097.313] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts2.css", pszSpec="*.pwm") returned 0 [0097.313] lstrlenA (lpString="*.pwm") returned 5 [0097.313] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts2.css", pszSpec="*.1cd") returned 0 [0097.313] lstrlenA (lpString="*.1cd") returned 5 [0097.313] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts2.css", pszSpec="*.md") returned 0 [0097.313] lstrlenA (lpString="*.md") returned 4 [0097.313] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts2.css", pszSpec="*.mdf") returned 0 [0097.313] lstrlenA (lpString="*.mdf") returned 5 [0097.313] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts2.css", pszSpec="*.dbf") returned 0 [0097.313] lstrlenA (lpString="*.dbf") returned 5 [0097.314] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts2.css", pszSpec="*.odt") returned 0 [0097.314] lstrlenA (lpString="*.odt") returned 5 [0097.314] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts2.css", pszSpec="*.vob") returned 0 [0097.314] lstrlenA (lpString="*.vob") returned 5 [0097.314] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts2.css", pszSpec="*.ifo") returned 0 [0097.314] lstrlenA (lpString="*.ifo") returned 5 [0097.314] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts2.css", pszSpec="*.lnk") returned 0 [0097.314] lstrlenA (lpString="*.lnk") returned 5 [0097.314] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts2.css", pszSpec="*.torrent") returned 0 [0097.314] lstrlenA (lpString="*.torrent") returned 9 [0097.314] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts2.css", pszSpec="*.mov") returned 0 [0097.314] lstrlenA (lpString="*.mov") returned 5 [0097.314] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts2.css", pszSpec="*.m2v") returned 0 [0097.314] lstrlenA (lpString="*.m2v") returned 5 [0097.314] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts2.css", pszSpec="*.3gp") returned 0 [0097.314] lstrlenA (lpString="*.3gp") returned 5 [0097.314] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts2.css", pszSpec="*.mpeg") returned 0 [0097.314] lstrlenA (lpString="*.mpeg") returned 6 [0097.314] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts2.css", pszSpec="*.mpg") returned 0 [0097.314] lstrlenA (lpString="*.mpg") returned 5 [0097.314] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts2.css", pszSpec="*.flv") returned 0 [0097.314] lstrlenA (lpString="*.flv") returned 5 [0097.314] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts2.css", pszSpec="*.avi") returned 0 [0097.314] lstrlenA (lpString="*.avi") returned 5 [0097.314] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts2.css", pszSpec="*.mp4") returned 0 [0097.314] lstrlenA (lpString="*.mp4") returned 5 [0097.314] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts2.css", pszSpec="*.wmv") returned 0 [0097.314] lstrlenA (lpString="*.wmv") returned 5 [0097.314] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts2.css", pszSpec="*.divx") returned 0 [0097.314] lstrlenA (lpString="*.divx") returned 6 [0097.314] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts2.css", pszSpec="*.mkv") returned 0 [0097.314] lstrlenA (lpString="*.mkv") returned 5 [0097.314] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts2.css", pszSpec="*.mp3") returned 0 [0097.314] lstrlenA (lpString="*.mp3") returned 5 [0097.314] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts2.css", pszSpec="*.wav") returned 0 [0097.315] lstrlenA (lpString="*.wav") returned 5 [0097.315] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts2.css", pszSpec="*.flac") returned 0 [0097.315] lstrlenA (lpString="*.flac") returned 6 [0097.315] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts2.css", pszSpec="*.ape") returned 0 [0097.315] lstrlenA (lpString="*.ape") returned 5 [0097.315] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts2.css", pszSpec="*.wma") returned 0 [0097.315] lstrlenA (lpString="*.wma") returned 5 [0097.315] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts2.css", pszSpec="*.ac3") returned 0 [0097.315] lstrlenA (lpString="*.ac3") returned 5 [0097.315] FindNextFileA (in: hFindFile=0x5be1a0, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0097.315] lstrcmpA (lpString1=".", lpString2="Swirl") returned -1 [0097.315] lstrcmpA (lpString1="..", lpString2="Swirl") returned -1 [0097.315] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts2.css") returned="Sts2.css" [0097.315] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\", lpString2="Swirl" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl" [0097.315] lstrlenA (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl") returned 100 [0097.315] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\*.*", lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 0x5be1e0 [0097.335] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0097.335] FindNextFileA (in: hFindFile=0x5be1e0, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 1 [0097.335] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0097.335] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0097.335] FindNextFileA (in: hFindFile=0x5be1e0, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 1 [0097.335] PeekMessageA (in: lpMsg=0xaeb94, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaeb94) returned 0 [0097.335] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="background.gif") returned 1 [0097.335] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="background.gif") returned 1 [0097.335] lstrcmpiA (lpString1="", lpString2="background.gif") returned -1 [0097.335] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\*.*") returned="*.*" [0097.335] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\", lpString2="background.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\background.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\background.gif" [0097.336] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\background.gif", pszSpec="*.zip") returned 0 [0097.336] lstrlenA (lpString="*.zip") returned 5 [0097.336] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\background.gif", pszSpec="*.rar") returned 0 [0097.336] lstrlenA (lpString="*.rar") returned 5 [0097.336] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\background.gif", pszSpec="*.7z") returned 0 [0097.336] lstrlenA (lpString="*.7z") returned 4 [0097.336] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\background.gif", pszSpec="*.tar") returned 0 [0097.336] lstrlenA (lpString="*.tar") returned 5 [0097.336] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\background.gif", pszSpec="*.gzip") returned 0 [0097.336] lstrlenA (lpString="*.gzip") returned 6 [0097.336] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\background.gif", pszSpec="*.jpg") returned 0 [0097.336] lstrlenA (lpString="*.jpg") returned 5 [0097.336] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\background.gif", pszSpec="*.jpeg") returned 0 [0097.336] lstrlenA (lpString="*.jpeg") returned 6 [0097.336] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\background.gif", pszSpec="*.psd") returned 0 [0097.336] lstrlenA (lpString="*.psd") returned 5 [0097.336] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\background.gif", pszSpec="*.cdr") returned 0 [0097.336] lstrlenA (lpString="*.cdr") returned 5 [0097.336] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\background.gif", pszSpec="*.dwg") returned 0 [0097.336] lstrlenA (lpString="*.dwg") returned 5 [0097.336] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\background.gif", pszSpec="*.max") returned 0 [0097.336] lstrlenA (lpString="*.max") returned 5 [0097.336] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\background.gif", pszSpec="*.bmp") returned 0 [0097.336] lstrlenA (lpString="*.bmp") returned 5 [0097.336] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\background.gif", pszSpec="*.gif") returned 1 [0097.336] lstrlenA (lpString="*.gif") returned 5 [0097.336] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\background.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\background.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\background.gif" [0097.336] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\background.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\background.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\background.gif" [0097.336] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\background.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\background.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\background.gif." [0097.336] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\background.gif.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\background.gif. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\background.gif. " [0097.336] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\background.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\swirl\\background.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0 [0097.338] GetFileSize (in: hFile=0xa0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x32f [0097.338] GetFileTime (in: hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xa2a52600, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x6d43ce90, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xa2a52600, dwHighDateTime=0x1c747ea)) returned 1 [0097.338] SetFilePointer (in: hFile=0xa0, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0097.338] ReadFile (in: hFile=0xa0, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x2d5, lpOverlapped=0x0) returned 1 [0097.363] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\background.gif") returned="background.gif" [0097.363] SetFilePointer (in: hFile=0xa0, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0097.363] WriteFile (in: hFile=0xa0, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x2d5, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x2d5, lpOverlapped=0x0) returned 1 [0097.363] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0097.363] CloseHandle (hObject=0xa0) returned 1 [0097.363] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\background.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\swirl\\background.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\background.gif. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\swirl\\background.gif. ")) returned 1 [0097.364] FindNextFileA (in: hFindFile=0x5be1e0, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 1 [0097.364] PeekMessageA (in: lpMsg=0xaeb94, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaeb94) returned 0 [0097.364] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="HEADER.GIF") returned -1 [0097.364] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="HEADER.GIF") returned 1 [0097.364] lstrcmpiA (lpString1="", lpString2="HEADER.GIF") returned -1 [0097.364] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\background.gif") returned="background.gif" [0097.365] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\", lpString2="HEADER.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\HEADER.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\HEADER.GIF" [0097.365] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\HEADER.GIF", pszSpec="*.zip") returned 0 [0097.365] lstrlenA (lpString="*.zip") returned 5 [0097.365] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\HEADER.GIF", pszSpec="*.rar") returned 0 [0097.365] lstrlenA (lpString="*.rar") returned 5 [0097.365] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\HEADER.GIF", pszSpec="*.7z") returned 0 [0097.365] lstrlenA (lpString="*.7z") returned 4 [0097.365] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\HEADER.GIF", pszSpec="*.tar") returned 0 [0097.365] lstrlenA (lpString="*.tar") returned 5 [0097.365] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\HEADER.GIF", pszSpec="*.gzip") returned 0 [0097.365] lstrlenA (lpString="*.gzip") returned 6 [0097.365] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\HEADER.GIF", pszSpec="*.jpg") returned 0 [0097.365] lstrlenA (lpString="*.jpg") returned 5 [0097.365] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\HEADER.GIF", pszSpec="*.jpeg") returned 0 [0097.365] lstrlenA (lpString="*.jpeg") returned 6 [0097.365] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\HEADER.GIF", pszSpec="*.psd") returned 0 [0097.365] lstrlenA (lpString="*.psd") returned 5 [0097.365] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\HEADER.GIF", pszSpec="*.cdr") returned 0 [0097.365] lstrlenA (lpString="*.cdr") returned 5 [0097.365] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\HEADER.GIF", pszSpec="*.dwg") returned 0 [0097.365] lstrlenA (lpString="*.dwg") returned 5 [0097.365] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\HEADER.GIF", pszSpec="*.max") returned 0 [0097.365] lstrlenA (lpString="*.max") returned 5 [0097.365] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\HEADER.GIF", pszSpec="*.bmp") returned 0 [0097.365] lstrlenA (lpString="*.bmp") returned 5 [0097.365] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\HEADER.GIF", pszSpec="*.gif") returned 1 [0097.365] lstrlenA (lpString="*.gif") returned 5 [0097.365] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\HEADER.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\HEADER.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\HEADER.GIF" [0097.365] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\HEADER.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\HEADER.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\HEADER.GIF" [0097.365] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\HEADER.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\HEADER.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\HEADER.GIF." [0097.365] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\HEADER.GIF.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\HEADER.GIF. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\HEADER.GIF. " [0097.365] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\HEADER.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\swirl\\header.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0 [0097.366] GetFileSize (in: hFile=0xa0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x6993 [0097.366] GetFileTime (in: hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xa2a52600, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5ac7a110, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xa2a52600, dwHighDateTime=0x1c747ea)) returned 1 [0097.366] SetFilePointer (in: hFile=0xa0, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0097.366] ReadFile (in: hFile=0xa0, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x6939, lpOverlapped=0x0) returned 1 [0097.399] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\HEADER.GIF") returned="HEADER.GIF" [0097.399] SetFilePointer (in: hFile=0xa0, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0097.399] WriteFile (in: hFile=0xa0, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x6939, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x6939, lpOverlapped=0x0) returned 1 [0097.399] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0097.399] CloseHandle (hObject=0xa0) returned 1 [0097.399] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\HEADER.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\swirl\\header.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\HEADER.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\swirl\\header.gif. ")) returned 1 [0097.401] FindNextFileA (in: hFindFile=0x5be1e0, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 1 [0097.401] PeekMessageA (in: lpMsg=0xaeb94, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaeb94) returned 0 [0097.401] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="TAB_OFF.GIF") returned -1 [0097.401] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TAB_OFF.GIF") returned -1 [0097.401] lstrcmpiA (lpString1="", lpString2="TAB_OFF.GIF") returned -1 [0097.401] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\HEADER.GIF") returned="HEADER.GIF" [0097.401] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\", lpString2="TAB_OFF.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_OFF.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_OFF.GIF" [0097.401] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_OFF.GIF", pszSpec="*.zip") returned 0 [0097.401] lstrlenA (lpString="*.zip") returned 5 [0097.401] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_OFF.GIF", pszSpec="*.rar") returned 0 [0097.401] lstrlenA (lpString="*.rar") returned 5 [0097.401] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_OFF.GIF", pszSpec="*.7z") returned 0 [0097.401] lstrlenA (lpString="*.7z") returned 4 [0097.401] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_OFF.GIF", pszSpec="*.tar") returned 0 [0097.401] lstrlenA (lpString="*.tar") returned 5 [0097.401] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_OFF.GIF", pszSpec="*.gzip") returned 0 [0097.401] lstrlenA (lpString="*.gzip") returned 6 [0097.401] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_OFF.GIF", pszSpec="*.jpg") returned 0 [0097.401] lstrlenA (lpString="*.jpg") returned 5 [0097.401] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_OFF.GIF", pszSpec="*.jpeg") returned 0 [0097.401] lstrlenA (lpString="*.jpeg") returned 6 [0097.401] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_OFF.GIF", pszSpec="*.psd") returned 0 [0097.401] lstrlenA (lpString="*.psd") returned 5 [0097.401] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_OFF.GIF", pszSpec="*.cdr") returned 0 [0097.401] lstrlenA (lpString="*.cdr") returned 5 [0097.401] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_OFF.GIF", pszSpec="*.dwg") returned 0 [0097.401] lstrlenA (lpString="*.dwg") returned 5 [0097.401] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_OFF.GIF", pszSpec="*.max") returned 0 [0097.401] lstrlenA (lpString="*.max") returned 5 [0097.401] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_OFF.GIF", pszSpec="*.bmp") returned 0 [0097.401] lstrlenA (lpString="*.bmp") returned 5 [0097.401] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_OFF.GIF", pszSpec="*.gif") returned 1 [0097.402] lstrlenA (lpString="*.gif") returned 5 [0097.402] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_OFF.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_OFF.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_OFF.GIF" [0097.402] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_OFF.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_OFF.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_OFF.GIF" [0097.402] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_OFF.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_OFF.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_OFF.GIF." [0097.402] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_OFF.GIF.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_OFF.GIF. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_OFF.GIF. " [0097.402] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\swirl\\tab_off.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0 [0097.403] GetFileSize (in: hFile=0xa0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x155 [0097.403] GetFileTime (in: hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xa3d65300, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5ac7a110, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xa3d65300, dwHighDateTime=0x1c747ea)) returned 1 [0097.403] SetFilePointer (in: hFile=0xa0, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0097.403] ReadFile (in: hFile=0xa0, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0xfb, lpOverlapped=0x0) returned 1 [0097.404] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_OFF.GIF") returned="TAB_OFF.GIF" [0097.404] SetFilePointer (in: hFile=0xa0, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0097.404] WriteFile (in: hFile=0xa0, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0xfb, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0xfb, lpOverlapped=0x0) returned 1 [0097.404] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0097.404] CloseHandle (hObject=0xa0) returned 1 [0097.404] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\swirl\\tab_off.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_OFF.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\swirl\\tab_off.gif. ")) returned 1 [0097.407] FindNextFileA (in: hFindFile=0x5be1e0, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 1 [0097.407] PeekMessageA (in: lpMsg=0xaeb94, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaeb94) returned 0 [0097.407] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="TAB_ON.GIF") returned -1 [0097.407] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TAB_ON.GIF") returned -1 [0097.407] lstrcmpiA (lpString1="", lpString2="TAB_ON.GIF") returned -1 [0097.407] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_OFF.GIF") returned="TAB_OFF.GIF" [0097.407] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\", lpString2="TAB_ON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_ON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_ON.GIF" [0097.407] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_ON.GIF", pszSpec="*.zip") returned 0 [0097.407] lstrlenA (lpString="*.zip") returned 5 [0097.407] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_ON.GIF", pszSpec="*.rar") returned 0 [0097.407] lstrlenA (lpString="*.rar") returned 5 [0097.407] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_ON.GIF", pszSpec="*.7z") returned 0 [0097.407] lstrlenA (lpString="*.7z") returned 4 [0097.407] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_ON.GIF", pszSpec="*.tar") returned 0 [0097.407] lstrlenA (lpString="*.tar") returned 5 [0097.407] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_ON.GIF", pszSpec="*.gzip") returned 0 [0097.407] lstrlenA (lpString="*.gzip") returned 6 [0097.407] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_ON.GIF", pszSpec="*.jpg") returned 0 [0097.407] lstrlenA (lpString="*.jpg") returned 5 [0097.407] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_ON.GIF", pszSpec="*.jpeg") returned 0 [0097.407] lstrlenA (lpString="*.jpeg") returned 6 [0097.407] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_ON.GIF", pszSpec="*.psd") returned 0 [0097.407] lstrlenA (lpString="*.psd") returned 5 [0097.407] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_ON.GIF", pszSpec="*.cdr") returned 0 [0097.407] lstrlenA (lpString="*.cdr") returned 5 [0097.407] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_ON.GIF", pszSpec="*.dwg") returned 0 [0097.407] lstrlenA (lpString="*.dwg") returned 5 [0097.407] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_ON.GIF", pszSpec="*.max") returned 0 [0097.407] lstrlenA (lpString="*.max") returned 5 [0097.407] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_ON.GIF", pszSpec="*.bmp") returned 0 [0097.407] lstrlenA (lpString="*.bmp") returned 5 [0097.407] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_ON.GIF", pszSpec="*.gif") returned 1 [0097.407] lstrlenA (lpString="*.gif") returned 5 [0097.408] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_ON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_ON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_ON.GIF" [0097.408] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_ON.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_ON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_ON.GIF" [0097.408] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_ON.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_ON.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_ON.GIF." [0097.408] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_ON.GIF.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_ON.GIF. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_ON.GIF. " [0097.408] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\swirl\\tab_on.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0 [0097.409] GetFileSize (in: hFile=0xa0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xde [0097.409] GetFileTime (in: hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xa3d65300, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x6d43ce90, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xa3d65300, dwHighDateTime=0x1c747ea)) returned 1 [0097.409] SetFilePointer (in: hFile=0xa0, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0097.409] ReadFile (in: hFile=0xa0, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x84, lpOverlapped=0x0) returned 1 [0097.410] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_ON.GIF") returned="TAB_ON.GIF" [0097.410] SetFilePointer (in: hFile=0xa0, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0097.410] WriteFile (in: hFile=0xa0, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x84, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x84, lpOverlapped=0x0) returned 1 [0097.410] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0097.410] CloseHandle (hObject=0xa0) returned 1 [0097.410] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\swirl\\tab_on.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_ON.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\swirl\\tab_on.gif. ")) returned 1 [0097.411] FindNextFileA (in: hFindFile=0x5be1e0, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 0 [0097.411] FindClose (in: hFindFile=0x5be1e0 | out: hFindFile=0x5be1e0) returned 1 [0097.411] FindNextFileA (in: hFindFile=0x5be1a0, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0097.411] PeekMessageA (in: lpMsg=0xaece4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaece4) returned 0 [0097.411] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Swirl.css") returned -1 [0097.411] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Swirl.css") returned -1 [0097.411] lstrcmpiA (lpString1="", lpString2="Swirl.css") returned -1 [0097.411] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\*.*") returned="*.*" [0097.411] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\", lpString2="Swirl.css" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl.css") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl.css" [0097.411] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl.css", pszSpec="*.zip") returned 0 [0097.411] lstrlenA (lpString="*.zip") returned 5 [0097.411] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl.css", pszSpec="*.rar") returned 0 [0097.412] lstrlenA (lpString="*.rar") returned 5 [0097.412] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl.css", pszSpec="*.7z") returned 0 [0097.412] lstrlenA (lpString="*.7z") returned 4 [0097.412] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl.css", pszSpec="*.tar") returned 0 [0097.412] lstrlenA (lpString="*.tar") returned 5 [0097.412] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl.css", pszSpec="*.gzip") returned 0 [0097.412] lstrlenA (lpString="*.gzip") returned 6 [0097.412] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl.css", pszSpec="*.jpg") returned 0 [0097.412] lstrlenA (lpString="*.jpg") returned 5 [0097.412] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl.css", pszSpec="*.jpeg") returned 0 [0097.412] lstrlenA (lpString="*.jpeg") returned 6 [0097.412] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl.css", pszSpec="*.psd") returned 0 [0097.412] lstrlenA (lpString="*.psd") returned 5 [0097.412] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl.css", pszSpec="*.cdr") returned 0 [0097.412] lstrlenA (lpString="*.cdr") returned 5 [0097.412] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl.css", pszSpec="*.dwg") returned 0 [0097.412] lstrlenA (lpString="*.dwg") returned 5 [0097.412] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl.css", pszSpec="*.max") returned 0 [0097.412] lstrlenA (lpString="*.max") returned 5 [0097.412] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl.css", pszSpec="*.bmp") returned 0 [0097.412] lstrlenA (lpString="*.bmp") returned 5 [0097.412] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl.css", pszSpec="*.gif") returned 0 [0097.412] lstrlenA (lpString="*.gif") returned 5 [0097.412] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl.css", pszSpec="*.png") returned 0 [0097.412] lstrlenA (lpString="*.png") returned 5 [0097.412] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl.css", pszSpec="*.doc") returned 0 [0097.412] lstrlenA (lpString="*.doc") returned 5 [0097.412] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl.css", pszSpec="*.docx") returned 0 [0097.412] lstrlenA (lpString="*.docx") returned 6 [0097.412] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl.css", pszSpec="*.xls") returned 0 [0097.412] lstrlenA (lpString="*.xls") returned 5 [0097.412] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl.css", pszSpec="*.xlsx") returned 0 [0097.412] lstrlenA (lpString="*.xlsx") returned 6 [0097.412] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl.css", pszSpec="*.ppt") returned 0 [0097.412] lstrlenA (lpString="*.ppt") returned 5 [0097.412] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl.css", pszSpec="*.pptx") returned 0 [0097.412] lstrlenA (lpString="*.pptx") returned 6 [0097.412] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl.css", pszSpec="*.txt") returned 0 [0097.413] lstrlenA (lpString="*.txt") returned 5 [0097.413] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl.css", pszSpec="*.pdf") returned 0 [0097.413] lstrlenA (lpString="*.pdf") returned 5 [0097.413] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl.css", pszSpec="*.djvu") returned 0 [0097.413] lstrlenA (lpString="*.djvu") returned 6 [0097.413] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl.css", pszSpec="*.htm") returned 0 [0097.413] lstrlenA (lpString="*.htm") returned 5 [0097.413] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl.css", pszSpec="*.html") returned 0 [0097.413] lstrlenA (lpString="*.html") returned 6 [0097.413] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl.css", pszSpec="*.mdb") returned 0 [0097.413] lstrlenA (lpString="*.mdb") returned 5 [0097.413] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl.css", pszSpec="*.cer") returned 0 [0097.413] lstrlenA (lpString="*.cer") returned 5 [0097.413] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl.css", pszSpec="*.p12") returned 0 [0097.413] lstrlenA (lpString="*.p12") returned 5 [0097.413] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl.css", pszSpec="*.pfx") returned 0 [0097.413] lstrlenA (lpString="*.pfx") returned 5 [0097.413] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl.css", pszSpec="*.kwm") returned 0 [0097.413] lstrlenA (lpString="*.kwm") returned 5 [0097.413] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl.css", pszSpec="*.pwm") returned 0 [0097.413] lstrlenA (lpString="*.pwm") returned 5 [0097.413] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl.css", pszSpec="*.1cd") returned 0 [0097.413] lstrlenA (lpString="*.1cd") returned 5 [0097.413] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl.css", pszSpec="*.md") returned 0 [0097.413] lstrlenA (lpString="*.md") returned 4 [0097.413] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl.css", pszSpec="*.mdf") returned 0 [0097.413] lstrlenA (lpString="*.mdf") returned 5 [0097.413] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl.css", pszSpec="*.dbf") returned 0 [0097.413] lstrlenA (lpString="*.dbf") returned 5 [0097.413] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl.css", pszSpec="*.odt") returned 0 [0097.413] lstrlenA (lpString="*.odt") returned 5 [0097.413] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl.css", pszSpec="*.vob") returned 0 [0097.413] lstrlenA (lpString="*.vob") returned 5 [0097.413] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl.css", pszSpec="*.ifo") returned 0 [0097.413] lstrlenA (lpString="*.ifo") returned 5 [0097.413] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl.css", pszSpec="*.lnk") returned 0 [0097.413] lstrlenA (lpString="*.lnk") returned 5 [0097.413] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl.css", pszSpec="*.torrent") returned 0 [0097.413] lstrlenA (lpString="*.torrent") returned 9 [0097.413] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl.css", pszSpec="*.mov") returned 0 [0097.414] lstrlenA (lpString="*.mov") returned 5 [0097.414] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl.css", pszSpec="*.m2v") returned 0 [0097.414] lstrlenA (lpString="*.m2v") returned 5 [0097.414] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl.css", pszSpec="*.3gp") returned 0 [0097.414] lstrlenA (lpString="*.3gp") returned 5 [0097.414] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl.css", pszSpec="*.mpeg") returned 0 [0097.414] lstrlenA (lpString="*.mpeg") returned 6 [0097.414] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl.css", pszSpec="*.mpg") returned 0 [0097.414] lstrlenA (lpString="*.mpg") returned 5 [0097.414] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl.css", pszSpec="*.flv") returned 0 [0097.414] lstrlenA (lpString="*.flv") returned 5 [0097.414] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl.css", pszSpec="*.avi") returned 0 [0097.414] lstrlenA (lpString="*.avi") returned 5 [0097.414] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl.css", pszSpec="*.mp4") returned 0 [0097.414] lstrlenA (lpString="*.mp4") returned 5 [0097.414] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl.css", pszSpec="*.wmv") returned 0 [0097.414] lstrlenA (lpString="*.wmv") returned 5 [0097.414] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl.css", pszSpec="*.divx") returned 0 [0097.414] lstrlenA (lpString="*.divx") returned 6 [0097.414] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl.css", pszSpec="*.mkv") returned 0 [0097.414] lstrlenA (lpString="*.mkv") returned 5 [0097.414] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl.css", pszSpec="*.mp3") returned 0 [0097.414] lstrlenA (lpString="*.mp3") returned 5 [0097.414] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl.css", pszSpec="*.wav") returned 0 [0097.414] lstrlenA (lpString="*.wav") returned 5 [0097.414] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl.css", pszSpec="*.flac") returned 0 [0097.414] lstrlenA (lpString="*.flac") returned 6 [0097.414] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl.css", pszSpec="*.ape") returned 0 [0097.414] lstrlenA (lpString="*.ape") returned 5 [0097.414] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl.css", pszSpec="*.wma") returned 0 [0097.414] lstrlenA (lpString="*.wma") returned 5 [0097.414] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl.css", pszSpec="*.ac3") returned 0 [0097.414] lstrlenA (lpString="*.ac3") returned 5 [0097.414] FindNextFileA (in: hFindFile=0x5be1a0, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0097.414] PeekMessageA (in: lpMsg=0xaece4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaece4) returned 0 [0097.414] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Teal.css") returned -1 [0097.414] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Teal.css") returned -1 [0097.414] lstrcmpiA (lpString1="", lpString2="Teal.css") returned -1 [0097.414] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl.css") returned="Swirl.css" [0097.414] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\", lpString2="Teal.css" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Teal.css") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Teal.css" [0097.414] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Teal.css", pszSpec="*.zip") returned 0 [0097.414] lstrlenA (lpString="*.zip") returned 5 [0097.414] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Teal.css", pszSpec="*.rar") returned 0 [0097.415] lstrlenA (lpString="*.rar") returned 5 [0097.415] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Teal.css", pszSpec="*.7z") returned 0 [0097.415] lstrlenA (lpString="*.7z") returned 4 [0097.415] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Teal.css", pszSpec="*.tar") returned 0 [0097.415] lstrlenA (lpString="*.tar") returned 5 [0097.415] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Teal.css", pszSpec="*.gzip") returned 0 [0097.415] lstrlenA (lpString="*.gzip") returned 6 [0097.415] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Teal.css", pszSpec="*.jpg") returned 0 [0097.415] lstrlenA (lpString="*.jpg") returned 5 [0097.415] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Teal.css", pszSpec="*.jpeg") returned 0 [0097.415] lstrlenA (lpString="*.jpeg") returned 6 [0097.415] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Teal.css", pszSpec="*.psd") returned 0 [0097.415] lstrlenA (lpString="*.psd") returned 5 [0097.415] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Teal.css", pszSpec="*.cdr") returned 0 [0097.415] lstrlenA (lpString="*.cdr") returned 5 [0097.415] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Teal.css", pszSpec="*.dwg") returned 0 [0097.415] lstrlenA (lpString="*.dwg") returned 5 [0097.415] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Teal.css", pszSpec="*.max") returned 0 [0097.415] lstrlenA (lpString="*.max") returned 5 [0097.415] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Teal.css", pszSpec="*.bmp") returned 0 [0097.415] lstrlenA (lpString="*.bmp") returned 5 [0097.415] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Teal.css", pszSpec="*.gif") returned 0 [0097.415] lstrlenA (lpString="*.gif") returned 5 [0097.415] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Teal.css", pszSpec="*.png") returned 0 [0097.415] lstrlenA (lpString="*.png") returned 5 [0097.415] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Teal.css", pszSpec="*.doc") returned 0 [0097.415] lstrlenA (lpString="*.doc") returned 5 [0097.415] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Teal.css", pszSpec="*.docx") returned 0 [0097.415] lstrlenA (lpString="*.docx") returned 6 [0097.415] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Teal.css", pszSpec="*.xls") returned 0 [0097.415] lstrlenA (lpString="*.xls") returned 5 [0097.415] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Teal.css", pszSpec="*.xlsx") returned 0 [0097.415] lstrlenA (lpString="*.xlsx") returned 6 [0097.415] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Teal.css", pszSpec="*.ppt") returned 0 [0097.415] lstrlenA (lpString="*.ppt") returned 5 [0097.415] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Teal.css", pszSpec="*.pptx") returned 0 [0097.415] lstrlenA (lpString="*.pptx") returned 6 [0097.415] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Teal.css", pszSpec="*.txt") returned 0 [0097.415] lstrlenA (lpString="*.txt") returned 5 [0097.415] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Teal.css", pszSpec="*.pdf") returned 0 [0097.415] lstrlenA (lpString="*.pdf") returned 5 [0097.415] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Teal.css", pszSpec="*.djvu") returned 0 [0097.415] lstrlenA (lpString="*.djvu") returned 6 [0097.415] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Teal.css", pszSpec="*.htm") returned 0 [0097.415] lstrlenA (lpString="*.htm") returned 5 [0097.416] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Teal.css", pszSpec="*.html") returned 0 [0097.416] lstrlenA (lpString="*.html") returned 6 [0097.416] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Teal.css", pszSpec="*.mdb") returned 0 [0097.416] lstrlenA (lpString="*.mdb") returned 5 [0097.416] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Teal.css", pszSpec="*.cer") returned 0 [0097.416] lstrlenA (lpString="*.cer") returned 5 [0097.416] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Teal.css", pszSpec="*.p12") returned 0 [0097.416] lstrlenA (lpString="*.p12") returned 5 [0097.416] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Teal.css", pszSpec="*.pfx") returned 0 [0097.416] lstrlenA (lpString="*.pfx") returned 5 [0097.416] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Teal.css", pszSpec="*.kwm") returned 0 [0097.416] lstrlenA (lpString="*.kwm") returned 5 [0097.416] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Teal.css", pszSpec="*.pwm") returned 0 [0097.416] lstrlenA (lpString="*.pwm") returned 5 [0097.416] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Teal.css", pszSpec="*.1cd") returned 0 [0097.416] lstrlenA (lpString="*.1cd") returned 5 [0097.416] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Teal.css", pszSpec="*.md") returned 0 [0097.416] lstrlenA (lpString="*.md") returned 4 [0097.416] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Teal.css", pszSpec="*.mdf") returned 0 [0097.416] lstrlenA (lpString="*.mdf") returned 5 [0097.416] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Teal.css", pszSpec="*.dbf") returned 0 [0097.416] lstrlenA (lpString="*.dbf") returned 5 [0097.416] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Teal.css", pszSpec="*.odt") returned 0 [0097.416] lstrlenA (lpString="*.odt") returned 5 [0097.416] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Teal.css", pszSpec="*.vob") returned 0 [0097.416] lstrlenA (lpString="*.vob") returned 5 [0097.416] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Teal.css", pszSpec="*.ifo") returned 0 [0097.416] lstrlenA (lpString="*.ifo") returned 5 [0097.416] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Teal.css", pszSpec="*.lnk") returned 0 [0097.416] lstrlenA (lpString="*.lnk") returned 5 [0097.416] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Teal.css", pszSpec="*.torrent") returned 0 [0097.416] lstrlenA (lpString="*.torrent") returned 9 [0097.416] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Teal.css", pszSpec="*.mov") returned 0 [0097.416] lstrlenA (lpString="*.mov") returned 5 [0097.416] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Teal.css", pszSpec="*.m2v") returned 0 [0097.416] lstrlenA (lpString="*.m2v") returned 5 [0097.416] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Teal.css", pszSpec="*.3gp") returned 0 [0097.416] lstrlenA (lpString="*.3gp") returned 5 [0097.416] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Teal.css", pszSpec="*.mpeg") returned 0 [0097.416] lstrlenA (lpString="*.mpeg") returned 6 [0097.416] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Teal.css", pszSpec="*.mpg") returned 0 [0097.417] lstrlenA (lpString="*.mpg") returned 5 [0097.417] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Teal.css", pszSpec="*.flv") returned 0 [0097.417] lstrlenA (lpString="*.flv") returned 5 [0097.417] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Teal.css", pszSpec="*.avi") returned 0 [0097.417] lstrlenA (lpString="*.avi") returned 5 [0097.417] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Teal.css", pszSpec="*.mp4") returned 0 [0097.417] lstrlenA (lpString="*.mp4") returned 5 [0097.417] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Teal.css", pszSpec="*.wmv") returned 0 [0097.417] lstrlenA (lpString="*.wmv") returned 5 [0097.417] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Teal.css", pszSpec="*.divx") returned 0 [0097.417] lstrlenA (lpString="*.divx") returned 6 [0097.417] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Teal.css", pszSpec="*.mkv") returned 0 [0097.417] lstrlenA (lpString="*.mkv") returned 5 [0097.417] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Teal.css", pszSpec="*.mp3") returned 0 [0097.417] lstrlenA (lpString="*.mp3") returned 5 [0097.417] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Teal.css", pszSpec="*.wav") returned 0 [0097.417] lstrlenA (lpString="*.wav") returned 5 [0097.417] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Teal.css", pszSpec="*.flac") returned 0 [0097.417] lstrlenA (lpString="*.flac") returned 6 [0097.417] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Teal.css", pszSpec="*.ape") returned 0 [0097.417] lstrlenA (lpString="*.ape") returned 5 [0097.417] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Teal.css", pszSpec="*.wma") returned 0 [0097.417] lstrlenA (lpString="*.wma") returned 5 [0097.417] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Teal.css", pszSpec="*.ac3") returned 0 [0097.417] lstrlenA (lpString="*.ac3") returned 5 [0097.417] FindNextFileA (in: hFindFile=0x5be1a0, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0097.417] PeekMessageA (in: lpMsg=0xaece4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaece4) returned 0 [0097.417] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="TexturedBlue.css") returned -1 [0097.417] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TexturedBlue.css") returned -1 [0097.417] lstrcmpiA (lpString1="", lpString2="TexturedBlue.css") returned -1 [0097.417] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Teal.css") returned="Teal.css" [0097.417] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\", lpString2="TexturedBlue.css" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\TexturedBlue.css") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\TexturedBlue.css" [0097.417] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\TexturedBlue.css", pszSpec="*.zip") returned 0 [0097.417] lstrlenA (lpString="*.zip") returned 5 [0097.417] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\TexturedBlue.css", pszSpec="*.rar") returned 0 [0097.417] lstrlenA (lpString="*.rar") returned 5 [0097.417] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\TexturedBlue.css", pszSpec="*.7z") returned 0 [0097.417] lstrlenA (lpString="*.7z") returned 4 [0097.417] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\TexturedBlue.css", pszSpec="*.tar") returned 0 [0097.417] lstrlenA (lpString="*.tar") returned 5 [0097.417] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\TexturedBlue.css", pszSpec="*.gzip") returned 0 [0097.418] lstrlenA (lpString="*.gzip") returned 6 [0097.418] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\TexturedBlue.css", pszSpec="*.jpg") returned 0 [0097.418] lstrlenA (lpString="*.jpg") returned 5 [0097.418] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\TexturedBlue.css", pszSpec="*.jpeg") returned 0 [0097.418] lstrlenA (lpString="*.jpeg") returned 6 [0097.418] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\TexturedBlue.css", pszSpec="*.psd") returned 0 [0097.418] lstrlenA (lpString="*.psd") returned 5 [0097.418] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\TexturedBlue.css", pszSpec="*.cdr") returned 0 [0097.418] lstrlenA (lpString="*.cdr") returned 5 [0097.418] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\TexturedBlue.css", pszSpec="*.dwg") returned 0 [0097.418] lstrlenA (lpString="*.dwg") returned 5 [0097.418] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\TexturedBlue.css", pszSpec="*.max") returned 0 [0097.418] lstrlenA (lpString="*.max") returned 5 [0097.418] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\TexturedBlue.css", pszSpec="*.bmp") returned 0 [0097.418] lstrlenA (lpString="*.bmp") returned 5 [0097.418] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\TexturedBlue.css", pszSpec="*.gif") returned 0 [0097.418] lstrlenA (lpString="*.gif") returned 5 [0097.418] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\TexturedBlue.css", pszSpec="*.png") returned 0 [0097.418] lstrlenA (lpString="*.png") returned 5 [0097.418] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\TexturedBlue.css", pszSpec="*.doc") returned 0 [0097.418] lstrlenA (lpString="*.doc") returned 5 [0097.418] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\TexturedBlue.css", pszSpec="*.docx") returned 0 [0097.418] lstrlenA (lpString="*.docx") returned 6 [0097.418] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\TexturedBlue.css", pszSpec="*.xls") returned 0 [0097.418] lstrlenA (lpString="*.xls") returned 5 [0097.418] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\TexturedBlue.css", pszSpec="*.xlsx") returned 0 [0097.418] lstrlenA (lpString="*.xlsx") returned 6 [0097.418] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\TexturedBlue.css", pszSpec="*.ppt") returned 0 [0097.418] lstrlenA (lpString="*.ppt") returned 5 [0097.418] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\TexturedBlue.css", pszSpec="*.pptx") returned 0 [0097.418] lstrlenA (lpString="*.pptx") returned 6 [0097.418] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\TexturedBlue.css", pszSpec="*.txt") returned 0 [0097.418] lstrlenA (lpString="*.txt") returned 5 [0097.418] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\TexturedBlue.css", pszSpec="*.pdf") returned 0 [0097.418] lstrlenA (lpString="*.pdf") returned 5 [0097.418] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\TexturedBlue.css", pszSpec="*.djvu") returned 0 [0097.418] lstrlenA (lpString="*.djvu") returned 6 [0097.418] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\TexturedBlue.css", pszSpec="*.htm") returned 0 [0097.418] lstrlenA (lpString="*.htm") returned 5 [0097.419] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\TexturedBlue.css", pszSpec="*.html") returned 0 [0097.419] lstrlenA (lpString="*.html") returned 6 [0097.419] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\TexturedBlue.css", pszSpec="*.mdb") returned 0 [0097.419] lstrlenA (lpString="*.mdb") returned 5 [0097.419] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\TexturedBlue.css", pszSpec="*.cer") returned 0 [0097.419] lstrlenA (lpString="*.cer") returned 5 [0097.419] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\TexturedBlue.css", pszSpec="*.p12") returned 0 [0097.419] lstrlenA (lpString="*.p12") returned 5 [0097.419] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\TexturedBlue.css", pszSpec="*.pfx") returned 0 [0097.419] lstrlenA (lpString="*.pfx") returned 5 [0097.419] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\TexturedBlue.css", pszSpec="*.kwm") returned 0 [0097.419] lstrlenA (lpString="*.kwm") returned 5 [0097.419] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\TexturedBlue.css", pszSpec="*.pwm") returned 0 [0097.419] lstrlenA (lpString="*.pwm") returned 5 [0097.419] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\TexturedBlue.css", pszSpec="*.1cd") returned 0 [0097.419] lstrlenA (lpString="*.1cd") returned 5 [0097.419] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\TexturedBlue.css", pszSpec="*.md") returned 0 [0097.419] lstrlenA (lpString="*.md") returned 4 [0097.419] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\TexturedBlue.css", pszSpec="*.mdf") returned 0 [0097.419] lstrlenA (lpString="*.mdf") returned 5 [0097.419] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\TexturedBlue.css", pszSpec="*.dbf") returned 0 [0097.419] lstrlenA (lpString="*.dbf") returned 5 [0097.419] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\TexturedBlue.css", pszSpec="*.odt") returned 0 [0097.419] lstrlenA (lpString="*.odt") returned 5 [0097.419] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\TexturedBlue.css", pszSpec="*.vob") returned 0 [0097.419] lstrlenA (lpString="*.vob") returned 5 [0097.419] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\TexturedBlue.css", pszSpec="*.ifo") returned 0 [0097.419] lstrlenA (lpString="*.ifo") returned 5 [0097.419] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\TexturedBlue.css", pszSpec="*.lnk") returned 0 [0097.419] lstrlenA (lpString="*.lnk") returned 5 [0097.419] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\TexturedBlue.css", pszSpec="*.torrent") returned 0 [0097.419] lstrlenA (lpString="*.torrent") returned 9 [0097.419] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\TexturedBlue.css", pszSpec="*.mov") returned 0 [0097.419] lstrlenA (lpString="*.mov") returned 5 [0097.419] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\TexturedBlue.css", pszSpec="*.m2v") returned 0 [0097.419] lstrlenA (lpString="*.m2v") returned 5 [0097.419] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\TexturedBlue.css", pszSpec="*.3gp") returned 0 [0097.419] lstrlenA (lpString="*.3gp") returned 5 [0097.419] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\TexturedBlue.css", pszSpec="*.mpeg") returned 0 [0097.420] lstrlenA (lpString="*.mpeg") returned 6 [0097.420] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\TexturedBlue.css", pszSpec="*.mpg") returned 0 [0097.420] lstrlenA (lpString="*.mpg") returned 5 [0097.420] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\TexturedBlue.css", pszSpec="*.flv") returned 0 [0097.420] lstrlenA (lpString="*.flv") returned 5 [0097.420] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\TexturedBlue.css", pszSpec="*.avi") returned 0 [0097.420] lstrlenA (lpString="*.avi") returned 5 [0097.420] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\TexturedBlue.css", pszSpec="*.mp4") returned 0 [0097.420] lstrlenA (lpString="*.mp4") returned 5 [0097.420] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\TexturedBlue.css", pszSpec="*.wmv") returned 0 [0097.420] lstrlenA (lpString="*.wmv") returned 5 [0097.420] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\TexturedBlue.css", pszSpec="*.divx") returned 0 [0097.420] lstrlenA (lpString="*.divx") returned 6 [0097.420] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\TexturedBlue.css", pszSpec="*.mkv") returned 0 [0097.420] lstrlenA (lpString="*.mkv") returned 5 [0097.420] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\TexturedBlue.css", pszSpec="*.mp3") returned 0 [0097.420] lstrlenA (lpString="*.mp3") returned 5 [0097.420] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\TexturedBlue.css", pszSpec="*.wav") returned 0 [0097.420] lstrlenA (lpString="*.wav") returned 5 [0097.420] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\TexturedBlue.css", pszSpec="*.flac") returned 0 [0097.420] lstrlenA (lpString="*.flac") returned 6 [0097.420] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\TexturedBlue.css", pszSpec="*.ape") returned 0 [0097.420] lstrlenA (lpString="*.ape") returned 5 [0097.420] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\TexturedBlue.css", pszSpec="*.wma") returned 0 [0097.420] lstrlenA (lpString="*.wma") returned 5 [0097.420] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\TexturedBlue.css", pszSpec="*.ac3") returned 0 [0097.420] lstrlenA (lpString="*.ac3") returned 5 [0097.420] FindNextFileA (in: hFindFile=0x5be1a0, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0097.420] PeekMessageA (in: lpMsg=0xaece4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaece4) returned 0 [0097.420] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="VelvetRose.css") returned -1 [0097.420] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="VelvetRose.css") returned -1 [0097.420] lstrcmpiA (lpString1="", lpString2="VelvetRose.css") returned -1 [0097.420] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\TexturedBlue.css") returned="TexturedBlue.css" [0097.420] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\", lpString2="VelvetRose.css" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\VelvetRose.css") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\VelvetRose.css" [0097.420] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\VelvetRose.css", pszSpec="*.zip") returned 0 [0097.420] lstrlenA (lpString="*.zip") returned 5 [0097.420] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\VelvetRose.css", pszSpec="*.rar") returned 0 [0097.420] lstrlenA (lpString="*.rar") returned 5 [0097.420] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\VelvetRose.css", pszSpec="*.7z") returned 0 [0097.420] lstrlenA (lpString="*.7z") returned 4 [0097.420] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\VelvetRose.css", pszSpec="*.tar") returned 0 [0097.420] lstrlenA (lpString="*.tar") returned 5 [0097.420] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\VelvetRose.css", pszSpec="*.gzip") returned 0 [0097.421] lstrlenA (lpString="*.gzip") returned 6 [0097.421] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\VelvetRose.css", pszSpec="*.jpg") returned 0 [0097.421] lstrlenA (lpString="*.jpg") returned 5 [0097.421] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\VelvetRose.css", pszSpec="*.jpeg") returned 0 [0097.421] lstrlenA (lpString="*.jpeg") returned 6 [0097.421] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\VelvetRose.css", pszSpec="*.psd") returned 0 [0097.421] lstrlenA (lpString="*.psd") returned 5 [0097.421] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\VelvetRose.css", pszSpec="*.cdr") returned 0 [0097.421] lstrlenA (lpString="*.cdr") returned 5 [0097.421] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\VelvetRose.css", pszSpec="*.dwg") returned 0 [0097.421] lstrlenA (lpString="*.dwg") returned 5 [0097.421] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\VelvetRose.css", pszSpec="*.max") returned 0 [0097.421] lstrlenA (lpString="*.max") returned 5 [0097.421] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\VelvetRose.css", pszSpec="*.bmp") returned 0 [0097.421] lstrlenA (lpString="*.bmp") returned 5 [0097.421] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\VelvetRose.css", pszSpec="*.gif") returned 0 [0097.421] lstrlenA (lpString="*.gif") returned 5 [0097.421] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\VelvetRose.css", pszSpec="*.png") returned 0 [0097.421] lstrlenA (lpString="*.png") returned 5 [0097.421] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\VelvetRose.css", pszSpec="*.doc") returned 0 [0097.421] lstrlenA (lpString="*.doc") returned 5 [0097.421] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\VelvetRose.css", pszSpec="*.docx") returned 0 [0097.421] lstrlenA (lpString="*.docx") returned 6 [0097.421] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\VelvetRose.css", pszSpec="*.xls") returned 0 [0097.421] lstrlenA (lpString="*.xls") returned 5 [0097.421] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\VelvetRose.css", pszSpec="*.xlsx") returned 0 [0097.421] lstrlenA (lpString="*.xlsx") returned 6 [0097.421] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\VelvetRose.css", pszSpec="*.ppt") returned 0 [0097.421] lstrlenA (lpString="*.ppt") returned 5 [0097.421] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\VelvetRose.css", pszSpec="*.pptx") returned 0 [0097.421] lstrlenA (lpString="*.pptx") returned 6 [0097.421] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\VelvetRose.css", pszSpec="*.txt") returned 0 [0097.421] lstrlenA (lpString="*.txt") returned 5 [0097.421] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\VelvetRose.css", pszSpec="*.pdf") returned 0 [0097.421] lstrlenA (lpString="*.pdf") returned 5 [0097.421] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\VelvetRose.css", pszSpec="*.djvu") returned 0 [0097.421] lstrlenA (lpString="*.djvu") returned 6 [0097.421] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\VelvetRose.css", pszSpec="*.htm") returned 0 [0097.421] lstrlenA (lpString="*.htm") returned 5 [0097.421] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\VelvetRose.css", pszSpec="*.html") returned 0 [0097.421] lstrlenA (lpString="*.html") returned 6 [0097.421] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\VelvetRose.css", pszSpec="*.mdb") returned 0 [0097.421] lstrlenA (lpString="*.mdb") returned 5 [0097.422] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\VelvetRose.css", pszSpec="*.cer") returned 0 [0097.422] lstrlenA (lpString="*.cer") returned 5 [0097.422] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\VelvetRose.css", pszSpec="*.p12") returned 0 [0097.422] lstrlenA (lpString="*.p12") returned 5 [0097.422] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\VelvetRose.css", pszSpec="*.pfx") returned 0 [0097.422] lstrlenA (lpString="*.pfx") returned 5 [0097.422] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\VelvetRose.css", pszSpec="*.kwm") returned 0 [0097.422] lstrlenA (lpString="*.kwm") returned 5 [0097.422] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\VelvetRose.css", pszSpec="*.pwm") returned 0 [0097.422] lstrlenA (lpString="*.pwm") returned 5 [0097.422] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\VelvetRose.css", pszSpec="*.1cd") returned 0 [0097.422] lstrlenA (lpString="*.1cd") returned 5 [0097.422] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\VelvetRose.css", pszSpec="*.md") returned 0 [0097.422] lstrlenA (lpString="*.md") returned 4 [0097.422] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\VelvetRose.css", pszSpec="*.mdf") returned 0 [0097.422] lstrlenA (lpString="*.mdf") returned 5 [0097.422] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\VelvetRose.css", pszSpec="*.dbf") returned 0 [0097.422] lstrlenA (lpString="*.dbf") returned 5 [0097.422] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\VelvetRose.css", pszSpec="*.odt") returned 0 [0097.422] lstrlenA (lpString="*.odt") returned 5 [0097.422] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\VelvetRose.css", pszSpec="*.vob") returned 0 [0097.422] lstrlenA (lpString="*.vob") returned 5 [0097.422] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\VelvetRose.css", pszSpec="*.ifo") returned 0 [0097.422] lstrlenA (lpString="*.ifo") returned 5 [0097.422] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\VelvetRose.css", pszSpec="*.lnk") returned 0 [0097.422] lstrlenA (lpString="*.lnk") returned 5 [0097.422] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\VelvetRose.css", pszSpec="*.torrent") returned 0 [0097.422] lstrlenA (lpString="*.torrent") returned 9 [0097.422] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\VelvetRose.css", pszSpec="*.mov") returned 0 [0097.422] lstrlenA (lpString="*.mov") returned 5 [0097.422] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\VelvetRose.css", pszSpec="*.m2v") returned 0 [0097.422] lstrlenA (lpString="*.m2v") returned 5 [0097.422] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\VelvetRose.css", pszSpec="*.3gp") returned 0 [0097.422] lstrlenA (lpString="*.3gp") returned 5 [0097.422] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\VelvetRose.css", pszSpec="*.mpeg") returned 0 [0097.422] lstrlenA (lpString="*.mpeg") returned 6 [0097.422] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\VelvetRose.css", pszSpec="*.mpg") returned 0 [0097.422] lstrlenA (lpString="*.mpg") returned 5 [0097.422] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\VelvetRose.css", pszSpec="*.flv") returned 0 [0097.422] lstrlenA (lpString="*.flv") returned 5 [0097.422] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\VelvetRose.css", pszSpec="*.avi") returned 0 [0097.422] lstrlenA (lpString="*.avi") returned 5 [0097.422] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\VelvetRose.css", pszSpec="*.mp4") returned 0 [0097.423] lstrlenA (lpString="*.mp4") returned 5 [0097.423] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\VelvetRose.css", pszSpec="*.wmv") returned 0 [0097.423] lstrlenA (lpString="*.wmv") returned 5 [0097.423] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\VelvetRose.css", pszSpec="*.divx") returned 0 [0097.423] lstrlenA (lpString="*.divx") returned 6 [0097.423] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\VelvetRose.css", pszSpec="*.mkv") returned 0 [0097.423] lstrlenA (lpString="*.mkv") returned 5 [0097.423] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\VelvetRose.css", pszSpec="*.mp3") returned 0 [0097.423] lstrlenA (lpString="*.mp3") returned 5 [0097.423] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\VelvetRose.css", pszSpec="*.wav") returned 0 [0097.423] lstrlenA (lpString="*.wav") returned 5 [0097.423] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\VelvetRose.css", pszSpec="*.flac") returned 0 [0097.423] lstrlenA (lpString="*.flac") returned 6 [0097.423] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\VelvetRose.css", pszSpec="*.ape") returned 0 [0097.423] lstrlenA (lpString="*.ape") returned 5 [0097.423] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\VelvetRose.css", pszSpec="*.wma") returned 0 [0097.423] lstrlenA (lpString="*.wma") returned 5 [0097.423] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\VelvetRose.css", pszSpec="*.ac3") returned 0 [0097.423] lstrlenA (lpString="*.ac3") returned 5 [0097.423] FindNextFileA (in: hFindFile=0x5be1a0, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 0 [0097.423] FindClose (in: hFindFile=0x5be1a0 | out: hFindFile=0x5be1a0) returned 1 [0097.423] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0097.423] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0097.423] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="FormsVersion1Warning.htm") returned -1 [0097.423] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FormsVersion1Warning.htm") returned 1 [0097.423] lstrcmpiA (lpString1="", lpString2="FormsVersion1Warning.htm") returned -1 [0097.423] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\*.*") returned="*.*" [0097.423] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="FormsVersion1Warning.htm" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsVersion1Warning.htm") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsVersion1Warning.htm" [0097.423] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsVersion1Warning.htm", pszSpec="*.zip") returned 0 [0097.423] lstrlenA (lpString="*.zip") returned 5 [0097.424] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsVersion1Warning.htm", pszSpec="*.rar") returned 0 [0097.424] lstrlenA (lpString="*.rar") returned 5 [0097.424] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsVersion1Warning.htm", pszSpec="*.7z") returned 0 [0097.424] lstrlenA (lpString="*.7z") returned 4 [0097.424] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsVersion1Warning.htm", pszSpec="*.tar") returned 0 [0097.424] lstrlenA (lpString="*.tar") returned 5 [0097.424] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsVersion1Warning.htm", pszSpec="*.gzip") returned 0 [0097.424] lstrlenA (lpString="*.gzip") returned 6 [0097.424] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsVersion1Warning.htm", pszSpec="*.jpg") returned 0 [0097.424] lstrlenA (lpString="*.jpg") returned 5 [0097.424] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsVersion1Warning.htm", pszSpec="*.jpeg") returned 0 [0097.424] lstrlenA (lpString="*.jpeg") returned 6 [0097.424] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsVersion1Warning.htm", pszSpec="*.psd") returned 0 [0097.424] lstrlenA (lpString="*.psd") returned 5 [0097.424] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsVersion1Warning.htm", pszSpec="*.cdr") returned 0 [0097.424] lstrlenA (lpString="*.cdr") returned 5 [0097.424] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsVersion1Warning.htm", pszSpec="*.dwg") returned 0 [0097.424] lstrlenA (lpString="*.dwg") returned 5 [0097.424] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsVersion1Warning.htm", pszSpec="*.max") returned 0 [0097.424] lstrlenA (lpString="*.max") returned 5 [0097.424] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsVersion1Warning.htm", pszSpec="*.bmp") returned 0 [0097.424] lstrlenA (lpString="*.bmp") returned 5 [0097.424] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsVersion1Warning.htm", pszSpec="*.gif") returned 0 [0097.424] lstrlenA (lpString="*.gif") returned 5 [0097.424] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsVersion1Warning.htm", pszSpec="*.png") returned 0 [0097.424] lstrlenA (lpString="*.png") returned 5 [0097.424] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsVersion1Warning.htm", pszSpec="*.doc") returned 0 [0097.424] lstrlenA (lpString="*.doc") returned 5 [0097.424] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsVersion1Warning.htm", pszSpec="*.docx") returned 0 [0097.424] lstrlenA (lpString="*.docx") returned 6 [0097.424] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsVersion1Warning.htm", pszSpec="*.xls") returned 0 [0097.424] lstrlenA (lpString="*.xls") returned 5 [0097.424] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsVersion1Warning.htm", pszSpec="*.xlsx") returned 0 [0097.424] lstrlenA (lpString="*.xlsx") returned 6 [0097.424] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsVersion1Warning.htm", pszSpec="*.ppt") returned 0 [0097.424] lstrlenA (lpString="*.ppt") returned 5 [0097.424] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsVersion1Warning.htm", pszSpec="*.pptx") returned 0 [0097.424] lstrlenA (lpString="*.pptx") returned 6 [0097.424] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsVersion1Warning.htm", pszSpec="*.txt") returned 0 [0097.424] lstrlenA (lpString="*.txt") returned 5 [0097.425] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsVersion1Warning.htm" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsVersion1Warning.htm") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsVersion1Warning.htm" [0097.425] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsVersion1Warning.htm" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsVersion1Warning.htm") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsVersion1Warning.htm" [0097.425] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsVersion1Warning.htm", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsVersion1Warning.htm.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsVersion1Warning.htm." [0097.425] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsVersion1Warning.htm.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsVersion1Warning.htm. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsVersion1Warning.htm. " [0097.425] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsVersion1Warning.htm" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsversion1warning.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0097.426] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x8f8 [0097.426] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xa3d65300, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5298e710, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xa3d65300, dwHighDateTime=0x1c747ea)) returned 1 [0097.426] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0097.426] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x89e, lpOverlapped=0x0) returned 1 [0097.441] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsVersion1Warning.htm") returned="FormsVersion1Warning.htm" [0097.441] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0097.441] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x89e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x89e, lpOverlapped=0x0) returned 1 [0097.441] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0097.441] CloseHandle (hObject=0x98) returned 1 [0097.442] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsVersion1Warning.htm" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsversion1warning.htm"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsVersion1Warning.htm. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsversion1warning.htm. ")) returned 1 [0097.443] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0097.443] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0097.443] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="FormsViewAttachmentIcons.jpg") returned -1 [0097.443] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FormsViewAttachmentIcons.jpg") returned 1 [0097.443] lstrcmpiA (lpString1="", lpString2="FormsViewAttachmentIcons.jpg") returned -1 [0097.443] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsVersion1Warning.htm") returned="FormsVersion1Warning.htm" [0097.443] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="FormsViewAttachmentIcons.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIcons.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIcons.jpg" [0097.443] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIcons.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIcons.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIcons.jpg" [0097.443] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIcons.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIcons.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIcons.jpg" [0097.443] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIcons.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIcons.jpg.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIcons.jpg." [0097.443] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIcons.jpg.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIcons.jpg. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIcons.jpg. " [0097.443] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIcons.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsviewattachmenticons.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0097.444] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1499 [0097.444] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xa3d65300, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x618eeb70, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xa3d65300, dwHighDateTime=0x1c747ea)) returned 1 [0097.444] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0097.444] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x143f, lpOverlapped=0x0) returned 1 [0097.446] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIcons.jpg") returned="FormsViewAttachmentIcons.jpg" [0097.446] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0097.446] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x143f, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x143f, lpOverlapped=0x0) returned 1 [0097.446] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0097.446] CloseHandle (hObject=0x98) returned 1 [0097.446] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIcons.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsviewattachmenticons.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIcons.jpg. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsviewattachmenticons.jpg. ")) returned 1 [0097.447] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0097.447] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0097.447] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="FormsViewAttachmentIconsMask.bmp") returned -1 [0097.447] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FormsViewAttachmentIconsMask.bmp") returned 1 [0097.447] lstrcmpiA (lpString1="", lpString2="FormsViewAttachmentIconsMask.bmp") returned -1 [0097.447] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIcons.jpg") returned="FormsViewAttachmentIcons.jpg" [0097.447] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="FormsViewAttachmentIconsMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIconsMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIconsMask.bmp" [0097.447] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIconsMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIconsMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIconsMask.bmp" [0097.448] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIconsMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIconsMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIconsMask.bmp" [0097.448] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIconsMask.bmp", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIconsMask.bmp.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIconsMask.bmp." [0097.448] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIconsMask.bmp.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIconsMask.bmp. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIconsMask.bmp. " [0097.448] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIconsMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsviewattachmenticonsmask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0097.448] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x638 [0097.448] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xa3d65300, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5298e710, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xa3d65300, dwHighDateTime=0x1c747ea)) returned 1 [0097.449] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0097.449] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x5de, lpOverlapped=0x0) returned 1 [0097.535] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIconsMask.bmp") returned="FormsViewAttachmentIconsMask.bmp" [0097.535] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0097.535] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x5de, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x5de, lpOverlapped=0x0) returned 1 [0097.536] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0097.536] CloseHandle (hObject=0x98) returned 1 [0097.536] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIconsMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsviewattachmenticonsmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIconsMask.bmp. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsviewattachmenticonsmask.bmp. ")) returned 1 [0097.537] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0097.537] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0097.537] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="FormsViewFrame.html") returned -1 [0097.537] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FormsViewFrame.html") returned 1 [0097.537] lstrcmpiA (lpString1="", lpString2="FormsViewFrame.html") returned -1 [0097.537] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIconsMask.bmp") returned="FormsViewAttachmentIconsMask.bmp" [0097.537] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="FormsViewFrame.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewFrame.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewFrame.html" [0097.537] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewFrame.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewFrame.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewFrame.html" [0097.537] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewFrame.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewFrame.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewFrame.html" [0097.537] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewFrame.html", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewFrame.html.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewFrame.html." [0097.537] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewFrame.html.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewFrame.html. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewFrame.html. " [0097.537] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewFrame.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsviewframe.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0097.538] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x164a [0097.538] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xa3d65300, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x529b4870, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xa3d65300, dwHighDateTime=0x1c747ea)) returned 1 [0097.538] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0097.538] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x15f0, lpOverlapped=0x0) returned 1 [0097.579] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewFrame.html") returned="FormsViewFrame.html" [0097.579] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0097.579] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x15f0, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x15f0, lpOverlapped=0x0) returned 1 [0097.579] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0097.579] CloseHandle (hObject=0x98) returned 1 [0097.579] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewFrame.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsviewframe.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewFrame.html. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsviewframe.html. ")) returned 1 [0097.581] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0097.581] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0097.581] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="FormsViewTemplate.html") returned -1 [0097.581] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FormsViewTemplate.html") returned 1 [0097.581] lstrcmpiA (lpString1="", lpString2="FormsViewTemplate.html") returned -1 [0097.581] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewFrame.html") returned="FormsViewFrame.html" [0097.581] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="FormsViewTemplate.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewTemplate.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewTemplate.html" [0097.581] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewTemplate.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewTemplate.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewTemplate.html" [0097.581] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewTemplate.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewTemplate.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewTemplate.html" [0097.581] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewTemplate.html", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewTemplate.html.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewTemplate.html." [0097.581] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewTemplate.html.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewTemplate.html. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewTemplate.html. " [0097.581] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsviewtemplate.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0097.582] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xadf [0097.582] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xa3d65300, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x529b4870, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xa3d65300, dwHighDateTime=0x1c747ea)) returned 1 [0097.582] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0097.582] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0xa85, lpOverlapped=0x0) returned 1 [0097.597] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewTemplate.html") returned="FormsViewTemplate.html" [0097.597] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0097.597] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0xa85, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0xa85, lpOverlapped=0x0) returned 1 [0097.597] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0097.597] CloseHandle (hObject=0x98) returned 1 [0097.597] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsviewtemplate.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewTemplate.html. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsviewtemplate.html. ")) returned 1 [0097.598] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0097.598] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0097.598] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="FormToolImages.jpg") returned -1 [0097.598] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FormToolImages.jpg") returned 1 [0097.598] lstrcmpiA (lpString1="", lpString2="FormToolImages.jpg") returned -1 [0097.598] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewTemplate.html") returned="FormsViewTemplate.html" [0097.598] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="FormToolImages.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormToolImages.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormToolImages.jpg" [0097.598] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormToolImages.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormToolImages.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormToolImages.jpg" [0097.598] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormToolImages.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormToolImages.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormToolImages.jpg" [0097.599] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormToolImages.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormToolImages.jpg.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormToolImages.jpg." [0097.599] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormToolImages.jpg.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormToolImages.jpg. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormToolImages.jpg. " [0097.599] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormToolImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formtoolimages.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0097.599] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1bfb [0097.599] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xa3d65300, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x618eeb70, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xa3d65300, dwHighDateTime=0x1c747ea)) returned 1 [0097.599] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0097.599] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x1ba1, lpOverlapped=0x0) returned 1 [0097.600] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormToolImages.jpg") returned="FormToolImages.jpg" [0097.600] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0097.601] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x1ba1, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x1ba1, lpOverlapped=0x0) returned 1 [0097.601] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0097.601] CloseHandle (hObject=0x98) returned 1 [0097.601] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormToolImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formtoolimages.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormToolImages.jpg. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formtoolimages.jpg. ")) returned 1 [0097.602] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0097.602] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0097.602] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="form_edit.js") returned -1 [0097.602] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="form_edit.js") returned 1 [0097.602] lstrcmpiA (lpString1="", lpString2="form_edit.js") returned -1 [0097.602] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormToolImages.jpg") returned="FormToolImages.jpg" [0097.602] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="form_edit.js" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\form_edit.js") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\form_edit.js" [0097.602] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0097.602] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0097.602] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="LAUNCH.GIF") returned -1 [0097.602] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="LAUNCH.GIF") returned -1 [0097.602] lstrcmpiA (lpString1="", lpString2="LAUNCH.GIF") returned -1 [0097.602] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\form_edit.js") returned="form_edit.js" [0097.602] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="LAUNCH.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\LAUNCH.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\LAUNCH.GIF" [0097.602] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\LAUNCH.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\LAUNCH.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\LAUNCH.GIF" [0097.602] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\LAUNCH.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\LAUNCH.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\LAUNCH.GIF" [0097.602] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\LAUNCH.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\LAUNCH.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\LAUNCH.GIF." [0097.602] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\LAUNCH.GIF.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\LAUNCH.GIF. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\LAUNCH.GIF. " [0097.602] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\LAUNCH.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\launch.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0097.603] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x267 [0097.603] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xa3d65300, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x567e4730, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xa3d65300, dwHighDateTime=0x1c747ea)) returned 1 [0097.603] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0097.603] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x20d, lpOverlapped=0x0) returned 1 [0097.604] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\LAUNCH.GIF") returned="LAUNCH.GIF" [0097.604] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0097.604] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x20d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x20d, lpOverlapped=0x0) returned 1 [0097.604] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0097.604] CloseHandle (hObject=0x98) returned 1 [0097.604] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\LAUNCH.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\launch.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\LAUNCH.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\launch.gif. ")) returned 1 [0097.628] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0097.628] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0097.628] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="macroprogress.gif") returned -1 [0097.628] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="macroprogress.gif") returned -1 [0097.628] lstrcmpiA (lpString1="", lpString2="macroprogress.gif") returned -1 [0097.628] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\LAUNCH.GIF") returned="LAUNCH.GIF" [0097.628] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="macroprogress.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\macroprogress.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\macroprogress.gif" [0097.628] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\macroprogress.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\macroprogress.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\macroprogress.gif" [0097.628] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\macroprogress.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\macroprogress.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\macroprogress.gif" [0097.628] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\macroprogress.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\macroprogress.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\macroprogress.gif." [0097.628] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\macroprogress.gif.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\macroprogress.gif. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\macroprogress.gif. " [0097.628] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\macroprogress.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\macroprogress.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0097.628] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xa52f [0097.628] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xa3d65300, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x58285d50, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xa3d65300, dwHighDateTime=0x1c747ea)) returned 1 [0097.629] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0097.629] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0xa4d5, lpOverlapped=0x0) returned 1 [0097.646] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\macroprogress.gif") returned="macroprogress.gif" [0097.646] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0097.646] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0xa4d5, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0xa4d5, lpOverlapped=0x0) returned 1 [0097.647] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0097.647] CloseHandle (hObject=0x98) returned 1 [0097.647] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\macroprogress.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\macroprogress.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\macroprogress.gif. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\macroprogress.gif. ")) returned 1 [0097.648] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0097.648] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0097.648] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="PublicFunctions.js") returned -1 [0097.648] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PublicFunctions.js") returned -1 [0097.648] lstrcmpiA (lpString1="", lpString2="PublicFunctions.js") returned -1 [0097.648] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\macroprogress.gif") returned="macroprogress.gif" [0097.648] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="PublicFunctions.js" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\PublicFunctions.js") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\PublicFunctions.js" [0097.648] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0097.648] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0097.648] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="rtf_alignleft.gif") returned -1 [0097.648] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="rtf_alignleft.gif") returned -1 [0097.648] lstrcmpiA (lpString1="", lpString2="rtf_alignleft.gif") returned -1 [0097.648] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\PublicFunctions.js") returned="PublicFunctions.js" [0097.648] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="rtf_alignleft.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignleft.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignleft.gif" [0097.648] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignleft.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignleft.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignleft.gif" [0097.648] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignleft.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignleft.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignleft.gif" [0097.648] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignleft.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignleft.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignleft.gif." [0097.648] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignleft.gif.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignleft.gif. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignleft.gif. " [0097.648] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignleft.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_alignleft.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0097.649] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x350 [0097.649] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xa5078000, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x6d227b50, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xa5078000, dwHighDateTime=0x1c747ea)) returned 1 [0097.649] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0097.649] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x2f6, lpOverlapped=0x0) returned 1 [0097.667] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignleft.gif") returned="rtf_alignleft.gif" [0097.667] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0097.667] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x2f6, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x2f6, lpOverlapped=0x0) returned 1 [0097.667] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0097.668] CloseHandle (hObject=0x98) returned 1 [0097.668] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignleft.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_alignleft.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignleft.gif. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_alignleft.gif. ")) returned 1 [0097.669] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0097.669] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0097.669] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="rtf_alignright.gif") returned -1 [0097.669] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="rtf_alignright.gif") returned -1 [0097.669] lstrcmpiA (lpString1="", lpString2="rtf_alignright.gif") returned -1 [0097.669] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignleft.gif") returned="rtf_alignleft.gif" [0097.669] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="rtf_alignright.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignright.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignright.gif" [0097.669] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignright.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignright.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignright.gif" [0097.669] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignright.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignright.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignright.gif" [0097.669] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignright.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignright.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignright.gif." [0097.669] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignright.gif.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignright.gif. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignright.gif. " [0097.669] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignright.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_alignright.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0097.670] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x34f [0097.670] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xa5078000, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x6d227b50, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xa5078000, dwHighDateTime=0x1c747ea)) returned 1 [0097.670] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0097.670] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x2f5, lpOverlapped=0x0) returned 1 [0097.677] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignright.gif") returned="rtf_alignright.gif" [0097.677] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0097.677] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x2f5, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x2f5, lpOverlapped=0x0) returned 1 [0097.677] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0097.677] CloseHandle (hObject=0x98) returned 1 [0097.678] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignright.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_alignright.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignright.gif. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_alignright.gif. ")) returned 1 [0097.679] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0097.679] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0097.679] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="RTF_BOLD.GIF") returned -1 [0097.679] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="RTF_BOLD.GIF") returned -1 [0097.679] lstrcmpiA (lpString1="", lpString2="RTF_BOLD.GIF") returned -1 [0097.679] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignright.gif") returned="rtf_alignright.gif" [0097.679] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="RTF_BOLD.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\RTF_BOLD.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\RTF_BOLD.GIF" [0097.679] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\RTF_BOLD.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\RTF_BOLD.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\RTF_BOLD.GIF" [0097.679] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\RTF_BOLD.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\RTF_BOLD.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\RTF_BOLD.GIF" [0097.679] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\RTF_BOLD.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\RTF_BOLD.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\RTF_BOLD.GIF." [0097.679] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\RTF_BOLD.GIF.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\RTF_BOLD.GIF. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\RTF_BOLD.GIF. " [0097.679] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\RTF_BOLD.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_bold.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0097.680] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x366 [0097.680] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xa5078000, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5a8e8010, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xa5078000, dwHighDateTime=0x1c747ea)) returned 1 [0097.680] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0097.680] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x30c, lpOverlapped=0x0) returned 1 [0097.704] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\RTF_BOLD.GIF") returned="RTF_BOLD.GIF" [0097.704] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0097.704] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x30c, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x30c, lpOverlapped=0x0) returned 1 [0097.704] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0097.705] CloseHandle (hObject=0x98) returned 1 [0097.706] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\RTF_BOLD.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_bold.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\RTF_BOLD.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_bold.gif. ")) returned 1 [0097.707] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0097.707] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0097.707] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="rtf_bullets.gif") returned -1 [0097.707] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="rtf_bullets.gif") returned -1 [0097.707] lstrcmpiA (lpString1="", lpString2="rtf_bullets.gif") returned -1 [0097.707] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\RTF_BOLD.GIF") returned="RTF_BOLD.GIF" [0097.707] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="rtf_bullets.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_bullets.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_bullets.gif" [0097.707] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_bullets.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_bullets.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_bullets.gif" [0097.707] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_bullets.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_bullets.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_bullets.gif" [0097.707] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_bullets.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_bullets.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_bullets.gif." [0097.707] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_bullets.gif.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_bullets.gif. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_bullets.gif. " [0097.707] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_bullets.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_bullets.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0097.708] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x365 [0097.708] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xa5078000, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x6d227b50, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xa5078000, dwHighDateTime=0x1c747ea)) returned 1 [0097.708] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0097.708] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x30b, lpOverlapped=0x0) returned 1 [0097.710] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_bullets.gif") returned="rtf_bullets.gif" [0097.710] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0097.710] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x30b, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x30b, lpOverlapped=0x0) returned 1 [0097.710] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0097.711] CloseHandle (hObject=0x98) returned 1 [0097.711] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_bullets.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_bullets.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_bullets.gif. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_bullets.gif. ")) returned 1 [0097.712] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0097.712] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0097.712] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="rtf_center.gif") returned -1 [0097.712] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="rtf_center.gif") returned -1 [0097.712] lstrcmpiA (lpString1="", lpString2="rtf_center.gif") returned -1 [0097.712] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_bullets.gif") returned="rtf_bullets.gif" [0097.712] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="rtf_center.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_center.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_center.gif" [0097.712] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_center.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_center.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_center.gif" [0097.712] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_center.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_center.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_center.gif" [0097.712] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_center.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_center.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_center.gif." [0097.712] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_center.gif.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_center.gif. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_center.gif. " [0097.712] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_center.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_center.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0097.713] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x34f [0097.713] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xa5078000, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x6d227b50, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xa5078000, dwHighDateTime=0x1c747ea)) returned 1 [0097.713] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0097.713] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x2f5, lpOverlapped=0x0) returned 1 [0097.714] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_center.gif") returned="rtf_center.gif" [0097.714] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0097.714] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x2f5, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x2f5, lpOverlapped=0x0) returned 1 [0097.715] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0097.715] CloseHandle (hObject=0x98) returned 1 [0097.715] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_center.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_center.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_center.gif. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_center.gif. ")) returned 1 [0097.716] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0097.716] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0097.716] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="rtf_choosecolor.gif") returned -1 [0097.716] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="rtf_choosecolor.gif") returned -1 [0097.716] lstrcmpiA (lpString1="", lpString2="rtf_choosecolor.gif") returned -1 [0097.716] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_center.gif") returned="rtf_center.gif" [0097.716] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="rtf_choosecolor.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosecolor.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosecolor.gif" [0097.716] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosecolor.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosecolor.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosecolor.gif" [0097.716] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosecolor.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosecolor.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosecolor.gif" [0097.716] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosecolor.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosecolor.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosecolor.gif." [0097.716] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosecolor.gif.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosecolor.gif. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosecolor.gif. " [0097.716] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosecolor.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_choosecolor.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0097.717] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3ec [0097.717] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xa5078000, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x6d227b50, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xa5078000, dwHighDateTime=0x1c747ea)) returned 1 [0097.717] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0097.717] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x392, lpOverlapped=0x0) returned 1 [0097.718] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosecolor.gif") returned="rtf_choosecolor.gif" [0097.718] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0097.719] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x392, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x392, lpOverlapped=0x0) returned 1 [0097.719] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0097.719] CloseHandle (hObject=0x98) returned 1 [0097.719] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosecolor.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_choosecolor.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosecolor.gif. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_choosecolor.gif. ")) returned 1 [0097.720] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0097.720] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0097.720] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="rtf_choosefont.gif") returned -1 [0097.720] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="rtf_choosefont.gif") returned -1 [0097.720] lstrcmpiA (lpString1="", lpString2="rtf_choosefont.gif") returned -1 [0097.720] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosecolor.gif") returned="rtf_choosecolor.gif" [0097.720] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="rtf_choosefont.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosefont.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosefont.gif" [0097.720] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosefont.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosefont.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosefont.gif" [0097.720] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosefont.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosefont.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosefont.gif" [0097.720] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosefont.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosefont.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosefont.gif." [0097.720] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosefont.gif.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosefont.gif. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosefont.gif. " [0097.720] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosefont.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_choosefont.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0097.721] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x37a [0097.721] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xa5078000, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x6d227b50, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xa5078000, dwHighDateTime=0x1c747ea)) returned 1 [0097.721] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0097.721] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x320, lpOverlapped=0x0) returned 1 [0097.723] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosefont.gif") returned="rtf_choosefont.gif" [0097.723] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0097.723] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x320, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x320, lpOverlapped=0x0) returned 1 [0097.723] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0097.723] CloseHandle (hObject=0x98) returned 1 [0097.723] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosefont.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_choosefont.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosefont.gif. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_choosefont.gif. ")) returned 1 [0097.724] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0097.724] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0097.724] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="rtf_decreaseindent.gif") returned -1 [0097.724] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="rtf_decreaseindent.gif") returned -1 [0097.724] lstrcmpiA (lpString1="", lpString2="rtf_decreaseindent.gif") returned -1 [0097.724] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosefont.gif") returned="rtf_choosefont.gif" [0097.724] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="rtf_decreaseindent.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_decreaseindent.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_decreaseindent.gif" [0097.724] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_decreaseindent.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_decreaseindent.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_decreaseindent.gif" [0097.725] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_decreaseindent.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_decreaseindent.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_decreaseindent.gif" [0097.725] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_decreaseindent.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_decreaseindent.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_decreaseindent.gif." [0097.725] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_decreaseindent.gif.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_decreaseindent.gif. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_decreaseindent.gif. " [0097.725] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_decreaseindent.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_decreaseindent.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0097.725] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x35f [0097.725] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xa5078000, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5a8e8010, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xa5078000, dwHighDateTime=0x1c747ea)) returned 1 [0097.725] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0097.726] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x305, lpOverlapped=0x0) returned 1 [0097.727] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_decreaseindent.gif") returned="rtf_decreaseindent.gif" [0097.727] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0097.727] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x305, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x305, lpOverlapped=0x0) returned 1 [0097.727] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0097.727] CloseHandle (hObject=0x98) returned 1 [0097.727] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_decreaseindent.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_decreaseindent.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_decreaseindent.gif. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_decreaseindent.gif. ")) returned 1 [0097.728] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0097.728] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0097.728] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="rtf_hyperlink.gif") returned -1 [0097.729] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="rtf_hyperlink.gif") returned -1 [0097.729] lstrcmpiA (lpString1="", lpString2="rtf_hyperlink.gif") returned -1 [0097.729] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_decreaseindent.gif") returned="rtf_decreaseindent.gif" [0097.729] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="rtf_hyperlink.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_hyperlink.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_hyperlink.gif" [0097.729] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_hyperlink.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_hyperlink.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_hyperlink.gif" [0097.729] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_hyperlink.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_hyperlink.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_hyperlink.gif" [0097.729] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_hyperlink.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_hyperlink.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_hyperlink.gif." [0097.729] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_hyperlink.gif.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_hyperlink.gif. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_hyperlink.gif. " [0097.729] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_hyperlink.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_hyperlink.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0097.729] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xf1 [0097.730] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xa5078000, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x6d227b50, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xa5078000, dwHighDateTime=0x1c747ea)) returned 1 [0097.730] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0097.730] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x97, lpOverlapped=0x0) returned 1 [0097.731] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_hyperlink.gif") returned="rtf_hyperlink.gif" [0097.731] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0097.731] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x97, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x97, lpOverlapped=0x0) returned 1 [0097.731] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0097.731] CloseHandle (hObject=0x98) returned 1 [0097.731] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_hyperlink.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_hyperlink.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_hyperlink.gif. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_hyperlink.gif. ")) returned 1 [0097.732] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0097.732] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0097.732] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="rtf_increaseindent.gif") returned -1 [0097.732] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="rtf_increaseindent.gif") returned -1 [0097.732] lstrcmpiA (lpString1="", lpString2="rtf_increaseindent.gif") returned -1 [0097.732] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_hyperlink.gif") returned="rtf_hyperlink.gif" [0097.732] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="rtf_increaseindent.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_increaseindent.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_increaseindent.gif" [0097.732] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_increaseindent.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_increaseindent.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_increaseindent.gif" [0097.732] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_increaseindent.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_increaseindent.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_increaseindent.gif" [0097.732] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_increaseindent.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_increaseindent.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_increaseindent.gif." [0097.732] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_increaseindent.gif.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_increaseindent.gif. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_increaseindent.gif. " [0097.732] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_increaseindent.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_increaseindent.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0097.733] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x35d [0097.733] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xa5078000, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5a8e8010, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xa5078000, dwHighDateTime=0x1c747ea)) returned 1 [0097.733] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0097.733] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x303, lpOverlapped=0x0) returned 1 [0097.736] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_increaseindent.gif") returned="rtf_increaseindent.gif" [0097.736] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0097.736] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x303, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x303, lpOverlapped=0x0) returned 1 [0097.736] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0097.736] CloseHandle (hObject=0x98) returned 1 [0097.736] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_increaseindent.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_increaseindent.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_increaseindent.gif. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_increaseindent.gif. ")) returned 1 [0097.738] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0097.738] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0097.738] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="rtf_italic.gif") returned -1 [0097.738] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="rtf_italic.gif") returned -1 [0097.738] lstrcmpiA (lpString1="", lpString2="rtf_italic.gif") returned -1 [0097.738] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_increaseindent.gif") returned="rtf_increaseindent.gif" [0097.738] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="rtf_italic.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_italic.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_italic.gif" [0097.738] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_italic.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_italic.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_italic.gif" [0097.738] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_italic.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_italic.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_italic.gif" [0097.738] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_italic.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_italic.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_italic.gif." [0097.738] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_italic.gif.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_italic.gif. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_italic.gif. " [0097.738] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_italic.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_italic.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0097.739] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x354 [0097.739] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xa5078000, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5a90e170, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xa5078000, dwHighDateTime=0x1c747ea)) returned 1 [0097.739] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0097.739] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x2fa, lpOverlapped=0x0) returned 1 [0097.740] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_italic.gif") returned="rtf_italic.gif" [0097.741] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0097.741] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x2fa, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x2fa, lpOverlapped=0x0) returned 1 [0097.741] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0097.741] CloseHandle (hObject=0x98) returned 1 [0097.741] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_italic.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_italic.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_italic.gif. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_italic.gif. ")) returned 1 [0097.742] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0097.742] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0097.742] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="rtf_justify.gif") returned -1 [0097.742] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="rtf_justify.gif") returned -1 [0097.742] lstrcmpiA (lpString1="", lpString2="rtf_justify.gif") returned -1 [0097.742] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_italic.gif") returned="rtf_italic.gif" [0097.742] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="rtf_justify.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_justify.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_justify.gif" [0097.743] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_justify.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_justify.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_justify.gif" [0097.743] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_justify.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_justify.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_justify.gif" [0097.743] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_justify.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_justify.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_justify.gif." [0097.743] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_justify.gif.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_justify.gif. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_justify.gif. " [0097.743] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_justify.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_justify.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0097.744] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x352 [0097.744] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xa638ad00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5a90e170, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xa638ad00, dwHighDateTime=0x1c747ea)) returned 1 [0097.744] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0097.744] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x2f8, lpOverlapped=0x0) returned 1 [0097.745] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_justify.gif") returned="rtf_justify.gif" [0097.745] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0097.745] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x2f8, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x2f8, lpOverlapped=0x0) returned 1 [0097.746] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0097.746] CloseHandle (hObject=0x98) returned 1 [0097.746] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_justify.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_justify.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_justify.gif. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_justify.gif. ")) returned 1 [0097.747] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0097.747] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0097.747] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="rtf_pressed.gif") returned -1 [0097.747] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="rtf_pressed.gif") returned -1 [0097.747] lstrcmpiA (lpString1="", lpString2="rtf_pressed.gif") returned -1 [0097.747] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_justify.gif") returned="rtf_justify.gif" [0097.747] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="rtf_pressed.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_pressed.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_pressed.gif" [0097.747] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_pressed.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_pressed.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_pressed.gif" [0097.747] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_pressed.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_pressed.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_pressed.gif" [0097.747] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_pressed.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_pressed.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_pressed.gif." [0097.747] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_pressed.gif.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_pressed.gif. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_pressed.gif. " [0097.748] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_pressed.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_pressed.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0097.749] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x373 [0097.749] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xa638ad00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5a90e170, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xa638ad00, dwHighDateTime=0x1c747ea)) returned 1 [0097.749] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0097.749] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x319, lpOverlapped=0x0) returned 1 [0097.751] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_pressed.gif") returned="rtf_pressed.gif" [0097.751] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0097.751] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x319, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x319, lpOverlapped=0x0) returned 1 [0097.751] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0097.751] CloseHandle (hObject=0x98) returned 1 [0097.751] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_pressed.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_pressed.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_pressed.gif. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_pressed.gif. ")) returned 1 [0097.752] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0097.752] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0097.752] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="rtf_spellcheck.gif") returned -1 [0097.752] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="rtf_spellcheck.gif") returned -1 [0097.752] lstrcmpiA (lpString1="", lpString2="rtf_spellcheck.gif") returned -1 [0097.752] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_pressed.gif") returned="rtf_pressed.gif" [0097.752] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="rtf_spellcheck.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_spellcheck.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_spellcheck.gif" [0097.752] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_spellcheck.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_spellcheck.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_spellcheck.gif" [0097.753] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_spellcheck.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_spellcheck.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_spellcheck.gif" [0097.753] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_spellcheck.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_spellcheck.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_spellcheck.gif." [0097.753] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_spellcheck.gif.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_spellcheck.gif. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_spellcheck.gif. " [0097.753] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_spellcheck.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_spellcheck.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0097.753] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xa0 [0097.753] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xa638ad00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5a90e170, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xa638ad00, dwHighDateTime=0x1c747ea)) returned 1 [0097.753] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0097.753] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x46, lpOverlapped=0x0) returned 1 [0097.754] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_spellcheck.gif") returned="rtf_spellcheck.gif" [0097.754] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0097.754] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x46, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x46, lpOverlapped=0x0) returned 1 [0097.755] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0097.755] CloseHandle (hObject=0x98) returned 1 [0097.755] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_spellcheck.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_spellcheck.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_spellcheck.gif. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_spellcheck.gif. ")) returned 1 [0097.756] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0097.756] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0097.756] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="rtf_underline.gif") returned -1 [0097.756] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="rtf_underline.gif") returned -1 [0097.756] lstrcmpiA (lpString1="", lpString2="rtf_underline.gif") returned -1 [0097.756] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_spellcheck.gif") returned="rtf_spellcheck.gif" [0097.756] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="rtf_underline.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_underline.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_underline.gif" [0097.756] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_underline.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_underline.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_underline.gif" [0097.756] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_underline.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_underline.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_underline.gif" [0097.756] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_underline.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_underline.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_underline.gif." [0097.756] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_underline.gif.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_underline.gif. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_underline.gif. " [0097.756] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_underline.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_underline.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0097.758] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x35c [0097.758] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xa638ad00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x6d24dcb0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xa638ad00, dwHighDateTime=0x1c747ea)) returned 1 [0097.758] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0097.758] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x302, lpOverlapped=0x0) returned 1 [0097.759] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_underline.gif") returned="rtf_underline.gif" [0097.759] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0097.759] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x302, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x302, lpOverlapped=0x0) returned 1 [0097.759] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0097.760] CloseHandle (hObject=0x98) returned 1 [0097.760] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_underline.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_underline.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_underline.gif. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_underline.gif. ")) returned 1 [0097.761] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0097.761] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0097.761] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="SAVE.GIF") returned -1 [0097.761] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SAVE.GIF") returned -1 [0097.761] lstrcmpiA (lpString1="", lpString2="SAVE.GIF") returned -1 [0097.761] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_underline.gif") returned="rtf_underline.gif" [0097.761] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="SAVE.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SAVE.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SAVE.GIF" [0097.761] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SAVE.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SAVE.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SAVE.GIF" [0097.761] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SAVE.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SAVE.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SAVE.GIF" [0097.761] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SAVE.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SAVE.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SAVE.GIF." [0097.761] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SAVE.GIF.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SAVE.GIF. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SAVE.GIF. " [0097.761] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SAVE.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\save.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0097.764] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x267 [0097.764] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xa638ad00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x6d24dcb0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xa638ad00, dwHighDateTime=0x1c747ea)) returned 1 [0097.764] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0097.764] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x20d, lpOverlapped=0x0) returned 1 [0097.765] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SAVE.GIF") returned="SAVE.GIF" [0097.765] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0097.765] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x20d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x20d, lpOverlapped=0x0) returned 1 [0097.765] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0097.765] CloseHandle (hObject=0x98) returned 1 [0097.765] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SAVE.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\save.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SAVE.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\save.gif. ")) returned 1 [0097.766] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0097.767] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0097.767] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="SUBMIT.JS") returned -1 [0097.767] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SUBMIT.JS") returned -1 [0097.767] lstrcmpiA (lpString1="", lpString2="SUBMIT.JS") returned -1 [0097.767] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SAVE.GIF") returned="SAVE.GIF" [0097.767] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="SUBMIT.JS" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SUBMIT.JS") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SUBMIT.JS" [0097.767] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0097.767] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0097.767] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="utilityfunctions.js") returned -1 [0097.767] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="utilityfunctions.js") returned -1 [0097.767] lstrcmpiA (lpString1="", lpString2="utilityfunctions.js") returned -1 [0097.767] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SUBMIT.JS") returned="SUBMIT.JS" [0097.767] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="utilityfunctions.js" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\utilityfunctions.js") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\utilityfunctions.js" [0097.767] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0097.767] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0097.767] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="validation.js") returned -1 [0097.767] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="validation.js") returned -1 [0097.767] lstrcmpiA (lpString1="", lpString2="validation.js") returned -1 [0097.767] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\utilityfunctions.js") returned="utilityfunctions.js" [0097.767] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="validation.js" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\validation.js") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\validation.js" [0097.767] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0097.767] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0097.767] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="VIEW.ICO") returned -1 [0097.768] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="VIEW.ICO") returned -1 [0097.768] lstrcmpiA (lpString1="", lpString2="VIEW.ICO") returned -1 [0097.768] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\validation.js") returned="validation.js" [0097.768] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="VIEW.ICO" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.ICO") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.ICO" [0097.768] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0097.768] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0097.768] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="VIEW.JS") returned -1 [0097.768] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="VIEW.JS") returned -1 [0097.768] lstrcmpiA (lpString1="", lpString2="VIEW.JS") returned -1 [0097.768] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.ICO") returned="VIEW.ICO" [0097.768] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="VIEW.JS" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.JS") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.JS" [0097.768] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0097.768] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0097.768] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="ViewHeaderPreview.jpg") returned -1 [0097.768] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ViewHeaderPreview.jpg") returned -1 [0097.768] lstrcmpiA (lpString1="", lpString2="ViewHeaderPreview.jpg") returned -1 [0097.768] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.JS") returned="VIEW.JS" [0097.768] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", lpString2="ViewHeaderPreview.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ViewHeaderPreview.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ViewHeaderPreview.jpg" [0097.768] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ViewHeaderPreview.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ViewHeaderPreview.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ViewHeaderPreview.jpg" [0097.768] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ViewHeaderPreview.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ViewHeaderPreview.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ViewHeaderPreview.jpg" [0097.768] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ViewHeaderPreview.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ViewHeaderPreview.jpg.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ViewHeaderPreview.jpg." [0097.768] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ViewHeaderPreview.jpg.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ViewHeaderPreview.jpg. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ViewHeaderPreview.jpg. " [0097.768] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ViewHeaderPreview.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\viewheaderpreview.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0097.769] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xd78 [0097.769] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xa638ad00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x706f8370, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xa638ad00, dwHighDateTime=0x1c747ea)) returned 1 [0097.769] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0097.769] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0xd1e, lpOverlapped=0x0) returned 1 [0097.771] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ViewHeaderPreview.jpg") returned="ViewHeaderPreview.jpg" [0097.771] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0097.771] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0xd1e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0xd1e, lpOverlapped=0x0) returned 1 [0097.771] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0097.771] CloseHandle (hObject=0x98) returned 1 [0097.771] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ViewHeaderPreview.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\viewheaderpreview.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ViewHeaderPreview.jpg. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\viewheaderpreview.jpg. ")) returned 1 [0097.773] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 0 [0097.773] FindClose (in: hFindFile=0x5be160 | out: hFindFile=0x5be160) returned 1 [0097.773] FindNextFileA (in: hFindFile=0x5b7dd0, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0097.773] lstrcmpA (lpString1=".", lpString2="GrooveForms5") returned -1 [0097.773] lstrcmpA (lpString1="..", lpString2="GrooveForms5") returned -1 [0097.773] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\*.*") returned="*.*" [0097.773] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\", lpString2="GrooveForms5" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5" [0097.773] lstrlenA (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5") returned 82 [0097.773] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\*.*", lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 0x5be160 [0097.811] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0097.811] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0097.813] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0097.813] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0097.813] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0097.813] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0097.813] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="ADD.GIF") returned 1 [0097.813] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ADD.GIF") returned 1 [0097.813] lstrcmpiA (lpString1="", lpString2="ADD.GIF") returned -1 [0097.813] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\*.*") returned="*.*" [0097.813] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\", lpString2="ADD.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ADD.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ADD.GIF" [0097.813] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ADD.GIF", pszSpec="*.zip") returned 0 [0097.813] lstrlenA (lpString="*.zip") returned 5 [0097.813] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ADD.GIF", pszSpec="*.rar") returned 0 [0097.813] lstrlenA (lpString="*.rar") returned 5 [0097.813] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ADD.GIF", pszSpec="*.7z") returned 0 [0097.813] lstrlenA (lpString="*.7z") returned 4 [0097.813] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ADD.GIF", pszSpec="*.tar") returned 0 [0097.813] lstrlenA (lpString="*.tar") returned 5 [0097.813] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ADD.GIF", pszSpec="*.gzip") returned 0 [0097.813] lstrlenA (lpString="*.gzip") returned 6 [0097.813] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ADD.GIF", pszSpec="*.jpg") returned 0 [0097.814] lstrlenA (lpString="*.jpg") returned 5 [0097.814] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ADD.GIF", pszSpec="*.jpeg") returned 0 [0097.814] lstrlenA (lpString="*.jpeg") returned 6 [0097.814] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ADD.GIF", pszSpec="*.psd") returned 0 [0097.814] lstrlenA (lpString="*.psd") returned 5 [0097.814] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ADD.GIF", pszSpec="*.cdr") returned 0 [0097.814] lstrlenA (lpString="*.cdr") returned 5 [0097.814] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ADD.GIF", pszSpec="*.dwg") returned 0 [0097.814] lstrlenA (lpString="*.dwg") returned 5 [0097.814] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ADD.GIF", pszSpec="*.max") returned 0 [0097.814] lstrlenA (lpString="*.max") returned 5 [0097.814] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ADD.GIF", pszSpec="*.bmp") returned 0 [0097.814] lstrlenA (lpString="*.bmp") returned 5 [0097.814] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ADD.GIF", pszSpec="*.gif") returned 1 [0097.814] lstrlenA (lpString="*.gif") returned 5 [0097.814] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ADD.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ADD.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ADD.GIF" [0097.814] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ADD.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ADD.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ADD.GIF" [0097.814] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ADD.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ADD.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ADD.GIF." [0097.814] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ADD.GIF.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ADD.GIF. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ADD.GIF. " [0097.814] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ADD.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\add.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0097.815] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x244 [0097.815] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xa638ad00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5127f1f0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xa638ad00, dwHighDateTime=0x1c747ea)) returned 1 [0097.815] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0097.815] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x1ea, lpOverlapped=0x0) returned 1 [0097.816] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ADD.GIF") returned="ADD.GIF" [0097.816] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0097.816] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x1ea, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x1ea, lpOverlapped=0x0) returned 1 [0097.816] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0097.816] CloseHandle (hObject=0x98) returned 1 [0097.817] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ADD.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\add.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ADD.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\add.gif. ")) returned 1 [0097.818] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0097.818] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0097.818] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="attention.gif") returned 1 [0097.818] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="attention.gif") returned 1 [0097.818] lstrcmpiA (lpString1="", lpString2="attention.gif") returned -1 [0097.818] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ADD.GIF") returned="ADD.GIF" [0097.818] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\", lpString2="attention.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\attention.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\attention.gif" [0097.818] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\attention.gif", pszSpec="*.zip") returned 0 [0097.818] lstrlenA (lpString="*.zip") returned 5 [0097.818] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\attention.gif", pszSpec="*.rar") returned 0 [0097.818] lstrlenA (lpString="*.rar") returned 5 [0097.818] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\attention.gif", pszSpec="*.7z") returned 0 [0097.818] lstrlenA (lpString="*.7z") returned 4 [0097.818] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\attention.gif", pszSpec="*.tar") returned 0 [0097.818] lstrlenA (lpString="*.tar") returned 5 [0097.818] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\attention.gif", pszSpec="*.gzip") returned 0 [0097.819] lstrlenA (lpString="*.gzip") returned 6 [0097.819] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\attention.gif", pszSpec="*.jpg") returned 0 [0097.819] lstrlenA (lpString="*.jpg") returned 5 [0097.819] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\attention.gif", pszSpec="*.jpeg") returned 0 [0097.819] lstrlenA (lpString="*.jpeg") returned 6 [0097.819] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\attention.gif", pszSpec="*.psd") returned 0 [0097.819] lstrlenA (lpString="*.psd") returned 5 [0097.819] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\attention.gif", pszSpec="*.cdr") returned 0 [0097.819] lstrlenA (lpString="*.cdr") returned 5 [0097.819] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\attention.gif", pszSpec="*.dwg") returned 0 [0097.819] lstrlenA (lpString="*.dwg") returned 5 [0097.819] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\attention.gif", pszSpec="*.max") returned 0 [0097.819] lstrlenA (lpString="*.max") returned 5 [0097.819] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\attention.gif", pszSpec="*.bmp") returned 0 [0097.819] lstrlenA (lpString="*.bmp") returned 5 [0097.819] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\attention.gif", pszSpec="*.gif") returned 1 [0097.819] lstrlenA (lpString="*.gif") returned 5 [0097.819] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\attention.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\attention.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\attention.gif" [0097.819] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\attention.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\attention.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\attention.gif" [0097.819] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\attention.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\attention.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\attention.gif." [0097.819] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\attention.gif.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\attention.gif. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\attention.gif. " [0097.819] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\attention.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\attention.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0097.820] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xae8 [0097.820] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xa638ad00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x51767f50, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xa638ad00, dwHighDateTime=0x1c747ea)) returned 1 [0097.820] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0097.820] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0xa8e, lpOverlapped=0x0) returned 1 [0097.876] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\attention.gif") returned="attention.gif" [0097.876] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0097.876] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0xa8e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0xa8e, lpOverlapped=0x0) returned 1 [0097.876] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0097.876] CloseHandle (hObject=0x98) returned 1 [0097.876] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\attention.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\attention.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\attention.gif. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\attention.gif. ")) returned 1 [0097.877] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0097.877] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0097.878] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="CALENDAR.GIF") returned 1 [0097.878] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="CALENDAR.GIF") returned 1 [0097.878] lstrcmpiA (lpString1="", lpString2="CALENDAR.GIF") returned -1 [0097.878] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\attention.gif") returned="attention.gif" [0097.878] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\", lpString2="CALENDAR.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\CALENDAR.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\CALENDAR.GIF" [0097.878] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\CALENDAR.GIF", pszSpec="*.zip") returned 0 [0097.878] lstrlenA (lpString="*.zip") returned 5 [0097.878] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\CALENDAR.GIF", pszSpec="*.rar") returned 0 [0097.878] lstrlenA (lpString="*.rar") returned 5 [0097.878] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\CALENDAR.GIF", pszSpec="*.7z") returned 0 [0097.878] lstrlenA (lpString="*.7z") returned 4 [0097.878] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\CALENDAR.GIF", pszSpec="*.tar") returned 0 [0097.878] lstrlenA (lpString="*.tar") returned 5 [0097.878] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\CALENDAR.GIF", pszSpec="*.gzip") returned 0 [0097.878] lstrlenA (lpString="*.gzip") returned 6 [0097.878] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\CALENDAR.GIF", pszSpec="*.jpg") returned 0 [0097.878] lstrlenA (lpString="*.jpg") returned 5 [0097.878] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\CALENDAR.GIF", pszSpec="*.jpeg") returned 0 [0097.878] lstrlenA (lpString="*.jpeg") returned 6 [0097.878] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\CALENDAR.GIF", pszSpec="*.psd") returned 0 [0097.878] lstrlenA (lpString="*.psd") returned 5 [0097.878] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\CALENDAR.GIF", pszSpec="*.cdr") returned 0 [0097.878] lstrlenA (lpString="*.cdr") returned 5 [0097.878] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\CALENDAR.GIF", pszSpec="*.dwg") returned 0 [0097.878] lstrlenA (lpString="*.dwg") returned 5 [0097.878] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\CALENDAR.GIF", pszSpec="*.max") returned 0 [0097.878] lstrlenA (lpString="*.max") returned 5 [0097.878] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\CALENDAR.GIF", pszSpec="*.bmp") returned 0 [0097.878] lstrlenA (lpString="*.bmp") returned 5 [0097.878] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\CALENDAR.GIF", pszSpec="*.gif") returned 1 [0097.878] lstrlenA (lpString="*.gif") returned 5 [0097.878] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\CALENDAR.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\CALENDAR.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\CALENDAR.GIF" [0097.879] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\CALENDAR.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\CALENDAR.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\CALENDAR.GIF" [0097.879] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\CALENDAR.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\CALENDAR.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\CALENDAR.GIF." [0097.879] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\CALENDAR.GIF.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\CALENDAR.GIF. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\CALENDAR.GIF. " [0097.879] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\CALENDAR.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\calendar.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0097.879] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x383 [0097.880] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xa769da00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x60120f70, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xa769da00, dwHighDateTime=0x1c747ea)) returned 1 [0097.880] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0097.880] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x329, lpOverlapped=0x0) returned 1 [0097.906] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\CALENDAR.GIF") returned="CALENDAR.GIF" [0097.906] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0097.906] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x329, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x329, lpOverlapped=0x0) returned 1 [0097.906] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0097.906] CloseHandle (hObject=0x98) returned 1 [0097.906] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\CALENDAR.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\calendar.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\CALENDAR.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\calendar.gif. ")) returned 1 [0097.907] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0097.907] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0097.907] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="DELETE.GIF") returned 1 [0097.907] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DELETE.GIF") returned 1 [0097.907] lstrcmpiA (lpString1="", lpString2="DELETE.GIF") returned -1 [0097.907] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\CALENDAR.GIF") returned="CALENDAR.GIF" [0097.907] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\", lpString2="DELETE.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\DELETE.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\DELETE.GIF" [0097.907] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\DELETE.GIF", pszSpec="*.zip") returned 0 [0097.907] lstrlenA (lpString="*.zip") returned 5 [0097.907] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\DELETE.GIF", pszSpec="*.rar") returned 0 [0097.907] lstrlenA (lpString="*.rar") returned 5 [0097.907] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\DELETE.GIF", pszSpec="*.7z") returned 0 [0097.907] lstrlenA (lpString="*.7z") returned 4 [0097.907] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\DELETE.GIF", pszSpec="*.tar") returned 0 [0097.907] lstrlenA (lpString="*.tar") returned 5 [0097.907] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\DELETE.GIF", pszSpec="*.gzip") returned 0 [0097.907] lstrlenA (lpString="*.gzip") returned 6 [0097.907] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\DELETE.GIF", pszSpec="*.jpg") returned 0 [0097.907] lstrlenA (lpString="*.jpg") returned 5 [0097.907] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\DELETE.GIF", pszSpec="*.jpeg") returned 0 [0097.907] lstrlenA (lpString="*.jpeg") returned 6 [0097.907] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\DELETE.GIF", pszSpec="*.psd") returned 0 [0097.908] lstrlenA (lpString="*.psd") returned 5 [0097.908] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\DELETE.GIF", pszSpec="*.cdr") returned 0 [0097.908] lstrlenA (lpString="*.cdr") returned 5 [0097.908] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\DELETE.GIF", pszSpec="*.dwg") returned 0 [0097.908] lstrlenA (lpString="*.dwg") returned 5 [0097.908] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\DELETE.GIF", pszSpec="*.max") returned 0 [0097.908] lstrlenA (lpString="*.max") returned 5 [0097.908] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\DELETE.GIF", pszSpec="*.bmp") returned 0 [0097.908] lstrlenA (lpString="*.bmp") returned 5 [0097.908] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\DELETE.GIF", pszSpec="*.gif") returned 1 [0097.908] lstrlenA (lpString="*.gif") returned 5 [0097.908] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\DELETE.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\DELETE.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\DELETE.GIF" [0097.908] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\DELETE.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\DELETE.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\DELETE.GIF" [0097.908] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\DELETE.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\DELETE.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\DELETE.GIF." [0097.908] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\DELETE.GIF.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\DELETE.GIF. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\DELETE.GIF. " [0097.908] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\DELETE.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\delete.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0098.009] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x271 [0098.009] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xa769da00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x51da7910, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xa769da00, dwHighDateTime=0x1c747ea)) returned 1 [0098.009] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0098.009] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x217, lpOverlapped=0x0) returned 1 [0098.010] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\DELETE.GIF") returned="DELETE.GIF" [0098.010] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0098.010] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x217, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x217, lpOverlapped=0x0) returned 1 [0098.010] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0098.010] CloseHandle (hObject=0x98) returned 1 [0098.010] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\DELETE.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\delete.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\DELETE.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\delete.gif. ")) returned 1 [0098.012] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0098.012] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0098.012] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="ERROR.GIF") returned -1 [0098.012] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ERROR.GIF") returned 1 [0098.012] lstrcmpiA (lpString1="", lpString2="ERROR.GIF") returned -1 [0098.012] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\DELETE.GIF") returned="DELETE.GIF" [0098.012] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\", lpString2="ERROR.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ERROR.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ERROR.GIF" [0098.012] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ERROR.GIF", pszSpec="*.zip") returned 0 [0098.012] lstrlenA (lpString="*.zip") returned 5 [0098.012] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ERROR.GIF", pszSpec="*.rar") returned 0 [0098.012] lstrlenA (lpString="*.rar") returned 5 [0098.012] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ERROR.GIF", pszSpec="*.7z") returned 0 [0098.012] lstrlenA (lpString="*.7z") returned 4 [0098.012] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ERROR.GIF", pszSpec="*.tar") returned 0 [0098.012] lstrlenA (lpString="*.tar") returned 5 [0098.012] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ERROR.GIF", pszSpec="*.gzip") returned 0 [0098.012] lstrlenA (lpString="*.gzip") returned 6 [0098.012] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ERROR.GIF", pszSpec="*.jpg") returned 0 [0098.013] lstrlenA (lpString="*.jpg") returned 5 [0098.013] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ERROR.GIF", pszSpec="*.jpeg") returned 0 [0098.013] lstrlenA (lpString="*.jpeg") returned 6 [0098.013] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ERROR.GIF", pszSpec="*.psd") returned 0 [0098.013] lstrlenA (lpString="*.psd") returned 5 [0098.013] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ERROR.GIF", pszSpec="*.cdr") returned 0 [0098.013] lstrlenA (lpString="*.cdr") returned 5 [0098.013] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ERROR.GIF", pszSpec="*.dwg") returned 0 [0098.013] lstrlenA (lpString="*.dwg") returned 5 [0098.013] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ERROR.GIF", pszSpec="*.max") returned 0 [0098.013] lstrlenA (lpString="*.max") returned 5 [0098.013] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ERROR.GIF", pszSpec="*.bmp") returned 0 [0098.013] lstrlenA (lpString="*.bmp") returned 5 [0098.013] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ERROR.GIF", pszSpec="*.gif") returned 1 [0098.013] lstrlenA (lpString="*.gif") returned 5 [0098.013] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ERROR.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ERROR.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ERROR.GIF" [0098.013] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ERROR.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ERROR.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ERROR.GIF" [0098.013] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ERROR.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ERROR.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ERROR.GIF." [0098.013] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ERROR.GIF.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ERROR.GIF. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ERROR.GIF. " [0098.013] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ERROR.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\error.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0098.016] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x369 [0098.016] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xa89b0700, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x6099bdd0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xa89b0700, dwHighDateTime=0x1c747ea)) returned 1 [0098.016] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0098.016] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x30f, lpOverlapped=0x0) returned 1 [0098.017] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ERROR.GIF") returned="ERROR.GIF" [0098.017] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0098.018] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x30f, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x30f, lpOverlapped=0x0) returned 1 [0098.018] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0098.018] CloseHandle (hObject=0x98) returned 1 [0098.018] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ERROR.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\error.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ERROR.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\error.gif. ")) returned 1 [0098.022] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0098.022] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0098.023] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="FORM.JS") returned -1 [0098.023] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FORM.JS") returned 1 [0098.023] lstrcmpiA (lpString1="", lpString2="FORM.JS") returned -1 [0098.023] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ERROR.GIF") returned="ERROR.GIF" [0098.023] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\", lpString2="FORM.JS" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FORM.JS") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FORM.JS" [0098.023] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FORM.JS", pszSpec="*.zip") returned 0 [0098.023] lstrlenA (lpString="*.zip") returned 5 [0098.023] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FORM.JS", pszSpec="*.rar") returned 0 [0098.023] lstrlenA (lpString="*.rar") returned 5 [0098.023] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FORM.JS", pszSpec="*.7z") returned 0 [0098.023] lstrlenA (lpString="*.7z") returned 4 [0098.023] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FORM.JS", pszSpec="*.tar") returned 0 [0098.023] lstrlenA (lpString="*.tar") returned 5 [0098.023] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FORM.JS", pszSpec="*.gzip") returned 0 [0098.023] lstrlenA (lpString="*.gzip") returned 6 [0098.023] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FORM.JS", pszSpec="*.jpg") returned 0 [0098.023] lstrlenA (lpString="*.jpg") returned 5 [0098.023] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FORM.JS", pszSpec="*.jpeg") returned 0 [0098.023] lstrlenA (lpString="*.jpeg") returned 6 [0098.023] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FORM.JS", pszSpec="*.psd") returned 0 [0098.023] lstrlenA (lpString="*.psd") returned 5 [0098.023] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FORM.JS", pszSpec="*.cdr") returned 0 [0098.023] lstrlenA (lpString="*.cdr") returned 5 [0098.023] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FORM.JS", pszSpec="*.dwg") returned 0 [0098.023] lstrlenA (lpString="*.dwg") returned 5 [0098.023] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FORM.JS", pszSpec="*.max") returned 0 [0098.023] lstrlenA (lpString="*.max") returned 5 [0098.023] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FORM.JS", pszSpec="*.bmp") returned 0 [0098.023] lstrlenA (lpString="*.bmp") returned 5 [0098.023] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FORM.JS", pszSpec="*.gif") returned 0 [0098.023] lstrlenA (lpString="*.gif") returned 5 [0098.023] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FORM.JS", pszSpec="*.png") returned 0 [0098.023] lstrlenA (lpString="*.png") returned 5 [0098.023] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FORM.JS", pszSpec="*.doc") returned 0 [0098.023] lstrlenA (lpString="*.doc") returned 5 [0098.023] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FORM.JS", pszSpec="*.docx") returned 0 [0098.023] lstrlenA (lpString="*.docx") returned 6 [0098.023] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FORM.JS", pszSpec="*.xls") returned 0 [0098.023] lstrlenA (lpString="*.xls") returned 5 [0098.023] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FORM.JS", pszSpec="*.xlsx") returned 0 [0098.023] lstrlenA (lpString="*.xlsx") returned 6 [0098.023] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FORM.JS", pszSpec="*.ppt") returned 0 [0098.024] lstrlenA (lpString="*.ppt") returned 5 [0098.024] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FORM.JS", pszSpec="*.pptx") returned 0 [0098.024] lstrlenA (lpString="*.pptx") returned 6 [0098.024] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FORM.JS", pszSpec="*.txt") returned 0 [0098.024] lstrlenA (lpString="*.txt") returned 5 [0098.024] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FORM.JS", pszSpec="*.pdf") returned 0 [0098.024] lstrlenA (lpString="*.pdf") returned 5 [0098.024] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FORM.JS", pszSpec="*.djvu") returned 0 [0098.024] lstrlenA (lpString="*.djvu") returned 6 [0098.024] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FORM.JS", pszSpec="*.htm") returned 0 [0098.024] lstrlenA (lpString="*.htm") returned 5 [0098.024] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FORM.JS", pszSpec="*.html") returned 0 [0098.024] lstrlenA (lpString="*.html") returned 6 [0098.024] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FORM.JS", pszSpec="*.mdb") returned 0 [0098.024] lstrlenA (lpString="*.mdb") returned 5 [0098.024] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FORM.JS", pszSpec="*.cer") returned 0 [0098.024] lstrlenA (lpString="*.cer") returned 5 [0098.024] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FORM.JS", pszSpec="*.p12") returned 0 [0098.024] lstrlenA (lpString="*.p12") returned 5 [0098.024] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FORM.JS", pszSpec="*.pfx") returned 0 [0098.024] lstrlenA (lpString="*.pfx") returned 5 [0098.024] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FORM.JS", pszSpec="*.kwm") returned 0 [0098.024] lstrlenA (lpString="*.kwm") returned 5 [0098.024] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FORM.JS", pszSpec="*.pwm") returned 0 [0098.024] lstrlenA (lpString="*.pwm") returned 5 [0098.024] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FORM.JS", pszSpec="*.1cd") returned 0 [0098.024] lstrlenA (lpString="*.1cd") returned 5 [0098.024] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FORM.JS", pszSpec="*.md") returned 0 [0098.024] lstrlenA (lpString="*.md") returned 4 [0098.024] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FORM.JS", pszSpec="*.mdf") returned 0 [0098.024] lstrlenA (lpString="*.mdf") returned 5 [0098.024] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FORM.JS", pszSpec="*.dbf") returned 0 [0098.024] lstrlenA (lpString="*.dbf") returned 5 [0098.024] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FORM.JS", pszSpec="*.odt") returned 0 [0098.024] lstrlenA (lpString="*.odt") returned 5 [0098.024] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FORM.JS", pszSpec="*.vob") returned 0 [0098.024] lstrlenA (lpString="*.vob") returned 5 [0098.024] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FORM.JS", pszSpec="*.ifo") returned 0 [0098.024] lstrlenA (lpString="*.ifo") returned 5 [0098.024] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FORM.JS", pszSpec="*.lnk") returned 0 [0098.024] lstrlenA (lpString="*.lnk") returned 5 [0098.024] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FORM.JS", pszSpec="*.torrent") returned 0 [0098.024] lstrlenA (lpString="*.torrent") returned 9 [0098.024] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FORM.JS", pszSpec="*.mov") returned 0 [0098.024] lstrlenA (lpString="*.mov") returned 5 [0098.025] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FORM.JS", pszSpec="*.m2v") returned 0 [0098.025] lstrlenA (lpString="*.m2v") returned 5 [0098.025] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FORM.JS", pszSpec="*.3gp") returned 0 [0098.025] lstrlenA (lpString="*.3gp") returned 5 [0098.025] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FORM.JS", pszSpec="*.mpeg") returned 0 [0098.025] lstrlenA (lpString="*.mpeg") returned 6 [0098.025] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FORM.JS", pszSpec="*.mpg") returned 0 [0098.025] lstrlenA (lpString="*.mpg") returned 5 [0098.025] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FORM.JS", pszSpec="*.flv") returned 0 [0098.025] lstrlenA (lpString="*.flv") returned 5 [0098.025] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FORM.JS", pszSpec="*.avi") returned 0 [0098.025] lstrlenA (lpString="*.avi") returned 5 [0098.025] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FORM.JS", pszSpec="*.mp4") returned 0 [0098.025] lstrlenA (lpString="*.mp4") returned 5 [0098.025] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FORM.JS", pszSpec="*.wmv") returned 0 [0098.025] lstrlenA (lpString="*.wmv") returned 5 [0098.025] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FORM.JS", pszSpec="*.divx") returned 0 [0098.025] lstrlenA (lpString="*.divx") returned 6 [0098.025] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FORM.JS", pszSpec="*.mkv") returned 0 [0098.025] lstrlenA (lpString="*.mkv") returned 5 [0098.025] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FORM.JS", pszSpec="*.mp3") returned 0 [0098.025] lstrlenA (lpString="*.mp3") returned 5 [0098.025] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FORM.JS", pszSpec="*.wav") returned 0 [0098.025] lstrlenA (lpString="*.wav") returned 5 [0098.025] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FORM.JS", pszSpec="*.flac") returned 0 [0098.025] lstrlenA (lpString="*.flac") returned 6 [0098.025] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FORM.JS", pszSpec="*.ape") returned 0 [0098.025] lstrlenA (lpString="*.ape") returned 5 [0098.025] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FORM.JS", pszSpec="*.wma") returned 0 [0098.025] lstrlenA (lpString="*.wma") returned 5 [0098.025] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FORM.JS", pszSpec="*.ac3") returned 0 [0098.025] lstrlenA (lpString="*.ac3") returned 5 [0098.025] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0098.025] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0098.025] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="FormsBlankPage.html") returned -1 [0098.025] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FormsBlankPage.html") returned 1 [0098.025] lstrcmpiA (lpString1="", lpString2="FormsBlankPage.html") returned -1 [0098.025] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FORM.JS") returned="FORM.JS" [0098.025] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\", lpString2="FormsBlankPage.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBlankPage.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBlankPage.html" [0098.025] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBlankPage.html", pszSpec="*.zip") returned 0 [0098.025] lstrlenA (lpString="*.zip") returned 5 [0098.025] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBlankPage.html", pszSpec="*.rar") returned 0 [0098.026] lstrlenA (lpString="*.rar") returned 5 [0098.026] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBlankPage.html", pszSpec="*.7z") returned 0 [0098.026] lstrlenA (lpString="*.7z") returned 4 [0098.026] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBlankPage.html", pszSpec="*.tar") returned 0 [0098.026] lstrlenA (lpString="*.tar") returned 5 [0098.026] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBlankPage.html", pszSpec="*.gzip") returned 0 [0098.026] lstrlenA (lpString="*.gzip") returned 6 [0098.026] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBlankPage.html", pszSpec="*.jpg") returned 0 [0098.026] lstrlenA (lpString="*.jpg") returned 5 [0098.026] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBlankPage.html", pszSpec="*.jpeg") returned 0 [0098.026] lstrlenA (lpString="*.jpeg") returned 6 [0098.026] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBlankPage.html", pszSpec="*.psd") returned 0 [0098.026] lstrlenA (lpString="*.psd") returned 5 [0098.026] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBlankPage.html", pszSpec="*.cdr") returned 0 [0098.026] lstrlenA (lpString="*.cdr") returned 5 [0098.026] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBlankPage.html", pszSpec="*.dwg") returned 0 [0098.026] lstrlenA (lpString="*.dwg") returned 5 [0098.026] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBlankPage.html", pszSpec="*.max") returned 0 [0098.026] lstrlenA (lpString="*.max") returned 5 [0098.026] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBlankPage.html", pszSpec="*.bmp") returned 0 [0098.026] lstrlenA (lpString="*.bmp") returned 5 [0098.026] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBlankPage.html", pszSpec="*.gif") returned 0 [0098.026] lstrlenA (lpString="*.gif") returned 5 [0098.026] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBlankPage.html", pszSpec="*.png") returned 0 [0098.026] lstrlenA (lpString="*.png") returned 5 [0098.026] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBlankPage.html", pszSpec="*.doc") returned 0 [0098.026] lstrlenA (lpString="*.doc") returned 5 [0098.026] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBlankPage.html", pszSpec="*.docx") returned 0 [0098.026] lstrlenA (lpString="*.docx") returned 6 [0098.026] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBlankPage.html", pszSpec="*.xls") returned 0 [0098.026] lstrlenA (lpString="*.xls") returned 5 [0098.026] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBlankPage.html", pszSpec="*.xlsx") returned 0 [0098.026] lstrlenA (lpString="*.xlsx") returned 6 [0098.026] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBlankPage.html", pszSpec="*.ppt") returned 0 [0098.026] lstrlenA (lpString="*.ppt") returned 5 [0098.026] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBlankPage.html", pszSpec="*.pptx") returned 0 [0098.026] lstrlenA (lpString="*.pptx") returned 6 [0098.026] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBlankPage.html", pszSpec="*.txt") returned 0 [0098.026] lstrlenA (lpString="*.txt") returned 5 [0098.026] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBlankPage.html", pszSpec="*.pdf") returned 0 [0098.026] lstrlenA (lpString="*.pdf") returned 5 [0098.026] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBlankPage.html", pszSpec="*.djvu") returned 0 [0098.026] lstrlenA (lpString="*.djvu") returned 6 [0098.026] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBlankPage.html", pszSpec="*.htm") returned 0 [0098.026] lstrlenA (lpString="*.htm") returned 5 [0098.026] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBlankPage.html", pszSpec="*.html") returned 1 [0098.027] lstrlenA (lpString="*.html") returned 6 [0098.027] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBlankPage.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBlankPage.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBlankPage.html" [0098.027] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBlankPage.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBlankPage.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBlankPage.html" [0098.027] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBlankPage.html", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBlankPage.html.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBlankPage.html." [0098.027] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBlankPage.html.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBlankPage.html. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBlankPage.html. " [0098.027] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBlankPage.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsblankpage.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0098.027] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x43a [0098.027] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xa89b0700, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5291c2f0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xa89b0700, dwHighDateTime=0x1c747ea)) returned 1 [0098.027] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0098.028] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x3e0, lpOverlapped=0x0) returned 1 [0098.105] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBlankPage.html") returned="FormsBlankPage.html" [0098.105] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0098.105] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x3e0, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x3e0, lpOverlapped=0x0) returned 1 [0098.105] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0098.105] CloseHandle (hObject=0x98) returned 1 [0098.105] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBlankPage.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsblankpage.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBlankPage.html. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsblankpage.html. ")) returned 1 [0098.107] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0098.107] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0098.107] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="FormsBrowserUpgrade.html") returned -1 [0098.107] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FormsBrowserUpgrade.html") returned 1 [0098.107] lstrcmpiA (lpString1="", lpString2="FormsBrowserUpgrade.html") returned -1 [0098.107] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBlankPage.html") returned="FormsBlankPage.html" [0098.107] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\", lpString2="FormsBrowserUpgrade.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBrowserUpgrade.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBrowserUpgrade.html" [0098.107] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBrowserUpgrade.html", pszSpec="*.zip") returned 0 [0098.107] lstrlenA (lpString="*.zip") returned 5 [0098.107] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBrowserUpgrade.html", pszSpec="*.rar") returned 0 [0098.107] lstrlenA (lpString="*.rar") returned 5 [0098.107] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBrowserUpgrade.html", pszSpec="*.7z") returned 0 [0098.107] lstrlenA (lpString="*.7z") returned 4 [0098.107] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBrowserUpgrade.html", pszSpec="*.tar") returned 0 [0098.107] lstrlenA (lpString="*.tar") returned 5 [0098.107] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBrowserUpgrade.html", pszSpec="*.gzip") returned 0 [0098.107] lstrlenA (lpString="*.gzip") returned 6 [0098.107] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBrowserUpgrade.html", pszSpec="*.jpg") returned 0 [0098.107] lstrlenA (lpString="*.jpg") returned 5 [0098.107] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBrowserUpgrade.html", pszSpec="*.jpeg") returned 0 [0098.107] lstrlenA (lpString="*.jpeg") returned 6 [0098.111] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBrowserUpgrade.html", pszSpec="*.psd") returned 0 [0098.111] lstrlenA (lpString="*.psd") returned 5 [0098.111] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBrowserUpgrade.html", pszSpec="*.cdr") returned 0 [0098.111] lstrlenA (lpString="*.cdr") returned 5 [0098.111] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBrowserUpgrade.html", pszSpec="*.dwg") returned 0 [0098.111] lstrlenA (lpString="*.dwg") returned 5 [0098.111] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBrowserUpgrade.html", pszSpec="*.max") returned 0 [0098.111] lstrlenA (lpString="*.max") returned 5 [0098.111] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBrowserUpgrade.html", pszSpec="*.bmp") returned 0 [0098.111] lstrlenA (lpString="*.bmp") returned 5 [0098.111] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBrowserUpgrade.html", pszSpec="*.gif") returned 0 [0098.111] lstrlenA (lpString="*.gif") returned 5 [0098.111] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBrowserUpgrade.html", pszSpec="*.png") returned 0 [0098.112] lstrlenA (lpString="*.png") returned 5 [0098.112] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBrowserUpgrade.html", pszSpec="*.doc") returned 0 [0098.112] lstrlenA (lpString="*.doc") returned 5 [0098.112] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBrowserUpgrade.html", pszSpec="*.docx") returned 0 [0098.113] lstrlenA (lpString="*.docx") returned 6 [0098.113] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBrowserUpgrade.html", pszSpec="*.xls") returned 0 [0098.113] lstrlenA (lpString="*.xls") returned 5 [0098.113] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBrowserUpgrade.html", pszSpec="*.xlsx") returned 0 [0098.113] lstrlenA (lpString="*.xlsx") returned 6 [0098.113] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBrowserUpgrade.html", pszSpec="*.ppt") returned 0 [0098.113] lstrlenA (lpString="*.ppt") returned 5 [0098.113] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBrowserUpgrade.html", pszSpec="*.pptx") returned 0 [0098.113] lstrlenA (lpString="*.pptx") returned 6 [0098.113] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBrowserUpgrade.html", pszSpec="*.txt") returned 0 [0098.113] lstrlenA (lpString="*.txt") returned 5 [0098.113] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBrowserUpgrade.html", pszSpec="*.pdf") returned 0 [0098.113] lstrlenA (lpString="*.pdf") returned 5 [0098.114] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBrowserUpgrade.html", pszSpec="*.djvu") returned 0 [0098.114] lstrlenA (lpString="*.djvu") returned 6 [0098.114] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBrowserUpgrade.html", pszSpec="*.htm") returned 0 [0098.114] lstrlenA (lpString="*.htm") returned 5 [0098.114] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBrowserUpgrade.html", pszSpec="*.html") returned 1 [0098.114] lstrlenA (lpString="*.html") returned 6 [0098.114] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBrowserUpgrade.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBrowserUpgrade.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBrowserUpgrade.html" [0098.114] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBrowserUpgrade.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBrowserUpgrade.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBrowserUpgrade.html" [0098.114] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBrowserUpgrade.html", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBrowserUpgrade.html.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBrowserUpgrade.html." [0098.114] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBrowserUpgrade.html.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBrowserUpgrade.html. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBrowserUpgrade.html. " [0098.114] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBrowserUpgrade.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsbrowserupgrade.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0098.115] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x829 [0098.115] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xa89b0700, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x618c8a10, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xa89b0700, dwHighDateTime=0x1c747ea)) returned 1 [0098.115] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0098.115] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x7cf, lpOverlapped=0x0) returned 1 [0098.117] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBrowserUpgrade.html") returned="FormsBrowserUpgrade.html" [0098.117] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0098.118] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x7cf, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x7cf, lpOverlapped=0x0) returned 1 [0098.118] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0098.118] CloseHandle (hObject=0x98) returned 1 [0098.118] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBrowserUpgrade.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsbrowserupgrade.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBrowserUpgrade.html. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsbrowserupgrade.html. ")) returned 1 [0098.119] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0098.119] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0098.119] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="FormsColorChart.html") returned -1 [0098.119] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FormsColorChart.html") returned 1 [0098.119] lstrcmpiA (lpString1="", lpString2="FormsColorChart.html") returned -1 [0098.119] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBrowserUpgrade.html") returned="FormsBrowserUpgrade.html" [0098.119] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\", lpString2="FormsColorChart.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsColorChart.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsColorChart.html" [0098.119] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsColorChart.html", pszSpec="*.zip") returned 0 [0098.119] lstrlenA (lpString="*.zip") returned 5 [0098.119] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsColorChart.html", pszSpec="*.rar") returned 0 [0098.119] lstrlenA (lpString="*.rar") returned 5 [0098.119] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsColorChart.html", pszSpec="*.7z") returned 0 [0098.119] lstrlenA (lpString="*.7z") returned 4 [0098.120] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsColorChart.html", pszSpec="*.tar") returned 0 [0098.120] lstrlenA (lpString="*.tar") returned 5 [0098.120] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsColorChart.html", pszSpec="*.gzip") returned 0 [0098.120] lstrlenA (lpString="*.gzip") returned 6 [0098.120] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsColorChart.html", pszSpec="*.jpg") returned 0 [0098.120] lstrlenA (lpString="*.jpg") returned 5 [0098.120] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsColorChart.html", pszSpec="*.jpeg") returned 0 [0098.120] lstrlenA (lpString="*.jpeg") returned 6 [0098.120] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsColorChart.html", pszSpec="*.psd") returned 0 [0098.120] lstrlenA (lpString="*.psd") returned 5 [0098.120] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsColorChart.html", pszSpec="*.cdr") returned 0 [0098.120] lstrlenA (lpString="*.cdr") returned 5 [0098.120] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsColorChart.html", pszSpec="*.dwg") returned 0 [0098.120] lstrlenA (lpString="*.dwg") returned 5 [0098.120] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsColorChart.html", pszSpec="*.max") returned 0 [0098.120] lstrlenA (lpString="*.max") returned 5 [0098.120] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsColorChart.html", pszSpec="*.bmp") returned 0 [0098.120] lstrlenA (lpString="*.bmp") returned 5 [0098.120] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsColorChart.html", pszSpec="*.gif") returned 0 [0098.120] lstrlenA (lpString="*.gif") returned 5 [0098.122] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsColorChart.html", pszSpec="*.png") returned 0 [0098.122] lstrlenA (lpString="*.png") returned 5 [0098.122] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsColorChart.html", pszSpec="*.doc") returned 0 [0098.122] lstrlenA (lpString="*.doc") returned 5 [0098.122] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsColorChart.html", pszSpec="*.docx") returned 0 [0098.122] lstrlenA (lpString="*.docx") returned 6 [0098.122] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsColorChart.html", pszSpec="*.xls") returned 0 [0098.122] lstrlenA (lpString="*.xls") returned 5 [0098.122] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsColorChart.html", pszSpec="*.xlsx") returned 0 [0098.122] lstrlenA (lpString="*.xlsx") returned 6 [0098.123] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsColorChart.html", pszSpec="*.ppt") returned 0 [0098.123] lstrlenA (lpString="*.ppt") returned 5 [0098.123] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsColorChart.html", pszSpec="*.pptx") returned 0 [0098.123] lstrlenA (lpString="*.pptx") returned 6 [0098.123] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsColorChart.html", pszSpec="*.txt") returned 0 [0098.123] lstrlenA (lpString="*.txt") returned 5 [0098.123] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsColorChart.html", pszSpec="*.pdf") returned 0 [0098.123] lstrlenA (lpString="*.pdf") returned 5 [0098.123] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsColorChart.html", pszSpec="*.djvu") returned 0 [0098.123] lstrlenA (lpString="*.djvu") returned 6 [0098.123] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsColorChart.html", pszSpec="*.htm") returned 0 [0098.123] lstrlenA (lpString="*.htm") returned 5 [0098.123] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsColorChart.html", pszSpec="*.html") returned 1 [0098.123] lstrlenA (lpString="*.html") returned 6 [0098.123] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsColorChart.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsColorChart.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsColorChart.html" [0098.123] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsColorChart.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsColorChart.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsColorChart.html" [0098.123] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsColorChart.html", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsColorChart.html.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsColorChart.html." [0098.123] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsColorChart.html.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsColorChart.html. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsColorChart.html. " [0098.123] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsColorChart.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formscolorchart.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0098.124] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2ef [0098.124] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xa89b0700, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5291c2f0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xa89b0700, dwHighDateTime=0x1c747ea)) returned 1 [0098.124] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0098.124] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x295, lpOverlapped=0x0) returned 1 [0098.163] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsColorChart.html") returned="FormsColorChart.html" [0098.163] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0098.163] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x295, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x295, lpOverlapped=0x0) returned 1 [0098.163] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0098.163] CloseHandle (hObject=0x98) returned 1 [0098.163] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsColorChart.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formscolorchart.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsColorChart.html. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formscolorchart.html. ")) returned 1 [0098.164] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0098.164] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0098.164] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="FormsFormTemplate.html") returned -1 [0098.165] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FormsFormTemplate.html") returned 1 [0098.165] lstrcmpiA (lpString1="", lpString2="FormsFormTemplate.html") returned -1 [0098.165] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsColorChart.html") returned="FormsColorChart.html" [0098.165] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\", lpString2="FormsFormTemplate.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplate.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplate.html" [0098.165] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplate.html", pszSpec="*.zip") returned 0 [0098.165] lstrlenA (lpString="*.zip") returned 5 [0098.165] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplate.html", pszSpec="*.rar") returned 0 [0098.165] lstrlenA (lpString="*.rar") returned 5 [0098.165] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplate.html", pszSpec="*.7z") returned 0 [0098.165] lstrlenA (lpString="*.7z") returned 4 [0098.165] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplate.html", pszSpec="*.tar") returned 0 [0098.165] lstrlenA (lpString="*.tar") returned 5 [0098.165] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplate.html", pszSpec="*.gzip") returned 0 [0098.165] lstrlenA (lpString="*.gzip") returned 6 [0098.165] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplate.html", pszSpec="*.jpg") returned 0 [0098.165] lstrlenA (lpString="*.jpg") returned 5 [0098.165] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplate.html", pszSpec="*.jpeg") returned 0 [0098.165] lstrlenA (lpString="*.jpeg") returned 6 [0098.165] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplate.html", pszSpec="*.psd") returned 0 [0098.165] lstrlenA (lpString="*.psd") returned 5 [0098.165] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplate.html", pszSpec="*.cdr") returned 0 [0098.165] lstrlenA (lpString="*.cdr") returned 5 [0098.165] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplate.html", pszSpec="*.dwg") returned 0 [0098.165] lstrlenA (lpString="*.dwg") returned 5 [0098.165] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplate.html", pszSpec="*.max") returned 0 [0098.165] lstrlenA (lpString="*.max") returned 5 [0098.165] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplate.html", pszSpec="*.bmp") returned 0 [0098.165] lstrlenA (lpString="*.bmp") returned 5 [0098.165] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplate.html", pszSpec="*.gif") returned 0 [0098.165] lstrlenA (lpString="*.gif") returned 5 [0098.165] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplate.html", pszSpec="*.png") returned 0 [0098.165] lstrlenA (lpString="*.png") returned 5 [0098.165] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplate.html", pszSpec="*.doc") returned 0 [0098.165] lstrlenA (lpString="*.doc") returned 5 [0098.165] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplate.html", pszSpec="*.docx") returned 0 [0098.165] lstrlenA (lpString="*.docx") returned 6 [0098.166] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplate.html", pszSpec="*.xls") returned 0 [0098.166] lstrlenA (lpString="*.xls") returned 5 [0098.166] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplate.html", pszSpec="*.xlsx") returned 0 [0098.166] lstrlenA (lpString="*.xlsx") returned 6 [0098.166] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplate.html", pszSpec="*.ppt") returned 0 [0098.166] lstrlenA (lpString="*.ppt") returned 5 [0098.166] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplate.html", pszSpec="*.pptx") returned 0 [0098.166] lstrlenA (lpString="*.pptx") returned 6 [0098.166] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplate.html", pszSpec="*.txt") returned 0 [0098.166] lstrlenA (lpString="*.txt") returned 5 [0098.166] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplate.html", pszSpec="*.pdf") returned 0 [0098.166] lstrlenA (lpString="*.pdf") returned 5 [0098.166] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplate.html", pszSpec="*.djvu") returned 0 [0098.166] lstrlenA (lpString="*.djvu") returned 6 [0098.166] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplate.html", pszSpec="*.htm") returned 0 [0098.166] lstrlenA (lpString="*.htm") returned 5 [0098.166] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplate.html", pszSpec="*.html") returned 1 [0098.166] lstrlenA (lpString="*.html") returned 6 [0098.166] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplate.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplate.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplate.html" [0098.166] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplate.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplate.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplate.html" [0098.166] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplate.html", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplate.html.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplate.html." [0098.166] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplate.html.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplate.html. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplate.html. " [0098.166] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsformtemplate.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0098.170] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x13bb [0098.170] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xa89b0700, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5291c2f0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xa89b0700, dwHighDateTime=0x1c747ea)) returned 1 [0098.170] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0098.170] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x1361, lpOverlapped=0x0) returned 1 [0098.172] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplate.html") returned="FormsFormTemplate.html" [0098.172] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0098.172] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x1361, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x1361, lpOverlapped=0x0) returned 1 [0098.172] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0098.172] CloseHandle (hObject=0x98) returned 1 [0098.175] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsformtemplate.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplate.html. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsformtemplate.html. ")) returned 1 [0098.176] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0098.176] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0098.176] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="FormsFormTemplateRTL.html") returned -1 [0098.176] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FormsFormTemplateRTL.html") returned 1 [0098.176] lstrcmpiA (lpString1="", lpString2="FormsFormTemplateRTL.html") returned -1 [0098.176] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplate.html") returned="FormsFormTemplate.html" [0098.176] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\", lpString2="FormsFormTemplateRTL.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplateRTL.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplateRTL.html" [0098.176] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplateRTL.html", pszSpec="*.zip") returned 0 [0098.176] lstrlenA (lpString="*.zip") returned 5 [0098.176] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplateRTL.html", pszSpec="*.rar") returned 0 [0098.176] lstrlenA (lpString="*.rar") returned 5 [0098.176] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplateRTL.html", pszSpec="*.7z") returned 0 [0098.177] lstrlenA (lpString="*.7z") returned 4 [0098.177] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplateRTL.html", pszSpec="*.tar") returned 0 [0098.177] lstrlenA (lpString="*.tar") returned 5 [0098.177] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplateRTL.html", pszSpec="*.gzip") returned 0 [0098.177] lstrlenA (lpString="*.gzip") returned 6 [0098.177] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplateRTL.html", pszSpec="*.jpg") returned 0 [0098.177] lstrlenA (lpString="*.jpg") returned 5 [0098.177] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplateRTL.html", pszSpec="*.jpeg") returned 0 [0098.177] lstrlenA (lpString="*.jpeg") returned 6 [0098.177] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplateRTL.html", pszSpec="*.psd") returned 0 [0098.177] lstrlenA (lpString="*.psd") returned 5 [0098.177] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplateRTL.html", pszSpec="*.cdr") returned 0 [0098.177] lstrlenA (lpString="*.cdr") returned 5 [0098.177] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplateRTL.html", pszSpec="*.dwg") returned 0 [0098.177] lstrlenA (lpString="*.dwg") returned 5 [0098.177] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplateRTL.html", pszSpec="*.max") returned 0 [0098.177] lstrlenA (lpString="*.max") returned 5 [0098.177] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplateRTL.html", pszSpec="*.bmp") returned 0 [0098.177] lstrlenA (lpString="*.bmp") returned 5 [0098.177] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplateRTL.html", pszSpec="*.gif") returned 0 [0098.177] lstrlenA (lpString="*.gif") returned 5 [0098.177] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplateRTL.html", pszSpec="*.png") returned 0 [0098.177] lstrlenA (lpString="*.png") returned 5 [0098.177] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplateRTL.html", pszSpec="*.doc") returned 0 [0098.177] lstrlenA (lpString="*.doc") returned 5 [0098.177] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplateRTL.html", pszSpec="*.docx") returned 0 [0098.177] lstrlenA (lpString="*.docx") returned 6 [0098.177] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplateRTL.html", pszSpec="*.xls") returned 0 [0098.177] lstrlenA (lpString="*.xls") returned 5 [0098.177] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplateRTL.html", pszSpec="*.xlsx") returned 0 [0098.177] lstrlenA (lpString="*.xlsx") returned 6 [0098.177] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplateRTL.html", pszSpec="*.ppt") returned 0 [0098.177] lstrlenA (lpString="*.ppt") returned 5 [0098.177] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplateRTL.html", pszSpec="*.pptx") returned 0 [0098.177] lstrlenA (lpString="*.pptx") returned 6 [0098.178] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplateRTL.html", pszSpec="*.txt") returned 0 [0098.178] lstrlenA (lpString="*.txt") returned 5 [0098.178] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplateRTL.html", pszSpec="*.pdf") returned 0 [0098.178] lstrlenA (lpString="*.pdf") returned 5 [0098.178] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplateRTL.html", pszSpec="*.djvu") returned 0 [0098.178] lstrlenA (lpString="*.djvu") returned 6 [0098.178] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplateRTL.html", pszSpec="*.htm") returned 0 [0098.178] lstrlenA (lpString="*.htm") returned 5 [0098.178] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplateRTL.html", pszSpec="*.html") returned 1 [0098.178] lstrlenA (lpString="*.html") returned 6 [0098.178] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplateRTL.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplateRTL.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplateRTL.html" [0098.178] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplateRTL.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplateRTL.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplateRTL.html" [0098.178] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplateRTL.html", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplateRTL.html.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplateRTL.html." [0098.178] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplateRTL.html.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplateRTL.html. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplateRTL.html. " [0098.178] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplateRTL.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsformtemplatertl.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0098.179] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x13c5 [0098.179] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x69fe8900, dwHighDateTime=0x1c7d303), lpLastAccessTime=0x407536*(dwLowDateTime=0x618c8a10, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x69fe8900, dwHighDateTime=0x1c7d303)) returned 1 [0098.179] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0098.179] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x136b, lpOverlapped=0x0) returned 1 [0098.180] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplateRTL.html") returned="FormsFormTemplateRTL.html" [0098.181] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0098.181] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x136b, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x136b, lpOverlapped=0x0) returned 1 [0098.181] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0098.181] CloseHandle (hObject=0x98) returned 1 [0098.181] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplateRTL.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsformtemplatertl.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplateRTL.html. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsformtemplatertl.html. ")) returned 1 [0098.182] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0098.182] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0098.182] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="FormsImageTemplate.html") returned -1 [0098.182] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FormsImageTemplate.html") returned 1 [0098.182] lstrcmpiA (lpString1="", lpString2="FormsImageTemplate.html") returned -1 [0098.182] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplateRTL.html") returned="FormsFormTemplateRTL.html" [0098.182] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\", lpString2="FormsImageTemplate.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsImageTemplate.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsImageTemplate.html" [0098.182] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsImageTemplate.html", pszSpec="*.zip") returned 0 [0098.182] lstrlenA (lpString="*.zip") returned 5 [0098.182] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsImageTemplate.html", pszSpec="*.rar") returned 0 [0098.182] lstrlenA (lpString="*.rar") returned 5 [0098.182] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsImageTemplate.html", pszSpec="*.7z") returned 0 [0098.182] lstrlenA (lpString="*.7z") returned 4 [0098.182] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsImageTemplate.html", pszSpec="*.tar") returned 0 [0098.182] lstrlenA (lpString="*.tar") returned 5 [0098.182] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsImageTemplate.html", pszSpec="*.gzip") returned 0 [0098.182] lstrlenA (lpString="*.gzip") returned 6 [0098.182] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsImageTemplate.html", pszSpec="*.jpg") returned 0 [0098.183] lstrlenA (lpString="*.jpg") returned 5 [0098.183] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsImageTemplate.html", pszSpec="*.jpeg") returned 0 [0098.183] lstrlenA (lpString="*.jpeg") returned 6 [0098.183] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsImageTemplate.html", pszSpec="*.psd") returned 0 [0098.183] lstrlenA (lpString="*.psd") returned 5 [0098.183] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsImageTemplate.html", pszSpec="*.cdr") returned 0 [0098.183] lstrlenA (lpString="*.cdr") returned 5 [0098.183] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsImageTemplate.html", pszSpec="*.dwg") returned 0 [0098.183] lstrlenA (lpString="*.dwg") returned 5 [0098.183] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsImageTemplate.html", pszSpec="*.max") returned 0 [0098.183] lstrlenA (lpString="*.max") returned 5 [0098.183] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsImageTemplate.html", pszSpec="*.bmp") returned 0 [0098.183] lstrlenA (lpString="*.bmp") returned 5 [0098.183] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsImageTemplate.html", pszSpec="*.gif") returned 0 [0098.183] lstrlenA (lpString="*.gif") returned 5 [0098.183] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsImageTemplate.html", pszSpec="*.png") returned 0 [0098.183] lstrlenA (lpString="*.png") returned 5 [0098.183] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsImageTemplate.html", pszSpec="*.doc") returned 0 [0098.183] lstrlenA (lpString="*.doc") returned 5 [0098.183] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsImageTemplate.html", pszSpec="*.docx") returned 0 [0098.183] lstrlenA (lpString="*.docx") returned 6 [0098.183] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsImageTemplate.html", pszSpec="*.xls") returned 0 [0098.183] lstrlenA (lpString="*.xls") returned 5 [0098.183] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsImageTemplate.html", pszSpec="*.xlsx") returned 0 [0098.183] lstrlenA (lpString="*.xlsx") returned 6 [0098.183] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsImageTemplate.html", pszSpec="*.ppt") returned 0 [0098.183] lstrlenA (lpString="*.ppt") returned 5 [0098.183] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsImageTemplate.html", pszSpec="*.pptx") returned 0 [0098.183] lstrlenA (lpString="*.pptx") returned 6 [0098.183] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsImageTemplate.html", pszSpec="*.txt") returned 0 [0098.183] lstrlenA (lpString="*.txt") returned 5 [0098.183] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsImageTemplate.html", pszSpec="*.pdf") returned 0 [0098.184] lstrlenA (lpString="*.pdf") returned 5 [0098.184] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsImageTemplate.html", pszSpec="*.djvu") returned 0 [0098.184] lstrlenA (lpString="*.djvu") returned 6 [0098.184] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsImageTemplate.html", pszSpec="*.htm") returned 0 [0098.184] lstrlenA (lpString="*.htm") returned 5 [0098.184] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsImageTemplate.html", pszSpec="*.html") returned 1 [0098.184] lstrlenA (lpString="*.html") returned 6 [0098.184] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsImageTemplate.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsImageTemplate.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsImageTemplate.html" [0098.184] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsImageTemplate.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsImageTemplate.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsImageTemplate.html" [0098.184] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsImageTemplate.html", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsImageTemplate.html.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsImageTemplate.html." [0098.184] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsImageTemplate.html.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsImageTemplate.html. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsImageTemplate.html. " [0098.184] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsImageTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsimagetemplate.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0098.185] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x8ab [0098.185] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xa89b0700, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x618eeb70, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xa89b0700, dwHighDateTime=0x1c747ea)) returned 1 [0098.185] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0098.185] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x851, lpOverlapped=0x0) returned 1 [0098.186] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsImageTemplate.html") returned="FormsImageTemplate.html" [0098.186] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0098.186] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x851, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x851, lpOverlapped=0x0) returned 1 [0098.186] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0098.186] CloseHandle (hObject=0x98) returned 1 [0098.187] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsImageTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsimagetemplate.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsImageTemplate.html. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsimagetemplate.html. ")) returned 1 [0098.187] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0098.187] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0098.188] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="FormsMacroTemplate.html") returned -1 [0098.188] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FormsMacroTemplate.html") returned 1 [0098.188] lstrcmpiA (lpString1="", lpString2="FormsMacroTemplate.html") returned -1 [0098.188] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsImageTemplate.html") returned="FormsImageTemplate.html" [0098.188] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\", lpString2="FormsMacroTemplate.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsMacroTemplate.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsMacroTemplate.html" [0098.188] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsMacroTemplate.html", pszSpec="*.zip") returned 0 [0098.188] lstrlenA (lpString="*.zip") returned 5 [0098.188] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsMacroTemplate.html", pszSpec="*.rar") returned 0 [0098.188] lstrlenA (lpString="*.rar") returned 5 [0098.188] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsMacroTemplate.html", pszSpec="*.7z") returned 0 [0098.188] lstrlenA (lpString="*.7z") returned 4 [0098.188] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsMacroTemplate.html", pszSpec="*.tar") returned 0 [0098.188] lstrlenA (lpString="*.tar") returned 5 [0098.188] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsMacroTemplate.html", pszSpec="*.gzip") returned 0 [0098.188] lstrlenA (lpString="*.gzip") returned 6 [0098.188] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsMacroTemplate.html", pszSpec="*.jpg") returned 0 [0098.188] lstrlenA (lpString="*.jpg") returned 5 [0098.188] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsMacroTemplate.html", pszSpec="*.jpeg") returned 0 [0098.188] lstrlenA (lpString="*.jpeg") returned 6 [0098.188] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsMacroTemplate.html", pszSpec="*.psd") returned 0 [0098.188] lstrlenA (lpString="*.psd") returned 5 [0098.188] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsMacroTemplate.html", pszSpec="*.cdr") returned 0 [0098.188] lstrlenA (lpString="*.cdr") returned 5 [0098.188] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsMacroTemplate.html", pszSpec="*.dwg") returned 0 [0098.188] lstrlenA (lpString="*.dwg") returned 5 [0098.188] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsMacroTemplate.html", pszSpec="*.max") returned 0 [0098.188] lstrlenA (lpString="*.max") returned 5 [0098.188] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsMacroTemplate.html", pszSpec="*.bmp") returned 0 [0098.188] lstrlenA (lpString="*.bmp") returned 5 [0098.188] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsMacroTemplate.html", pszSpec="*.gif") returned 0 [0098.188] lstrlenA (lpString="*.gif") returned 5 [0098.188] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsMacroTemplate.html", pszSpec="*.png") returned 0 [0098.188] lstrlenA (lpString="*.png") returned 5 [0098.188] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsMacroTemplate.html", pszSpec="*.doc") returned 0 [0098.188] lstrlenA (lpString="*.doc") returned 5 [0098.188] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsMacroTemplate.html", pszSpec="*.docx") returned 0 [0098.188] lstrlenA (lpString="*.docx") returned 6 [0098.188] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsMacroTemplate.html", pszSpec="*.xls") returned 0 [0098.188] lstrlenA (lpString="*.xls") returned 5 [0098.188] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsMacroTemplate.html", pszSpec="*.xlsx") returned 0 [0098.189] lstrlenA (lpString="*.xlsx") returned 6 [0098.189] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsMacroTemplate.html", pszSpec="*.ppt") returned 0 [0098.189] lstrlenA (lpString="*.ppt") returned 5 [0098.189] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsMacroTemplate.html", pszSpec="*.pptx") returned 0 [0098.189] lstrlenA (lpString="*.pptx") returned 6 [0098.189] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsMacroTemplate.html", pszSpec="*.txt") returned 0 [0098.189] lstrlenA (lpString="*.txt") returned 5 [0098.189] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsMacroTemplate.html", pszSpec="*.pdf") returned 0 [0098.189] lstrlenA (lpString="*.pdf") returned 5 [0098.189] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsMacroTemplate.html", pszSpec="*.djvu") returned 0 [0098.189] lstrlenA (lpString="*.djvu") returned 6 [0098.189] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsMacroTemplate.html", pszSpec="*.htm") returned 0 [0098.189] lstrlenA (lpString="*.htm") returned 5 [0098.189] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsMacroTemplate.html", pszSpec="*.html") returned 1 [0098.189] lstrlenA (lpString="*.html") returned 6 [0098.189] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsMacroTemplate.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsMacroTemplate.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsMacroTemplate.html" [0098.189] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsMacroTemplate.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsMacroTemplate.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsMacroTemplate.html" [0098.189] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsMacroTemplate.html", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsMacroTemplate.html.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsMacroTemplate.html." [0098.189] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsMacroTemplate.html.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsMacroTemplate.html. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsMacroTemplate.html. " [0098.189] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsMacroTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsmacrotemplate.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0098.190] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x858 [0098.190] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xa89b0700, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x52942450, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xa89b0700, dwHighDateTime=0x1c747ea)) returned 1 [0098.190] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0098.190] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x7fe, lpOverlapped=0x0) returned 1 [0098.215] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsMacroTemplate.html") returned="FormsMacroTemplate.html" [0098.215] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0098.215] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x7fe, lpOverlapped=0x0) returned 1 [0098.215] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0098.215] CloseHandle (hObject=0x98) returned 1 [0098.215] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsMacroTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsmacrotemplate.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsMacroTemplate.html. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsmacrotemplate.html. ")) returned 1 [0098.216] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0098.216] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0098.216] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="FormsPreviewTemplate.html") returned -1 [0098.216] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FormsPreviewTemplate.html") returned 1 [0098.216] lstrcmpiA (lpString1="", lpString2="FormsPreviewTemplate.html") returned -1 [0098.216] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsMacroTemplate.html") returned="FormsMacroTemplate.html" [0098.216] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\", lpString2="FormsPreviewTemplate.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplate.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplate.html" [0098.216] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplate.html", pszSpec="*.zip") returned 0 [0098.216] lstrlenA (lpString="*.zip") returned 5 [0098.217] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplate.html", pszSpec="*.rar") returned 0 [0098.217] lstrlenA (lpString="*.rar") returned 5 [0098.217] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplate.html", pszSpec="*.7z") returned 0 [0098.217] lstrlenA (lpString="*.7z") returned 4 [0098.217] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplate.html", pszSpec="*.tar") returned 0 [0098.217] lstrlenA (lpString="*.tar") returned 5 [0098.217] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplate.html", pszSpec="*.gzip") returned 0 [0098.217] lstrlenA (lpString="*.gzip") returned 6 [0098.217] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplate.html", pszSpec="*.jpg") returned 0 [0098.217] lstrlenA (lpString="*.jpg") returned 5 [0098.217] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplate.html", pszSpec="*.jpeg") returned 0 [0098.217] lstrlenA (lpString="*.jpeg") returned 6 [0098.217] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplate.html", pszSpec="*.psd") returned 0 [0098.217] lstrlenA (lpString="*.psd") returned 5 [0098.217] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplate.html", pszSpec="*.cdr") returned 0 [0098.217] lstrlenA (lpString="*.cdr") returned 5 [0098.217] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplate.html", pszSpec="*.dwg") returned 0 [0098.217] lstrlenA (lpString="*.dwg") returned 5 [0098.217] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplate.html", pszSpec="*.max") returned 0 [0098.217] lstrlenA (lpString="*.max") returned 5 [0098.217] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplate.html", pszSpec="*.bmp") returned 0 [0098.217] lstrlenA (lpString="*.bmp") returned 5 [0098.217] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplate.html", pszSpec="*.gif") returned 0 [0098.217] lstrlenA (lpString="*.gif") returned 5 [0098.217] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplate.html", pszSpec="*.png") returned 0 [0098.217] lstrlenA (lpString="*.png") returned 5 [0098.217] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplate.html", pszSpec="*.doc") returned 0 [0098.217] lstrlenA (lpString="*.doc") returned 5 [0098.217] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplate.html", pszSpec="*.docx") returned 0 [0098.217] lstrlenA (lpString="*.docx") returned 6 [0098.217] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplate.html", pszSpec="*.xls") returned 0 [0098.217] lstrlenA (lpString="*.xls") returned 5 [0098.217] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplate.html", pszSpec="*.xlsx") returned 0 [0098.217] lstrlenA (lpString="*.xlsx") returned 6 [0098.217] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplate.html", pszSpec="*.ppt") returned 0 [0098.217] lstrlenA (lpString="*.ppt") returned 5 [0098.217] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplate.html", pszSpec="*.pptx") returned 0 [0098.217] lstrlenA (lpString="*.pptx") returned 6 [0098.217] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplate.html", pszSpec="*.txt") returned 0 [0098.217] lstrlenA (lpString="*.txt") returned 5 [0098.218] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplate.html", pszSpec="*.pdf") returned 0 [0098.218] lstrlenA (lpString="*.pdf") returned 5 [0098.218] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplate.html", pszSpec="*.djvu") returned 0 [0098.218] lstrlenA (lpString="*.djvu") returned 6 [0098.218] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplate.html", pszSpec="*.htm") returned 0 [0098.218] lstrlenA (lpString="*.htm") returned 5 [0098.218] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplate.html", pszSpec="*.html") returned 1 [0098.218] lstrlenA (lpString="*.html") returned 6 [0098.218] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplate.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplate.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplate.html" [0098.218] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplate.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplate.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplate.html" [0098.218] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplate.html", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplate.html.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplate.html." [0098.218] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplate.html.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplate.html. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplate.html. " [0098.218] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formspreviewtemplate.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0098.218] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x46ff [0098.218] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xa89b0700, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5298e710, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xa89b0700, dwHighDateTime=0x1c747ea)) returned 1 [0098.219] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0098.219] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x46a5, lpOverlapped=0x0) returned 1 [0098.224] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplate.html") returned="FormsPreviewTemplate.html" [0098.224] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0098.225] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x46a5, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x46a5, lpOverlapped=0x0) returned 1 [0098.225] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0098.225] CloseHandle (hObject=0x98) returned 1 [0098.225] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formspreviewtemplate.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplate.html. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formspreviewtemplate.html. ")) returned 1 [0098.226] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0098.226] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0098.226] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="FormsPreviewTemplateRTL.html") returned -1 [0098.226] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FormsPreviewTemplateRTL.html") returned 1 [0098.226] lstrcmpiA (lpString1="", lpString2="FormsPreviewTemplateRTL.html") returned -1 [0098.226] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplate.html") returned="FormsPreviewTemplate.html" [0098.226] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\", lpString2="FormsPreviewTemplateRTL.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplateRTL.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplateRTL.html" [0098.226] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplateRTL.html", pszSpec="*.zip") returned 0 [0098.226] lstrlenA (lpString="*.zip") returned 5 [0098.226] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplateRTL.html", pszSpec="*.rar") returned 0 [0098.226] lstrlenA (lpString="*.rar") returned 5 [0098.226] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplateRTL.html", pszSpec="*.7z") returned 0 [0098.226] lstrlenA (lpString="*.7z") returned 4 [0098.226] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplateRTL.html", pszSpec="*.tar") returned 0 [0098.226] lstrlenA (lpString="*.tar") returned 5 [0098.226] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplateRTL.html", pszSpec="*.gzip") returned 0 [0098.226] lstrlenA (lpString="*.gzip") returned 6 [0098.226] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplateRTL.html", pszSpec="*.jpg") returned 0 [0098.226] lstrlenA (lpString="*.jpg") returned 5 [0098.226] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplateRTL.html", pszSpec="*.jpeg") returned 0 [0098.226] lstrlenA (lpString="*.jpeg") returned 6 [0098.227] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplateRTL.html", pszSpec="*.psd") returned 0 [0098.227] lstrlenA (lpString="*.psd") returned 5 [0098.227] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplateRTL.html", pszSpec="*.cdr") returned 0 [0098.227] lstrlenA (lpString="*.cdr") returned 5 [0098.227] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplateRTL.html", pszSpec="*.dwg") returned 0 [0098.227] lstrlenA (lpString="*.dwg") returned 5 [0098.227] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplateRTL.html", pszSpec="*.max") returned 0 [0098.227] lstrlenA (lpString="*.max") returned 5 [0098.227] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplateRTL.html", pszSpec="*.bmp") returned 0 [0098.227] lstrlenA (lpString="*.bmp") returned 5 [0098.227] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplateRTL.html", pszSpec="*.gif") returned 0 [0098.227] lstrlenA (lpString="*.gif") returned 5 [0098.227] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplateRTL.html", pszSpec="*.png") returned 0 [0098.227] lstrlenA (lpString="*.png") returned 5 [0098.227] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplateRTL.html", pszSpec="*.doc") returned 0 [0098.227] lstrlenA (lpString="*.doc") returned 5 [0098.227] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplateRTL.html", pszSpec="*.docx") returned 0 [0098.227] lstrlenA (lpString="*.docx") returned 6 [0098.227] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplateRTL.html", pszSpec="*.xls") returned 0 [0098.227] lstrlenA (lpString="*.xls") returned 5 [0098.227] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplateRTL.html", pszSpec="*.xlsx") returned 0 [0098.227] lstrlenA (lpString="*.xlsx") returned 6 [0098.227] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplateRTL.html", pszSpec="*.ppt") returned 0 [0098.227] lstrlenA (lpString="*.ppt") returned 5 [0098.227] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplateRTL.html", pszSpec="*.pptx") returned 0 [0098.227] lstrlenA (lpString="*.pptx") returned 6 [0098.227] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplateRTL.html", pszSpec="*.txt") returned 0 [0098.227] lstrlenA (lpString="*.txt") returned 5 [0098.227] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplateRTL.html", pszSpec="*.pdf") returned 0 [0098.227] lstrlenA (lpString="*.pdf") returned 5 [0098.227] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplateRTL.html", pszSpec="*.djvu") returned 0 [0098.227] lstrlenA (lpString="*.djvu") returned 6 [0098.227] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplateRTL.html", pszSpec="*.htm") returned 0 [0098.227] lstrlenA (lpString="*.htm") returned 5 [0098.227] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplateRTL.html", pszSpec="*.html") returned 1 [0098.227] lstrlenA (lpString="*.html") returned 6 [0098.227] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplateRTL.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplateRTL.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplateRTL.html" [0098.227] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplateRTL.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplateRTL.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplateRTL.html" [0098.228] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplateRTL.html", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplateRTL.html.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplateRTL.html." [0098.228] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplateRTL.html.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplateRTL.html. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplateRTL.html. " [0098.228] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplateRTL.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formspreviewtemplatertl.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0098.228] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4709 [0098.228] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x797dd200, dwHighDateTime=0x1c7d303), lpLastAccessTime=0x407536*(dwLowDateTime=0x618eeb70, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x797dd200, dwHighDateTime=0x1c7d303)) returned 1 [0098.228] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0098.228] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x46af, lpOverlapped=0x0) returned 1 [0098.230] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplateRTL.html") returned="FormsPreviewTemplateRTL.html" [0098.230] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0098.230] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x46af, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x46af, lpOverlapped=0x0) returned 1 [0098.230] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0098.230] CloseHandle (hObject=0x98) returned 1 [0098.230] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplateRTL.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formspreviewtemplatertl.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplateRTL.html. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formspreviewtemplatertl.html. ")) returned 1 [0098.233] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0098.233] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0098.233] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="FormsPrintTemplate.html") returned -1 [0098.233] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FormsPrintTemplate.html") returned 1 [0098.233] lstrcmpiA (lpString1="", lpString2="FormsPrintTemplate.html") returned -1 [0098.233] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplateRTL.html") returned="FormsPreviewTemplateRTL.html" [0098.233] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\", lpString2="FormsPrintTemplate.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplate.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplate.html" [0098.233] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplate.html", pszSpec="*.zip") returned 0 [0098.233] lstrlenA (lpString="*.zip") returned 5 [0098.233] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplate.html", pszSpec="*.rar") returned 0 [0098.233] lstrlenA (lpString="*.rar") returned 5 [0098.233] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplate.html", pszSpec="*.7z") returned 0 [0098.233] lstrlenA (lpString="*.7z") returned 4 [0098.233] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplate.html", pszSpec="*.tar") returned 0 [0098.233] lstrlenA (lpString="*.tar") returned 5 [0098.233] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplate.html", pszSpec="*.gzip") returned 0 [0098.233] lstrlenA (lpString="*.gzip") returned 6 [0098.233] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplate.html", pszSpec="*.jpg") returned 0 [0098.233] lstrlenA (lpString="*.jpg") returned 5 [0098.233] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplate.html", pszSpec="*.jpeg") returned 0 [0098.233] lstrlenA (lpString="*.jpeg") returned 6 [0098.233] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplate.html", pszSpec="*.psd") returned 0 [0098.233] lstrlenA (lpString="*.psd") returned 5 [0098.233] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplate.html", pszSpec="*.cdr") returned 0 [0098.233] lstrlenA (lpString="*.cdr") returned 5 [0098.233] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplate.html", pszSpec="*.dwg") returned 0 [0098.233] lstrlenA (lpString="*.dwg") returned 5 [0098.233] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplate.html", pszSpec="*.max") returned 0 [0098.233] lstrlenA (lpString="*.max") returned 5 [0098.233] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplate.html", pszSpec="*.bmp") returned 0 [0098.233] lstrlenA (lpString="*.bmp") returned 5 [0098.233] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplate.html", pszSpec="*.gif") returned 0 [0098.233] lstrlenA (lpString="*.gif") returned 5 [0098.234] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplate.html", pszSpec="*.png") returned 0 [0098.234] lstrlenA (lpString="*.png") returned 5 [0098.234] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplate.html", pszSpec="*.doc") returned 0 [0098.234] lstrlenA (lpString="*.doc") returned 5 [0098.234] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplate.html", pszSpec="*.docx") returned 0 [0098.234] lstrlenA (lpString="*.docx") returned 6 [0098.234] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplate.html", pszSpec="*.xls") returned 0 [0098.234] lstrlenA (lpString="*.xls") returned 5 [0098.234] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplate.html", pszSpec="*.xlsx") returned 0 [0098.234] lstrlenA (lpString="*.xlsx") returned 6 [0098.234] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplate.html", pszSpec="*.ppt") returned 0 [0098.234] lstrlenA (lpString="*.ppt") returned 5 [0098.234] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplate.html", pszSpec="*.pptx") returned 0 [0098.234] lstrlenA (lpString="*.pptx") returned 6 [0098.234] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplate.html", pszSpec="*.txt") returned 0 [0098.234] lstrlenA (lpString="*.txt") returned 5 [0098.234] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplate.html", pszSpec="*.pdf") returned 0 [0098.234] lstrlenA (lpString="*.pdf") returned 5 [0098.234] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplate.html", pszSpec="*.djvu") returned 0 [0098.234] lstrlenA (lpString="*.djvu") returned 6 [0098.234] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplate.html", pszSpec="*.htm") returned 0 [0098.234] lstrlenA (lpString="*.htm") returned 5 [0098.234] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplate.html", pszSpec="*.html") returned 1 [0098.234] lstrlenA (lpString="*.html") returned 6 [0098.234] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplate.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplate.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplate.html" [0098.234] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplate.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplate.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplate.html" [0098.234] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplate.html", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplate.html.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplate.html." [0098.234] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplate.html.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplate.html. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplate.html. " [0098.234] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsprinttemplate.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0098.235] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x5bf [0098.235] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xa89b0700, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5298e710, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xa89b0700, dwHighDateTime=0x1c747ea)) returned 1 [0098.235] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0098.235] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x565, lpOverlapped=0x0) returned 1 [0098.243] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplate.html") returned="FormsPrintTemplate.html" [0098.243] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0098.243] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x565, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x565, lpOverlapped=0x0) returned 1 [0098.243] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0098.243] CloseHandle (hObject=0x98) returned 1 [0098.243] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsprinttemplate.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplate.html. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsprinttemplate.html. ")) returned 1 [0098.244] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0098.244] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0098.244] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="FormsPrintTemplateRTL.html") returned -1 [0098.244] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FormsPrintTemplateRTL.html") returned 1 [0098.244] lstrcmpiA (lpString1="", lpString2="FormsPrintTemplateRTL.html") returned -1 [0098.244] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplate.html") returned="FormsPrintTemplate.html" [0098.244] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\", lpString2="FormsPrintTemplateRTL.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplateRTL.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplateRTL.html" [0098.244] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplateRTL.html", pszSpec="*.zip") returned 0 [0098.244] lstrlenA (lpString="*.zip") returned 5 [0098.244] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplateRTL.html", pszSpec="*.rar") returned 0 [0098.244] lstrlenA (lpString="*.rar") returned 5 [0098.244] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplateRTL.html", pszSpec="*.7z") returned 0 [0098.244] lstrlenA (lpString="*.7z") returned 4 [0098.244] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplateRTL.html", pszSpec="*.tar") returned 0 [0098.244] lstrlenA (lpString="*.tar") returned 5 [0098.244] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplateRTL.html", pszSpec="*.gzip") returned 0 [0098.244] lstrlenA (lpString="*.gzip") returned 6 [0098.244] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplateRTL.html", pszSpec="*.jpg") returned 0 [0098.244] lstrlenA (lpString="*.jpg") returned 5 [0098.245] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplateRTL.html", pszSpec="*.jpeg") returned 0 [0098.245] lstrlenA (lpString="*.jpeg") returned 6 [0098.245] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplateRTL.html", pszSpec="*.psd") returned 0 [0098.245] lstrlenA (lpString="*.psd") returned 5 [0098.245] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplateRTL.html", pszSpec="*.cdr") returned 0 [0098.245] lstrlenA (lpString="*.cdr") returned 5 [0098.245] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplateRTL.html", pszSpec="*.dwg") returned 0 [0098.245] lstrlenA (lpString="*.dwg") returned 5 [0098.245] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplateRTL.html", pszSpec="*.max") returned 0 [0098.245] lstrlenA (lpString="*.max") returned 5 [0098.245] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplateRTL.html", pszSpec="*.bmp") returned 0 [0098.245] lstrlenA (lpString="*.bmp") returned 5 [0098.245] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplateRTL.html", pszSpec="*.gif") returned 0 [0098.245] lstrlenA (lpString="*.gif") returned 5 [0098.245] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplateRTL.html", pszSpec="*.png") returned 0 [0098.245] lstrlenA (lpString="*.png") returned 5 [0098.245] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplateRTL.html", pszSpec="*.doc") returned 0 [0098.245] lstrlenA (lpString="*.doc") returned 5 [0098.245] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplateRTL.html", pszSpec="*.docx") returned 0 [0098.245] lstrlenA (lpString="*.docx") returned 6 [0098.245] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplateRTL.html", pszSpec="*.xls") returned 0 [0098.245] lstrlenA (lpString="*.xls") returned 5 [0098.245] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplateRTL.html", pszSpec="*.xlsx") returned 0 [0098.245] lstrlenA (lpString="*.xlsx") returned 6 [0098.245] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplateRTL.html", pszSpec="*.ppt") returned 0 [0098.245] lstrlenA (lpString="*.ppt") returned 5 [0098.245] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplateRTL.html", pszSpec="*.pptx") returned 0 [0098.245] lstrlenA (lpString="*.pptx") returned 6 [0098.245] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplateRTL.html", pszSpec="*.txt") returned 0 [0098.245] lstrlenA (lpString="*.txt") returned 5 [0098.245] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplateRTL.html", pszSpec="*.pdf") returned 0 [0098.245] lstrlenA (lpString="*.pdf") returned 5 [0098.245] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplateRTL.html", pszSpec="*.djvu") returned 0 [0098.245] lstrlenA (lpString="*.djvu") returned 6 [0098.245] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplateRTL.html", pszSpec="*.htm") returned 0 [0098.245] lstrlenA (lpString="*.htm") returned 5 [0098.245] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplateRTL.html", pszSpec="*.html") returned 1 [0098.246] lstrlenA (lpString="*.html") returned 6 [0098.246] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplateRTL.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplateRTL.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplateRTL.html" [0098.246] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplateRTL.html" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplateRTL.html") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplateRTL.html" [0098.246] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplateRTL.html", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplateRTL.html.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplateRTL.html." [0098.246] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplateRTL.html.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplateRTL.html. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplateRTL.html. " [0098.246] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplateRTL.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsprinttemplatertl.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0098.246] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x5c9 [0098.247] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8a2e4800, dwHighDateTime=0x1c7d303), lpLastAccessTime=0x407536*(dwLowDateTime=0x618eeb70, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x8a2e4800, dwHighDateTime=0x1c7d303)) returned 1 [0098.247] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0098.247] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x56f, lpOverlapped=0x0) returned 1 [0098.262] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplateRTL.html") returned="FormsPrintTemplateRTL.html" [0098.262] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0098.262] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x56f, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x56f, lpOverlapped=0x0) returned 1 [0098.263] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0098.263] CloseHandle (hObject=0x98) returned 1 [0098.263] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplateRTL.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsprinttemplatertl.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplateRTL.html. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsprinttemplatertl.html. ")) returned 1 [0098.264] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0098.264] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0098.264] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="FormsViewAttachmentIcons.jpg") returned -1 [0098.264] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FormsViewAttachmentIcons.jpg") returned 1 [0098.264] lstrcmpiA (lpString1="", lpString2="FormsViewAttachmentIcons.jpg") returned -1 [0098.264] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplateRTL.html") returned="FormsPrintTemplateRTL.html" [0098.264] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\", lpString2="FormsViewAttachmentIcons.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIcons.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIcons.jpg" [0098.264] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIcons.jpg", pszSpec="*.zip") returned 0 [0098.264] lstrlenA (lpString="*.zip") returned 5 [0098.264] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIcons.jpg", pszSpec="*.rar") returned 0 [0098.264] lstrlenA (lpString="*.rar") returned 5 [0098.264] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIcons.jpg", pszSpec="*.7z") returned 0 [0098.264] lstrlenA (lpString="*.7z") returned 4 [0098.264] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIcons.jpg", pszSpec="*.tar") returned 0 [0098.264] lstrlenA (lpString="*.tar") returned 5 [0098.264] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIcons.jpg", pszSpec="*.gzip") returned 0 [0098.265] lstrlenA (lpString="*.gzip") returned 6 [0098.265] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIcons.jpg", pszSpec="*.jpg") returned 1 [0098.265] lstrlenA (lpString="*.jpg") returned 5 [0098.265] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIcons.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIcons.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIcons.jpg" [0098.265] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIcons.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIcons.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIcons.jpg" [0098.265] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIcons.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIcons.jpg.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIcons.jpg." [0098.265] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIcons.jpg.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIcons.jpg. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIcons.jpg. " [0098.265] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIcons.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsviewattachmenticons.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0098.265] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1499 [0098.266] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xb0f34200, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5298e710, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xb0f34200, dwHighDateTime=0x1c747ea)) returned 1 [0098.266] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0098.266] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x143f, lpOverlapped=0x0) returned 1 [0098.270] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIcons.jpg") returned="FormsViewAttachmentIcons.jpg" [0098.270] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0098.270] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x143f, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x143f, lpOverlapped=0x0) returned 1 [0098.271] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0098.271] CloseHandle (hObject=0x98) returned 1 [0098.271] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIcons.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsviewattachmenticons.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIcons.jpg. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsviewattachmenticons.jpg. ")) returned 1 [0098.272] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0098.272] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0098.272] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="FormsViewAttachmentIconsMask.bmp") returned -1 [0098.272] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FormsViewAttachmentIconsMask.bmp") returned 1 [0098.272] lstrcmpiA (lpString1="", lpString2="FormsViewAttachmentIconsMask.bmp") returned -1 [0098.272] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIcons.jpg") returned="FormsViewAttachmentIcons.jpg" [0098.272] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\", lpString2="FormsViewAttachmentIconsMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIconsMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIconsMask.bmp" [0098.272] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.zip") returned 0 [0098.272] lstrlenA (lpString="*.zip") returned 5 [0098.272] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.rar") returned 0 [0098.272] lstrlenA (lpString="*.rar") returned 5 [0098.272] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.7z") returned 0 [0098.272] lstrlenA (lpString="*.7z") returned 4 [0098.272] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.tar") returned 0 [0098.272] lstrlenA (lpString="*.tar") returned 5 [0098.272] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.gzip") returned 0 [0098.272] lstrlenA (lpString="*.gzip") returned 6 [0098.272] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.jpg") returned 0 [0098.273] lstrlenA (lpString="*.jpg") returned 5 [0098.273] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.jpeg") returned 0 [0098.273] lstrlenA (lpString="*.jpeg") returned 6 [0098.273] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.psd") returned 0 [0098.273] lstrlenA (lpString="*.psd") returned 5 [0098.273] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.cdr") returned 0 [0098.273] lstrlenA (lpString="*.cdr") returned 5 [0098.273] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.dwg") returned 0 [0098.273] lstrlenA (lpString="*.dwg") returned 5 [0098.273] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.max") returned 0 [0098.273] lstrlenA (lpString="*.max") returned 5 [0098.273] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIconsMask.bmp", pszSpec="*.bmp") returned 1 [0098.273] lstrlenA (lpString="*.bmp") returned 5 [0098.273] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIconsMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIconsMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIconsMask.bmp" [0098.273] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIconsMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIconsMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIconsMask.bmp" [0098.273] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIconsMask.bmp", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIconsMask.bmp.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIconsMask.bmp." [0098.273] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIconsMask.bmp.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIconsMask.bmp. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIconsMask.bmp. " [0098.273] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIconsMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsviewattachmenticonsmask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0098.275] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x638 [0098.275] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xb2246f00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x618eeb70, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xb2246f00, dwHighDateTime=0x1c747ea)) returned 1 [0098.276] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0098.276] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x5de, lpOverlapped=0x0) returned 1 [0098.278] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIconsMask.bmp") returned="FormsViewAttachmentIconsMask.bmp" [0098.278] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0098.279] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x5de, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x5de, lpOverlapped=0x0) returned 1 [0098.279] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0098.279] CloseHandle (hObject=0x98) returned 1 [0098.279] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIconsMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsviewattachmenticonsmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIconsMask.bmp. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsviewattachmenticonsmask.bmp. ")) returned 1 [0098.280] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0098.280] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0098.280] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="form_edit.js") returned -1 [0098.280] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="form_edit.js") returned 1 [0098.280] lstrcmpiA (lpString1="", lpString2="form_edit.js") returned -1 [0098.280] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIconsMask.bmp") returned="FormsViewAttachmentIconsMask.bmp" [0098.281] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\", lpString2="form_edit.js" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js" [0098.281] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js", pszSpec="*.zip") returned 0 [0098.281] lstrlenA (lpString="*.zip") returned 5 [0098.281] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js", pszSpec="*.rar") returned 0 [0098.281] lstrlenA (lpString="*.rar") returned 5 [0098.281] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js", pszSpec="*.7z") returned 0 [0098.281] lstrlenA (lpString="*.7z") returned 4 [0098.281] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js", pszSpec="*.tar") returned 0 [0098.281] lstrlenA (lpString="*.tar") returned 5 [0098.281] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js", pszSpec="*.gzip") returned 0 [0098.281] lstrlenA (lpString="*.gzip") returned 6 [0098.281] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js", pszSpec="*.jpg") returned 0 [0098.281] lstrlenA (lpString="*.jpg") returned 5 [0098.281] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js", pszSpec="*.jpeg") returned 0 [0098.281] lstrlenA (lpString="*.jpeg") returned 6 [0098.281] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js", pszSpec="*.psd") returned 0 [0098.281] lstrlenA (lpString="*.psd") returned 5 [0098.281] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js", pszSpec="*.cdr") returned 0 [0098.281] lstrlenA (lpString="*.cdr") returned 5 [0098.281] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js", pszSpec="*.dwg") returned 0 [0098.281] lstrlenA (lpString="*.dwg") returned 5 [0098.281] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js", pszSpec="*.max") returned 0 [0098.281] lstrlenA (lpString="*.max") returned 5 [0098.281] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js", pszSpec="*.bmp") returned 0 [0098.281] lstrlenA (lpString="*.bmp") returned 5 [0098.281] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js", pszSpec="*.gif") returned 0 [0098.281] lstrlenA (lpString="*.gif") returned 5 [0098.281] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js", pszSpec="*.png") returned 0 [0098.282] lstrlenA (lpString="*.png") returned 5 [0098.282] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js", pszSpec="*.doc") returned 0 [0098.282] lstrlenA (lpString="*.doc") returned 5 [0098.282] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js", pszSpec="*.docx") returned 0 [0098.282] lstrlenA (lpString="*.docx") returned 6 [0098.282] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js", pszSpec="*.xls") returned 0 [0098.282] lstrlenA (lpString="*.xls") returned 5 [0098.282] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js", pszSpec="*.xlsx") returned 0 [0098.282] lstrlenA (lpString="*.xlsx") returned 6 [0098.282] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js", pszSpec="*.ppt") returned 0 [0098.282] lstrlenA (lpString="*.ppt") returned 5 [0098.282] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js", pszSpec="*.pptx") returned 0 [0098.282] lstrlenA (lpString="*.pptx") returned 6 [0098.282] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js", pszSpec="*.txt") returned 0 [0098.282] lstrlenA (lpString="*.txt") returned 5 [0098.282] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js", pszSpec="*.pdf") returned 0 [0098.282] lstrlenA (lpString="*.pdf") returned 5 [0098.282] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js", pszSpec="*.djvu") returned 0 [0098.282] lstrlenA (lpString="*.djvu") returned 6 [0098.282] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js", pszSpec="*.htm") returned 0 [0098.282] lstrlenA (lpString="*.htm") returned 5 [0098.282] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js", pszSpec="*.html") returned 0 [0098.282] lstrlenA (lpString="*.html") returned 6 [0098.282] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js", pszSpec="*.mdb") returned 0 [0098.282] lstrlenA (lpString="*.mdb") returned 5 [0098.282] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js", pszSpec="*.cer") returned 0 [0098.282] lstrlenA (lpString="*.cer") returned 5 [0098.282] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js", pszSpec="*.p12") returned 0 [0098.282] lstrlenA (lpString="*.p12") returned 5 [0098.282] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js", pszSpec="*.pfx") returned 0 [0098.282] lstrlenA (lpString="*.pfx") returned 5 [0098.282] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js", pszSpec="*.kwm") returned 0 [0098.283] lstrlenA (lpString="*.kwm") returned 5 [0098.283] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js", pszSpec="*.pwm") returned 0 [0098.283] lstrlenA (lpString="*.pwm") returned 5 [0098.283] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js", pszSpec="*.1cd") returned 0 [0098.283] lstrlenA (lpString="*.1cd") returned 5 [0098.283] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js", pszSpec="*.md") returned 0 [0098.283] lstrlenA (lpString="*.md") returned 4 [0098.283] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js", pszSpec="*.mdf") returned 0 [0098.283] lstrlenA (lpString="*.mdf") returned 5 [0098.283] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js", pszSpec="*.dbf") returned 0 [0098.283] lstrlenA (lpString="*.dbf") returned 5 [0098.283] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js", pszSpec="*.odt") returned 0 [0098.283] lstrlenA (lpString="*.odt") returned 5 [0098.283] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js", pszSpec="*.vob") returned 0 [0098.283] lstrlenA (lpString="*.vob") returned 5 [0098.283] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js", pszSpec="*.ifo") returned 0 [0098.283] lstrlenA (lpString="*.ifo") returned 5 [0098.283] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js", pszSpec="*.lnk") returned 0 [0098.283] lstrlenA (lpString="*.lnk") returned 5 [0098.283] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js", pszSpec="*.torrent") returned 0 [0098.283] lstrlenA (lpString="*.torrent") returned 9 [0098.283] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js", pszSpec="*.mov") returned 0 [0098.283] lstrlenA (lpString="*.mov") returned 5 [0098.283] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js", pszSpec="*.m2v") returned 0 [0098.283] lstrlenA (lpString="*.m2v") returned 5 [0098.283] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js", pszSpec="*.3gp") returned 0 [0098.283] lstrlenA (lpString="*.3gp") returned 5 [0098.283] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js", pszSpec="*.mpeg") returned 0 [0098.283] lstrlenA (lpString="*.mpeg") returned 6 [0098.283] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js", pszSpec="*.mpg") returned 0 [0098.284] lstrlenA (lpString="*.mpg") returned 5 [0098.284] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js", pszSpec="*.flv") returned 0 [0098.284] lstrlenA (lpString="*.flv") returned 5 [0098.284] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js", pszSpec="*.avi") returned 0 [0098.284] lstrlenA (lpString="*.avi") returned 5 [0098.284] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js", pszSpec="*.mp4") returned 0 [0098.284] lstrlenA (lpString="*.mp4") returned 5 [0098.284] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js", pszSpec="*.wmv") returned 0 [0098.284] lstrlenA (lpString="*.wmv") returned 5 [0098.284] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js", pszSpec="*.divx") returned 0 [0098.284] lstrlenA (lpString="*.divx") returned 6 [0098.284] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js", pszSpec="*.mkv") returned 0 [0098.284] lstrlenA (lpString="*.mkv") returned 5 [0098.284] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js", pszSpec="*.mp3") returned 0 [0098.284] lstrlenA (lpString="*.mp3") returned 5 [0098.284] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js", pszSpec="*.wav") returned 0 [0098.284] lstrlenA (lpString="*.wav") returned 5 [0098.284] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js", pszSpec="*.flac") returned 0 [0098.284] lstrlenA (lpString="*.flac") returned 6 [0098.284] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js", pszSpec="*.ape") returned 0 [0098.284] lstrlenA (lpString="*.ape") returned 5 [0098.284] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js", pszSpec="*.wma") returned 0 [0098.284] lstrlenA (lpString="*.wma") returned 5 [0098.284] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js", pszSpec="*.ac3") returned 0 [0098.284] lstrlenA (lpString="*.ac3") returned 5 [0098.284] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0098.284] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0098.284] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="InfoPathWelcomeImage.jpg") returned -1 [0098.284] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="InfoPathWelcomeImage.jpg") returned -1 [0098.284] lstrcmpiA (lpString1="", lpString2="InfoPathWelcomeImage.jpg") returned -1 [0098.285] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js") returned="form_edit.js" [0098.285] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\", lpString2="InfoPathWelcomeImage.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\InfoPathWelcomeImage.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\InfoPathWelcomeImage.jpg" [0098.285] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\InfoPathWelcomeImage.jpg", pszSpec="*.zip") returned 0 [0098.285] lstrlenA (lpString="*.zip") returned 5 [0098.285] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\InfoPathWelcomeImage.jpg", pszSpec="*.rar") returned 0 [0098.285] lstrlenA (lpString="*.rar") returned 5 [0098.285] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\InfoPathWelcomeImage.jpg", pszSpec="*.7z") returned 0 [0098.285] lstrlenA (lpString="*.7z") returned 4 [0098.285] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\InfoPathWelcomeImage.jpg", pszSpec="*.tar") returned 0 [0098.285] lstrlenA (lpString="*.tar") returned 5 [0098.285] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\InfoPathWelcomeImage.jpg", pszSpec="*.gzip") returned 0 [0098.285] lstrlenA (lpString="*.gzip") returned 6 [0098.285] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\InfoPathWelcomeImage.jpg", pszSpec="*.jpg") returned 1 [0098.285] lstrlenA (lpString="*.jpg") returned 5 [0098.285] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\InfoPathWelcomeImage.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\InfoPathWelcomeImage.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\InfoPathWelcomeImage.jpg" [0098.285] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\InfoPathWelcomeImage.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\InfoPathWelcomeImage.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\InfoPathWelcomeImage.jpg" [0098.285] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\InfoPathWelcomeImage.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\InfoPathWelcomeImage.jpg.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\InfoPathWelcomeImage.jpg." [0098.285] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\InfoPathWelcomeImage.jpg.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\InfoPathWelcomeImage.jpg. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\InfoPathWelcomeImage.jpg. " [0098.285] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\InfoPathWelcomeImage.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\infopathwelcomeimage.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0098.286] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x14316 [0098.286] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xb2246f00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x61cf3090, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xb2246f00, dwHighDateTime=0x1c747ea)) returned 1 [0098.286] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0098.286] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x142bc, lpOverlapped=0x0) returned 1 [0098.298] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\InfoPathWelcomeImage.jpg") returned="InfoPathWelcomeImage.jpg" [0098.298] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0098.298] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x142bc, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x142bc, lpOverlapped=0x0) returned 1 [0098.299] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0098.299] CloseHandle (hObject=0x98) returned 1 [0098.299] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\InfoPathWelcomeImage.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\infopathwelcomeimage.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\InfoPathWelcomeImage.jpg. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\infopathwelcomeimage.jpg. ")) returned 1 [0098.300] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0098.300] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0098.300] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="LAUNCH.GIF") returned -1 [0098.300] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="LAUNCH.GIF") returned -1 [0098.300] lstrcmpiA (lpString1="", lpString2="LAUNCH.GIF") returned -1 [0098.300] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\InfoPathWelcomeImage.jpg") returned="InfoPathWelcomeImage.jpg" [0098.300] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\", lpString2="LAUNCH.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\LAUNCH.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\LAUNCH.GIF" [0098.300] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\LAUNCH.GIF", pszSpec="*.zip") returned 0 [0098.300] lstrlenA (lpString="*.zip") returned 5 [0098.300] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\LAUNCH.GIF", pszSpec="*.rar") returned 0 [0098.300] lstrlenA (lpString="*.rar") returned 5 [0098.300] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\LAUNCH.GIF", pszSpec="*.7z") returned 0 [0098.300] lstrlenA (lpString="*.7z") returned 4 [0098.300] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\LAUNCH.GIF", pszSpec="*.tar") returned 0 [0098.300] lstrlenA (lpString="*.tar") returned 5 [0098.300] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\LAUNCH.GIF", pszSpec="*.gzip") returned 0 [0098.300] lstrlenA (lpString="*.gzip") returned 6 [0098.300] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\LAUNCH.GIF", pszSpec="*.jpg") returned 0 [0098.300] lstrlenA (lpString="*.jpg") returned 5 [0098.300] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\LAUNCH.GIF", pszSpec="*.jpeg") returned 0 [0098.300] lstrlenA (lpString="*.jpeg") returned 6 [0098.300] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\LAUNCH.GIF", pszSpec="*.psd") returned 0 [0098.300] lstrlenA (lpString="*.psd") returned 5 [0098.300] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\LAUNCH.GIF", pszSpec="*.cdr") returned 0 [0098.300] lstrlenA (lpString="*.cdr") returned 5 [0098.300] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\LAUNCH.GIF", pszSpec="*.dwg") returned 0 [0098.300] lstrlenA (lpString="*.dwg") returned 5 [0098.301] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\LAUNCH.GIF", pszSpec="*.max") returned 0 [0098.301] lstrlenA (lpString="*.max") returned 5 [0098.301] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\LAUNCH.GIF", pszSpec="*.bmp") returned 0 [0098.301] lstrlenA (lpString="*.bmp") returned 5 [0098.301] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\LAUNCH.GIF", pszSpec="*.gif") returned 1 [0098.301] lstrlenA (lpString="*.gif") returned 5 [0098.301] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\LAUNCH.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\LAUNCH.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\LAUNCH.GIF" [0098.301] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\LAUNCH.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\LAUNCH.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\LAUNCH.GIF" [0098.301] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\LAUNCH.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\LAUNCH.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\LAUNCH.GIF." [0098.301] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\LAUNCH.GIF.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\LAUNCH.GIF. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\LAUNCH.GIF. " [0098.302] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\LAUNCH.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\launch.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0098.303] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x267 [0098.303] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xb2246f00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x567e4730, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xb2246f00, dwHighDateTime=0x1c747ea)) returned 1 [0098.303] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0098.303] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x20d, lpOverlapped=0x0) returned 1 [0098.304] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\LAUNCH.GIF") returned="LAUNCH.GIF" [0098.304] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0098.304] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x20d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x20d, lpOverlapped=0x0) returned 1 [0098.304] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0098.304] CloseHandle (hObject=0x98) returned 1 [0098.304] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\LAUNCH.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\launch.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\LAUNCH.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\launch.gif. ")) returned 1 [0098.306] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0098.306] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0098.306] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="macroprogress.gif") returned -1 [0098.306] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="macroprogress.gif") returned -1 [0098.306] lstrcmpiA (lpString1="", lpString2="macroprogress.gif") returned -1 [0098.306] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\LAUNCH.GIF") returned="LAUNCH.GIF" [0098.307] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\", lpString2="macroprogress.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\macroprogress.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\macroprogress.gif" [0098.307] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\macroprogress.gif", pszSpec="*.zip") returned 0 [0098.307] lstrlenA (lpString="*.zip") returned 5 [0098.307] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\macroprogress.gif", pszSpec="*.rar") returned 0 [0098.307] lstrlenA (lpString="*.rar") returned 5 [0098.307] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\macroprogress.gif", pszSpec="*.7z") returned 0 [0098.307] lstrlenA (lpString="*.7z") returned 4 [0098.307] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\macroprogress.gif", pszSpec="*.tar") returned 0 [0098.307] lstrlenA (lpString="*.tar") returned 5 [0098.307] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\macroprogress.gif", pszSpec="*.gzip") returned 0 [0098.307] lstrlenA (lpString="*.gzip") returned 6 [0098.307] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\macroprogress.gif", pszSpec="*.jpg") returned 0 [0098.307] lstrlenA (lpString="*.jpg") returned 5 [0098.307] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\macroprogress.gif", pszSpec="*.jpeg") returned 0 [0098.307] lstrlenA (lpString="*.jpeg") returned 6 [0098.307] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\macroprogress.gif", pszSpec="*.psd") returned 0 [0098.307] lstrlenA (lpString="*.psd") returned 5 [0098.307] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\macroprogress.gif", pszSpec="*.cdr") returned 0 [0098.307] lstrlenA (lpString="*.cdr") returned 5 [0098.307] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\macroprogress.gif", pszSpec="*.dwg") returned 0 [0098.307] lstrlenA (lpString="*.dwg") returned 5 [0098.307] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\macroprogress.gif", pszSpec="*.max") returned 0 [0098.307] lstrlenA (lpString="*.max") returned 5 [0098.307] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\macroprogress.gif", pszSpec="*.bmp") returned 0 [0098.307] lstrlenA (lpString="*.bmp") returned 5 [0098.307] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\macroprogress.gif", pszSpec="*.gif") returned 1 [0098.307] lstrlenA (lpString="*.gif") returned 5 [0098.307] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\macroprogress.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\macroprogress.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\macroprogress.gif" [0098.307] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\macroprogress.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\macroprogress.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\macroprogress.gif" [0098.307] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\macroprogress.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\macroprogress.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\macroprogress.gif." [0098.307] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\macroprogress.gif.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\macroprogress.gif. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\macroprogress.gif. " [0098.307] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\macroprogress.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\macroprogress.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0098.308] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x30074 [0098.308] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x418f4a00, dwHighDateTime=0x1c9fe9d), lpLastAccessTime=0x407536*(dwLowDateTime=0x582abeb0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x418f4a00, dwHighDateTime=0x1c9fe9d)) returned 1 [0098.308] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0098.308] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x3001a, lpOverlapped=0x0) returned 1 [0098.348] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\macroprogress.gif") returned="macroprogress.gif" [0098.349] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0098.349] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x3001a, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x3001a, lpOverlapped=0x0) returned 1 [0098.349] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0098.349] CloseHandle (hObject=0x98) returned 1 [0098.349] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\macroprogress.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\macroprogress.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\macroprogress.gif. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\macroprogress.gif. ")) returned 1 [0098.351] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0098.351] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0098.351] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="PublicFunctions.js") returned -1 [0098.351] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PublicFunctions.js") returned -1 [0098.351] lstrcmpiA (lpString1="", lpString2="PublicFunctions.js") returned -1 [0098.351] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\macroprogress.gif") returned="macroprogress.gif" [0098.351] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\", lpString2="PublicFunctions.js" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\PublicFunctions.js") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\PublicFunctions.js" [0098.351] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\PublicFunctions.js", pszSpec="*.zip") returned 0 [0098.351] lstrlenA (lpString="*.zip") returned 5 [0098.351] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\PublicFunctions.js", pszSpec="*.rar") returned 0 [0098.351] lstrlenA (lpString="*.rar") returned 5 [0098.351] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\PublicFunctions.js", pszSpec="*.7z") returned 0 [0098.351] lstrlenA (lpString="*.7z") returned 4 [0098.351] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\PublicFunctions.js", pszSpec="*.tar") returned 0 [0098.351] lstrlenA (lpString="*.tar") returned 5 [0098.351] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\PublicFunctions.js", pszSpec="*.gzip") returned 0 [0098.352] lstrlenA (lpString="*.gzip") returned 6 [0098.352] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\PublicFunctions.js", pszSpec="*.jpg") returned 0 [0098.352] lstrlenA (lpString="*.jpg") returned 5 [0098.352] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\PublicFunctions.js", pszSpec="*.jpeg") returned 0 [0098.352] lstrlenA (lpString="*.jpeg") returned 6 [0098.352] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\PublicFunctions.js", pszSpec="*.psd") returned 0 [0098.352] lstrlenA (lpString="*.psd") returned 5 [0098.352] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\PublicFunctions.js", pszSpec="*.cdr") returned 0 [0098.352] lstrlenA (lpString="*.cdr") returned 5 [0098.352] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\PublicFunctions.js", pszSpec="*.dwg") returned 0 [0098.352] lstrlenA (lpString="*.dwg") returned 5 [0098.352] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\PublicFunctions.js", pszSpec="*.max") returned 0 [0098.352] lstrlenA (lpString="*.max") returned 5 [0098.352] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\PublicFunctions.js", pszSpec="*.bmp") returned 0 [0098.352] lstrlenA (lpString="*.bmp") returned 5 [0098.352] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\PublicFunctions.js", pszSpec="*.gif") returned 0 [0098.352] lstrlenA (lpString="*.gif") returned 5 [0098.352] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\PublicFunctions.js", pszSpec="*.png") returned 0 [0098.352] lstrlenA (lpString="*.png") returned 5 [0098.352] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\PublicFunctions.js", pszSpec="*.doc") returned 0 [0098.352] lstrlenA (lpString="*.doc") returned 5 [0098.352] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\PublicFunctions.js", pszSpec="*.docx") returned 0 [0098.352] lstrlenA (lpString="*.docx") returned 6 [0098.352] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\PublicFunctions.js", pszSpec="*.xls") returned 0 [0098.352] lstrlenA (lpString="*.xls") returned 5 [0098.352] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\PublicFunctions.js", pszSpec="*.xlsx") returned 0 [0098.352] lstrlenA (lpString="*.xlsx") returned 6 [0098.352] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\PublicFunctions.js", pszSpec="*.ppt") returned 0 [0098.352] lstrlenA (lpString="*.ppt") returned 5 [0098.352] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\PublicFunctions.js", pszSpec="*.pptx") returned 0 [0098.352] lstrlenA (lpString="*.pptx") returned 6 [0098.352] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\PublicFunctions.js", pszSpec="*.txt") returned 0 [0098.352] lstrlenA (lpString="*.txt") returned 5 [0098.352] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\PublicFunctions.js", pszSpec="*.pdf") returned 0 [0098.352] lstrlenA (lpString="*.pdf") returned 5 [0098.352] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\PublicFunctions.js", pszSpec="*.djvu") returned 0 [0098.352] lstrlenA (lpString="*.djvu") returned 6 [0098.352] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\PublicFunctions.js", pszSpec="*.htm") returned 0 [0098.352] lstrlenA (lpString="*.htm") returned 5 [0098.352] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\PublicFunctions.js", pszSpec="*.html") returned 0 [0098.352] lstrlenA (lpString="*.html") returned 6 [0098.352] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\PublicFunctions.js", pszSpec="*.mdb") returned 0 [0098.352] lstrlenA (lpString="*.mdb") returned 5 [0098.352] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\PublicFunctions.js", pszSpec="*.cer") returned 0 [0098.352] lstrlenA (lpString="*.cer") returned 5 [0098.354] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\PublicFunctions.js", pszSpec="*.p12") returned 0 [0098.354] lstrlenA (lpString="*.p12") returned 5 [0098.354] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\PublicFunctions.js", pszSpec="*.pfx") returned 0 [0098.354] lstrlenA (lpString="*.pfx") returned 5 [0098.354] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\PublicFunctions.js", pszSpec="*.kwm") returned 0 [0098.354] lstrlenA (lpString="*.kwm") returned 5 [0098.354] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\PublicFunctions.js", pszSpec="*.pwm") returned 0 [0098.354] lstrlenA (lpString="*.pwm") returned 5 [0098.354] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\PublicFunctions.js", pszSpec="*.1cd") returned 0 [0098.354] lstrlenA (lpString="*.1cd") returned 5 [0098.354] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\PublicFunctions.js", pszSpec="*.md") returned 0 [0098.354] lstrlenA (lpString="*.md") returned 4 [0098.354] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\PublicFunctions.js", pszSpec="*.mdf") returned 0 [0098.354] lstrlenA (lpString="*.mdf") returned 5 [0098.354] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\PublicFunctions.js", pszSpec="*.dbf") returned 0 [0098.354] lstrlenA (lpString="*.dbf") returned 5 [0098.354] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\PublicFunctions.js", pszSpec="*.odt") returned 0 [0098.354] lstrlenA (lpString="*.odt") returned 5 [0098.354] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\PublicFunctions.js", pszSpec="*.vob") returned 0 [0098.354] lstrlenA (lpString="*.vob") returned 5 [0098.354] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\PublicFunctions.js", pszSpec="*.ifo") returned 0 [0098.354] lstrlenA (lpString="*.ifo") returned 5 [0098.354] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\PublicFunctions.js", pszSpec="*.lnk") returned 0 [0098.354] lstrlenA (lpString="*.lnk") returned 5 [0098.354] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\PublicFunctions.js", pszSpec="*.torrent") returned 0 [0098.354] lstrlenA (lpString="*.torrent") returned 9 [0098.354] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\PublicFunctions.js", pszSpec="*.mov") returned 0 [0098.354] lstrlenA (lpString="*.mov") returned 5 [0098.354] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\PublicFunctions.js", pszSpec="*.m2v") returned 0 [0098.354] lstrlenA (lpString="*.m2v") returned 5 [0098.354] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\PublicFunctions.js", pszSpec="*.3gp") returned 0 [0098.354] lstrlenA (lpString="*.3gp") returned 5 [0098.354] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\PublicFunctions.js", pszSpec="*.mpeg") returned 0 [0098.354] lstrlenA (lpString="*.mpeg") returned 6 [0098.354] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\PublicFunctions.js", pszSpec="*.mpg") returned 0 [0098.354] lstrlenA (lpString="*.mpg") returned 5 [0098.354] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\PublicFunctions.js", pszSpec="*.flv") returned 0 [0098.354] lstrlenA (lpString="*.flv") returned 5 [0098.354] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\PublicFunctions.js", pszSpec="*.avi") returned 0 [0098.354] lstrlenA (lpString="*.avi") returned 5 [0098.354] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\PublicFunctions.js", pszSpec="*.mp4") returned 0 [0098.355] lstrlenA (lpString="*.mp4") returned 5 [0098.355] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\PublicFunctions.js", pszSpec="*.wmv") returned 0 [0098.355] lstrlenA (lpString="*.wmv") returned 5 [0098.355] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\PublicFunctions.js", pszSpec="*.divx") returned 0 [0098.355] lstrlenA (lpString="*.divx") returned 6 [0098.355] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\PublicFunctions.js", pszSpec="*.mkv") returned 0 [0098.355] lstrlenA (lpString="*.mkv") returned 5 [0098.355] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\PublicFunctions.js", pszSpec="*.mp3") returned 0 [0098.355] lstrlenA (lpString="*.mp3") returned 5 [0098.355] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\PublicFunctions.js", pszSpec="*.wav") returned 0 [0098.355] lstrlenA (lpString="*.wav") returned 5 [0098.355] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\PublicFunctions.js", pszSpec="*.flac") returned 0 [0098.355] lstrlenA (lpString="*.flac") returned 6 [0098.355] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\PublicFunctions.js", pszSpec="*.ape") returned 0 [0098.355] lstrlenA (lpString="*.ape") returned 5 [0098.355] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\PublicFunctions.js", pszSpec="*.wma") returned 0 [0098.355] lstrlenA (lpString="*.wma") returned 5 [0098.355] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\PublicFunctions.js", pszSpec="*.ac3") returned 0 [0098.355] lstrlenA (lpString="*.ac3") returned 5 [0098.355] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0098.355] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0098.355] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="rtf_alignleft.gif") returned -1 [0098.355] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="rtf_alignleft.gif") returned -1 [0098.355] lstrcmpiA (lpString1="", lpString2="rtf_alignleft.gif") returned -1 [0098.355] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\PublicFunctions.js") returned="PublicFunctions.js" [0098.355] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\", lpString2="rtf_alignleft.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignleft.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignleft.gif" [0098.355] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignleft.gif", pszSpec="*.zip") returned 0 [0098.355] lstrlenA (lpString="*.zip") returned 5 [0098.355] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignleft.gif", pszSpec="*.rar") returned 0 [0098.355] lstrlenA (lpString="*.rar") returned 5 [0098.355] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignleft.gif", pszSpec="*.7z") returned 0 [0098.355] lstrlenA (lpString="*.7z") returned 4 [0098.355] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignleft.gif", pszSpec="*.tar") returned 0 [0098.355] lstrlenA (lpString="*.tar") returned 5 [0098.355] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignleft.gif", pszSpec="*.gzip") returned 0 [0098.355] lstrlenA (lpString="*.gzip") returned 6 [0098.355] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignleft.gif", pszSpec="*.jpg") returned 0 [0098.355] lstrlenA (lpString="*.jpg") returned 5 [0098.355] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignleft.gif", pszSpec="*.jpeg") returned 0 [0098.355] lstrlenA (lpString="*.jpeg") returned 6 [0098.355] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignleft.gif", pszSpec="*.psd") returned 0 [0098.355] lstrlenA (lpString="*.psd") returned 5 [0098.355] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignleft.gif", pszSpec="*.cdr") returned 0 [0098.355] lstrlenA (lpString="*.cdr") returned 5 [0098.355] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignleft.gif", pszSpec="*.dwg") returned 0 [0098.355] lstrlenA (lpString="*.dwg") returned 5 [0098.355] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignleft.gif", pszSpec="*.max") returned 0 [0098.355] lstrlenA (lpString="*.max") returned 5 [0098.355] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignleft.gif", pszSpec="*.bmp") returned 0 [0098.355] lstrlenA (lpString="*.bmp") returned 5 [0098.356] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignleft.gif", pszSpec="*.gif") returned 1 [0098.356] lstrlenA (lpString="*.gif") returned 5 [0098.356] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignleft.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignleft.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignleft.gif" [0098.356] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignleft.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignleft.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignleft.gif" [0098.356] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignleft.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignleft.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignleft.gif." [0098.356] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignleft.gif.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignleft.gif. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignleft.gif. " [0098.356] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignleft.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_alignleft.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0098.356] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x350 [0098.356] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xb2246f00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5a8e8010, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xb2246f00, dwHighDateTime=0x1c747ea)) returned 1 [0098.356] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0098.356] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x2f6, lpOverlapped=0x0) returned 1 [0098.362] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignleft.gif") returned="rtf_alignleft.gif" [0098.362] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0098.362] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x2f6, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x2f6, lpOverlapped=0x0) returned 1 [0098.362] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0098.362] CloseHandle (hObject=0x98) returned 1 [0098.362] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignleft.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_alignleft.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignleft.gif. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_alignleft.gif. ")) returned 1 [0098.363] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0098.363] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0098.363] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="rtf_alignright.gif") returned -1 [0098.363] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="rtf_alignright.gif") returned -1 [0098.363] lstrcmpiA (lpString1="", lpString2="rtf_alignright.gif") returned -1 [0098.363] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignleft.gif") returned="rtf_alignleft.gif" [0098.363] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\", lpString2="rtf_alignright.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignright.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignright.gif" [0098.363] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignright.gif", pszSpec="*.zip") returned 0 [0098.363] lstrlenA (lpString="*.zip") returned 5 [0098.363] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignright.gif", pszSpec="*.rar") returned 0 [0098.363] lstrlenA (lpString="*.rar") returned 5 [0098.363] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignright.gif", pszSpec="*.7z") returned 0 [0098.363] lstrlenA (lpString="*.7z") returned 4 [0098.363] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignright.gif", pszSpec="*.tar") returned 0 [0098.363] lstrlenA (lpString="*.tar") returned 5 [0098.363] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignright.gif", pszSpec="*.gzip") returned 0 [0098.363] lstrlenA (lpString="*.gzip") returned 6 [0098.363] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignright.gif", pszSpec="*.jpg") returned 0 [0098.363] lstrlenA (lpString="*.jpg") returned 5 [0098.363] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignright.gif", pszSpec="*.jpeg") returned 0 [0098.364] lstrlenA (lpString="*.jpeg") returned 6 [0098.364] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignright.gif", pszSpec="*.psd") returned 0 [0098.364] lstrlenA (lpString="*.psd") returned 5 [0098.364] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignright.gif", pszSpec="*.cdr") returned 0 [0098.364] lstrlenA (lpString="*.cdr") returned 5 [0098.364] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignright.gif", pszSpec="*.dwg") returned 0 [0098.364] lstrlenA (lpString="*.dwg") returned 5 [0098.364] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignright.gif", pszSpec="*.max") returned 0 [0098.364] lstrlenA (lpString="*.max") returned 5 [0098.364] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignright.gif", pszSpec="*.bmp") returned 0 [0098.364] lstrlenA (lpString="*.bmp") returned 5 [0098.364] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignright.gif", pszSpec="*.gif") returned 1 [0098.364] lstrlenA (lpString="*.gif") returned 5 [0098.364] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignright.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignright.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignright.gif" [0098.364] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignright.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignright.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignright.gif" [0098.364] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignright.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignright.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignright.gif." [0098.364] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignright.gif.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignright.gif. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignright.gif. " [0098.364] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignright.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_alignright.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0098.364] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x34f [0098.364] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xb2246f00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x6d227b50, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xb2246f00, dwHighDateTime=0x1c747ea)) returned 1 [0098.364] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0098.365] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x2f5, lpOverlapped=0x0) returned 1 [0098.366] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignright.gif") returned="rtf_alignright.gif" [0098.366] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0098.366] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x2f5, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x2f5, lpOverlapped=0x0) returned 1 [0098.366] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0098.366] CloseHandle (hObject=0x98) returned 1 [0098.366] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignright.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_alignright.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignright.gif. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_alignright.gif. ")) returned 1 [0098.366] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0098.366] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0098.367] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="rtf_bullets.gif") returned -1 [0098.367] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="rtf_bullets.gif") returned -1 [0098.367] lstrcmpiA (lpString1="", lpString2="rtf_bullets.gif") returned -1 [0098.367] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignright.gif") returned="rtf_alignright.gif" [0098.367] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\", lpString2="rtf_bullets.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_bullets.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_bullets.gif" [0098.367] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_bullets.gif", pszSpec="*.zip") returned 0 [0098.367] lstrlenA (lpString="*.zip") returned 5 [0098.367] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_bullets.gif", pszSpec="*.rar") returned 0 [0098.367] lstrlenA (lpString="*.rar") returned 5 [0098.367] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_bullets.gif", pszSpec="*.7z") returned 0 [0098.367] lstrlenA (lpString="*.7z") returned 4 [0098.367] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_bullets.gif", pszSpec="*.tar") returned 0 [0098.367] lstrlenA (lpString="*.tar") returned 5 [0098.367] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_bullets.gif", pszSpec="*.gzip") returned 0 [0098.367] lstrlenA (lpString="*.gzip") returned 6 [0098.367] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_bullets.gif", pszSpec="*.jpg") returned 0 [0098.367] lstrlenA (lpString="*.jpg") returned 5 [0098.367] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_bullets.gif", pszSpec="*.jpeg") returned 0 [0098.367] lstrlenA (lpString="*.jpeg") returned 6 [0098.367] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_bullets.gif", pszSpec="*.psd") returned 0 [0098.367] lstrlenA (lpString="*.psd") returned 5 [0098.367] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_bullets.gif", pszSpec="*.cdr") returned 0 [0098.367] lstrlenA (lpString="*.cdr") returned 5 [0098.367] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_bullets.gif", pszSpec="*.dwg") returned 0 [0098.367] lstrlenA (lpString="*.dwg") returned 5 [0098.367] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_bullets.gif", pszSpec="*.max") returned 0 [0098.367] lstrlenA (lpString="*.max") returned 5 [0098.367] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_bullets.gif", pszSpec="*.bmp") returned 0 [0098.367] lstrlenA (lpString="*.bmp") returned 5 [0098.367] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_bullets.gif", pszSpec="*.gif") returned 1 [0098.367] lstrlenA (lpString="*.gif") returned 5 [0098.367] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_bullets.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_bullets.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_bullets.gif" [0098.367] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_bullets.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_bullets.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_bullets.gif" [0098.367] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_bullets.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_bullets.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_bullets.gif." [0098.367] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_bullets.gif.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_bullets.gif. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_bullets.gif. " [0098.367] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_bullets.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_bullets.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0098.368] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x365 [0098.369] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xb2246f00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5a8e8010, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xb2246f00, dwHighDateTime=0x1c747ea)) returned 1 [0098.369] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0098.369] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x30b, lpOverlapped=0x0) returned 1 [0098.395] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_bullets.gif") returned="rtf_bullets.gif" [0098.395] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0098.395] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x30b, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x30b, lpOverlapped=0x0) returned 1 [0098.395] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0098.395] CloseHandle (hObject=0x98) returned 1 [0098.396] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_bullets.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_bullets.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_bullets.gif. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_bullets.gif. ")) returned 1 [0098.396] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0098.396] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0098.396] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="rtf_center.gif") returned -1 [0098.396] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="rtf_center.gif") returned -1 [0098.396] lstrcmpiA (lpString1="", lpString2="rtf_center.gif") returned -1 [0098.396] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_bullets.gif") returned="rtf_bullets.gif" [0098.396] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\", lpString2="rtf_center.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_center.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_center.gif" [0098.396] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_center.gif", pszSpec="*.zip") returned 0 [0098.396] lstrlenA (lpString="*.zip") returned 5 [0098.397] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_center.gif", pszSpec="*.rar") returned 0 [0098.397] lstrlenA (lpString="*.rar") returned 5 [0098.397] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_center.gif", pszSpec="*.7z") returned 0 [0098.397] lstrlenA (lpString="*.7z") returned 4 [0098.397] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_center.gif", pszSpec="*.tar") returned 0 [0098.397] lstrlenA (lpString="*.tar") returned 5 [0098.397] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_center.gif", pszSpec="*.gzip") returned 0 [0098.397] lstrlenA (lpString="*.gzip") returned 6 [0098.397] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_center.gif", pszSpec="*.jpg") returned 0 [0098.397] lstrlenA (lpString="*.jpg") returned 5 [0098.397] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_center.gif", pszSpec="*.jpeg") returned 0 [0098.397] lstrlenA (lpString="*.jpeg") returned 6 [0098.397] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_center.gif", pszSpec="*.psd") returned 0 [0098.397] lstrlenA (lpString="*.psd") returned 5 [0098.397] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_center.gif", pszSpec="*.cdr") returned 0 [0098.397] lstrlenA (lpString="*.cdr") returned 5 [0098.397] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_center.gif", pszSpec="*.dwg") returned 0 [0098.397] lstrlenA (lpString="*.dwg") returned 5 [0098.397] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_center.gif", pszSpec="*.max") returned 0 [0098.397] lstrlenA (lpString="*.max") returned 5 [0098.397] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_center.gif", pszSpec="*.bmp") returned 0 [0098.397] lstrlenA (lpString="*.bmp") returned 5 [0098.397] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_center.gif", pszSpec="*.gif") returned 1 [0098.397] lstrlenA (lpString="*.gif") returned 5 [0098.397] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_center.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_center.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_center.gif" [0098.397] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_center.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_center.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_center.gif" [0098.397] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_center.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_center.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_center.gif." [0098.397] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_center.gif.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_center.gif. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_center.gif. " [0098.397] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_center.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_center.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0098.398] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x34f [0098.398] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xb2246f00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5a8e8010, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xb2246f00, dwHighDateTime=0x1c747ea)) returned 1 [0098.398] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0098.398] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x2f5, lpOverlapped=0x0) returned 1 [0098.402] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_center.gif") returned="rtf_center.gif" [0098.402] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0098.403] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x2f5, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x2f5, lpOverlapped=0x0) returned 1 [0098.403] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0098.403] CloseHandle (hObject=0x98) returned 1 [0098.403] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_center.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_center.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_center.gif. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_center.gif. ")) returned 1 [0098.404] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0098.404] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0098.404] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="rtf_choosecolor.gif") returned -1 [0098.404] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="rtf_choosecolor.gif") returned -1 [0098.404] lstrcmpiA (lpString1="", lpString2="rtf_choosecolor.gif") returned -1 [0098.404] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_center.gif") returned="rtf_center.gif" [0098.404] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\", lpString2="rtf_choosecolor.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_choosecolor.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_choosecolor.gif" [0098.404] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_choosecolor.gif", pszSpec="*.zip") returned 0 [0098.404] lstrlenA (lpString="*.zip") returned 5 [0098.404] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_choosecolor.gif", pszSpec="*.rar") returned 0 [0098.404] lstrlenA (lpString="*.rar") returned 5 [0098.404] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_choosecolor.gif", pszSpec="*.7z") returned 0 [0098.404] lstrlenA (lpString="*.7z") returned 4 [0098.404] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_choosecolor.gif", pszSpec="*.tar") returned 0 [0098.404] lstrlenA (lpString="*.tar") returned 5 [0098.404] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_choosecolor.gif", pszSpec="*.gzip") returned 0 [0098.404] lstrlenA (lpString="*.gzip") returned 6 [0098.404] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_choosecolor.gif", pszSpec="*.jpg") returned 0 [0098.404] lstrlenA (lpString="*.jpg") returned 5 [0098.404] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_choosecolor.gif", pszSpec="*.jpeg") returned 0 [0098.404] lstrlenA (lpString="*.jpeg") returned 6 [0098.404] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_choosecolor.gif", pszSpec="*.psd") returned 0 [0098.404] lstrlenA (lpString="*.psd") returned 5 [0098.404] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_choosecolor.gif", pszSpec="*.cdr") returned 0 [0098.404] lstrlenA (lpString="*.cdr") returned 5 [0098.404] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_choosecolor.gif", pszSpec="*.dwg") returned 0 [0098.404] lstrlenA (lpString="*.dwg") returned 5 [0098.404] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_choosecolor.gif", pszSpec="*.max") returned 0 [0098.404] lstrlenA (lpString="*.max") returned 5 [0098.404] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_choosecolor.gif", pszSpec="*.bmp") returned 0 [0098.404] lstrlenA (lpString="*.bmp") returned 5 [0098.404] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_choosecolor.gif", pszSpec="*.gif") returned 1 [0098.404] lstrlenA (lpString="*.gif") returned 5 [0098.404] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_choosecolor.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_choosecolor.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_choosecolor.gif" [0098.404] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_choosecolor.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_choosecolor.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_choosecolor.gif" [0098.404] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_choosecolor.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_choosecolor.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_choosecolor.gif." [0098.404] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_choosecolor.gif.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_choosecolor.gif. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_choosecolor.gif. " [0098.404] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_choosecolor.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_choosecolor.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0098.405] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3ee [0098.405] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x3031bc00, dwHighDateTime=0x1ca033b), lpLastAccessTime=0x407536*(dwLowDateTime=0x6d227b50, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x3031bc00, dwHighDateTime=0x1ca033b)) returned 1 [0098.405] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0098.405] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x394, lpOverlapped=0x0) returned 1 [0098.406] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_choosecolor.gif") returned="rtf_choosecolor.gif" [0098.406] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0098.406] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x394, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x394, lpOverlapped=0x0) returned 1 [0098.406] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0098.406] CloseHandle (hObject=0x98) returned 1 [0098.406] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_choosecolor.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_choosecolor.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_choosecolor.gif. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_choosecolor.gif. ")) returned 1 [0098.407] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0098.407] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0098.407] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="rtf_decreaseindent.gif") returned -1 [0098.407] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="rtf_decreaseindent.gif") returned -1 [0098.407] lstrcmpiA (lpString1="", lpString2="rtf_decreaseindent.gif") returned -1 [0098.407] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_choosecolor.gif") returned="rtf_choosecolor.gif" [0098.407] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\", lpString2="rtf_decreaseindent.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_decreaseindent.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_decreaseindent.gif" [0098.407] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_decreaseindent.gif", pszSpec="*.zip") returned 0 [0098.407] lstrlenA (lpString="*.zip") returned 5 [0098.407] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_decreaseindent.gif", pszSpec="*.rar") returned 0 [0098.407] lstrlenA (lpString="*.rar") returned 5 [0098.407] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_decreaseindent.gif", pszSpec="*.7z") returned 0 [0098.407] lstrlenA (lpString="*.7z") returned 4 [0098.407] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_decreaseindent.gif", pszSpec="*.tar") returned 0 [0098.407] lstrlenA (lpString="*.tar") returned 5 [0098.407] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_decreaseindent.gif", pszSpec="*.gzip") returned 0 [0098.407] lstrlenA (lpString="*.gzip") returned 6 [0098.407] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_decreaseindent.gif", pszSpec="*.jpg") returned 0 [0098.407] lstrlenA (lpString="*.jpg") returned 5 [0098.408] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_decreaseindent.gif", pszSpec="*.jpeg") returned 0 [0098.408] lstrlenA (lpString="*.jpeg") returned 6 [0098.408] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_decreaseindent.gif", pszSpec="*.psd") returned 0 [0098.408] lstrlenA (lpString="*.psd") returned 5 [0098.408] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_decreaseindent.gif", pszSpec="*.cdr") returned 0 [0098.408] lstrlenA (lpString="*.cdr") returned 5 [0098.408] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_decreaseindent.gif", pszSpec="*.dwg") returned 0 [0098.408] lstrlenA (lpString="*.dwg") returned 5 [0098.408] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_decreaseindent.gif", pszSpec="*.max") returned 0 [0098.408] lstrlenA (lpString="*.max") returned 5 [0098.408] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_decreaseindent.gif", pszSpec="*.bmp") returned 0 [0098.408] lstrlenA (lpString="*.bmp") returned 5 [0098.408] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_decreaseindent.gif", pszSpec="*.gif") returned 1 [0098.408] lstrlenA (lpString="*.gif") returned 5 [0098.408] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_decreaseindent.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_decreaseindent.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_decreaseindent.gif" [0098.408] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_decreaseindent.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_decreaseindent.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_decreaseindent.gif" [0098.408] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_decreaseindent.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_decreaseindent.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_decreaseindent.gif." [0098.408] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_decreaseindent.gif.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_decreaseindent.gif. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_decreaseindent.gif. " [0098.408] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_decreaseindent.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_decreaseindent.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0098.408] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x35f [0098.408] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xb2246f00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x6d227b50, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xb2246f00, dwHighDateTime=0x1c747ea)) returned 1 [0098.408] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0098.409] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x305, lpOverlapped=0x0) returned 1 [0098.410] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_decreaseindent.gif") returned="rtf_decreaseindent.gif" [0098.410] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0098.410] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x305, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x305, lpOverlapped=0x0) returned 1 [0098.410] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0098.410] CloseHandle (hObject=0x98) returned 1 [0098.410] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_decreaseindent.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_decreaseindent.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_decreaseindent.gif. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_decreaseindent.gif. ")) returned 1 [0098.411] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0098.411] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0098.411] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="rtf_hyperlink.gif") returned -1 [0098.411] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="rtf_hyperlink.gif") returned -1 [0098.411] lstrcmpiA (lpString1="", lpString2="rtf_hyperlink.gif") returned -1 [0098.411] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_decreaseindent.gif") returned="rtf_decreaseindent.gif" [0098.411] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\", lpString2="rtf_hyperlink.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_hyperlink.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_hyperlink.gif" [0098.411] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_hyperlink.gif", pszSpec="*.zip") returned 0 [0098.411] lstrlenA (lpString="*.zip") returned 5 [0098.411] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_hyperlink.gif", pszSpec="*.rar") returned 0 [0098.411] lstrlenA (lpString="*.rar") returned 5 [0098.411] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_hyperlink.gif", pszSpec="*.7z") returned 0 [0098.411] lstrlenA (lpString="*.7z") returned 4 [0098.411] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_hyperlink.gif", pszSpec="*.tar") returned 0 [0098.411] lstrlenA (lpString="*.tar") returned 5 [0098.411] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_hyperlink.gif", pszSpec="*.gzip") returned 0 [0098.411] lstrlenA (lpString="*.gzip") returned 6 [0098.411] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_hyperlink.gif", pszSpec="*.jpg") returned 0 [0098.411] lstrlenA (lpString="*.jpg") returned 5 [0098.411] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_hyperlink.gif", pszSpec="*.jpeg") returned 0 [0098.411] lstrlenA (lpString="*.jpeg") returned 6 [0098.411] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_hyperlink.gif", pszSpec="*.psd") returned 0 [0098.411] lstrlenA (lpString="*.psd") returned 5 [0098.411] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_hyperlink.gif", pszSpec="*.cdr") returned 0 [0098.411] lstrlenA (lpString="*.cdr") returned 5 [0098.412] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_hyperlink.gif", pszSpec="*.dwg") returned 0 [0098.412] lstrlenA (lpString="*.dwg") returned 5 [0098.412] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_hyperlink.gif", pszSpec="*.max") returned 0 [0098.412] lstrlenA (lpString="*.max") returned 5 [0098.412] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_hyperlink.gif", pszSpec="*.bmp") returned 0 [0098.412] lstrlenA (lpString="*.bmp") returned 5 [0098.412] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_hyperlink.gif", pszSpec="*.gif") returned 1 [0098.412] lstrlenA (lpString="*.gif") returned 5 [0098.412] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_hyperlink.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_hyperlink.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_hyperlink.gif" [0098.412] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_hyperlink.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_hyperlink.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_hyperlink.gif" [0098.412] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_hyperlink.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_hyperlink.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_hyperlink.gif." [0098.412] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_hyperlink.gif.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_hyperlink.gif. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_hyperlink.gif. " [0098.412] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_hyperlink.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_hyperlink.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0098.413] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xf1 [0098.413] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xb3559c00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x6d24dcb0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xb3559c00, dwHighDateTime=0x1c747ea)) returned 1 [0098.413] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0098.413] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x97, lpOverlapped=0x0) returned 1 [0098.413] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_hyperlink.gif") returned="rtf_hyperlink.gif" [0098.413] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0098.413] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x97, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x97, lpOverlapped=0x0) returned 1 [0098.414] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0098.414] CloseHandle (hObject=0x98) returned 1 [0098.414] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_hyperlink.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_hyperlink.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_hyperlink.gif. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_hyperlink.gif. ")) returned 1 [0098.416] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0098.416] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0098.416] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="rtf_increaseindent.gif") returned -1 [0098.416] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="rtf_increaseindent.gif") returned -1 [0098.416] lstrcmpiA (lpString1="", lpString2="rtf_increaseindent.gif") returned -1 [0098.416] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_hyperlink.gif") returned="rtf_hyperlink.gif" [0098.416] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\", lpString2="rtf_increaseindent.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_increaseindent.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_increaseindent.gif" [0098.416] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_increaseindent.gif", pszSpec="*.zip") returned 0 [0098.416] lstrlenA (lpString="*.zip") returned 5 [0098.416] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_increaseindent.gif", pszSpec="*.rar") returned 0 [0098.416] lstrlenA (lpString="*.rar") returned 5 [0098.416] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_increaseindent.gif", pszSpec="*.7z") returned 0 [0098.416] lstrlenA (lpString="*.7z") returned 4 [0098.416] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_increaseindent.gif", pszSpec="*.tar") returned 0 [0098.416] lstrlenA (lpString="*.tar") returned 5 [0098.416] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_increaseindent.gif", pszSpec="*.gzip") returned 0 [0098.416] lstrlenA (lpString="*.gzip") returned 6 [0098.416] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_increaseindent.gif", pszSpec="*.jpg") returned 0 [0098.416] lstrlenA (lpString="*.jpg") returned 5 [0098.416] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_increaseindent.gif", pszSpec="*.jpeg") returned 0 [0098.416] lstrlenA (lpString="*.jpeg") returned 6 [0098.416] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_increaseindent.gif", pszSpec="*.psd") returned 0 [0098.416] lstrlenA (lpString="*.psd") returned 5 [0098.416] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_increaseindent.gif", pszSpec="*.cdr") returned 0 [0098.416] lstrlenA (lpString="*.cdr") returned 5 [0098.416] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_increaseindent.gif", pszSpec="*.dwg") returned 0 [0098.416] lstrlenA (lpString="*.dwg") returned 5 [0098.416] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_increaseindent.gif", pszSpec="*.max") returned 0 [0098.416] lstrlenA (lpString="*.max") returned 5 [0098.416] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_increaseindent.gif", pszSpec="*.bmp") returned 0 [0098.416] lstrlenA (lpString="*.bmp") returned 5 [0098.416] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_increaseindent.gif", pszSpec="*.gif") returned 1 [0098.416] lstrlenA (lpString="*.gif") returned 5 [0098.416] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_increaseindent.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_increaseindent.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_increaseindent.gif" [0098.416] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_increaseindent.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_increaseindent.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_increaseindent.gif" [0098.416] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_increaseindent.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_increaseindent.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_increaseindent.gif." [0098.417] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_increaseindent.gif.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_increaseindent.gif. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_increaseindent.gif. " [0098.417] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_increaseindent.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_increaseindent.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0098.417] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x35d [0098.417] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xb3559c00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5a8e8010, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xb3559c00, dwHighDateTime=0x1c747ea)) returned 1 [0098.417] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0098.417] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x303, lpOverlapped=0x0) returned 1 [0098.418] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_increaseindent.gif") returned="rtf_increaseindent.gif" [0098.418] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0098.418] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x303, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x303, lpOverlapped=0x0) returned 1 [0098.419] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0098.419] CloseHandle (hObject=0x98) returned 1 [0098.419] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_increaseindent.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_increaseindent.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_increaseindent.gif. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_increaseindent.gif. ")) returned 1 [0098.419] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0098.419] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0098.419] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="rtf_justify.gif") returned -1 [0098.420] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="rtf_justify.gif") returned -1 [0098.420] lstrcmpiA (lpString1="", lpString2="rtf_justify.gif") returned -1 [0098.420] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_increaseindent.gif") returned="rtf_increaseindent.gif" [0098.420] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\", lpString2="rtf_justify.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_justify.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_justify.gif" [0098.420] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_justify.gif", pszSpec="*.zip") returned 0 [0098.420] lstrlenA (lpString="*.zip") returned 5 [0098.420] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_justify.gif", pszSpec="*.rar") returned 0 [0098.420] lstrlenA (lpString="*.rar") returned 5 [0098.420] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_justify.gif", pszSpec="*.7z") returned 0 [0098.420] lstrlenA (lpString="*.7z") returned 4 [0098.420] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_justify.gif", pszSpec="*.tar") returned 0 [0098.420] lstrlenA (lpString="*.tar") returned 5 [0098.420] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_justify.gif", pszSpec="*.gzip") returned 0 [0098.420] lstrlenA (lpString="*.gzip") returned 6 [0098.420] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_justify.gif", pszSpec="*.jpg") returned 0 [0098.420] lstrlenA (lpString="*.jpg") returned 5 [0098.420] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_justify.gif", pszSpec="*.jpeg") returned 0 [0098.420] lstrlenA (lpString="*.jpeg") returned 6 [0098.420] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_justify.gif", pszSpec="*.psd") returned 0 [0098.420] lstrlenA (lpString="*.psd") returned 5 [0098.420] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_justify.gif", pszSpec="*.cdr") returned 0 [0098.420] lstrlenA (lpString="*.cdr") returned 5 [0098.420] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_justify.gif", pszSpec="*.dwg") returned 0 [0098.420] lstrlenA (lpString="*.dwg") returned 5 [0098.420] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_justify.gif", pszSpec="*.max") returned 0 [0098.420] lstrlenA (lpString="*.max") returned 5 [0098.420] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_justify.gif", pszSpec="*.bmp") returned 0 [0098.420] lstrlenA (lpString="*.bmp") returned 5 [0098.420] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_justify.gif", pszSpec="*.gif") returned 1 [0098.420] lstrlenA (lpString="*.gif") returned 5 [0098.420] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_justify.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_justify.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_justify.gif" [0098.420] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_justify.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_justify.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_justify.gif" [0098.420] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_justify.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_justify.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_justify.gif." [0098.420] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_justify.gif.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_justify.gif. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_justify.gif. " [0098.420] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_justify.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_justify.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0098.421] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x352 [0098.422] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xb3559c00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5a90e170, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xb3559c00, dwHighDateTime=0x1c747ea)) returned 1 [0098.422] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0098.422] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x2f8, lpOverlapped=0x0) returned 1 [0098.423] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_justify.gif") returned="rtf_justify.gif" [0098.423] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0098.423] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x2f8, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x2f8, lpOverlapped=0x0) returned 1 [0098.423] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0098.423] CloseHandle (hObject=0x98) returned 1 [0098.423] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_justify.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_justify.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_justify.gif. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_justify.gif. ")) returned 1 [0098.424] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0098.424] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0098.424] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="rtf_pressed.gif") returned -1 [0098.424] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="rtf_pressed.gif") returned -1 [0098.424] lstrcmpiA (lpString1="", lpString2="rtf_pressed.gif") returned -1 [0098.424] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_justify.gif") returned="rtf_justify.gif" [0098.424] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\", lpString2="rtf_pressed.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_pressed.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_pressed.gif" [0098.424] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_pressed.gif", pszSpec="*.zip") returned 0 [0098.424] lstrlenA (lpString="*.zip") returned 5 [0098.424] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_pressed.gif", pszSpec="*.rar") returned 0 [0098.424] lstrlenA (lpString="*.rar") returned 5 [0098.424] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_pressed.gif", pszSpec="*.7z") returned 0 [0098.424] lstrlenA (lpString="*.7z") returned 4 [0098.424] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_pressed.gif", pszSpec="*.tar") returned 0 [0098.424] lstrlenA (lpString="*.tar") returned 5 [0098.424] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_pressed.gif", pszSpec="*.gzip") returned 0 [0098.424] lstrlenA (lpString="*.gzip") returned 6 [0098.424] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_pressed.gif", pszSpec="*.jpg") returned 0 [0098.424] lstrlenA (lpString="*.jpg") returned 5 [0098.424] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_pressed.gif", pszSpec="*.jpeg") returned 0 [0098.425] lstrlenA (lpString="*.jpeg") returned 6 [0098.425] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_pressed.gif", pszSpec="*.psd") returned 0 [0098.425] lstrlenA (lpString="*.psd") returned 5 [0098.425] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_pressed.gif", pszSpec="*.cdr") returned 0 [0098.425] lstrlenA (lpString="*.cdr") returned 5 [0098.425] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_pressed.gif", pszSpec="*.dwg") returned 0 [0098.425] lstrlenA (lpString="*.dwg") returned 5 [0098.425] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_pressed.gif", pszSpec="*.max") returned 0 [0098.425] lstrlenA (lpString="*.max") returned 5 [0098.425] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_pressed.gif", pszSpec="*.bmp") returned 0 [0098.425] lstrlenA (lpString="*.bmp") returned 5 [0098.425] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_pressed.gif", pszSpec="*.gif") returned 1 [0098.425] lstrlenA (lpString="*.gif") returned 5 [0098.425] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_pressed.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_pressed.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_pressed.gif" [0098.425] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_pressed.gif" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_pressed.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_pressed.gif" [0098.425] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_pressed.gif", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_pressed.gif.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_pressed.gif." [0098.425] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_pressed.gif.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_pressed.gif. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_pressed.gif. " [0098.425] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_pressed.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_pressed.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0098.425] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x373 [0098.425] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xb3559c00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x6d24dcb0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xb3559c00, dwHighDateTime=0x1c747ea)) returned 1 [0098.426] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0098.426] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x319, lpOverlapped=0x0) returned 1 [0098.427] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_pressed.gif") returned="rtf_pressed.gif" [0098.427] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0098.427] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x319, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x319, lpOverlapped=0x0) returned 1 [0098.427] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0098.427] CloseHandle (hObject=0x98) returned 1 [0098.427] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_pressed.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_pressed.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_pressed.gif. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_pressed.gif. ")) returned 1 [0098.428] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0098.428] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0098.428] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="SAVE.GIF") returned -1 [0098.428] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SAVE.GIF") returned -1 [0098.428] lstrcmpiA (lpString1="", lpString2="SAVE.GIF") returned -1 [0098.428] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_pressed.gif") returned="rtf_pressed.gif" [0098.428] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\", lpString2="SAVE.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SAVE.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SAVE.GIF" [0098.428] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SAVE.GIF", pszSpec="*.zip") returned 0 [0098.428] lstrlenA (lpString="*.zip") returned 5 [0098.428] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SAVE.GIF", pszSpec="*.rar") returned 0 [0098.428] lstrlenA (lpString="*.rar") returned 5 [0098.428] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SAVE.GIF", pszSpec="*.7z") returned 0 [0098.428] lstrlenA (lpString="*.7z") returned 4 [0098.428] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SAVE.GIF", pszSpec="*.tar") returned 0 [0098.428] lstrlenA (lpString="*.tar") returned 5 [0098.428] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SAVE.GIF", pszSpec="*.gzip") returned 0 [0098.428] lstrlenA (lpString="*.gzip") returned 6 [0098.428] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SAVE.GIF", pszSpec="*.jpg") returned 0 [0098.428] lstrlenA (lpString="*.jpg") returned 5 [0098.428] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SAVE.GIF", pszSpec="*.jpeg") returned 0 [0098.428] lstrlenA (lpString="*.jpeg") returned 6 [0098.428] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SAVE.GIF", pszSpec="*.psd") returned 0 [0098.428] lstrlenA (lpString="*.psd") returned 5 [0098.428] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SAVE.GIF", pszSpec="*.cdr") returned 0 [0098.428] lstrlenA (lpString="*.cdr") returned 5 [0098.428] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SAVE.GIF", pszSpec="*.dwg") returned 0 [0098.428] lstrlenA (lpString="*.dwg") returned 5 [0098.428] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SAVE.GIF", pszSpec="*.max") returned 0 [0098.428] lstrlenA (lpString="*.max") returned 5 [0098.428] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SAVE.GIF", pszSpec="*.bmp") returned 0 [0098.428] lstrlenA (lpString="*.bmp") returned 5 [0098.428] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SAVE.GIF", pszSpec="*.gif") returned 1 [0098.428] lstrlenA (lpString="*.gif") returned 5 [0098.428] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SAVE.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SAVE.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SAVE.GIF" [0098.428] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SAVE.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SAVE.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SAVE.GIF" [0098.428] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SAVE.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SAVE.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SAVE.GIF." [0098.428] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SAVE.GIF.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SAVE.GIF. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SAVE.GIF. " [0098.428] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SAVE.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\save.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0098.429] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x26d [0098.429] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x58b9b600, dwHighDateTime=0x1ca033b), lpLastAccessTime=0x407536*(dwLowDateTime=0x6d24dcb0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x58b9b600, dwHighDateTime=0x1ca033b)) returned 1 [0098.429] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0098.429] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x213, lpOverlapped=0x0) returned 1 [0098.430] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SAVE.GIF") returned="SAVE.GIF" [0098.430] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0098.430] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x213, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x213, lpOverlapped=0x0) returned 1 [0098.430] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0098.430] CloseHandle (hObject=0x98) returned 1 [0098.430] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SAVE.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\save.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SAVE.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\save.gif. ")) returned 1 [0098.431] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0098.431] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0098.431] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="SUBMIT.JS") returned -1 [0098.431] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SUBMIT.JS") returned -1 [0098.431] lstrcmpiA (lpString1="", lpString2="SUBMIT.JS") returned -1 [0098.431] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SAVE.GIF") returned="SAVE.GIF" [0098.431] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\", lpString2="SUBMIT.JS" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SUBMIT.JS") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SUBMIT.JS" [0098.431] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SUBMIT.JS", pszSpec="*.zip") returned 0 [0098.431] lstrlenA (lpString="*.zip") returned 5 [0098.431] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SUBMIT.JS", pszSpec="*.rar") returned 0 [0098.431] lstrlenA (lpString="*.rar") returned 5 [0098.432] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SUBMIT.JS", pszSpec="*.7z") returned 0 [0098.432] lstrlenA (lpString="*.7z") returned 4 [0098.432] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SUBMIT.JS", pszSpec="*.tar") returned 0 [0098.432] lstrlenA (lpString="*.tar") returned 5 [0098.432] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SUBMIT.JS", pszSpec="*.gzip") returned 0 [0098.432] lstrlenA (lpString="*.gzip") returned 6 [0098.432] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SUBMIT.JS", pszSpec="*.jpg") returned 0 [0098.432] lstrlenA (lpString="*.jpg") returned 5 [0098.432] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SUBMIT.JS", pszSpec="*.jpeg") returned 0 [0098.432] lstrlenA (lpString="*.jpeg") returned 6 [0098.432] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SUBMIT.JS", pszSpec="*.psd") returned 0 [0098.432] lstrlenA (lpString="*.psd") returned 5 [0098.432] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SUBMIT.JS", pszSpec="*.cdr") returned 0 [0098.432] lstrlenA (lpString="*.cdr") returned 5 [0098.432] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SUBMIT.JS", pszSpec="*.dwg") returned 0 [0098.432] lstrlenA (lpString="*.dwg") returned 5 [0098.432] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SUBMIT.JS", pszSpec="*.max") returned 0 [0098.432] lstrlenA (lpString="*.max") returned 5 [0098.432] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SUBMIT.JS", pszSpec="*.bmp") returned 0 [0098.432] lstrlenA (lpString="*.bmp") returned 5 [0098.432] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SUBMIT.JS", pszSpec="*.gif") returned 0 [0098.432] lstrlenA (lpString="*.gif") returned 5 [0098.432] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SUBMIT.JS", pszSpec="*.png") returned 0 [0098.432] lstrlenA (lpString="*.png") returned 5 [0098.432] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SUBMIT.JS", pszSpec="*.doc") returned 0 [0098.432] lstrlenA (lpString="*.doc") returned 5 [0098.432] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SUBMIT.JS", pszSpec="*.docx") returned 0 [0098.432] lstrlenA (lpString="*.docx") returned 6 [0098.432] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SUBMIT.JS", pszSpec="*.xls") returned 0 [0098.432] lstrlenA (lpString="*.xls") returned 5 [0098.432] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SUBMIT.JS", pszSpec="*.xlsx") returned 0 [0098.432] lstrlenA (lpString="*.xlsx") returned 6 [0098.432] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SUBMIT.JS", pszSpec="*.ppt") returned 0 [0098.432] lstrlenA (lpString="*.ppt") returned 5 [0098.432] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SUBMIT.JS", pszSpec="*.pptx") returned 0 [0098.432] lstrlenA (lpString="*.pptx") returned 6 [0098.432] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SUBMIT.JS", pszSpec="*.txt") returned 0 [0098.432] lstrlenA (lpString="*.txt") returned 5 [0098.432] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SUBMIT.JS", pszSpec="*.pdf") returned 0 [0098.432] lstrlenA (lpString="*.pdf") returned 5 [0098.432] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SUBMIT.JS", pszSpec="*.djvu") returned 0 [0098.432] lstrlenA (lpString="*.djvu") returned 6 [0098.432] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SUBMIT.JS", pszSpec="*.htm") returned 0 [0098.432] lstrlenA (lpString="*.htm") returned 5 [0098.432] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SUBMIT.JS", pszSpec="*.html") returned 0 [0098.432] lstrlenA (lpString="*.html") returned 6 [0098.432] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SUBMIT.JS", pszSpec="*.mdb") returned 0 [0098.432] lstrlenA (lpString="*.mdb") returned 5 [0098.432] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SUBMIT.JS", pszSpec="*.cer") returned 0 [0098.433] lstrlenA (lpString="*.cer") returned 5 [0098.433] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SUBMIT.JS", pszSpec="*.p12") returned 0 [0098.433] lstrlenA (lpString="*.p12") returned 5 [0098.433] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SUBMIT.JS", pszSpec="*.pfx") returned 0 [0098.433] lstrlenA (lpString="*.pfx") returned 5 [0098.433] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SUBMIT.JS", pszSpec="*.kwm") returned 0 [0098.433] lstrlenA (lpString="*.kwm") returned 5 [0098.433] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SUBMIT.JS", pszSpec="*.pwm") returned 0 [0098.433] lstrlenA (lpString="*.pwm") returned 5 [0098.433] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SUBMIT.JS", pszSpec="*.1cd") returned 0 [0098.433] lstrlenA (lpString="*.1cd") returned 5 [0098.433] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SUBMIT.JS", pszSpec="*.md") returned 0 [0098.433] lstrlenA (lpString="*.md") returned 4 [0098.433] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SUBMIT.JS", pszSpec="*.mdf") returned 0 [0098.433] lstrlenA (lpString="*.mdf") returned 5 [0098.433] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SUBMIT.JS", pszSpec="*.dbf") returned 0 [0098.433] lstrlenA (lpString="*.dbf") returned 5 [0098.433] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SUBMIT.JS", pszSpec="*.odt") returned 0 [0098.433] lstrlenA (lpString="*.odt") returned 5 [0098.433] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SUBMIT.JS", pszSpec="*.vob") returned 0 [0098.433] lstrlenA (lpString="*.vob") returned 5 [0098.433] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SUBMIT.JS", pszSpec="*.ifo") returned 0 [0098.433] lstrlenA (lpString="*.ifo") returned 5 [0098.433] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SUBMIT.JS", pszSpec="*.lnk") returned 0 [0098.433] lstrlenA (lpString="*.lnk") returned 5 [0098.433] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SUBMIT.JS", pszSpec="*.torrent") returned 0 [0098.433] lstrlenA (lpString="*.torrent") returned 9 [0098.433] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SUBMIT.JS", pszSpec="*.mov") returned 0 [0098.433] lstrlenA (lpString="*.mov") returned 5 [0098.433] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SUBMIT.JS", pszSpec="*.m2v") returned 0 [0098.433] lstrlenA (lpString="*.m2v") returned 5 [0098.433] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SUBMIT.JS", pszSpec="*.3gp") returned 0 [0098.433] lstrlenA (lpString="*.3gp") returned 5 [0098.433] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SUBMIT.JS", pszSpec="*.mpeg") returned 0 [0098.433] lstrlenA (lpString="*.mpeg") returned 6 [0098.433] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SUBMIT.JS", pszSpec="*.mpg") returned 0 [0098.433] lstrlenA (lpString="*.mpg") returned 5 [0098.433] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SUBMIT.JS", pszSpec="*.flv") returned 0 [0098.433] lstrlenA (lpString="*.flv") returned 5 [0098.433] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SUBMIT.JS", pszSpec="*.avi") returned 0 [0098.433] lstrlenA (lpString="*.avi") returned 5 [0098.433] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SUBMIT.JS", pszSpec="*.mp4") returned 0 [0098.433] lstrlenA (lpString="*.mp4") returned 5 [0098.434] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SUBMIT.JS", pszSpec="*.wmv") returned 0 [0098.434] lstrlenA (lpString="*.wmv") returned 5 [0098.434] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SUBMIT.JS", pszSpec="*.divx") returned 0 [0098.434] lstrlenA (lpString="*.divx") returned 6 [0098.434] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SUBMIT.JS", pszSpec="*.mkv") returned 0 [0098.434] lstrlenA (lpString="*.mkv") returned 5 [0098.434] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SUBMIT.JS", pszSpec="*.mp3") returned 0 [0098.434] lstrlenA (lpString="*.mp3") returned 5 [0098.434] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SUBMIT.JS", pszSpec="*.wav") returned 0 [0098.434] lstrlenA (lpString="*.wav") returned 5 [0098.434] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SUBMIT.JS", pszSpec="*.flac") returned 0 [0098.434] lstrlenA (lpString="*.flac") returned 6 [0098.434] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SUBMIT.JS", pszSpec="*.ape") returned 0 [0098.434] lstrlenA (lpString="*.ape") returned 5 [0098.434] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SUBMIT.JS", pszSpec="*.wma") returned 0 [0098.434] lstrlenA (lpString="*.wma") returned 5 [0098.434] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SUBMIT.JS", pszSpec="*.ac3") returned 0 [0098.434] lstrlenA (lpString="*.ac3") returned 5 [0098.434] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0098.434] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0098.434] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="utilityfunctions.js") returned -1 [0098.434] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="utilityfunctions.js") returned -1 [0098.434] lstrcmpiA (lpString1="", lpString2="utilityfunctions.js") returned -1 [0098.434] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SUBMIT.JS") returned="SUBMIT.JS" [0098.434] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\", lpString2="utilityfunctions.js" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\utilityfunctions.js") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\utilityfunctions.js" [0098.434] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\utilityfunctions.js", pszSpec="*.zip") returned 0 [0098.434] lstrlenA (lpString="*.zip") returned 5 [0098.434] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\utilityfunctions.js", pszSpec="*.rar") returned 0 [0098.434] lstrlenA (lpString="*.rar") returned 5 [0098.434] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\utilityfunctions.js", pszSpec="*.7z") returned 0 [0098.434] lstrlenA (lpString="*.7z") returned 4 [0098.434] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\utilityfunctions.js", pszSpec="*.tar") returned 0 [0098.434] lstrlenA (lpString="*.tar") returned 5 [0098.434] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\utilityfunctions.js", pszSpec="*.gzip") returned 0 [0098.434] lstrlenA (lpString="*.gzip") returned 6 [0098.434] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\utilityfunctions.js", pszSpec="*.jpg") returned 0 [0098.435] lstrlenA (lpString="*.jpg") returned 5 [0098.435] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\utilityfunctions.js", pszSpec="*.jpeg") returned 0 [0098.435] lstrlenA (lpString="*.jpeg") returned 6 [0098.435] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\utilityfunctions.js", pszSpec="*.psd") returned 0 [0098.435] lstrlenA (lpString="*.psd") returned 5 [0098.435] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\utilityfunctions.js", pszSpec="*.cdr") returned 0 [0098.435] lstrlenA (lpString="*.cdr") returned 5 [0098.435] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\utilityfunctions.js", pszSpec="*.dwg") returned 0 [0098.435] lstrlenA (lpString="*.dwg") returned 5 [0098.435] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\utilityfunctions.js", pszSpec="*.max") returned 0 [0098.435] lstrlenA (lpString="*.max") returned 5 [0098.435] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\utilityfunctions.js", pszSpec="*.bmp") returned 0 [0098.435] lstrlenA (lpString="*.bmp") returned 5 [0098.435] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\utilityfunctions.js", pszSpec="*.gif") returned 0 [0098.435] lstrlenA (lpString="*.gif") returned 5 [0098.435] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\utilityfunctions.js", pszSpec="*.png") returned 0 [0098.435] lstrlenA (lpString="*.png") returned 5 [0098.435] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\utilityfunctions.js", pszSpec="*.doc") returned 0 [0098.435] lstrlenA (lpString="*.doc") returned 5 [0098.435] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\utilityfunctions.js", pszSpec="*.docx") returned 0 [0098.435] lstrlenA (lpString="*.docx") returned 6 [0098.435] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\utilityfunctions.js", pszSpec="*.xls") returned 0 [0098.435] lstrlenA (lpString="*.xls") returned 5 [0098.435] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\utilityfunctions.js", pszSpec="*.xlsx") returned 0 [0098.435] lstrlenA (lpString="*.xlsx") returned 6 [0098.435] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\utilityfunctions.js", pszSpec="*.ppt") returned 0 [0098.435] lstrlenA (lpString="*.ppt") returned 5 [0098.435] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\utilityfunctions.js", pszSpec="*.pptx") returned 0 [0098.435] lstrlenA (lpString="*.pptx") returned 6 [0098.435] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\utilityfunctions.js", pszSpec="*.txt") returned 0 [0098.435] lstrlenA (lpString="*.txt") returned 5 [0098.435] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\utilityfunctions.js", pszSpec="*.pdf") returned 0 [0098.435] lstrlenA (lpString="*.pdf") returned 5 [0098.435] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\utilityfunctions.js", pszSpec="*.djvu") returned 0 [0098.435] lstrlenA (lpString="*.djvu") returned 6 [0098.435] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\utilityfunctions.js", pszSpec="*.htm") returned 0 [0098.435] lstrlenA (lpString="*.htm") returned 5 [0098.435] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\utilityfunctions.js", pszSpec="*.html") returned 0 [0098.435] lstrlenA (lpString="*.html") returned 6 [0098.435] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\utilityfunctions.js", pszSpec="*.mdb") returned 0 [0098.435] lstrlenA (lpString="*.mdb") returned 5 [0098.435] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\utilityfunctions.js", pszSpec="*.cer") returned 0 [0098.435] lstrlenA (lpString="*.cer") returned 5 [0098.435] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\utilityfunctions.js", pszSpec="*.p12") returned 0 [0098.435] lstrlenA (lpString="*.p12") returned 5 [0098.435] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\utilityfunctions.js", pszSpec="*.pfx") returned 0 [0098.435] lstrlenA (lpString="*.pfx") returned 5 [0098.435] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\utilityfunctions.js", pszSpec="*.kwm") returned 0 [0098.435] lstrlenA (lpString="*.kwm") returned 5 [0098.435] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\utilityfunctions.js", pszSpec="*.pwm") returned 0 [0098.435] lstrlenA (lpString="*.pwm") returned 5 [0098.436] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\utilityfunctions.js", pszSpec="*.1cd") returned 0 [0098.436] lstrlenA (lpString="*.1cd") returned 5 [0098.436] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\utilityfunctions.js", pszSpec="*.md") returned 0 [0098.436] lstrlenA (lpString="*.md") returned 4 [0098.436] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\utilityfunctions.js", pszSpec="*.mdf") returned 0 [0098.436] lstrlenA (lpString="*.mdf") returned 5 [0098.436] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\utilityfunctions.js", pszSpec="*.dbf") returned 0 [0098.436] lstrlenA (lpString="*.dbf") returned 5 [0098.436] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\utilityfunctions.js", pszSpec="*.odt") returned 0 [0098.436] lstrlenA (lpString="*.odt") returned 5 [0098.436] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\utilityfunctions.js", pszSpec="*.vob") returned 0 [0098.436] lstrlenA (lpString="*.vob") returned 5 [0098.436] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\utilityfunctions.js", pszSpec="*.ifo") returned 0 [0098.436] lstrlenA (lpString="*.ifo") returned 5 [0098.436] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\utilityfunctions.js", pszSpec="*.lnk") returned 0 [0098.436] lstrlenA (lpString="*.lnk") returned 5 [0098.436] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\utilityfunctions.js", pszSpec="*.torrent") returned 0 [0098.436] lstrlenA (lpString="*.torrent") returned 9 [0098.436] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\utilityfunctions.js", pszSpec="*.mov") returned 0 [0098.436] lstrlenA (lpString="*.mov") returned 5 [0098.436] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\utilityfunctions.js", pszSpec="*.m2v") returned 0 [0098.436] lstrlenA (lpString="*.m2v") returned 5 [0098.436] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\utilityfunctions.js", pszSpec="*.3gp") returned 0 [0098.436] lstrlenA (lpString="*.3gp") returned 5 [0098.436] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\utilityfunctions.js", pszSpec="*.mpeg") returned 0 [0098.436] lstrlenA (lpString="*.mpeg") returned 6 [0098.436] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\utilityfunctions.js", pszSpec="*.mpg") returned 0 [0098.436] lstrlenA (lpString="*.mpg") returned 5 [0098.436] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\utilityfunctions.js", pszSpec="*.flv") returned 0 [0098.436] lstrlenA (lpString="*.flv") returned 5 [0098.436] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\utilityfunctions.js", pszSpec="*.avi") returned 0 [0098.436] lstrlenA (lpString="*.avi") returned 5 [0098.436] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\utilityfunctions.js", pszSpec="*.mp4") returned 0 [0098.436] lstrlenA (lpString="*.mp4") returned 5 [0098.436] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\utilityfunctions.js", pszSpec="*.wmv") returned 0 [0098.436] lstrlenA (lpString="*.wmv") returned 5 [0098.436] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\utilityfunctions.js", pszSpec="*.divx") returned 0 [0098.436] lstrlenA (lpString="*.divx") returned 6 [0098.436] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\utilityfunctions.js", pszSpec="*.mkv") returned 0 [0098.436] lstrlenA (lpString="*.mkv") returned 5 [0098.436] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\utilityfunctions.js", pszSpec="*.mp3") returned 0 [0098.436] lstrlenA (lpString="*.mp3") returned 5 [0098.436] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\utilityfunctions.js", pszSpec="*.wav") returned 0 [0098.436] lstrlenA (lpString="*.wav") returned 5 [0098.436] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\utilityfunctions.js", pszSpec="*.flac") returned 0 [0098.436] lstrlenA (lpString="*.flac") returned 6 [0098.436] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\utilityfunctions.js", pszSpec="*.ape") returned 0 [0098.436] lstrlenA (lpString="*.ape") returned 5 [0098.436] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\utilityfunctions.js", pszSpec="*.wma") returned 0 [0098.436] lstrlenA (lpString="*.wma") returned 5 [0098.436] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\utilityfunctions.js", pszSpec="*.ac3") returned 0 [0098.436] lstrlenA (lpString="*.ac3") returned 5 [0098.437] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0098.437] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0098.437] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="validation.js") returned -1 [0098.437] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="validation.js") returned -1 [0098.437] lstrcmpiA (lpString1="", lpString2="validation.js") returned -1 [0098.437] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\utilityfunctions.js") returned="utilityfunctions.js" [0098.437] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\", lpString2="validation.js" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\validation.js") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\validation.js" [0098.437] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\validation.js", pszSpec="*.zip") returned 0 [0098.437] lstrlenA (lpString="*.zip") returned 5 [0098.437] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\validation.js", pszSpec="*.rar") returned 0 [0098.438] lstrlenA (lpString="*.rar") returned 5 [0098.438] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\validation.js", pszSpec="*.7z") returned 0 [0098.438] lstrlenA (lpString="*.7z") returned 4 [0098.438] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\validation.js", pszSpec="*.tar") returned 0 [0098.438] lstrlenA (lpString="*.tar") returned 5 [0098.438] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\validation.js", pszSpec="*.gzip") returned 0 [0098.438] lstrlenA (lpString="*.gzip") returned 6 [0098.438] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\validation.js", pszSpec="*.jpg") returned 0 [0098.438] lstrlenA (lpString="*.jpg") returned 5 [0098.438] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\validation.js", pszSpec="*.jpeg") returned 0 [0098.438] lstrlenA (lpString="*.jpeg") returned 6 [0098.438] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\validation.js", pszSpec="*.psd") returned 0 [0098.438] lstrlenA (lpString="*.psd") returned 5 [0098.438] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\validation.js", pszSpec="*.cdr") returned 0 [0098.438] lstrlenA (lpString="*.cdr") returned 5 [0098.438] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\validation.js", pszSpec="*.dwg") returned 0 [0098.438] lstrlenA (lpString="*.dwg") returned 5 [0098.438] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\validation.js", pszSpec="*.max") returned 0 [0098.438] lstrlenA (lpString="*.max") returned 5 [0098.438] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\validation.js", pszSpec="*.bmp") returned 0 [0098.438] lstrlenA (lpString="*.bmp") returned 5 [0098.438] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\validation.js", pszSpec="*.gif") returned 0 [0098.438] lstrlenA (lpString="*.gif") returned 5 [0098.438] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\validation.js", pszSpec="*.png") returned 0 [0098.438] lstrlenA (lpString="*.png") returned 5 [0098.438] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\validation.js", pszSpec="*.doc") returned 0 [0098.438] lstrlenA (lpString="*.doc") returned 5 [0098.438] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\validation.js", pszSpec="*.docx") returned 0 [0098.438] lstrlenA (lpString="*.docx") returned 6 [0098.438] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\validation.js", pszSpec="*.xls") returned 0 [0098.438] lstrlenA (lpString="*.xls") returned 5 [0098.438] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\validation.js", pszSpec="*.xlsx") returned 0 [0098.438] lstrlenA (lpString="*.xlsx") returned 6 [0098.438] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\validation.js", pszSpec="*.ppt") returned 0 [0098.438] lstrlenA (lpString="*.ppt") returned 5 [0098.438] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\validation.js", pszSpec="*.pptx") returned 0 [0098.438] lstrlenA (lpString="*.pptx") returned 6 [0098.438] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\validation.js", pszSpec="*.txt") returned 0 [0098.438] lstrlenA (lpString="*.txt") returned 5 [0098.438] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\validation.js", pszSpec="*.pdf") returned 0 [0098.438] lstrlenA (lpString="*.pdf") returned 5 [0098.438] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\validation.js", pszSpec="*.djvu") returned 0 [0098.438] lstrlenA (lpString="*.djvu") returned 6 [0098.438] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\validation.js", pszSpec="*.htm") returned 0 [0098.439] lstrlenA (lpString="*.htm") returned 5 [0098.439] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\validation.js", pszSpec="*.html") returned 0 [0098.439] lstrlenA (lpString="*.html") returned 6 [0098.439] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\validation.js", pszSpec="*.mdb") returned 0 [0098.439] lstrlenA (lpString="*.mdb") returned 5 [0098.439] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\validation.js", pszSpec="*.cer") returned 0 [0098.439] lstrlenA (lpString="*.cer") returned 5 [0098.439] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\validation.js", pszSpec="*.p12") returned 0 [0098.439] lstrlenA (lpString="*.p12") returned 5 [0098.439] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\validation.js", pszSpec="*.pfx") returned 0 [0098.439] lstrlenA (lpString="*.pfx") returned 5 [0098.439] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\validation.js", pszSpec="*.kwm") returned 0 [0098.439] lstrlenA (lpString="*.kwm") returned 5 [0098.439] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\validation.js", pszSpec="*.pwm") returned 0 [0098.439] lstrlenA (lpString="*.pwm") returned 5 [0098.439] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\validation.js", pszSpec="*.1cd") returned 0 [0098.439] lstrlenA (lpString="*.1cd") returned 5 [0098.439] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\validation.js", pszSpec="*.md") returned 0 [0098.439] lstrlenA (lpString="*.md") returned 4 [0098.439] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\validation.js", pszSpec="*.mdf") returned 0 [0098.439] lstrlenA (lpString="*.mdf") returned 5 [0098.439] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\validation.js", pszSpec="*.dbf") returned 0 [0098.439] lstrlenA (lpString="*.dbf") returned 5 [0098.439] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\validation.js", pszSpec="*.odt") returned 0 [0098.439] lstrlenA (lpString="*.odt") returned 5 [0098.439] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\validation.js", pszSpec="*.vob") returned 0 [0098.439] lstrlenA (lpString="*.vob") returned 5 [0098.439] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\validation.js", pszSpec="*.ifo") returned 0 [0098.439] lstrlenA (lpString="*.ifo") returned 5 [0098.439] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\validation.js", pszSpec="*.lnk") returned 0 [0098.439] lstrlenA (lpString="*.lnk") returned 5 [0098.439] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\validation.js", pszSpec="*.torrent") returned 0 [0098.439] lstrlenA (lpString="*.torrent") returned 9 [0098.439] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\validation.js", pszSpec="*.mov") returned 0 [0098.439] lstrlenA (lpString="*.mov") returned 5 [0098.439] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\validation.js", pszSpec="*.m2v") returned 0 [0098.439] lstrlenA (lpString="*.m2v") returned 5 [0098.439] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\validation.js", pszSpec="*.3gp") returned 0 [0098.439] lstrlenA (lpString="*.3gp") returned 5 [0098.439] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\validation.js", pszSpec="*.mpeg") returned 0 [0098.439] lstrlenA (lpString="*.mpeg") returned 6 [0098.439] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\validation.js", pszSpec="*.mpg") returned 0 [0098.439] lstrlenA (lpString="*.mpg") returned 5 [0098.439] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\validation.js", pszSpec="*.flv") returned 0 [0098.439] lstrlenA (lpString="*.flv") returned 5 [0098.439] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\validation.js", pszSpec="*.avi") returned 0 [0098.439] lstrlenA (lpString="*.avi") returned 5 [0098.439] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\validation.js", pszSpec="*.mp4") returned 0 [0098.439] lstrlenA (lpString="*.mp4") returned 5 [0098.439] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\validation.js", pszSpec="*.wmv") returned 0 [0098.440] lstrlenA (lpString="*.wmv") returned 5 [0098.440] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\validation.js", pszSpec="*.divx") returned 0 [0098.440] lstrlenA (lpString="*.divx") returned 6 [0098.440] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\validation.js", pszSpec="*.mkv") returned 0 [0098.440] lstrlenA (lpString="*.mkv") returned 5 [0098.440] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\validation.js", pszSpec="*.mp3") returned 0 [0098.440] lstrlenA (lpString="*.mp3") returned 5 [0098.440] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\validation.js", pszSpec="*.wav") returned 0 [0098.440] lstrlenA (lpString="*.wav") returned 5 [0098.440] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\validation.js", pszSpec="*.flac") returned 0 [0098.440] lstrlenA (lpString="*.flac") returned 6 [0098.440] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\validation.js", pszSpec="*.ape") returned 0 [0098.440] lstrlenA (lpString="*.ape") returned 5 [0098.440] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\validation.js", pszSpec="*.wma") returned 0 [0098.440] lstrlenA (lpString="*.wma") returned 5 [0098.440] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\validation.js", pszSpec="*.ac3") returned 0 [0098.440] lstrlenA (lpString="*.ac3") returned 5 [0098.440] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 0 [0098.440] FindClose (in: hFindFile=0x5be160 | out: hFindFile=0x5be160) returned 1 [0098.440] FindNextFileA (in: hFindFile=0x5b7dd0, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0098.440] lstrcmpA (lpString1=".", lpString2="GrooveProjectToolset") returned -1 [0098.440] lstrcmpA (lpString1="..", lpString2="GrooveProjectToolset") returned -1 [0098.440] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\*.*") returned="*.*" [0098.440] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\", lpString2="GrooveProjectToolset" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset" [0098.440] lstrlenA (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset") returned 90 [0098.440] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\*.*", lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 0x5be160 [0098.441] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0098.441] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0098.442] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0098.442] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0098.442] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0098.442] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0098.442] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BriefcaseIcon.jpg") returned 1 [0098.442] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BriefcaseIcon.jpg") returned 1 [0098.442] lstrcmpiA (lpString1="", lpString2="BriefcaseIcon.jpg") returned -1 [0098.442] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\*.*") returned="*.*" [0098.442] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\", lpString2="BriefcaseIcon.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIcon.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIcon.jpg" [0098.442] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIcon.jpg", pszSpec="*.zip") returned 0 [0098.442] lstrlenA (lpString="*.zip") returned 5 [0098.442] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIcon.jpg", pszSpec="*.rar") returned 0 [0098.442] lstrlenA (lpString="*.rar") returned 5 [0098.442] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIcon.jpg", pszSpec="*.7z") returned 0 [0098.442] lstrlenA (lpString="*.7z") returned 4 [0098.442] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIcon.jpg", pszSpec="*.tar") returned 0 [0098.442] lstrlenA (lpString="*.tar") returned 5 [0098.442] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIcon.jpg", pszSpec="*.gzip") returned 0 [0098.442] lstrlenA (lpString="*.gzip") returned 6 [0098.442] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIcon.jpg", pszSpec="*.jpg") returned 1 [0098.442] lstrlenA (lpString="*.jpg") returned 5 [0098.442] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIcon.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIcon.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIcon.jpg" [0098.442] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIcon.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIcon.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIcon.jpg" [0098.442] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIcon.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIcon.jpg.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIcon.jpg." [0098.442] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIcon.jpg.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIcon.jpg. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIcon.jpg. " [0098.442] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIcon.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\briefcaseicon.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0098.443] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x140b [0098.443] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xb3559c00, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x51a61ad0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xb3559c00, dwHighDateTime=0x1c747ea)) returned 1 [0098.443] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0098.443] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x13b1, lpOverlapped=0x0) returned 1 [0098.737] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIcon.jpg") returned="BriefcaseIcon.jpg" [0098.737] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0098.737] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x13b1, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x13b1, lpOverlapped=0x0) returned 1 [0098.737] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0098.737] CloseHandle (hObject=0x98) returned 1 [0098.738] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIcon.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\briefcaseicon.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIcon.jpg. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\briefcaseicon.jpg. ")) returned 1 [0098.739] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0098.739] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0098.739] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BriefcaseIconMask.bmp") returned 1 [0098.739] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BriefcaseIconMask.bmp") returned 1 [0098.739] lstrcmpiA (lpString1="", lpString2="BriefcaseIconMask.bmp") returned -1 [0098.739] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIcon.jpg") returned="BriefcaseIcon.jpg" [0098.739] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\", lpString2="BriefcaseIconMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIconMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIconMask.bmp" [0098.739] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIconMask.bmp", pszSpec="*.zip") returned 0 [0098.739] lstrlenA (lpString="*.zip") returned 5 [0098.739] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIconMask.bmp", pszSpec="*.rar") returned 0 [0098.739] lstrlenA (lpString="*.rar") returned 5 [0098.739] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIconMask.bmp", pszSpec="*.7z") returned 0 [0098.739] lstrlenA (lpString="*.7z") returned 4 [0098.739] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIconMask.bmp", pszSpec="*.tar") returned 0 [0098.739] lstrlenA (lpString="*.tar") returned 5 [0098.739] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIconMask.bmp", pszSpec="*.gzip") returned 0 [0098.739] lstrlenA (lpString="*.gzip") returned 6 [0098.739] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIconMask.bmp", pszSpec="*.jpg") returned 0 [0098.739] lstrlenA (lpString="*.jpg") returned 5 [0098.739] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIconMask.bmp", pszSpec="*.jpeg") returned 0 [0098.739] lstrlenA (lpString="*.jpeg") returned 6 [0098.739] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIconMask.bmp", pszSpec="*.psd") returned 0 [0098.739] lstrlenA (lpString="*.psd") returned 5 [0098.739] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIconMask.bmp", pszSpec="*.cdr") returned 0 [0098.739] lstrlenA (lpString="*.cdr") returned 5 [0098.739] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIconMask.bmp", pszSpec="*.dwg") returned 0 [0098.739] lstrlenA (lpString="*.dwg") returned 5 [0098.739] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIconMask.bmp", pszSpec="*.max") returned 0 [0098.739] lstrlenA (lpString="*.max") returned 5 [0098.739] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIconMask.bmp", pszSpec="*.bmp") returned 1 [0098.739] lstrlenA (lpString="*.bmp") returned 5 [0098.739] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIconMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIconMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIconMask.bmp" [0098.739] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIconMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIconMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIconMask.bmp" [0098.739] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIconMask.bmp", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIconMask.bmp.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIconMask.bmp." [0098.739] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIconMask.bmp.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIconMask.bmp. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIconMask.bmp. " [0098.740] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIconMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\briefcaseiconmask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0098.741] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xf76 [0098.741] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xb486c900, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x51a87c30, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xb486c900, dwHighDateTime=0x1c747ea)) returned 1 [0098.741] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0098.741] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0xf1c, lpOverlapped=0x0) returned 1 [0098.754] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIconMask.bmp") returned="BriefcaseIconMask.bmp" [0098.754] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0098.754] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0xf1c, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0xf1c, lpOverlapped=0x0) returned 1 [0098.754] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0098.754] CloseHandle (hObject=0x98) returned 1 [0098.754] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIconMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\briefcaseiconmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIconMask.bmp. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\briefcaseiconmask.bmp. ")) returned 1 [0098.755] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0098.755] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0098.755] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="CircleIcons.jpg") returned 1 [0098.755] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="CircleIcons.jpg") returned 1 [0098.755] lstrcmpiA (lpString1="", lpString2="CircleIcons.jpg") returned -1 [0098.755] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIconMask.bmp") returned="BriefcaseIconMask.bmp" [0098.755] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\", lpString2="CircleIcons.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIcons.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIcons.jpg" [0098.755] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIcons.jpg", pszSpec="*.zip") returned 0 [0098.755] lstrlenA (lpString="*.zip") returned 5 [0098.755] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIcons.jpg", pszSpec="*.rar") returned 0 [0098.755] lstrlenA (lpString="*.rar") returned 5 [0098.755] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIcons.jpg", pszSpec="*.7z") returned 0 [0098.755] lstrlenA (lpString="*.7z") returned 4 [0098.755] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIcons.jpg", pszSpec="*.tar") returned 0 [0098.755] lstrlenA (lpString="*.tar") returned 5 [0098.755] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIcons.jpg", pszSpec="*.gzip") returned 0 [0098.755] lstrlenA (lpString="*.gzip") returned 6 [0098.755] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIcons.jpg", pszSpec="*.jpg") returned 1 [0098.755] lstrlenA (lpString="*.jpg") returned 5 [0098.755] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIcons.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIcons.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIcons.jpg" [0098.755] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIcons.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIcons.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIcons.jpg" [0098.755] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIcons.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIcons.jpg.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIcons.jpg." [0098.755] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIcons.jpg.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIcons.jpg. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIcons.jpg. " [0098.755] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIcons.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\circleicons.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0098.757] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x32cd [0098.757] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xb486c900, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x60382570, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xb486c900, dwHighDateTime=0x1c747ea)) returned 1 [0098.757] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0098.757] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x3273, lpOverlapped=0x0) returned 1 [0098.804] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIcons.jpg") returned="CircleIcons.jpg" [0098.804] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0098.804] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x3273, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x3273, lpOverlapped=0x0) returned 1 [0098.804] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0098.804] CloseHandle (hObject=0x98) returned 1 [0098.804] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIcons.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\circleicons.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIcons.jpg. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\circleicons.jpg. ")) returned 1 [0098.805] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0098.805] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0098.805] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="CircleIconsMask.bmp") returned 1 [0098.805] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="CircleIconsMask.bmp") returned 1 [0098.805] lstrcmpiA (lpString1="", lpString2="CircleIconsMask.bmp") returned -1 [0098.805] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIcons.jpg") returned="CircleIcons.jpg" [0098.805] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\", lpString2="CircleIconsMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIconsMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIconsMask.bmp" [0098.806] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIconsMask.bmp", pszSpec="*.zip") returned 0 [0098.806] lstrlenA (lpString="*.zip") returned 5 [0098.806] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIconsMask.bmp", pszSpec="*.rar") returned 0 [0098.806] lstrlenA (lpString="*.rar") returned 5 [0098.806] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIconsMask.bmp", pszSpec="*.7z") returned 0 [0098.806] lstrlenA (lpString="*.7z") returned 4 [0098.806] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIconsMask.bmp", pszSpec="*.tar") returned 0 [0098.806] lstrlenA (lpString="*.tar") returned 5 [0098.806] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIconsMask.bmp", pszSpec="*.gzip") returned 0 [0098.806] lstrlenA (lpString="*.gzip") returned 6 [0098.806] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIconsMask.bmp", pszSpec="*.jpg") returned 0 [0098.806] lstrlenA (lpString="*.jpg") returned 5 [0098.806] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIconsMask.bmp", pszSpec="*.jpeg") returned 0 [0098.806] lstrlenA (lpString="*.jpeg") returned 6 [0098.806] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIconsMask.bmp", pszSpec="*.psd") returned 0 [0098.806] lstrlenA (lpString="*.psd") returned 5 [0098.806] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIconsMask.bmp", pszSpec="*.cdr") returned 0 [0098.806] lstrlenA (lpString="*.cdr") returned 5 [0098.806] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIconsMask.bmp", pszSpec="*.dwg") returned 0 [0098.806] lstrlenA (lpString="*.dwg") returned 5 [0098.806] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIconsMask.bmp", pszSpec="*.max") returned 0 [0098.806] lstrlenA (lpString="*.max") returned 5 [0098.806] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIconsMask.bmp", pszSpec="*.bmp") returned 1 [0098.806] lstrlenA (lpString="*.bmp") returned 5 [0098.806] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIconsMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIconsMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIconsMask.bmp" [0098.806] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIconsMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIconsMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIconsMask.bmp" [0098.806] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIconsMask.bmp", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIconsMask.bmp.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIconsMask.bmp." [0098.806] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIconsMask.bmp.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIconsMask.bmp. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIconsMask.bmp. " [0098.806] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIconsMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\circleiconsmask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0098.807] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x114c [0098.807] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xb486c900, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x60382570, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xb486c900, dwHighDateTime=0x1c747ea)) returned 1 [0098.807] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0098.807] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x10f2, lpOverlapped=0x0) returned 1 [0098.875] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIconsMask.bmp") returned="CircleIconsMask.bmp" [0098.875] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0098.875] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x10f2, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x10f2, lpOverlapped=0x0) returned 1 [0098.875] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0098.875] CloseHandle (hObject=0x98) returned 1 [0098.875] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIconsMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\circleiconsmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIconsMask.bmp. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\circleiconsmask.bmp. ")) returned 1 [0098.876] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0098.876] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0098.876] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="MeetingIcon.jpg") returned -1 [0098.876] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MeetingIcon.jpg") returned -1 [0098.876] lstrcmpiA (lpString1="", lpString2="MeetingIcon.jpg") returned -1 [0098.876] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIconsMask.bmp") returned="CircleIconsMask.bmp" [0098.876] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\", lpString2="MeetingIcon.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIcon.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIcon.jpg" [0098.876] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIcon.jpg", pszSpec="*.zip") returned 0 [0098.876] lstrlenA (lpString="*.zip") returned 5 [0098.876] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIcon.jpg", pszSpec="*.rar") returned 0 [0098.876] lstrlenA (lpString="*.rar") returned 5 [0098.876] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIcon.jpg", pszSpec="*.7z") returned 0 [0098.876] lstrlenA (lpString="*.7z") returned 4 [0098.876] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIcon.jpg", pszSpec="*.tar") returned 0 [0098.876] lstrlenA (lpString="*.tar") returned 5 [0098.876] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIcon.jpg", pszSpec="*.gzip") returned 0 [0098.876] lstrlenA (lpString="*.gzip") returned 6 [0098.876] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIcon.jpg", pszSpec="*.jpg") returned 1 [0098.876] lstrlenA (lpString="*.jpg") returned 5 [0098.876] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIcon.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIcon.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIcon.jpg" [0098.876] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIcon.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIcon.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIcon.jpg" [0098.876] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIcon.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIcon.jpg.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIcon.jpg." [0098.876] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIcon.jpg.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIcon.jpg. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIcon.jpg. " [0098.876] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIcon.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\meetingicon.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0098.877] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x26ba [0098.877] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xb486c900, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x582d2010, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xb486c900, dwHighDateTime=0x1c747ea)) returned 1 [0098.877] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0098.877] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x2660, lpOverlapped=0x0) returned 1 [0098.942] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIcon.jpg") returned="MeetingIcon.jpg" [0098.942] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0098.942] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x2660, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x2660, lpOverlapped=0x0) returned 1 [0098.943] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0098.943] CloseHandle (hObject=0x98) returned 1 [0098.943] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIcon.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\meetingicon.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIcon.jpg. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\meetingicon.jpg. ")) returned 1 [0098.944] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0098.944] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0098.944] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="MeetingIconMask.bmp") returned -1 [0098.944] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MeetingIconMask.bmp") returned -1 [0098.944] lstrcmpiA (lpString1="", lpString2="MeetingIconMask.bmp") returned -1 [0098.944] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIcon.jpg") returned="MeetingIcon.jpg" [0098.944] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\", lpString2="MeetingIconMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIconMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIconMask.bmp" [0098.944] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIconMask.bmp", pszSpec="*.zip") returned 0 [0098.944] lstrlenA (lpString="*.zip") returned 5 [0098.944] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIconMask.bmp", pszSpec="*.rar") returned 0 [0098.944] lstrlenA (lpString="*.rar") returned 5 [0098.944] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIconMask.bmp", pszSpec="*.7z") returned 0 [0098.944] lstrlenA (lpString="*.7z") returned 4 [0098.944] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIconMask.bmp", pszSpec="*.tar") returned 0 [0098.944] lstrlenA (lpString="*.tar") returned 5 [0098.944] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIconMask.bmp", pszSpec="*.gzip") returned 0 [0098.944] lstrlenA (lpString="*.gzip") returned 6 [0098.944] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIconMask.bmp", pszSpec="*.jpg") returned 0 [0098.944] lstrlenA (lpString="*.jpg") returned 5 [0098.944] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIconMask.bmp", pszSpec="*.jpeg") returned 0 [0098.944] lstrlenA (lpString="*.jpeg") returned 6 [0098.944] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIconMask.bmp", pszSpec="*.psd") returned 0 [0098.944] lstrlenA (lpString="*.psd") returned 5 [0098.944] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIconMask.bmp", pszSpec="*.cdr") returned 0 [0098.944] lstrlenA (lpString="*.cdr") returned 5 [0098.944] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIconMask.bmp", pszSpec="*.dwg") returned 0 [0098.944] lstrlenA (lpString="*.dwg") returned 5 [0098.944] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIconMask.bmp", pszSpec="*.max") returned 0 [0098.944] lstrlenA (lpString="*.max") returned 5 [0098.944] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIconMask.bmp", pszSpec="*.bmp") returned 1 [0098.944] lstrlenA (lpString="*.bmp") returned 5 [0098.944] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIconMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIconMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIconMask.bmp" [0098.944] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIconMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIconMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIconMask.bmp" [0098.944] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIconMask.bmp", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIconMask.bmp.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIconMask.bmp." [0098.944] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIconMask.bmp.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIconMask.bmp. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIconMask.bmp. " [0098.944] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIconMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\meetingiconmask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0098.945] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x6b8 [0098.945] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xb486c900, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x582d2010, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xb486c900, dwHighDateTime=0x1c747ea)) returned 1 [0098.945] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0098.945] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x65e, lpOverlapped=0x0) returned 1 [0098.985] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIconMask.bmp") returned="MeetingIconMask.bmp" [0098.985] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0098.985] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x65e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x65e, lpOverlapped=0x0) returned 1 [0098.985] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0098.985] CloseHandle (hObject=0x98) returned 1 [0098.985] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIconMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\meetingiconmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIconMask.bmp. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\meetingiconmask.bmp. ")) returned 1 [0098.986] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0098.986] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0098.986] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="ProjectStatusIcons.jpg") returned -1 [0098.986] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ProjectStatusIcons.jpg") returned -1 [0098.986] lstrcmpiA (lpString1="", lpString2="ProjectStatusIcons.jpg") returned -1 [0098.986] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIconMask.bmp") returned="MeetingIconMask.bmp" [0098.986] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\", lpString2="ProjectStatusIcons.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIcons.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIcons.jpg" [0098.986] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIcons.jpg", pszSpec="*.zip") returned 0 [0098.986] lstrlenA (lpString="*.zip") returned 5 [0098.986] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIcons.jpg", pszSpec="*.rar") returned 0 [0098.986] lstrlenA (lpString="*.rar") returned 5 [0098.986] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIcons.jpg", pszSpec="*.7z") returned 0 [0098.986] lstrlenA (lpString="*.7z") returned 4 [0098.986] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIcons.jpg", pszSpec="*.tar") returned 0 [0098.986] lstrlenA (lpString="*.tar") returned 5 [0098.986] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIcons.jpg", pszSpec="*.gzip") returned 0 [0098.986] lstrlenA (lpString="*.gzip") returned 6 [0098.986] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIcons.jpg", pszSpec="*.jpg") returned 1 [0098.986] lstrlenA (lpString="*.jpg") returned 5 [0098.986] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIcons.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIcons.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIcons.jpg" [0098.986] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIcons.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIcons.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIcons.jpg" [0098.987] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIcons.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIcons.jpg.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIcons.jpg." [0098.987] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIcons.jpg.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIcons.jpg. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIcons.jpg. " [0098.987] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIcons.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projectstatusicons.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0098.988] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x19e9 [0098.988] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xb486c900, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x6d084c30, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xb486c900, dwHighDateTime=0x1c747ea)) returned 1 [0098.988] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0098.988] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x198f, lpOverlapped=0x0) returned 1 [0099.025] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIcons.jpg") returned="ProjectStatusIcons.jpg" [0099.025] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0099.025] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x198f, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x198f, lpOverlapped=0x0) returned 1 [0099.025] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0099.025] CloseHandle (hObject=0x98) returned 1 [0099.025] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIcons.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projectstatusicons.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIcons.jpg. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projectstatusicons.jpg. ")) returned 1 [0099.027] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0099.027] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0099.027] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="ProjectStatusIconsMask.bmp") returned -1 [0099.027] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ProjectStatusIconsMask.bmp") returned -1 [0099.027] lstrcmpiA (lpString1="", lpString2="ProjectStatusIconsMask.bmp") returned -1 [0099.027] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIcons.jpg") returned="ProjectStatusIcons.jpg" [0099.027] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\", lpString2="ProjectStatusIconsMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIconsMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIconsMask.bmp" [0099.027] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIconsMask.bmp", pszSpec="*.zip") returned 0 [0099.027] lstrlenA (lpString="*.zip") returned 5 [0099.027] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIconsMask.bmp", pszSpec="*.rar") returned 0 [0099.027] lstrlenA (lpString="*.rar") returned 5 [0099.028] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIconsMask.bmp", pszSpec="*.7z") returned 0 [0099.028] lstrlenA (lpString="*.7z") returned 4 [0099.028] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIconsMask.bmp", pszSpec="*.tar") returned 0 [0099.028] lstrlenA (lpString="*.tar") returned 5 [0099.028] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIconsMask.bmp", pszSpec="*.gzip") returned 0 [0099.028] lstrlenA (lpString="*.gzip") returned 6 [0099.028] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIconsMask.bmp", pszSpec="*.jpg") returned 0 [0099.028] lstrlenA (lpString="*.jpg") returned 5 [0099.028] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIconsMask.bmp", pszSpec="*.jpeg") returned 0 [0099.028] lstrlenA (lpString="*.jpeg") returned 6 [0099.028] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIconsMask.bmp", pszSpec="*.psd") returned 0 [0099.028] lstrlenA (lpString="*.psd") returned 5 [0099.028] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIconsMask.bmp", pszSpec="*.cdr") returned 0 [0099.028] lstrlenA (lpString="*.cdr") returned 5 [0099.028] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIconsMask.bmp", pszSpec="*.dwg") returned 0 [0099.028] lstrlenA (lpString="*.dwg") returned 5 [0099.028] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIconsMask.bmp", pszSpec="*.max") returned 0 [0099.028] lstrlenA (lpString="*.max") returned 5 [0099.028] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIconsMask.bmp", pszSpec="*.bmp") returned 1 [0099.028] lstrlenA (lpString="*.bmp") returned 5 [0099.028] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIconsMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIconsMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIconsMask.bmp" [0099.028] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIconsMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIconsMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIconsMask.bmp" [0099.028] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIconsMask.bmp", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIconsMask.bmp.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIconsMask.bmp." [0099.028] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIconsMask.bmp.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIconsMask.bmp. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIconsMask.bmp. " [0099.028] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIconsMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projectstatusiconsmask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0099.029] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xa10 [0099.029] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xb486c900, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5a71ef90, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xb486c900, dwHighDateTime=0x1c747ea)) returned 1 [0099.029] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0099.029] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x9b6, lpOverlapped=0x0) returned 1 [0099.107] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIconsMask.bmp") returned="ProjectStatusIconsMask.bmp" [0099.107] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0099.107] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x9b6, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x9b6, lpOverlapped=0x0) returned 1 [0099.107] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0099.107] CloseHandle (hObject=0x98) returned 1 [0099.107] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIconsMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projectstatusiconsmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIconsMask.bmp. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projectstatusiconsmask.bmp. ")) returned 1 [0099.108] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0099.108] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0099.108] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="ProjectTaskIcon.jpg") returned -1 [0099.108] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ProjectTaskIcon.jpg") returned -1 [0099.109] lstrcmpiA (lpString1="", lpString2="ProjectTaskIcon.jpg") returned -1 [0099.109] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIconsMask.bmp") returned="ProjectStatusIconsMask.bmp" [0099.109] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\", lpString2="ProjectTaskIcon.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIcon.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIcon.jpg" [0099.109] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIcon.jpg", pszSpec="*.zip") returned 0 [0099.109] lstrlenA (lpString="*.zip") returned 5 [0099.109] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIcon.jpg", pszSpec="*.rar") returned 0 [0099.109] lstrlenA (lpString="*.rar") returned 5 [0099.109] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIcon.jpg", pszSpec="*.7z") returned 0 [0099.109] lstrlenA (lpString="*.7z") returned 4 [0099.109] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIcon.jpg", pszSpec="*.tar") returned 0 [0099.109] lstrlenA (lpString="*.tar") returned 5 [0099.109] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIcon.jpg", pszSpec="*.gzip") returned 0 [0099.109] lstrlenA (lpString="*.gzip") returned 6 [0099.109] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIcon.jpg", pszSpec="*.jpg") returned 1 [0099.109] lstrlenA (lpString="*.jpg") returned 5 [0099.109] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIcon.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIcon.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIcon.jpg" [0099.109] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIcon.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIcon.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIcon.jpg" [0099.109] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIcon.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIcon.jpg.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIcon.jpg." [0099.109] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIcon.jpg.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIcon.jpg. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIcon.jpg. " [0099.109] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIcon.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttaskicon.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0099.110] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x200e [0099.110] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xb486c900, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x6d084c30, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xb486c900, dwHighDateTime=0x1c747ea)) returned 1 [0099.110] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0099.110] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x1fb4, lpOverlapped=0x0) returned 1 [0099.149] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIcon.jpg") returned="ProjectTaskIcon.jpg" [0099.150] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0099.150] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x1fb4, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x1fb4, lpOverlapped=0x0) returned 1 [0099.150] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0099.150] CloseHandle (hObject=0x98) returned 1 [0099.150] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIcon.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttaskicon.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIcon.jpg. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttaskicon.jpg. ")) returned 1 [0099.151] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0099.151] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0099.151] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="ProjectTaskIconMask.bmp") returned -1 [0099.151] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ProjectTaskIconMask.bmp") returned -1 [0099.151] lstrcmpiA (lpString1="", lpString2="ProjectTaskIconMask.bmp") returned -1 [0099.151] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIcon.jpg") returned="ProjectTaskIcon.jpg" [0099.151] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\", lpString2="ProjectTaskIconMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIconMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIconMask.bmp" [0099.151] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIconMask.bmp", pszSpec="*.zip") returned 0 [0099.151] lstrlenA (lpString="*.zip") returned 5 [0099.151] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIconMask.bmp", pszSpec="*.rar") returned 0 [0099.151] lstrlenA (lpString="*.rar") returned 5 [0099.151] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIconMask.bmp", pszSpec="*.7z") returned 0 [0099.151] lstrlenA (lpString="*.7z") returned 4 [0099.151] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIconMask.bmp", pszSpec="*.tar") returned 0 [0099.151] lstrlenA (lpString="*.tar") returned 5 [0099.151] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIconMask.bmp", pszSpec="*.gzip") returned 0 [0099.151] lstrlenA (lpString="*.gzip") returned 6 [0099.151] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIconMask.bmp", pszSpec="*.jpg") returned 0 [0099.151] lstrlenA (lpString="*.jpg") returned 5 [0099.151] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIconMask.bmp", pszSpec="*.jpeg") returned 0 [0099.151] lstrlenA (lpString="*.jpeg") returned 6 [0099.151] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIconMask.bmp", pszSpec="*.psd") returned 0 [0099.151] lstrlenA (lpString="*.psd") returned 5 [0099.151] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIconMask.bmp", pszSpec="*.cdr") returned 0 [0099.151] lstrlenA (lpString="*.cdr") returned 5 [0099.151] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIconMask.bmp", pszSpec="*.dwg") returned 0 [0099.152] lstrlenA (lpString="*.dwg") returned 5 [0099.152] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIconMask.bmp", pszSpec="*.max") returned 0 [0099.152] lstrlenA (lpString="*.max") returned 5 [0099.152] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIconMask.bmp", pszSpec="*.bmp") returned 1 [0099.152] lstrlenA (lpString="*.bmp") returned 5 [0099.152] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIconMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIconMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIconMask.bmp" [0099.152] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIconMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIconMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIconMask.bmp" [0099.152] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIconMask.bmp", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIconMask.bmp.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIconMask.bmp." [0099.152] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIconMask.bmp.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIconMask.bmp. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIconMask.bmp. " [0099.152] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIconMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttaskiconmask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0099.153] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x79c [0099.153] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xb486c900, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5a71ef90, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xb486c900, dwHighDateTime=0x1c747ea)) returned 1 [0099.153] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0099.153] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x742, lpOverlapped=0x0) returned 1 [0099.223] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIconMask.bmp") returned="ProjectTaskIconMask.bmp" [0099.223] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0099.223] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x742, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x742, lpOverlapped=0x0) returned 1 [0099.223] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0099.223] CloseHandle (hObject=0x98) returned 1 [0099.223] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIconMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttaskiconmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIconMask.bmp. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttaskiconmask.bmp. ")) returned 1 [0099.224] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0099.224] lstrcmpA (lpString1=".", lpString2="ProjectTool") returned -1 [0099.224] lstrcmpA (lpString1="..", lpString2="ProjectTool") returned -1 [0099.224] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIconMask.bmp") returned="ProjectTaskIconMask.bmp" [0099.224] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\", lpString2="ProjectTool" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool" [0099.224] lstrlenA (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool") returned 102 [0099.224] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\*.*", lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 0x5be1a0 [0099.225] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0099.225] FindNextFileA (in: hFindFile=0x5be1a0, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0099.225] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0099.225] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0099.225] FindNextFileA (in: hFindFile=0x5be1a0, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0099.225] lstrcmpA (lpString1=".", lpString2="Project Report Type") returned -1 [0099.225] lstrcmpA (lpString1="..", lpString2="Project Report Type") returned -1 [0099.225] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\*.*") returned="*.*" [0099.225] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\", lpString2="Project Report Type" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type" [0099.225] lstrlenA (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type") returned 122 [0099.225] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\*.*", lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 0x5be1e0 [0099.225] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0099.225] FindNextFileA (in: hFindFile=0x5be1e0, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 1 [0099.225] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0099.225] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0099.226] FindNextFileA (in: hFindFile=0x5be1e0, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 1 [0099.226] lstrcmpA (lpString1=".", lpString2="Basic") returned -1 [0099.226] lstrcmpA (lpString1="..", lpString2="Basic") returned -1 [0099.226] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\*.*") returned="*.*" [0099.226] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\", lpString2="Basic" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic" [0099.226] lstrlenA (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic") returned 128 [0099.226] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\*.*", lpFindFileData=0xaea68 | out: lpFindFileData=0xaea68) returned 0x5be220 [0099.256] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0099.256] FindNextFileA (in: hFindFile=0x5be220, lpFindFileData=0xaea68 | out: lpFindFileData=0xaea68) returned 1 [0099.256] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0099.256] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0099.256] FindNextFileA (in: hFindFile=0x5be220, lpFindFileData=0xaea68 | out: lpFindFileData=0xaea68) returned 1 [0099.256] PeekMessageA (in: lpMsg=0xaea44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaea44) returned 0 [0099.256] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="DEFAULT.XSL") returned 1 [0099.256] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DEFAULT.XSL") returned 1 [0099.256] lstrcmpiA (lpString1="", lpString2="DEFAULT.XSL") returned -1 [0099.256] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\*.*") returned="*.*" [0099.256] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\", lpString2="DEFAULT.XSL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL" [0099.256] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", pszSpec="*.zip") returned 0 [0099.256] lstrlenA (lpString="*.zip") returned 5 [0099.256] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", pszSpec="*.rar") returned 0 [0099.256] lstrlenA (lpString="*.rar") returned 5 [0099.256] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", pszSpec="*.7z") returned 0 [0099.256] lstrlenA (lpString="*.7z") returned 4 [0099.256] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", pszSpec="*.tar") returned 0 [0099.256] lstrlenA (lpString="*.tar") returned 5 [0099.256] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", pszSpec="*.gzip") returned 0 [0099.256] lstrlenA (lpString="*.gzip") returned 6 [0099.256] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", pszSpec="*.jpg") returned 0 [0099.256] lstrlenA (lpString="*.jpg") returned 5 [0099.256] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", pszSpec="*.jpeg") returned 0 [0099.256] lstrlenA (lpString="*.jpeg") returned 6 [0099.256] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", pszSpec="*.psd") returned 0 [0099.256] lstrlenA (lpString="*.psd") returned 5 [0099.257] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", pszSpec="*.cdr") returned 0 [0099.257] lstrlenA (lpString="*.cdr") returned 5 [0099.257] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", pszSpec="*.dwg") returned 0 [0099.257] lstrlenA (lpString="*.dwg") returned 5 [0099.257] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", pszSpec="*.max") returned 0 [0099.257] lstrlenA (lpString="*.max") returned 5 [0099.257] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", pszSpec="*.bmp") returned 0 [0099.257] lstrlenA (lpString="*.bmp") returned 5 [0099.257] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", pszSpec="*.gif") returned 0 [0099.257] lstrlenA (lpString="*.gif") returned 5 [0099.257] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", pszSpec="*.png") returned 0 [0099.257] lstrlenA (lpString="*.png") returned 5 [0099.257] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", pszSpec="*.doc") returned 0 [0099.257] lstrlenA (lpString="*.doc") returned 5 [0099.257] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", pszSpec="*.docx") returned 0 [0099.257] lstrlenA (lpString="*.docx") returned 6 [0099.257] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", pszSpec="*.xls") returned 0 [0099.257] lstrlenA (lpString="*.xls") returned 5 [0099.257] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", pszSpec="*.xlsx") returned 0 [0099.257] lstrlenA (lpString="*.xlsx") returned 6 [0099.257] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", pszSpec="*.ppt") returned 0 [0099.257] lstrlenA (lpString="*.ppt") returned 5 [0099.257] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", pszSpec="*.pptx") returned 0 [0099.257] lstrlenA (lpString="*.pptx") returned 6 [0099.257] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", pszSpec="*.txt") returned 0 [0099.257] lstrlenA (lpString="*.txt") returned 5 [0099.257] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", pszSpec="*.pdf") returned 0 [0099.257] lstrlenA (lpString="*.pdf") returned 5 [0099.257] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", pszSpec="*.djvu") returned 0 [0099.257] lstrlenA (lpString="*.djvu") returned 6 [0099.257] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", pszSpec="*.htm") returned 0 [0099.257] lstrlenA (lpString="*.htm") returned 5 [0099.257] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", pszSpec="*.html") returned 0 [0099.257] lstrlenA (lpString="*.html") returned 6 [0099.257] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", pszSpec="*.mdb") returned 0 [0099.257] lstrlenA (lpString="*.mdb") returned 5 [0099.257] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", pszSpec="*.cer") returned 0 [0099.257] lstrlenA (lpString="*.cer") returned 5 [0099.257] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", pszSpec="*.p12") returned 0 [0099.258] lstrlenA (lpString="*.p12") returned 5 [0099.258] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", pszSpec="*.pfx") returned 0 [0099.258] lstrlenA (lpString="*.pfx") returned 5 [0099.258] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", pszSpec="*.kwm") returned 0 [0099.258] lstrlenA (lpString="*.kwm") returned 5 [0099.258] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", pszSpec="*.pwm") returned 0 [0099.258] lstrlenA (lpString="*.pwm") returned 5 [0099.258] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", pszSpec="*.1cd") returned 0 [0099.258] lstrlenA (lpString="*.1cd") returned 5 [0099.258] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", pszSpec="*.md") returned 0 [0099.258] lstrlenA (lpString="*.md") returned 4 [0099.258] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", pszSpec="*.mdf") returned 0 [0099.258] lstrlenA (lpString="*.mdf") returned 5 [0099.258] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", pszSpec="*.dbf") returned 0 [0099.258] lstrlenA (lpString="*.dbf") returned 5 [0099.258] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", pszSpec="*.odt") returned 0 [0099.258] lstrlenA (lpString="*.odt") returned 5 [0099.258] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", pszSpec="*.vob") returned 0 [0099.258] lstrlenA (lpString="*.vob") returned 5 [0099.258] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", pszSpec="*.ifo") returned 0 [0099.258] lstrlenA (lpString="*.ifo") returned 5 [0099.258] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", pszSpec="*.lnk") returned 0 [0099.258] lstrlenA (lpString="*.lnk") returned 5 [0099.258] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", pszSpec="*.torrent") returned 0 [0099.258] lstrlenA (lpString="*.torrent") returned 9 [0099.258] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", pszSpec="*.mov") returned 0 [0099.258] lstrlenA (lpString="*.mov") returned 5 [0099.258] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", pszSpec="*.m2v") returned 0 [0099.258] lstrlenA (lpString="*.m2v") returned 5 [0099.258] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", pszSpec="*.3gp") returned 0 [0099.258] lstrlenA (lpString="*.3gp") returned 5 [0099.258] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", pszSpec="*.mpeg") returned 0 [0099.258] lstrlenA (lpString="*.mpeg") returned 6 [0099.258] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", pszSpec="*.mpg") returned 0 [0099.258] lstrlenA (lpString="*.mpg") returned 5 [0099.258] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", pszSpec="*.flv") returned 0 [0099.258] lstrlenA (lpString="*.flv") returned 5 [0099.258] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", pszSpec="*.avi") returned 0 [0099.258] lstrlenA (lpString="*.avi") returned 5 [0099.258] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", pszSpec="*.mp4") returned 0 [0099.258] lstrlenA (lpString="*.mp4") returned 5 [0099.258] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", pszSpec="*.wmv") returned 0 [0099.258] lstrlenA (lpString="*.wmv") returned 5 [0099.258] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", pszSpec="*.divx") returned 0 [0099.258] lstrlenA (lpString="*.divx") returned 6 [0099.258] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", pszSpec="*.mkv") returned 0 [0099.258] lstrlenA (lpString="*.mkv") returned 5 [0099.258] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", pszSpec="*.mp3") returned 0 [0099.259] lstrlenA (lpString="*.mp3") returned 5 [0099.259] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", pszSpec="*.wav") returned 0 [0099.259] lstrlenA (lpString="*.wav") returned 5 [0099.259] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", pszSpec="*.flac") returned 0 [0099.259] lstrlenA (lpString="*.flac") returned 6 [0099.259] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", pszSpec="*.ape") returned 0 [0099.259] lstrlenA (lpString="*.ape") returned 5 [0099.259] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", pszSpec="*.wma") returned 0 [0099.259] lstrlenA (lpString="*.wma") returned 5 [0099.259] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", pszSpec="*.ac3") returned 0 [0099.259] lstrlenA (lpString="*.ac3") returned 5 [0099.259] FindNextFileA (in: hFindFile=0x5be220, lpFindFileData=0xaea68 | out: lpFindFileData=0xaea68) returned 0 [0099.259] FindClose (in: hFindFile=0x5be220 | out: hFindFile=0x5be220) returned 1 [0099.259] FindNextFileA (in: hFindFile=0x5be1e0, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 1 [0099.259] lstrcmpA (lpString1=".", lpString2="Fancy") returned -1 [0099.259] lstrcmpA (lpString1="..", lpString2="Fancy") returned -1 [0099.259] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\*.*") returned="*.*" [0099.259] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\", lpString2="Fancy" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy" [0099.259] lstrlenA (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy") returned 128 [0099.259] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\*.*", lpFindFileData=0xaea68 | out: lpFindFileData=0xaea68) returned 0x5be220 [0099.316] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0099.316] FindNextFileA (in: hFindFile=0x5be220, lpFindFileData=0xaea68 | out: lpFindFileData=0xaea68) returned 1 [0099.316] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0099.316] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0099.316] FindNextFileA (in: hFindFile=0x5be220, lpFindFileData=0xaea68 | out: lpFindFileData=0xaea68) returned 1 [0099.316] PeekMessageA (in: lpMsg=0xaea44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaea44) returned 0 [0099.316] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Hierarchy.js") returned -1 [0099.316] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Hierarchy.js") returned 1 [0099.316] lstrcmpiA (lpString1="", lpString2="Hierarchy.js") returned -1 [0099.316] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\*.*") returned="*.*" [0099.316] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\", lpString2="Hierarchy.js" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.js") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.js" [0099.316] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.js", pszSpec="*.zip") returned 0 [0099.316] lstrlenA (lpString="*.zip") returned 5 [0099.316] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.js", pszSpec="*.rar") returned 0 [0099.316] lstrlenA (lpString="*.rar") returned 5 [0099.316] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.js", pszSpec="*.7z") returned 0 [0099.316] lstrlenA (lpString="*.7z") returned 4 [0099.316] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.js", pszSpec="*.tar") returned 0 [0099.317] lstrlenA (lpString="*.tar") returned 5 [0099.317] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.js", pszSpec="*.gzip") returned 0 [0099.317] lstrlenA (lpString="*.gzip") returned 6 [0099.317] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.js", pszSpec="*.jpg") returned 0 [0099.317] lstrlenA (lpString="*.jpg") returned 5 [0099.317] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.js", pszSpec="*.jpeg") returned 0 [0099.317] lstrlenA (lpString="*.jpeg") returned 6 [0099.317] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.js", pszSpec="*.psd") returned 0 [0099.317] lstrlenA (lpString="*.psd") returned 5 [0099.317] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.js", pszSpec="*.cdr") returned 0 [0099.317] lstrlenA (lpString="*.cdr") returned 5 [0099.317] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.js", pszSpec="*.dwg") returned 0 [0099.317] lstrlenA (lpString="*.dwg") returned 5 [0099.317] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.js", pszSpec="*.max") returned 0 [0099.317] lstrlenA (lpString="*.max") returned 5 [0099.317] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.js", pszSpec="*.bmp") returned 0 [0099.317] lstrlenA (lpString="*.bmp") returned 5 [0099.317] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.js", pszSpec="*.gif") returned 0 [0099.317] lstrlenA (lpString="*.gif") returned 5 [0099.317] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.js", pszSpec="*.png") returned 0 [0099.317] lstrlenA (lpString="*.png") returned 5 [0099.317] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.js", pszSpec="*.doc") returned 0 [0099.317] lstrlenA (lpString="*.doc") returned 5 [0099.317] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.js", pszSpec="*.docx") returned 0 [0099.317] lstrlenA (lpString="*.docx") returned 6 [0099.317] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.js", pszSpec="*.xls") returned 0 [0099.317] lstrlenA (lpString="*.xls") returned 5 [0099.317] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.js", pszSpec="*.xlsx") returned 0 [0099.317] lstrlenA (lpString="*.xlsx") returned 6 [0099.317] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.js", pszSpec="*.ppt") returned 0 [0099.317] lstrlenA (lpString="*.ppt") returned 5 [0099.317] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.js", pszSpec="*.pptx") returned 0 [0099.317] lstrlenA (lpString="*.pptx") returned 6 [0099.317] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.js", pszSpec="*.txt") returned 0 [0099.317] lstrlenA (lpString="*.txt") returned 5 [0099.317] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.js", pszSpec="*.pdf") returned 0 [0099.317] lstrlenA (lpString="*.pdf") returned 5 [0099.318] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.js", pszSpec="*.djvu") returned 0 [0099.318] lstrlenA (lpString="*.djvu") returned 6 [0099.318] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.js", pszSpec="*.htm") returned 0 [0099.318] lstrlenA (lpString="*.htm") returned 5 [0099.318] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.js", pszSpec="*.html") returned 0 [0099.318] lstrlenA (lpString="*.html") returned 6 [0099.318] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.js", pszSpec="*.mdb") returned 0 [0099.318] lstrlenA (lpString="*.mdb") returned 5 [0099.318] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.js", pszSpec="*.cer") returned 0 [0099.318] lstrlenA (lpString="*.cer") returned 5 [0099.318] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.js", pszSpec="*.p12") returned 0 [0099.318] lstrlenA (lpString="*.p12") returned 5 [0099.318] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.js", pszSpec="*.pfx") returned 0 [0099.318] lstrlenA (lpString="*.pfx") returned 5 [0099.318] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.js", pszSpec="*.kwm") returned 0 [0099.318] lstrlenA (lpString="*.kwm") returned 5 [0099.318] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.js", pszSpec="*.pwm") returned 0 [0099.318] lstrlenA (lpString="*.pwm") returned 5 [0099.318] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.js", pszSpec="*.1cd") returned 0 [0099.318] lstrlenA (lpString="*.1cd") returned 5 [0099.318] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.js", pszSpec="*.md") returned 0 [0099.318] lstrlenA (lpString="*.md") returned 4 [0099.318] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.js", pszSpec="*.mdf") returned 0 [0099.318] lstrlenA (lpString="*.mdf") returned 5 [0099.318] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.js", pszSpec="*.dbf") returned 0 [0099.318] lstrlenA (lpString="*.dbf") returned 5 [0099.318] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.js", pszSpec="*.odt") returned 0 [0099.318] lstrlenA (lpString="*.odt") returned 5 [0099.318] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.js", pszSpec="*.vob") returned 0 [0099.318] lstrlenA (lpString="*.vob") returned 5 [0099.318] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.js", pszSpec="*.ifo") returned 0 [0099.318] lstrlenA (lpString="*.ifo") returned 5 [0099.318] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.js", pszSpec="*.lnk") returned 0 [0099.318] lstrlenA (lpString="*.lnk") returned 5 [0099.318] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.js", pszSpec="*.torrent") returned 0 [0099.318] lstrlenA (lpString="*.torrent") returned 9 [0099.318] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.js", pszSpec="*.mov") returned 0 [0099.319] lstrlenA (lpString="*.mov") returned 5 [0099.319] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.js", pszSpec="*.m2v") returned 0 [0099.319] lstrlenA (lpString="*.m2v") returned 5 [0099.319] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.js", pszSpec="*.3gp") returned 0 [0099.319] lstrlenA (lpString="*.3gp") returned 5 [0099.319] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.js", pszSpec="*.mpeg") returned 0 [0099.319] lstrlenA (lpString="*.mpeg") returned 6 [0099.319] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.js", pszSpec="*.mpg") returned 0 [0099.319] lstrlenA (lpString="*.mpg") returned 5 [0099.319] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.js", pszSpec="*.flv") returned 0 [0099.319] lstrlenA (lpString="*.flv") returned 5 [0099.319] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.js", pszSpec="*.avi") returned 0 [0099.319] lstrlenA (lpString="*.avi") returned 5 [0099.319] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.js", pszSpec="*.mp4") returned 0 [0099.319] lstrlenA (lpString="*.mp4") returned 5 [0099.319] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.js", pszSpec="*.wmv") returned 0 [0099.319] lstrlenA (lpString="*.wmv") returned 5 [0099.319] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.js", pszSpec="*.divx") returned 0 [0099.319] lstrlenA (lpString="*.divx") returned 6 [0099.319] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.js", pszSpec="*.mkv") returned 0 [0099.319] lstrlenA (lpString="*.mkv") returned 5 [0099.319] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.js", pszSpec="*.mp3") returned 0 [0099.319] lstrlenA (lpString="*.mp3") returned 5 [0099.319] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.js", pszSpec="*.wav") returned 0 [0099.319] lstrlenA (lpString="*.wav") returned 5 [0099.319] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.js", pszSpec="*.flac") returned 0 [0099.319] lstrlenA (lpString="*.flac") returned 6 [0099.319] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.js", pszSpec="*.ape") returned 0 [0099.319] lstrlenA (lpString="*.ape") returned 5 [0099.319] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.js", pszSpec="*.wma") returned 0 [0099.319] lstrlenA (lpString="*.wma") returned 5 [0099.319] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.js", pszSpec="*.ac3") returned 0 [0099.319] lstrlenA (lpString="*.ac3") returned 5 [0099.319] FindNextFileA (in: hFindFile=0x5be220, lpFindFileData=0xaea68 | out: lpFindFileData=0xaea68) returned 1 [0099.319] PeekMessageA (in: lpMsg=0xaea44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaea44) returned 0 [0099.319] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Hierarchy.xsl") returned -1 [0099.319] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Hierarchy.xsl") returned 1 [0099.320] lstrcmpiA (lpString1="", lpString2="Hierarchy.xsl") returned -1 [0099.320] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.js") returned="Hierarchy.js" [0099.320] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\", lpString2="Hierarchy.xsl" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.xsl") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.xsl" [0099.320] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.xsl", pszSpec="*.zip") returned 0 [0099.320] lstrlenA (lpString="*.zip") returned 5 [0099.320] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.xsl", pszSpec="*.rar") returned 0 [0099.320] lstrlenA (lpString="*.rar") returned 5 [0099.320] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.xsl", pszSpec="*.7z") returned 0 [0099.320] lstrlenA (lpString="*.7z") returned 4 [0099.320] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.xsl", pszSpec="*.tar") returned 0 [0099.320] lstrlenA (lpString="*.tar") returned 5 [0099.320] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.xsl", pszSpec="*.gzip") returned 0 [0099.320] lstrlenA (lpString="*.gzip") returned 6 [0099.320] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.xsl", pszSpec="*.jpg") returned 0 [0099.320] lstrlenA (lpString="*.jpg") returned 5 [0099.320] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.xsl", pszSpec="*.jpeg") returned 0 [0099.320] lstrlenA (lpString="*.jpeg") returned 6 [0099.320] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.xsl", pszSpec="*.psd") returned 0 [0099.320] lstrlenA (lpString="*.psd") returned 5 [0099.320] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.xsl", pszSpec="*.cdr") returned 0 [0099.320] lstrlenA (lpString="*.cdr") returned 5 [0099.320] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.xsl", pszSpec="*.dwg") returned 0 [0099.320] lstrlenA (lpString="*.dwg") returned 5 [0099.320] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.xsl", pszSpec="*.max") returned 0 [0099.320] lstrlenA (lpString="*.max") returned 5 [0099.320] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.xsl", pszSpec="*.bmp") returned 0 [0099.320] lstrlenA (lpString="*.bmp") returned 5 [0099.320] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.xsl", pszSpec="*.gif") returned 0 [0099.320] lstrlenA (lpString="*.gif") returned 5 [0099.320] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.xsl", pszSpec="*.png") returned 0 [0099.320] lstrlenA (lpString="*.png") returned 5 [0099.320] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.xsl", pszSpec="*.doc") returned 0 [0099.320] lstrlenA (lpString="*.doc") returned 5 [0099.320] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.xsl", pszSpec="*.docx") returned 0 [0099.320] lstrlenA (lpString="*.docx") returned 6 [0099.320] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.xsl", pszSpec="*.xls") returned 0 [0099.321] lstrlenA (lpString="*.xls") returned 5 [0099.321] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.xsl", pszSpec="*.xlsx") returned 0 [0099.321] lstrlenA (lpString="*.xlsx") returned 6 [0099.321] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.xsl", pszSpec="*.ppt") returned 0 [0099.321] lstrlenA (lpString="*.ppt") returned 5 [0099.321] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.xsl", pszSpec="*.pptx") returned 0 [0099.321] lstrlenA (lpString="*.pptx") returned 6 [0099.321] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.xsl", pszSpec="*.txt") returned 0 [0099.321] lstrlenA (lpString="*.txt") returned 5 [0099.321] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.xsl", pszSpec="*.pdf") returned 0 [0099.321] lstrlenA (lpString="*.pdf") returned 5 [0099.321] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.xsl", pszSpec="*.djvu") returned 0 [0099.321] lstrlenA (lpString="*.djvu") returned 6 [0099.321] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.xsl", pszSpec="*.htm") returned 0 [0099.321] lstrlenA (lpString="*.htm") returned 5 [0099.321] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.xsl", pszSpec="*.html") returned 0 [0099.321] lstrlenA (lpString="*.html") returned 6 [0099.321] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.xsl", pszSpec="*.mdb") returned 0 [0099.321] lstrlenA (lpString="*.mdb") returned 5 [0099.321] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.xsl", pszSpec="*.cer") returned 0 [0099.321] lstrlenA (lpString="*.cer") returned 5 [0099.321] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.xsl", pszSpec="*.p12") returned 0 [0099.321] lstrlenA (lpString="*.p12") returned 5 [0099.321] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.xsl", pszSpec="*.pfx") returned 0 [0099.321] lstrlenA (lpString="*.pfx") returned 5 [0099.321] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.xsl", pszSpec="*.kwm") returned 0 [0099.321] lstrlenA (lpString="*.kwm") returned 5 [0099.321] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.xsl", pszSpec="*.pwm") returned 0 [0099.321] lstrlenA (lpString="*.pwm") returned 5 [0099.321] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.xsl", pszSpec="*.1cd") returned 0 [0099.321] lstrlenA (lpString="*.1cd") returned 5 [0099.321] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.xsl", pszSpec="*.md") returned 0 [0099.321] lstrlenA (lpString="*.md") returned 4 [0099.321] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.xsl", pszSpec="*.mdf") returned 0 [0099.321] lstrlenA (lpString="*.mdf") returned 5 [0099.322] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.xsl", pszSpec="*.dbf") returned 0 [0099.322] lstrlenA (lpString="*.dbf") returned 5 [0099.322] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.xsl", pszSpec="*.odt") returned 0 [0099.322] lstrlenA (lpString="*.odt") returned 5 [0099.322] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.xsl", pszSpec="*.vob") returned 0 [0099.322] lstrlenA (lpString="*.vob") returned 5 [0099.322] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.xsl", pszSpec="*.ifo") returned 0 [0099.322] lstrlenA (lpString="*.ifo") returned 5 [0099.322] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.xsl", pszSpec="*.lnk") returned 0 [0099.322] lstrlenA (lpString="*.lnk") returned 5 [0099.322] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.xsl", pszSpec="*.torrent") returned 0 [0099.322] lstrlenA (lpString="*.torrent") returned 9 [0099.322] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.xsl", pszSpec="*.mov") returned 0 [0099.322] lstrlenA (lpString="*.mov") returned 5 [0099.322] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.xsl", pszSpec="*.m2v") returned 0 [0099.322] lstrlenA (lpString="*.m2v") returned 5 [0099.322] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.xsl", pszSpec="*.3gp") returned 0 [0099.322] lstrlenA (lpString="*.3gp") returned 5 [0099.322] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.xsl", pszSpec="*.mpeg") returned 0 [0099.322] lstrlenA (lpString="*.mpeg") returned 6 [0099.322] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.xsl", pszSpec="*.mpg") returned 0 [0099.322] lstrlenA (lpString="*.mpg") returned 5 [0099.322] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.xsl", pszSpec="*.flv") returned 0 [0099.322] lstrlenA (lpString="*.flv") returned 5 [0099.322] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.xsl", pszSpec="*.avi") returned 0 [0099.322] lstrlenA (lpString="*.avi") returned 5 [0099.322] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.xsl", pszSpec="*.mp4") returned 0 [0099.322] lstrlenA (lpString="*.mp4") returned 5 [0099.322] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.xsl", pszSpec="*.wmv") returned 0 [0099.322] lstrlenA (lpString="*.wmv") returned 5 [0099.322] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.xsl", pszSpec="*.divx") returned 0 [0099.322] lstrlenA (lpString="*.divx") returned 6 [0099.322] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.xsl", pszSpec="*.mkv") returned 0 [0099.322] lstrlenA (lpString="*.mkv") returned 5 [0099.322] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.xsl", pszSpec="*.mp3") returned 0 [0099.322] lstrlenA (lpString="*.mp3") returned 5 [0099.322] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.xsl", pszSpec="*.wav") returned 0 [0099.322] lstrlenA (lpString="*.wav") returned 5 [0099.323] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.xsl", pszSpec="*.flac") returned 0 [0099.323] lstrlenA (lpString="*.flac") returned 6 [0099.323] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.xsl", pszSpec="*.ape") returned 0 [0099.323] lstrlenA (lpString="*.ape") returned 5 [0099.323] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.xsl", pszSpec="*.wma") returned 0 [0099.323] lstrlenA (lpString="*.wma") returned 5 [0099.323] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.xsl", pszSpec="*.ac3") returned 0 [0099.323] lstrlenA (lpString="*.ac3") returned 5 [0099.323] FindNextFileA (in: hFindFile=0x5be220, lpFindFileData=0xaea68 | out: lpFindFileData=0xaea68) returned 1 [0099.323] PeekMessageA (in: lpMsg=0xaea44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaea44) returned 0 [0099.323] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="MINUS.GIF") returned -1 [0099.323] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MINUS.GIF") returned -1 [0099.323] lstrcmpiA (lpString1="", lpString2="MINUS.GIF") returned -1 [0099.323] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.xsl") returned="Hierarchy.xsl" [0099.323] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\", lpString2="MINUS.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\MINUS.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\MINUS.GIF" [0099.323] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\MINUS.GIF", pszSpec="*.zip") returned 0 [0099.323] lstrlenA (lpString="*.zip") returned 5 [0099.323] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\MINUS.GIF", pszSpec="*.rar") returned 0 [0099.323] lstrlenA (lpString="*.rar") returned 5 [0099.323] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\MINUS.GIF", pszSpec="*.7z") returned 0 [0099.323] lstrlenA (lpString="*.7z") returned 4 [0099.323] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\MINUS.GIF", pszSpec="*.tar") returned 0 [0099.323] lstrlenA (lpString="*.tar") returned 5 [0099.323] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\MINUS.GIF", pszSpec="*.gzip") returned 0 [0099.323] lstrlenA (lpString="*.gzip") returned 6 [0099.323] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\MINUS.GIF", pszSpec="*.jpg") returned 0 [0099.323] lstrlenA (lpString="*.jpg") returned 5 [0099.323] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\MINUS.GIF", pszSpec="*.jpeg") returned 0 [0099.323] lstrlenA (lpString="*.jpeg") returned 6 [0099.323] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\MINUS.GIF", pszSpec="*.psd") returned 0 [0099.323] lstrlenA (lpString="*.psd") returned 5 [0099.323] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\MINUS.GIF", pszSpec="*.cdr") returned 0 [0099.323] lstrlenA (lpString="*.cdr") returned 5 [0099.323] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\MINUS.GIF", pszSpec="*.dwg") returned 0 [0099.323] lstrlenA (lpString="*.dwg") returned 5 [0099.324] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\MINUS.GIF", pszSpec="*.max") returned 0 [0099.324] lstrlenA (lpString="*.max") returned 5 [0099.324] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\MINUS.GIF", pszSpec="*.bmp") returned 0 [0099.324] lstrlenA (lpString="*.bmp") returned 5 [0099.324] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\MINUS.GIF", pszSpec="*.gif") returned 1 [0099.324] lstrlenA (lpString="*.gif") returned 5 [0099.324] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\MINUS.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\MINUS.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\MINUS.GIF" [0099.324] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\MINUS.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\MINUS.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\MINUS.GIF" [0099.324] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\MINUS.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\MINUS.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\MINUS.GIF." [0099.324] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\MINUS.GIF.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\MINUS.GIF. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\MINUS.GIF. " [0099.324] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\MINUS.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttool\\project report type\\fancy\\minus.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa4 [0099.325] GetFileSize (in: hFile=0xa4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x345 [0099.325] GetFileTime (in: hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xb5b7f600, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x69c4c990, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xb5b7f600, dwHighDateTime=0x1c747ea)) returned 1 [0099.325] SetFilePointer (in: hFile=0xa4, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0099.325] ReadFile (in: hFile=0xa4, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x2eb, lpOverlapped=0x0) returned 1 [0099.453] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\MINUS.GIF") returned="MINUS.GIF" [0099.453] SetFilePointer (in: hFile=0xa4, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0099.453] WriteFile (in: hFile=0xa4, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x2eb, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x2eb, lpOverlapped=0x0) returned 1 [0099.454] SetFileTime (hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0099.454] CloseHandle (hObject=0xa4) returned 1 [0099.454] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\MINUS.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttool\\project report type\\fancy\\minus.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\MINUS.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttool\\project report type\\fancy\\minus.gif. ")) returned 1 [0099.455] FindNextFileA (in: hFindFile=0x5be220, lpFindFileData=0xaea68 | out: lpFindFileData=0xaea68) returned 1 [0099.455] PeekMessageA (in: lpMsg=0xaea44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaea44) returned 0 [0099.455] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="PLUS.GIF") returned -1 [0099.455] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PLUS.GIF") returned -1 [0099.455] lstrcmpiA (lpString1="", lpString2="PLUS.GIF") returned -1 [0099.455] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\MINUS.GIF") returned="MINUS.GIF" [0099.455] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\", lpString2="PLUS.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\PLUS.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\PLUS.GIF" [0099.455] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\PLUS.GIF", pszSpec="*.zip") returned 0 [0099.455] lstrlenA (lpString="*.zip") returned 5 [0099.455] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\PLUS.GIF", pszSpec="*.rar") returned 0 [0099.455] lstrlenA (lpString="*.rar") returned 5 [0099.455] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\PLUS.GIF", pszSpec="*.7z") returned 0 [0099.455] lstrlenA (lpString="*.7z") returned 4 [0099.455] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\PLUS.GIF", pszSpec="*.tar") returned 0 [0099.455] lstrlenA (lpString="*.tar") returned 5 [0099.455] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\PLUS.GIF", pszSpec="*.gzip") returned 0 [0099.455] lstrlenA (lpString="*.gzip") returned 6 [0099.455] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\PLUS.GIF", pszSpec="*.jpg") returned 0 [0099.455] lstrlenA (lpString="*.jpg") returned 5 [0099.455] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\PLUS.GIF", pszSpec="*.jpeg") returned 0 [0099.455] lstrlenA (lpString="*.jpeg") returned 6 [0099.455] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\PLUS.GIF", pszSpec="*.psd") returned 0 [0099.455] lstrlenA (lpString="*.psd") returned 5 [0099.455] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\PLUS.GIF", pszSpec="*.cdr") returned 0 [0099.455] lstrlenA (lpString="*.cdr") returned 5 [0099.455] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\PLUS.GIF", pszSpec="*.dwg") returned 0 [0099.455] lstrlenA (lpString="*.dwg") returned 5 [0099.455] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\PLUS.GIF", pszSpec="*.max") returned 0 [0099.455] lstrlenA (lpString="*.max") returned 5 [0099.455] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\PLUS.GIF", pszSpec="*.bmp") returned 0 [0099.455] lstrlenA (lpString="*.bmp") returned 5 [0099.455] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\PLUS.GIF", pszSpec="*.gif") returned 1 [0099.455] lstrlenA (lpString="*.gif") returned 5 [0099.455] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\PLUS.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\PLUS.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\PLUS.GIF" [0099.455] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\PLUS.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\PLUS.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\PLUS.GIF" [0099.455] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\PLUS.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\PLUS.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\PLUS.GIF." [0099.455] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\PLUS.GIF.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\PLUS.GIF. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\PLUS.GIF. " [0099.455] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\PLUS.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttool\\project report type\\fancy\\plus.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa4 [0099.457] GetFileSize (in: hFile=0xa4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x349 [0099.457] GetFileTime (in: hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xb5b7f600, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5a497830, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xb5b7f600, dwHighDateTime=0x1c747ea)) returned 1 [0099.457] SetFilePointer (in: hFile=0xa4, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0099.457] ReadFile (in: hFile=0xa4, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x2ef, lpOverlapped=0x0) returned 1 [0099.493] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\PLUS.GIF") returned="PLUS.GIF" [0099.493] SetFilePointer (in: hFile=0xa4, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0099.494] WriteFile (in: hFile=0xa4, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x2ef, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x2ef, lpOverlapped=0x0) returned 1 [0099.494] SetFileTime (hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0099.494] CloseHandle (hObject=0xa4) returned 1 [0099.494] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\PLUS.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttool\\project report type\\fancy\\plus.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\PLUS.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttool\\project report type\\fancy\\plus.gif. ")) returned 1 [0099.495] FindNextFileA (in: hFindFile=0x5be220, lpFindFileData=0xaea68 | out: lpFindFileData=0xaea68) returned 1 [0099.495] PeekMessageA (in: lpMsg=0xaea44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaea44) returned 0 [0099.495] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="SPACER.GIF") returned -1 [0099.495] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SPACER.GIF") returned -1 [0099.495] lstrcmpiA (lpString1="", lpString2="SPACER.GIF") returned -1 [0099.495] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\PLUS.GIF") returned="PLUS.GIF" [0099.495] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\", lpString2="SPACER.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\SPACER.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\SPACER.GIF" [0099.495] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\SPACER.GIF", pszSpec="*.zip") returned 0 [0099.495] lstrlenA (lpString="*.zip") returned 5 [0099.495] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\SPACER.GIF", pszSpec="*.rar") returned 0 [0099.495] lstrlenA (lpString="*.rar") returned 5 [0099.495] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\SPACER.GIF", pszSpec="*.7z") returned 0 [0099.495] lstrlenA (lpString="*.7z") returned 4 [0099.495] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\SPACER.GIF", pszSpec="*.tar") returned 0 [0099.495] lstrlenA (lpString="*.tar") returned 5 [0099.495] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\SPACER.GIF", pszSpec="*.gzip") returned 0 [0099.495] lstrlenA (lpString="*.gzip") returned 6 [0099.495] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\SPACER.GIF", pszSpec="*.jpg") returned 0 [0099.495] lstrlenA (lpString="*.jpg") returned 5 [0099.495] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\SPACER.GIF", pszSpec="*.jpeg") returned 0 [0099.495] lstrlenA (lpString="*.jpeg") returned 6 [0099.495] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\SPACER.GIF", pszSpec="*.psd") returned 0 [0099.495] lstrlenA (lpString="*.psd") returned 5 [0099.495] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\SPACER.GIF", pszSpec="*.cdr") returned 0 [0099.495] lstrlenA (lpString="*.cdr") returned 5 [0099.495] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\SPACER.GIF", pszSpec="*.dwg") returned 0 [0099.495] lstrlenA (lpString="*.dwg") returned 5 [0099.495] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\SPACER.GIF", pszSpec="*.max") returned 0 [0099.495] lstrlenA (lpString="*.max") returned 5 [0099.495] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\SPACER.GIF", pszSpec="*.bmp") returned 0 [0099.495] lstrlenA (lpString="*.bmp") returned 5 [0099.495] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\SPACER.GIF", pszSpec="*.gif") returned 1 [0099.495] lstrlenA (lpString="*.gif") returned 5 [0099.495] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\SPACER.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\SPACER.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\SPACER.GIF" [0099.495] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\SPACER.GIF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\SPACER.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\SPACER.GIF" [0099.495] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\SPACER.GIF", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\SPACER.GIF.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\SPACER.GIF." [0099.495] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\SPACER.GIF.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\SPACER.GIF. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\SPACER.GIF. " [0099.495] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\SPACER.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttool\\project report type\\fancy\\spacer.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa4 [0099.496] GetFileSize (in: hFile=0xa4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x327 [0099.496] GetFileTime (in: hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xb5b7f600, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5aad71f0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xb5b7f600, dwHighDateTime=0x1c747ea)) returned 1 [0099.496] SetFilePointer (in: hFile=0xa4, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0099.496] ReadFile (in: hFile=0xa4, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x2cd, lpOverlapped=0x0) returned 1 [0099.507] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\SPACER.GIF") returned="SPACER.GIF" [0099.507] SetFilePointer (in: hFile=0xa4, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0099.508] WriteFile (in: hFile=0xa4, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x2cd, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x2cd, lpOverlapped=0x0) returned 1 [0099.508] SetFileTime (hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0099.508] CloseHandle (hObject=0xa4) returned 1 [0099.508] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\SPACER.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttool\\project report type\\fancy\\spacer.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\SPACER.GIF. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttool\\project report type\\fancy\\spacer.gif. ")) returned 1 [0099.509] FindNextFileA (in: hFindFile=0x5be220, lpFindFileData=0xaea68 | out: lpFindFileData=0xaea68) returned 0 [0099.509] FindClose (in: hFindFile=0x5be220 | out: hFindFile=0x5be220) returned 1 [0099.509] FindNextFileA (in: hFindFile=0x5be1e0, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 0 [0099.509] FindClose (in: hFindFile=0x5be1e0 | out: hFindFile=0x5be1e0) returned 1 [0099.509] FindNextFileA (in: hFindFile=0x5be1a0, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 0 [0099.509] FindClose (in: hFindFile=0x5be1a0 | out: hFindFile=0x5be1a0) returned 1 [0099.509] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0099.509] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0099.509] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="ProjectToolsetIconImages.jpg") returned -1 [0099.509] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ProjectToolsetIconImages.jpg") returned -1 [0099.509] lstrcmpiA (lpString1="", lpString2="ProjectToolsetIconImages.jpg") returned -1 [0099.509] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\*.*") returned="*.*" [0099.509] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\", lpString2="ProjectToolsetIconImages.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImages.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImages.jpg" [0099.509] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImages.jpg", pszSpec="*.zip") returned 0 [0099.509] lstrlenA (lpString="*.zip") returned 5 [0099.509] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImages.jpg", pszSpec="*.rar") returned 0 [0099.509] lstrlenA (lpString="*.rar") returned 5 [0099.509] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImages.jpg", pszSpec="*.7z") returned 0 [0099.509] lstrlenA (lpString="*.7z") returned 4 [0099.509] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImages.jpg", pszSpec="*.tar") returned 0 [0099.509] lstrlenA (lpString="*.tar") returned 5 [0099.509] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImages.jpg", pszSpec="*.gzip") returned 0 [0099.509] lstrlenA (lpString="*.gzip") returned 6 [0099.509] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImages.jpg", pszSpec="*.jpg") returned 1 [0099.509] lstrlenA (lpString="*.jpg") returned 5 [0099.509] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImages.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImages.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImages.jpg" [0099.509] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImages.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImages.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImages.jpg" [0099.509] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImages.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImages.jpg.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImages.jpg." [0099.509] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImages.jpg.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImages.jpg. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImages.jpg. " [0099.509] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttoolseticonimages.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0099.510] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4f0a [0099.510] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xb5b7f600, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x6d084c30, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xb5b7f600, dwHighDateTime=0x1c747ea)) returned 1 [0099.510] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0099.510] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x4eb0, lpOverlapped=0x0) returned 1 [0099.524] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImages.jpg") returned="ProjectToolsetIconImages.jpg" [0099.524] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0099.525] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x4eb0, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x4eb0, lpOverlapped=0x0) returned 1 [0099.525] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0099.525] CloseHandle (hObject=0x98) returned 1 [0099.525] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttoolseticonimages.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImages.jpg. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttoolseticonimages.jpg. ")) returned 1 [0099.526] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0099.526] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0099.526] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="ProjectToolsetIconImagesMask.bmp") returned -1 [0099.526] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ProjectToolsetIconImagesMask.bmp") returned -1 [0099.526] lstrcmpiA (lpString1="", lpString2="ProjectToolsetIconImagesMask.bmp") returned -1 [0099.526] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImages.jpg") returned="ProjectToolsetIconImages.jpg" [0099.526] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\", lpString2="ProjectToolsetIconImagesMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImagesMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImagesMask.bmp" [0099.526] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImagesMask.bmp", pszSpec="*.zip") returned 0 [0099.526] lstrlenA (lpString="*.zip") returned 5 [0099.526] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImagesMask.bmp", pszSpec="*.rar") returned 0 [0099.526] lstrlenA (lpString="*.rar") returned 5 [0099.526] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImagesMask.bmp", pszSpec="*.7z") returned 0 [0099.526] lstrlenA (lpString="*.7z") returned 4 [0099.526] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImagesMask.bmp", pszSpec="*.tar") returned 0 [0099.526] lstrlenA (lpString="*.tar") returned 5 [0099.526] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImagesMask.bmp", pszSpec="*.gzip") returned 0 [0099.526] lstrlenA (lpString="*.gzip") returned 6 [0099.526] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImagesMask.bmp", pszSpec="*.jpg") returned 0 [0099.526] lstrlenA (lpString="*.jpg") returned 5 [0099.526] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImagesMask.bmp", pszSpec="*.jpeg") returned 0 [0099.526] lstrlenA (lpString="*.jpeg") returned 6 [0099.526] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImagesMask.bmp", pszSpec="*.psd") returned 0 [0099.526] lstrlenA (lpString="*.psd") returned 5 [0099.526] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImagesMask.bmp", pszSpec="*.cdr") returned 0 [0099.526] lstrlenA (lpString="*.cdr") returned 5 [0099.526] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImagesMask.bmp", pszSpec="*.dwg") returned 0 [0099.526] lstrlenA (lpString="*.dwg") returned 5 [0099.526] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImagesMask.bmp", pszSpec="*.max") returned 0 [0099.526] lstrlenA (lpString="*.max") returned 5 [0099.526] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImagesMask.bmp", pszSpec="*.bmp") returned 1 [0099.526] lstrlenA (lpString="*.bmp") returned 5 [0099.526] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImagesMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImagesMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImagesMask.bmp" [0099.526] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImagesMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImagesMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImagesMask.bmp" [0099.527] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImagesMask.bmp", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImagesMask.bmp.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImagesMask.bmp." [0099.527] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImagesMask.bmp.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImagesMask.bmp. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImagesMask.bmp. " [0099.527] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttoolseticonimagesmask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0099.528] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2338 [0099.528] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xb5b7f600, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x6d084c30, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xb5b7f600, dwHighDateTime=0x1c747ea)) returned 1 [0099.528] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0099.528] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x22de, lpOverlapped=0x0) returned 1 [0099.529] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImagesMask.bmp") returned="ProjectToolsetIconImagesMask.bmp" [0099.529] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0099.529] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x22de, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x22de, lpOverlapped=0x0) returned 1 [0099.529] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0099.529] CloseHandle (hObject=0x98) returned 1 [0099.529] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttoolseticonimagesmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImagesMask.bmp. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttoolseticonimagesmask.bmp. ")) returned 1 [0099.530] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0099.530] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0099.530] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="SplashImage.jpg") returned -1 [0099.530] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SplashImage.jpg") returned -1 [0099.530] lstrcmpiA (lpString1="", lpString2="SplashImage.jpg") returned -1 [0099.530] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImagesMask.bmp") returned="ProjectToolsetIconImagesMask.bmp" [0099.530] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\", lpString2="SplashImage.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImage.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImage.jpg" [0099.530] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImage.jpg", pszSpec="*.zip") returned 0 [0099.530] lstrlenA (lpString="*.zip") returned 5 [0099.530] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImage.jpg", pszSpec="*.rar") returned 0 [0099.530] lstrlenA (lpString="*.rar") returned 5 [0099.530] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImage.jpg", pszSpec="*.7z") returned 0 [0099.530] lstrlenA (lpString="*.7z") returned 4 [0099.530] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImage.jpg", pszSpec="*.tar") returned 0 [0099.531] lstrlenA (lpString="*.tar") returned 5 [0099.531] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImage.jpg", pszSpec="*.gzip") returned 0 [0099.531] lstrlenA (lpString="*.gzip") returned 6 [0099.531] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImage.jpg", pszSpec="*.jpg") returned 1 [0099.531] lstrlenA (lpString="*.jpg") returned 5 [0099.531] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImage.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImage.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImage.jpg" [0099.531] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImage.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImage.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImage.jpg" [0099.531] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImage.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImage.jpg.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImage.jpg." [0099.531] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImage.jpg.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImage.jpg. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImage.jpg. " [0099.531] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImage.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\splashimage.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0099.531] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x5f00 [0099.531] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xb5b7f600, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x6d3a4910, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xb5b7f600, dwHighDateTime=0x1c747ea)) returned 1 [0099.531] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0099.531] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x5ea6, lpOverlapped=0x0) returned 1 [0099.532] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImage.jpg") returned="SplashImage.jpg" [0099.532] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0099.532] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x5ea6, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x5ea6, lpOverlapped=0x0) returned 1 [0099.533] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0099.533] CloseHandle (hObject=0x98) returned 1 [0099.533] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImage.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\splashimage.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImage.jpg. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\splashimage.jpg. ")) returned 1 [0099.533] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0099.533] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0099.533] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="SplashImageMask.bmp") returned -1 [0099.534] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SplashImageMask.bmp") returned -1 [0099.534] lstrcmpiA (lpString1="", lpString2="SplashImageMask.bmp") returned -1 [0099.534] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImage.jpg") returned="SplashImage.jpg" [0099.534] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\", lpString2="SplashImageMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImageMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImageMask.bmp" [0099.534] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImageMask.bmp", pszSpec="*.zip") returned 0 [0099.534] lstrlenA (lpString="*.zip") returned 5 [0099.534] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImageMask.bmp", pszSpec="*.rar") returned 0 [0099.534] lstrlenA (lpString="*.rar") returned 5 [0099.534] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImageMask.bmp", pszSpec="*.7z") returned 0 [0099.534] lstrlenA (lpString="*.7z") returned 4 [0099.534] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImageMask.bmp", pszSpec="*.tar") returned 0 [0099.534] lstrlenA (lpString="*.tar") returned 5 [0099.534] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImageMask.bmp", pszSpec="*.gzip") returned 0 [0099.534] lstrlenA (lpString="*.gzip") returned 6 [0099.534] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImageMask.bmp", pszSpec="*.jpg") returned 0 [0099.534] lstrlenA (lpString="*.jpg") returned 5 [0099.534] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImageMask.bmp", pszSpec="*.jpeg") returned 0 [0099.534] lstrlenA (lpString="*.jpeg") returned 6 [0099.534] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImageMask.bmp", pszSpec="*.psd") returned 0 [0099.534] lstrlenA (lpString="*.psd") returned 5 [0099.534] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImageMask.bmp", pszSpec="*.cdr") returned 0 [0099.534] lstrlenA (lpString="*.cdr") returned 5 [0099.534] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImageMask.bmp", pszSpec="*.dwg") returned 0 [0099.534] lstrlenA (lpString="*.dwg") returned 5 [0099.534] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImageMask.bmp", pszSpec="*.max") returned 0 [0099.534] lstrlenA (lpString="*.max") returned 5 [0099.534] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImageMask.bmp", pszSpec="*.bmp") returned 1 [0099.534] lstrlenA (lpString="*.bmp") returned 5 [0099.534] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImageMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImageMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImageMask.bmp" [0099.534] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImageMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImageMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImageMask.bmp" [0099.534] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImageMask.bmp", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImageMask.bmp.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImageMask.bmp." [0099.534] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImageMask.bmp.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImageMask.bmp. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImageMask.bmp. " [0099.534] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImageMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\splashimagemask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0099.535] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x14078 [0099.535] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xb5b7f600, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x6d3a4910, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xb5b7f600, dwHighDateTime=0x1c747ea)) returned 1 [0099.536] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0099.536] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x1401e, lpOverlapped=0x0) returned 1 [0099.553] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImageMask.bmp") returned="SplashImageMask.bmp" [0099.553] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0099.553] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x1401e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x1401e, lpOverlapped=0x0) returned 1 [0099.553] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0099.553] CloseHandle (hObject=0x98) returned 1 [0099.553] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImageMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\splashimagemask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImageMask.bmp. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\splashimagemask.bmp. ")) returned 1 [0099.554] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0099.554] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0099.554] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="TABMASK.BMP") returned -1 [0099.554] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TABMASK.BMP") returned -1 [0099.554] lstrcmpiA (lpString1="", lpString2="TABMASK.BMP") returned -1 [0099.554] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImageMask.bmp") returned="SplashImageMask.bmp" [0099.554] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\", lpString2="TABMASK.BMP" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABMASK.BMP") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABMASK.BMP" [0099.554] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABMASK.BMP", pszSpec="*.zip") returned 0 [0099.555] lstrlenA (lpString="*.zip") returned 5 [0099.555] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABMASK.BMP", pszSpec="*.rar") returned 0 [0099.555] lstrlenA (lpString="*.rar") returned 5 [0099.555] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABMASK.BMP", pszSpec="*.7z") returned 0 [0099.555] lstrlenA (lpString="*.7z") returned 4 [0099.555] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABMASK.BMP", pszSpec="*.tar") returned 0 [0099.555] lstrlenA (lpString="*.tar") returned 5 [0099.555] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABMASK.BMP", pszSpec="*.gzip") returned 0 [0099.555] lstrlenA (lpString="*.gzip") returned 6 [0099.555] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABMASK.BMP", pszSpec="*.jpg") returned 0 [0099.555] lstrlenA (lpString="*.jpg") returned 5 [0099.555] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABMASK.BMP", pszSpec="*.jpeg") returned 0 [0099.555] lstrlenA (lpString="*.jpeg") returned 6 [0099.555] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABMASK.BMP", pszSpec="*.psd") returned 0 [0099.555] lstrlenA (lpString="*.psd") returned 5 [0099.555] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABMASK.BMP", pszSpec="*.cdr") returned 0 [0099.555] lstrlenA (lpString="*.cdr") returned 5 [0099.555] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABMASK.BMP", pszSpec="*.dwg") returned 0 [0099.555] lstrlenA (lpString="*.dwg") returned 5 [0099.555] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABMASK.BMP", pszSpec="*.max") returned 0 [0099.555] lstrlenA (lpString="*.max") returned 5 [0099.555] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABMASK.BMP", pszSpec="*.bmp") returned 1 [0099.555] lstrlenA (lpString="*.bmp") returned 5 [0099.555] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABMASK.BMP" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABMASK.BMP") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABMASK.BMP" [0099.555] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABMASK.BMP" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABMASK.BMP") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABMASK.BMP" [0099.555] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABMASK.BMP", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABMASK.BMP.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABMASK.BMP." [0099.555] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABMASK.BMP.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABMASK.BMP. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABMASK.BMP. " [0099.555] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABMASK.BMP" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\tabmask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0099.556] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x122 [0099.556] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xb5b7f600, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5aca0270, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xb5b7f600, dwHighDateTime=0x1c747ea)) returned 1 [0099.556] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0099.556] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0xc8, lpOverlapped=0x0) returned 1 [0099.557] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABMASK.BMP") returned="TABMASK.BMP" [0099.557] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0099.557] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0xc8, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0xc8, lpOverlapped=0x0) returned 1 [0099.557] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0099.557] CloseHandle (hObject=0x98) returned 1 [0099.557] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABMASK.BMP" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\tabmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABMASK.BMP. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\tabmask.bmp. ")) returned 1 [0099.558] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0099.558] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0099.558] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="TABOFF.JPG") returned -1 [0099.558] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TABOFF.JPG") returned -1 [0099.558] lstrcmpiA (lpString1="", lpString2="TABOFF.JPG") returned -1 [0099.558] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABMASK.BMP") returned="TABMASK.BMP" [0099.558] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\", lpString2="TABOFF.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABOFF.JPG") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABOFF.JPG" [0099.558] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABOFF.JPG", pszSpec="*.zip") returned 0 [0099.558] lstrlenA (lpString="*.zip") returned 5 [0099.558] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABOFF.JPG", pszSpec="*.rar") returned 0 [0099.558] lstrlenA (lpString="*.rar") returned 5 [0099.558] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABOFF.JPG", pszSpec="*.7z") returned 0 [0099.558] lstrlenA (lpString="*.7z") returned 4 [0099.558] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABOFF.JPG", pszSpec="*.tar") returned 0 [0099.558] lstrlenA (lpString="*.tar") returned 5 [0099.558] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABOFF.JPG", pszSpec="*.gzip") returned 0 [0099.558] lstrlenA (lpString="*.gzip") returned 6 [0099.558] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABOFF.JPG", pszSpec="*.jpg") returned 1 [0099.558] lstrlenA (lpString="*.jpg") returned 5 [0099.558] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABOFF.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABOFF.JPG") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABOFF.JPG" [0099.558] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABOFF.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABOFF.JPG") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABOFF.JPG" [0099.558] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABOFF.JPG", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABOFF.JPG.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABOFF.JPG." [0099.558] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABOFF.JPG.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABOFF.JPG. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABOFF.JPG. " [0099.558] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABOFF.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\taboff.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0099.562] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x9b6 [0099.562] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xb5b7f600, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5aca0270, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xb5b7f600, dwHighDateTime=0x1c747ea)) returned 1 [0099.562] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0099.562] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x95c, lpOverlapped=0x0) returned 1 [0099.575] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABOFF.JPG") returned="TABOFF.JPG" [0099.575] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0099.575] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x95c, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x95c, lpOverlapped=0x0) returned 1 [0099.575] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0099.575] CloseHandle (hObject=0x98) returned 1 [0099.576] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABOFF.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\taboff.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABOFF.JPG. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\taboff.jpg. ")) returned 1 [0099.576] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0099.576] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0099.576] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="TABON.JPG") returned -1 [0099.576] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TABON.JPG") returned -1 [0099.576] lstrcmpiA (lpString1="", lpString2="TABON.JPG") returned -1 [0099.576] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABOFF.JPG") returned="TABOFF.JPG" [0099.576] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\", lpString2="TABON.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABON.JPG") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABON.JPG" [0099.576] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABON.JPG", pszSpec="*.zip") returned 0 [0099.576] lstrlenA (lpString="*.zip") returned 5 [0099.577] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABON.JPG", pszSpec="*.rar") returned 0 [0099.577] lstrlenA (lpString="*.rar") returned 5 [0099.577] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABON.JPG", pszSpec="*.7z") returned 0 [0099.577] lstrlenA (lpString="*.7z") returned 4 [0099.577] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABON.JPG", pszSpec="*.tar") returned 0 [0099.577] lstrlenA (lpString="*.tar") returned 5 [0099.577] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABON.JPG", pszSpec="*.gzip") returned 0 [0099.577] lstrlenA (lpString="*.gzip") returned 6 [0099.577] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABON.JPG", pszSpec="*.jpg") returned 1 [0099.577] lstrlenA (lpString="*.jpg") returned 5 [0099.577] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABON.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABON.JPG") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABON.JPG" [0099.577] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABON.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABON.JPG") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABON.JPG" [0099.577] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABON.JPG", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABON.JPG.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABON.JPG." [0099.577] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABON.JPG.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABON.JPG. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABON.JPG. " [0099.577] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABON.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\tabon.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0099.578] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x9ef [0099.578] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xb5b7f600, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x6d43ce90, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xb5b7f600, dwHighDateTime=0x1c747ea)) returned 1 [0099.578] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0099.578] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x995, lpOverlapped=0x0) returned 1 [0099.648] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABON.JPG") returned="TABON.JPG" [0099.648] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0099.648] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x995, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x995, lpOverlapped=0x0) returned 1 [0099.648] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0099.648] CloseHandle (hObject=0x98) returned 1 [0099.649] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABON.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\tabon.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABON.JPG. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\tabon.jpg. ")) returned 1 [0099.650] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0099.650] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0099.650] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="WHITEBOX.JPG") returned -1 [0099.650] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WHITEBOX.JPG") returned -1 [0099.650] lstrcmpiA (lpString1="", lpString2="WHITEBOX.JPG") returned -1 [0099.650] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABON.JPG") returned="TABON.JPG" [0099.650] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\", lpString2="WHITEBOX.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WHITEBOX.JPG") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WHITEBOX.JPG" [0099.650] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WHITEBOX.JPG", pszSpec="*.zip") returned 0 [0099.650] lstrlenA (lpString="*.zip") returned 5 [0099.650] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WHITEBOX.JPG", pszSpec="*.rar") returned 0 [0099.650] lstrlenA (lpString="*.rar") returned 5 [0099.650] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WHITEBOX.JPG", pszSpec="*.7z") returned 0 [0099.650] lstrlenA (lpString="*.7z") returned 4 [0099.650] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WHITEBOX.JPG", pszSpec="*.tar") returned 0 [0099.650] lstrlenA (lpString="*.tar") returned 5 [0099.650] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WHITEBOX.JPG", pszSpec="*.gzip") returned 0 [0099.650] lstrlenA (lpString="*.gzip") returned 6 [0099.650] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WHITEBOX.JPG", pszSpec="*.jpg") returned 1 [0099.650] lstrlenA (lpString="*.jpg") returned 5 [0099.650] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WHITEBOX.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WHITEBOX.JPG") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WHITEBOX.JPG" [0099.650] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WHITEBOX.JPG" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WHITEBOX.JPG") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WHITEBOX.JPG" [0099.650] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WHITEBOX.JPG", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WHITEBOX.JPG.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WHITEBOX.JPG." [0099.650] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WHITEBOX.JPG.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WHITEBOX.JPG. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WHITEBOX.JPG. " [0099.650] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WHITEBOX.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\whitebox.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0099.651] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xdff [0099.651] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xb5b7f600, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5e5c1270, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xb5b7f600, dwHighDateTime=0x1c747ea)) returned 1 [0099.651] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0099.651] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0xda5, lpOverlapped=0x0) returned 1 [0099.822] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WHITEBOX.JPG") returned="WHITEBOX.JPG" [0099.822] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0099.822] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0xda5, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0xda5, lpOverlapped=0x0) returned 1 [0099.822] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0099.822] CloseHandle (hObject=0x98) returned 1 [0099.822] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WHITEBOX.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\whitebox.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WHITEBOX.JPG. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\whitebox.jpg. ")) returned 1 [0099.823] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0099.823] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0099.823] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="WhiteboxMask.bmp") returned -1 [0099.823] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WhiteboxMask.bmp") returned -1 [0099.823] lstrcmpiA (lpString1="", lpString2="WhiteboxMask.bmp") returned -1 [0099.823] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WHITEBOX.JPG") returned="WHITEBOX.JPG" [0099.823] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\", lpString2="WhiteboxMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WhiteboxMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WhiteboxMask.bmp" [0099.823] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WhiteboxMask.bmp", pszSpec="*.zip") returned 0 [0099.823] lstrlenA (lpString="*.zip") returned 5 [0099.823] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WhiteboxMask.bmp", pszSpec="*.rar") returned 0 [0099.823] lstrlenA (lpString="*.rar") returned 5 [0099.823] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WhiteboxMask.bmp", pszSpec="*.7z") returned 0 [0099.823] lstrlenA (lpString="*.7z") returned 4 [0099.823] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WhiteboxMask.bmp", pszSpec="*.tar") returned 0 [0099.823] lstrlenA (lpString="*.tar") returned 5 [0099.823] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WhiteboxMask.bmp", pszSpec="*.gzip") returned 0 [0099.823] lstrlenA (lpString="*.gzip") returned 6 [0099.823] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WhiteboxMask.bmp", pszSpec="*.jpg") returned 0 [0099.823] lstrlenA (lpString="*.jpg") returned 5 [0099.823] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WhiteboxMask.bmp", pszSpec="*.jpeg") returned 0 [0099.824] lstrlenA (lpString="*.jpeg") returned 6 [0099.824] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WhiteboxMask.bmp", pszSpec="*.psd") returned 0 [0099.824] lstrlenA (lpString="*.psd") returned 5 [0099.824] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WhiteboxMask.bmp", pszSpec="*.cdr") returned 0 [0099.824] lstrlenA (lpString="*.cdr") returned 5 [0099.824] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WhiteboxMask.bmp", pszSpec="*.dwg") returned 0 [0099.824] lstrlenA (lpString="*.dwg") returned 5 [0099.824] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WhiteboxMask.bmp", pszSpec="*.max") returned 0 [0099.824] lstrlenA (lpString="*.max") returned 5 [0099.824] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WhiteboxMask.bmp", pszSpec="*.bmp") returned 1 [0099.824] lstrlenA (lpString="*.bmp") returned 5 [0099.824] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WhiteboxMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WhiteboxMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WhiteboxMask.bmp" [0099.824] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WhiteboxMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WhiteboxMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WhiteboxMask.bmp" [0099.824] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WhiteboxMask.bmp", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WhiteboxMask.bmp.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WhiteboxMask.bmp." [0099.824] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WhiteboxMask.bmp.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WhiteboxMask.bmp. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WhiteboxMask.bmp. " [0099.824] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WhiteboxMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\whiteboxmask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0099.825] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4d72 [0099.825] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xb5b7f600, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5e5c1270, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xb5b7f600, dwHighDateTime=0x1c747ea)) returned 1 [0099.825] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0099.825] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x4d18, lpOverlapped=0x0) returned 1 [0099.831] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WhiteboxMask.bmp") returned="WhiteboxMask.bmp" [0099.831] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0099.831] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x4d18, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x4d18, lpOverlapped=0x0) returned 1 [0099.831] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0099.831] CloseHandle (hObject=0x98) returned 1 [0099.832] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WhiteboxMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\whiteboxmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WhiteboxMask.bmp. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\whiteboxmask.bmp. ")) returned 1 [0099.832] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0099.832] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0099.832] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="ZoomIcons.jpg") returned -1 [0099.832] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ZoomIcons.jpg") returned -1 [0099.832] lstrcmpiA (lpString1="", lpString2="ZoomIcons.jpg") returned -1 [0099.833] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WhiteboxMask.bmp") returned="WhiteboxMask.bmp" [0099.833] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\", lpString2="ZoomIcons.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIcons.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIcons.jpg" [0099.833] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIcons.jpg", pszSpec="*.zip") returned 0 [0099.833] lstrlenA (lpString="*.zip") returned 5 [0099.833] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIcons.jpg", pszSpec="*.rar") returned 0 [0099.833] lstrlenA (lpString="*.rar") returned 5 [0099.833] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIcons.jpg", pszSpec="*.7z") returned 0 [0099.833] lstrlenA (lpString="*.7z") returned 4 [0099.833] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIcons.jpg", pszSpec="*.tar") returned 0 [0099.833] lstrlenA (lpString="*.tar") returned 5 [0099.833] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIcons.jpg", pszSpec="*.gzip") returned 0 [0099.833] lstrlenA (lpString="*.gzip") returned 6 [0099.833] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIcons.jpg", pszSpec="*.jpg") returned 1 [0099.833] lstrlenA (lpString="*.jpg") returned 5 [0099.833] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIcons.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIcons.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIcons.jpg" [0099.833] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIcons.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIcons.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIcons.jpg" [0099.833] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIcons.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIcons.jpg.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIcons.jpg." [0099.833] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIcons.jpg.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIcons.jpg. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIcons.jpg. " [0099.833] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIcons.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\zoomicons.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0099.834] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xc59 [0099.834] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xb6e92300, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x70c9f7b0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xb6e92300, dwHighDateTime=0x1c747ea)) returned 1 [0099.834] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0099.834] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0xbff, lpOverlapped=0x0) returned 1 [0099.836] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIcons.jpg") returned="ZoomIcons.jpg" [0099.836] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0099.836] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0xbff, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0xbff, lpOverlapped=0x0) returned 1 [0099.836] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0099.836] CloseHandle (hObject=0x98) returned 1 [0099.836] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIcons.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\zoomicons.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIcons.jpg. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\zoomicons.jpg. ")) returned 1 [0099.837] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0099.837] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0099.837] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="ZoomIconsMask.bmp") returned -1 [0099.837] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ZoomIconsMask.bmp") returned -1 [0099.837] lstrcmpiA (lpString1="", lpString2="ZoomIconsMask.bmp") returned -1 [0099.837] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIcons.jpg") returned="ZoomIcons.jpg" [0099.837] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\", lpString2="ZoomIconsMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIconsMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIconsMask.bmp" [0099.837] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIconsMask.bmp", pszSpec="*.zip") returned 0 [0099.837] lstrlenA (lpString="*.zip") returned 5 [0099.837] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIconsMask.bmp", pszSpec="*.rar") returned 0 [0099.837] lstrlenA (lpString="*.rar") returned 5 [0099.837] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIconsMask.bmp", pszSpec="*.7z") returned 0 [0099.837] lstrlenA (lpString="*.7z") returned 4 [0099.837] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIconsMask.bmp", pszSpec="*.tar") returned 0 [0099.837] lstrlenA (lpString="*.tar") returned 5 [0099.837] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIconsMask.bmp", pszSpec="*.gzip") returned 0 [0099.837] lstrlenA (lpString="*.gzip") returned 6 [0099.837] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIconsMask.bmp", pszSpec="*.jpg") returned 0 [0099.837] lstrlenA (lpString="*.jpg") returned 5 [0099.837] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIconsMask.bmp", pszSpec="*.jpeg") returned 0 [0099.837] lstrlenA (lpString="*.jpeg") returned 6 [0099.837] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIconsMask.bmp", pszSpec="*.psd") returned 0 [0099.837] lstrlenA (lpString="*.psd") returned 5 [0099.837] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIconsMask.bmp", pszSpec="*.cdr") returned 0 [0099.837] lstrlenA (lpString="*.cdr") returned 5 [0099.837] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIconsMask.bmp", pszSpec="*.dwg") returned 0 [0099.837] lstrlenA (lpString="*.dwg") returned 5 [0099.837] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIconsMask.bmp", pszSpec="*.max") returned 0 [0099.837] lstrlenA (lpString="*.max") returned 5 [0099.837] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIconsMask.bmp", pszSpec="*.bmp") returned 1 [0099.837] lstrlenA (lpString="*.bmp") returned 5 [0099.837] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIconsMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIconsMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIconsMask.bmp" [0099.837] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIconsMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIconsMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIconsMask.bmp" [0099.837] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIconsMask.bmp", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIconsMask.bmp.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIconsMask.bmp." [0099.837] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIconsMask.bmp.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIconsMask.bmp. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIconsMask.bmp. " [0099.837] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIconsMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\zoomiconsmask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0099.853] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x638 [0099.853] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xb6e92300, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x5e86eb30, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xb6e92300, dwHighDateTime=0x1c747ea)) returned 1 [0099.854] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0099.854] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x5de, lpOverlapped=0x0) returned 1 [0099.955] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIconsMask.bmp") returned="ZoomIconsMask.bmp" [0099.955] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0099.955] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x5de, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x5de, lpOverlapped=0x0) returned 1 [0099.955] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0099.955] CloseHandle (hObject=0x98) returned 1 [0099.955] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIconsMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\zoomiconsmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIconsMask.bmp. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\zoomiconsmask.bmp. ")) returned 1 [0099.957] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 0 [0099.957] FindClose (in: hFindFile=0x5be160 | out: hFindFile=0x5be160) returned 1 [0099.957] FindNextFileA (in: hFindFile=0x5b7dd0, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0099.957] lstrcmpA (lpString1=".", lpString2="Welcome Tool") returned -1 [0099.957] lstrcmpA (lpString1="..", lpString2="Welcome Tool") returned -1 [0099.957] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\*.*") returned="*.*" [0099.957] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\", lpString2="Welcome Tool" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool" [0099.957] lstrlenA (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool") returned 82 [0099.957] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\*.*", lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 0x5be160 [0099.958] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0099.958] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0099.958] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0099.958] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0099.958] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0099.958] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0099.958] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="IconImages.jpg") returned -1 [0099.958] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="IconImages.jpg") returned -1 [0099.958] lstrcmpiA (lpString1="", lpString2="IconImages.jpg") returned -1 [0099.958] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\*.*") returned="*.*" [0099.958] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\", lpString2="IconImages.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImages.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImages.jpg" [0099.958] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImages.jpg", pszSpec="*.zip") returned 0 [0099.958] lstrlenA (lpString="*.zip") returned 5 [0099.958] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImages.jpg", pszSpec="*.rar") returned 0 [0099.958] lstrlenA (lpString="*.rar") returned 5 [0099.958] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImages.jpg", pszSpec="*.7z") returned 0 [0099.958] lstrlenA (lpString="*.7z") returned 4 [0099.958] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImages.jpg", pszSpec="*.tar") returned 0 [0099.958] lstrlenA (lpString="*.tar") returned 5 [0099.958] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImages.jpg", pszSpec="*.gzip") returned 0 [0099.958] lstrlenA (lpString="*.gzip") returned 6 [0099.958] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImages.jpg", pszSpec="*.jpg") returned 1 [0099.958] lstrlenA (lpString="*.jpg") returned 5 [0099.958] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImages.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImages.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImages.jpg" [0099.958] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImages.jpg" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImages.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImages.jpg" [0099.958] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImages.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImages.jpg.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImages.jpg." [0099.958] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImages.jpg.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImages.jpg. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImages.jpg. " [0099.958] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\welcome tool\\iconimages.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0099.960] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x10f3 [0099.960] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xbbadd700, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x61cccf30, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xbbadd700, dwHighDateTime=0x1c747ea)) returned 1 [0099.960] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0099.960] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x1099, lpOverlapped=0x0) returned 1 [0100.039] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImages.jpg") returned="IconImages.jpg" [0100.039] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0100.039] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x1099, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x1099, lpOverlapped=0x0) returned 1 [0100.039] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0100.039] CloseHandle (hObject=0x98) returned 1 [0100.039] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\welcome tool\\iconimages.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImages.jpg. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\welcome tool\\iconimages.jpg. ")) returned 1 [0100.042] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0100.042] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0100.042] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="IconImagesMask.bmp") returned -1 [0100.042] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="IconImagesMask.bmp") returned -1 [0100.042] lstrcmpiA (lpString1="", lpString2="IconImagesMask.bmp") returned -1 [0100.042] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImages.jpg") returned="IconImages.jpg" [0100.042] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\", lpString2="IconImagesMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImagesMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImagesMask.bmp" [0100.042] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImagesMask.bmp", pszSpec="*.zip") returned 0 [0100.042] lstrlenA (lpString="*.zip") returned 5 [0100.042] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImagesMask.bmp", pszSpec="*.rar") returned 0 [0100.042] lstrlenA (lpString="*.rar") returned 5 [0100.042] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImagesMask.bmp", pszSpec="*.7z") returned 0 [0100.042] lstrlenA (lpString="*.7z") returned 4 [0100.042] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImagesMask.bmp", pszSpec="*.tar") returned 0 [0100.042] lstrlenA (lpString="*.tar") returned 5 [0100.042] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImagesMask.bmp", pszSpec="*.gzip") returned 0 [0100.042] lstrlenA (lpString="*.gzip") returned 6 [0100.042] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImagesMask.bmp", pszSpec="*.jpg") returned 0 [0100.042] lstrlenA (lpString="*.jpg") returned 5 [0100.042] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImagesMask.bmp", pszSpec="*.jpeg") returned 0 [0100.042] lstrlenA (lpString="*.jpeg") returned 6 [0100.042] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImagesMask.bmp", pszSpec="*.psd") returned 0 [0100.042] lstrlenA (lpString="*.psd") returned 5 [0100.042] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImagesMask.bmp", pszSpec="*.cdr") returned 0 [0100.042] lstrlenA (lpString="*.cdr") returned 5 [0100.042] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImagesMask.bmp", pszSpec="*.dwg") returned 0 [0100.042] lstrlenA (lpString="*.dwg") returned 5 [0100.042] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImagesMask.bmp", pszSpec="*.max") returned 0 [0100.042] lstrlenA (lpString="*.max") returned 5 [0100.042] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImagesMask.bmp", pszSpec="*.bmp") returned 1 [0100.042] lstrlenA (lpString="*.bmp") returned 5 [0100.042] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImagesMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImagesMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImagesMask.bmp" [0100.042] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImagesMask.bmp" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImagesMask.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImagesMask.bmp" [0100.042] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImagesMask.bmp", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImagesMask.bmp.") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImagesMask.bmp." [0100.042] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImagesMask.bmp.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImagesMask.bmp. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImagesMask.bmp. " [0100.042] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\welcome tool\\iconimagesmask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0100.043] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xa38 [0100.043] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xbcdf0400, dwHighDateTime=0x1c747ea), lpLastAccessTime=0x407536*(dwLowDateTime=0x53907610, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xbcdf0400, dwHighDateTime=0x1c747ea)) returned 1 [0100.043] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0100.043] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x9de, lpOverlapped=0x0) returned 1 [0100.045] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImagesMask.bmp") returned="IconImagesMask.bmp" [0100.045] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0100.045] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x9de, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x9de, lpOverlapped=0x0) returned 1 [0100.045] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0100.045] CloseHandle (hObject=0x98) returned 1 [0100.045] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\welcome tool\\iconimagesmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImagesMask.bmp. " (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\welcome tool\\iconimagesmask.bmp. ")) returned 1 [0100.046] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 0 [0100.046] FindClose (in: hFindFile=0x5be160 | out: hFindFile=0x5be160) returned 1 [0100.046] FindNextFileA (in: hFindFile=0x5b7dd0, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0 [0100.046] FindClose (in: hFindFile=0x5b7dd0 | out: hFindFile=0x5b7dd0) returned 1 [0100.046] FindNextFileA (in: hFindFile=0x5b7c78, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0 [0100.047] FindClose (in: hFindFile=0x5b7c78 | out: hFindFile=0x5b7c78) returned 1 [0100.047] FindNextFileA (in: hFindFile=0x5b7cf0, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0100.047] lstrcmpA (lpString1=".", lpString2="ToolIcons") returned -1 [0100.047] lstrcmpA (lpString1="..", lpString2="ToolIcons") returned -1 [0100.047] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\*.*") returned="*.*" [0100.047] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\", lpString2="ToolIcons" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons" [0100.047] lstrlenA (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons") returned 59 [0100.047] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be160 [0100.092] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0100.092] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0100.109] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0100.109] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0100.109] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0100.109] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0100.109] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="ALERT.ICO") returned 1 [0100.109] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ALERT.ICO") returned 1 [0100.109] lstrcmpiA (lpString1="", lpString2="ALERT.ICO") returned -1 [0100.109] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\*.*") returned="*.*" [0100.109] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\", lpString2="ALERT.ICO" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO" [0100.109] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO", pszSpec="*.zip") returned 0 [0100.109] lstrlenA (lpString="*.zip") returned 5 [0100.109] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO", pszSpec="*.rar") returned 0 [0100.109] lstrlenA (lpString="*.rar") returned 5 [0100.109] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO", pszSpec="*.7z") returned 0 [0100.109] lstrlenA (lpString="*.7z") returned 4 [0100.109] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO", pszSpec="*.tar") returned 0 [0100.109] lstrlenA (lpString="*.tar") returned 5 [0100.109] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO", pszSpec="*.gzip") returned 0 [0100.110] lstrlenA (lpString="*.gzip") returned 6 [0100.110] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO", pszSpec="*.jpg") returned 0 [0100.110] lstrlenA (lpString="*.jpg") returned 5 [0100.110] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO", pszSpec="*.jpeg") returned 0 [0100.110] lstrlenA (lpString="*.jpeg") returned 6 [0100.110] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO", pszSpec="*.psd") returned 0 [0100.110] lstrlenA (lpString="*.psd") returned 5 [0100.110] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO", pszSpec="*.cdr") returned 0 [0100.110] lstrlenA (lpString="*.cdr") returned 5 [0100.110] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO", pszSpec="*.dwg") returned 0 [0100.110] lstrlenA (lpString="*.dwg") returned 5 [0100.110] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO", pszSpec="*.max") returned 0 [0100.110] lstrlenA (lpString="*.max") returned 5 [0100.110] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO", pszSpec="*.bmp") returned 0 [0100.110] lstrlenA (lpString="*.bmp") returned 5 [0100.110] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO", pszSpec="*.gif") returned 0 [0100.110] lstrlenA (lpString="*.gif") returned 5 [0100.110] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO", pszSpec="*.png") returned 0 [0100.110] lstrlenA (lpString="*.png") returned 5 [0100.110] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO", pszSpec="*.doc") returned 0 [0100.110] lstrlenA (lpString="*.doc") returned 5 [0100.110] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO", pszSpec="*.docx") returned 0 [0100.110] lstrlenA (lpString="*.docx") returned 6 [0100.110] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO", pszSpec="*.xls") returned 0 [0100.110] lstrlenA (lpString="*.xls") returned 5 [0100.110] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO", pszSpec="*.xlsx") returned 0 [0100.110] lstrlenA (lpString="*.xlsx") returned 6 [0100.110] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO", pszSpec="*.ppt") returned 0 [0100.110] lstrlenA (lpString="*.ppt") returned 5 [0100.110] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO", pszSpec="*.pptx") returned 0 [0100.110] lstrlenA (lpString="*.pptx") returned 6 [0100.110] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO", pszSpec="*.txt") returned 0 [0100.110] lstrlenA (lpString="*.txt") returned 5 [0100.110] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO", pszSpec="*.pdf") returned 0 [0100.110] lstrlenA (lpString="*.pdf") returned 5 [0100.110] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO", pszSpec="*.djvu") returned 0 [0100.110] lstrlenA (lpString="*.djvu") returned 6 [0100.110] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO", pszSpec="*.htm") returned 0 [0100.111] lstrlenA (lpString="*.htm") returned 5 [0100.111] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO", pszSpec="*.html") returned 0 [0100.111] lstrlenA (lpString="*.html") returned 6 [0100.111] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO", pszSpec="*.mdb") returned 0 [0100.111] lstrlenA (lpString="*.mdb") returned 5 [0100.111] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO", pszSpec="*.cer") returned 0 [0100.111] lstrlenA (lpString="*.cer") returned 5 [0100.111] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO", pszSpec="*.p12") returned 0 [0100.111] lstrlenA (lpString="*.p12") returned 5 [0100.111] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO", pszSpec="*.pfx") returned 0 [0100.111] lstrlenA (lpString="*.pfx") returned 5 [0100.111] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO", pszSpec="*.kwm") returned 0 [0100.111] lstrlenA (lpString="*.kwm") returned 5 [0100.111] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO", pszSpec="*.pwm") returned 0 [0100.111] lstrlenA (lpString="*.pwm") returned 5 [0100.111] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO", pszSpec="*.1cd") returned 0 [0100.111] lstrlenA (lpString="*.1cd") returned 5 [0100.111] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO", pszSpec="*.md") returned 0 [0100.111] lstrlenA (lpString="*.md") returned 4 [0100.111] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO", pszSpec="*.mdf") returned 0 [0100.111] lstrlenA (lpString="*.mdf") returned 5 [0100.111] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO", pszSpec="*.dbf") returned 0 [0100.111] lstrlenA (lpString="*.dbf") returned 5 [0100.111] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO", pszSpec="*.odt") returned 0 [0100.111] lstrlenA (lpString="*.odt") returned 5 [0100.111] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO", pszSpec="*.vob") returned 0 [0100.111] lstrlenA (lpString="*.vob") returned 5 [0100.111] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO", pszSpec="*.ifo") returned 0 [0100.111] lstrlenA (lpString="*.ifo") returned 5 [0100.111] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO", pszSpec="*.lnk") returned 0 [0100.111] lstrlenA (lpString="*.lnk") returned 5 [0100.111] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO", pszSpec="*.torrent") returned 0 [0100.111] lstrlenA (lpString="*.torrent") returned 9 [0100.111] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO", pszSpec="*.mov") returned 0 [0100.111] lstrlenA (lpString="*.mov") returned 5 [0100.111] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO", pszSpec="*.m2v") returned 0 [0100.111] lstrlenA (lpString="*.m2v") returned 5 [0100.111] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO", pszSpec="*.3gp") returned 0 [0100.111] lstrlenA (lpString="*.3gp") returned 5 [0100.112] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO", pszSpec="*.mpeg") returned 0 [0100.112] lstrlenA (lpString="*.mpeg") returned 6 [0100.112] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO", pszSpec="*.mpg") returned 0 [0100.112] lstrlenA (lpString="*.mpg") returned 5 [0100.112] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO", pszSpec="*.flv") returned 0 [0100.112] lstrlenA (lpString="*.flv") returned 5 [0100.112] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO", pszSpec="*.avi") returned 0 [0100.112] lstrlenA (lpString="*.avi") returned 5 [0100.112] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO", pszSpec="*.mp4") returned 0 [0100.112] lstrlenA (lpString="*.mp4") returned 5 [0100.112] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO", pszSpec="*.wmv") returned 0 [0100.112] lstrlenA (lpString="*.wmv") returned 5 [0100.112] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO", pszSpec="*.divx") returned 0 [0100.112] lstrlenA (lpString="*.divx") returned 6 [0100.112] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO", pszSpec="*.mkv") returned 0 [0100.112] lstrlenA (lpString="*.mkv") returned 5 [0100.112] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO", pszSpec="*.mp3") returned 0 [0100.112] lstrlenA (lpString="*.mp3") returned 5 [0100.112] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO", pszSpec="*.wav") returned 0 [0100.112] lstrlenA (lpString="*.wav") returned 5 [0100.112] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO", pszSpec="*.flac") returned 0 [0100.112] lstrlenA (lpString="*.flac") returned 6 [0100.112] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO", pszSpec="*.ape") returned 0 [0100.112] lstrlenA (lpString="*.ape") returned 5 [0100.112] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO", pszSpec="*.wma") returned 0 [0100.112] lstrlenA (lpString="*.wma") returned 5 [0100.112] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO", pszSpec="*.ac3") returned 0 [0100.112] lstrlenA (lpString="*.ac3") returned 5 [0100.112] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0100.112] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0100.112] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="CHEVRON.ICO") returned 1 [0100.112] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="CHEVRON.ICO") returned 1 [0100.112] lstrcmpiA (lpString1="", lpString2="CHEVRON.ICO") returned -1 [0100.112] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO") returned="ALERT.ICO" [0100.112] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\", lpString2="CHEVRON.ICO" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO" [0100.113] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO", pszSpec="*.zip") returned 0 [0100.113] lstrlenA (lpString="*.zip") returned 5 [0100.113] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO", pszSpec="*.rar") returned 0 [0100.113] lstrlenA (lpString="*.rar") returned 5 [0100.113] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO", pszSpec="*.7z") returned 0 [0100.113] lstrlenA (lpString="*.7z") returned 4 [0100.113] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO", pszSpec="*.tar") returned 0 [0100.113] lstrlenA (lpString="*.tar") returned 5 [0100.113] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO", pszSpec="*.gzip") returned 0 [0100.113] lstrlenA (lpString="*.gzip") returned 6 [0100.113] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO", pszSpec="*.jpg") returned 0 [0100.113] lstrlenA (lpString="*.jpg") returned 5 [0100.113] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO", pszSpec="*.jpeg") returned 0 [0100.113] lstrlenA (lpString="*.jpeg") returned 6 [0100.113] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO", pszSpec="*.psd") returned 0 [0100.113] lstrlenA (lpString="*.psd") returned 5 [0100.113] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO", pszSpec="*.cdr") returned 0 [0100.113] lstrlenA (lpString="*.cdr") returned 5 [0100.113] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO", pszSpec="*.dwg") returned 0 [0100.113] lstrlenA (lpString="*.dwg") returned 5 [0100.113] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO", pszSpec="*.max") returned 0 [0100.113] lstrlenA (lpString="*.max") returned 5 [0100.113] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO", pszSpec="*.bmp") returned 0 [0100.113] lstrlenA (lpString="*.bmp") returned 5 [0100.113] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO", pszSpec="*.gif") returned 0 [0100.113] lstrlenA (lpString="*.gif") returned 5 [0100.113] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO", pszSpec="*.png") returned 0 [0100.113] lstrlenA (lpString="*.png") returned 5 [0100.113] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO", pszSpec="*.doc") returned 0 [0100.113] lstrlenA (lpString="*.doc") returned 5 [0100.113] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO", pszSpec="*.docx") returned 0 [0100.113] lstrlenA (lpString="*.docx") returned 6 [0100.113] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO", pszSpec="*.xls") returned 0 [0100.113] lstrlenA (lpString="*.xls") returned 5 [0100.113] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO", pszSpec="*.xlsx") returned 0 [0100.113] lstrlenA (lpString="*.xlsx") returned 6 [0100.113] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO", pszSpec="*.ppt") returned 0 [0100.113] lstrlenA (lpString="*.ppt") returned 5 [0100.114] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO", pszSpec="*.pptx") returned 0 [0100.114] lstrlenA (lpString="*.pptx") returned 6 [0100.114] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO", pszSpec="*.txt") returned 0 [0100.114] lstrlenA (lpString="*.txt") returned 5 [0100.114] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO", pszSpec="*.pdf") returned 0 [0100.114] lstrlenA (lpString="*.pdf") returned 5 [0100.114] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO", pszSpec="*.djvu") returned 0 [0100.114] lstrlenA (lpString="*.djvu") returned 6 [0100.114] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO", pszSpec="*.htm") returned 0 [0100.114] lstrlenA (lpString="*.htm") returned 5 [0100.114] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO", pszSpec="*.html") returned 0 [0100.114] lstrlenA (lpString="*.html") returned 6 [0100.114] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO", pszSpec="*.mdb") returned 0 [0100.114] lstrlenA (lpString="*.mdb") returned 5 [0100.114] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO", pszSpec="*.cer") returned 0 [0100.114] lstrlenA (lpString="*.cer") returned 5 [0100.114] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO", pszSpec="*.p12") returned 0 [0100.114] lstrlenA (lpString="*.p12") returned 5 [0100.114] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO", pszSpec="*.pfx") returned 0 [0100.114] lstrlenA (lpString="*.pfx") returned 5 [0100.114] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO", pszSpec="*.kwm") returned 0 [0100.114] lstrlenA (lpString="*.kwm") returned 5 [0100.114] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO", pszSpec="*.pwm") returned 0 [0100.114] lstrlenA (lpString="*.pwm") returned 5 [0100.114] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO", pszSpec="*.1cd") returned 0 [0100.114] lstrlenA (lpString="*.1cd") returned 5 [0100.114] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO", pszSpec="*.md") returned 0 [0100.114] lstrlenA (lpString="*.md") returned 4 [0100.114] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO", pszSpec="*.mdf") returned 0 [0100.114] lstrlenA (lpString="*.mdf") returned 5 [0100.114] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO", pszSpec="*.dbf") returned 0 [0100.114] lstrlenA (lpString="*.dbf") returned 5 [0100.114] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO", pszSpec="*.odt") returned 0 [0100.114] lstrlenA (lpString="*.odt") returned 5 [0100.114] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO", pszSpec="*.vob") returned 0 [0100.114] lstrlenA (lpString="*.vob") returned 5 [0100.114] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO", pszSpec="*.ifo") returned 0 [0100.114] lstrlenA (lpString="*.ifo") returned 5 [0100.114] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO", pszSpec="*.lnk") returned 0 [0100.115] lstrlenA (lpString="*.lnk") returned 5 [0100.115] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO", pszSpec="*.torrent") returned 0 [0100.115] lstrlenA (lpString="*.torrent") returned 9 [0100.115] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO", pszSpec="*.mov") returned 0 [0100.115] lstrlenA (lpString="*.mov") returned 5 [0100.115] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO", pszSpec="*.m2v") returned 0 [0100.115] lstrlenA (lpString="*.m2v") returned 5 [0100.115] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO", pszSpec="*.3gp") returned 0 [0100.115] lstrlenA (lpString="*.3gp") returned 5 [0100.115] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO", pszSpec="*.mpeg") returned 0 [0100.115] lstrlenA (lpString="*.mpeg") returned 6 [0100.115] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO", pszSpec="*.mpg") returned 0 [0100.115] lstrlenA (lpString="*.mpg") returned 5 [0100.115] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO", pszSpec="*.flv") returned 0 [0100.115] lstrlenA (lpString="*.flv") returned 5 [0100.115] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO", pszSpec="*.avi") returned 0 [0100.115] lstrlenA (lpString="*.avi") returned 5 [0100.115] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO", pszSpec="*.mp4") returned 0 [0100.115] lstrlenA (lpString="*.mp4") returned 5 [0100.115] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO", pszSpec="*.wmv") returned 0 [0100.115] lstrlenA (lpString="*.wmv") returned 5 [0100.115] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO", pszSpec="*.divx") returned 0 [0100.115] lstrlenA (lpString="*.divx") returned 6 [0100.115] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO", pszSpec="*.mkv") returned 0 [0100.115] lstrlenA (lpString="*.mkv") returned 5 [0100.115] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO", pszSpec="*.mp3") returned 0 [0100.115] lstrlenA (lpString="*.mp3") returned 5 [0100.115] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO", pszSpec="*.wav") returned 0 [0100.115] lstrlenA (lpString="*.wav") returned 5 [0100.115] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO", pszSpec="*.flac") returned 0 [0100.115] lstrlenA (lpString="*.flac") returned 6 [0100.115] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO", pszSpec="*.ape") returned 0 [0100.115] lstrlenA (lpString="*.ape") returned 5 [0100.115] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO", pszSpec="*.wma") returned 0 [0100.115] lstrlenA (lpString="*.wma") returned 5 [0100.115] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO", pszSpec="*.ac3") returned 0 [0100.115] lstrlenA (lpString="*.ac3") returned 5 [0100.115] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0100.116] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0100.116] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="COMPUTER.ICO") returned 1 [0100.116] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="COMPUTER.ICO") returned 1 [0100.116] lstrcmpiA (lpString1="", lpString2="COMPUTER.ICO") returned -1 [0100.116] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO") returned="CHEVRON.ICO" [0100.116] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\", lpString2="COMPUTER.ICO" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\COMPUTER.ICO") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\COMPUTER.ICO" [0100.116] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\COMPUTER.ICO", pszSpec="*.zip") returned 0 [0100.116] lstrlenA (lpString="*.zip") returned 5 [0100.116] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\COMPUTER.ICO", pszSpec="*.rar") returned 0 [0100.116] lstrlenA (lpString="*.rar") returned 5 [0100.116] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\COMPUTER.ICO", pszSpec="*.7z") returned 0 [0100.116] lstrlenA (lpString="*.7z") returned 4 [0100.116] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\COMPUTER.ICO", pszSpec="*.tar") returned 0 [0100.116] lstrlenA (lpString="*.tar") returned 5 [0100.116] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\COMPUTER.ICO", pszSpec="*.gzip") returned 0 [0100.116] lstrlenA (lpString="*.gzip") returned 6 [0100.116] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\COMPUTER.ICO", pszSpec="*.jpg") returned 0 [0100.116] lstrlenA (lpString="*.jpg") returned 5 [0100.116] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\COMPUTER.ICO", pszSpec="*.jpeg") returned 0 [0100.116] lstrlenA (lpString="*.jpeg") returned 6 [0100.116] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\COMPUTER.ICO", pszSpec="*.psd") returned 0 [0100.116] lstrlenA (lpString="*.psd") returned 5 [0100.116] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\COMPUTER.ICO", pszSpec="*.cdr") returned 0 [0100.116] lstrlenA (lpString="*.cdr") returned 5 [0100.116] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\COMPUTER.ICO", pszSpec="*.dwg") returned 0 [0100.116] lstrlenA (lpString="*.dwg") returned 5 [0100.116] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\COMPUTER.ICO", pszSpec="*.max") returned 0 [0100.116] lstrlenA (lpString="*.max") returned 5 [0100.116] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\COMPUTER.ICO", pszSpec="*.bmp") returned 0 [0100.116] lstrlenA (lpString="*.bmp") returned 5 [0100.116] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\COMPUTER.ICO", pszSpec="*.gif") returned 0 [0100.116] lstrlenA (lpString="*.gif") returned 5 [0100.116] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\COMPUTER.ICO", pszSpec="*.png") returned 0 [0100.116] lstrlenA (lpString="*.png") returned 5 [0100.116] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\COMPUTER.ICO", pszSpec="*.doc") returned 0 [0100.116] lstrlenA (lpString="*.doc") returned 5 [0100.116] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\COMPUTER.ICO", pszSpec="*.docx") returned 0 [0100.116] lstrlenA (lpString="*.docx") returned 6 [0100.116] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\COMPUTER.ICO", pszSpec="*.xls") returned 0 [0100.117] lstrlenA (lpString="*.xls") returned 5 [0100.117] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\COMPUTER.ICO", pszSpec="*.xlsx") returned 0 [0100.117] lstrlenA (lpString="*.xlsx") returned 6 [0100.117] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\COMPUTER.ICO", pszSpec="*.ppt") returned 0 [0100.117] lstrlenA (lpString="*.ppt") returned 5 [0100.117] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\COMPUTER.ICO", pszSpec="*.pptx") returned 0 [0100.117] lstrlenA (lpString="*.pptx") returned 6 [0100.117] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\COMPUTER.ICO", pszSpec="*.txt") returned 0 [0100.117] lstrlenA (lpString="*.txt") returned 5 [0100.117] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\COMPUTER.ICO", pszSpec="*.pdf") returned 0 [0100.117] lstrlenA (lpString="*.pdf") returned 5 [0100.117] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\COMPUTER.ICO", pszSpec="*.djvu") returned 0 [0100.117] lstrlenA (lpString="*.djvu") returned 6 [0100.117] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\COMPUTER.ICO", pszSpec="*.htm") returned 0 [0100.117] lstrlenA (lpString="*.htm") returned 5 [0100.117] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\COMPUTER.ICO", pszSpec="*.html") returned 0 [0100.117] lstrlenA (lpString="*.html") returned 6 [0100.117] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\COMPUTER.ICO", pszSpec="*.mdb") returned 0 [0100.117] lstrlenA (lpString="*.mdb") returned 5 [0100.117] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\COMPUTER.ICO", pszSpec="*.cer") returned 0 [0100.117] lstrlenA (lpString="*.cer") returned 5 [0100.117] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\COMPUTER.ICO", pszSpec="*.p12") returned 0 [0100.117] lstrlenA (lpString="*.p12") returned 5 [0100.117] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\COMPUTER.ICO", pszSpec="*.pfx") returned 0 [0100.117] lstrlenA (lpString="*.pfx") returned 5 [0100.117] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\COMPUTER.ICO", pszSpec="*.kwm") returned 0 [0100.117] lstrlenA (lpString="*.kwm") returned 5 [0100.117] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\COMPUTER.ICO", pszSpec="*.pwm") returned 0 [0100.117] lstrlenA (lpString="*.pwm") returned 5 [0100.117] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\COMPUTER.ICO", pszSpec="*.1cd") returned 0 [0100.117] lstrlenA (lpString="*.1cd") returned 5 [0100.117] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\COMPUTER.ICO", pszSpec="*.md") returned 0 [0100.117] lstrlenA (lpString="*.md") returned 4 [0100.117] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\COMPUTER.ICO", pszSpec="*.mdf") returned 0 [0100.117] lstrlenA (lpString="*.mdf") returned 5 [0100.117] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\COMPUTER.ICO", pszSpec="*.dbf") returned 0 [0100.117] lstrlenA (lpString="*.dbf") returned 5 [0100.117] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\COMPUTER.ICO", pszSpec="*.odt") returned 0 [0100.117] lstrlenA (lpString="*.odt") returned 5 [0100.117] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\COMPUTER.ICO", pszSpec="*.vob") returned 0 [0100.117] lstrlenA (lpString="*.vob") returned 5 [0100.117] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\COMPUTER.ICO", pszSpec="*.ifo") returned 0 [0100.117] lstrlenA (lpString="*.ifo") returned 5 [0100.117] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\COMPUTER.ICO", pszSpec="*.lnk") returned 0 [0100.117] lstrlenA (lpString="*.lnk") returned 5 [0100.117] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\COMPUTER.ICO", pszSpec="*.torrent") returned 0 [0100.117] lstrlenA (lpString="*.torrent") returned 9 [0100.117] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\COMPUTER.ICO", pszSpec="*.mov") returned 0 [0100.117] lstrlenA (lpString="*.mov") returned 5 [0100.117] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\COMPUTER.ICO", pszSpec="*.m2v") returned 0 [0100.117] lstrlenA (lpString="*.m2v") returned 5 [0100.118] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\COMPUTER.ICO", pszSpec="*.3gp") returned 0 [0100.118] lstrlenA (lpString="*.3gp") returned 5 [0100.118] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\COMPUTER.ICO", pszSpec="*.mpeg") returned 0 [0100.118] lstrlenA (lpString="*.mpeg") returned 6 [0100.118] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\COMPUTER.ICO", pszSpec="*.mpg") returned 0 [0100.118] lstrlenA (lpString="*.mpg") returned 5 [0100.118] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\COMPUTER.ICO", pszSpec="*.flv") returned 0 [0100.118] lstrlenA (lpString="*.flv") returned 5 [0100.118] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\COMPUTER.ICO", pszSpec="*.avi") returned 0 [0100.118] lstrlenA (lpString="*.avi") returned 5 [0100.118] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\COMPUTER.ICO", pszSpec="*.mp4") returned 0 [0100.118] lstrlenA (lpString="*.mp4") returned 5 [0100.118] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\COMPUTER.ICO", pszSpec="*.wmv") returned 0 [0100.118] lstrlenA (lpString="*.wmv") returned 5 [0100.118] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\COMPUTER.ICO", pszSpec="*.divx") returned 0 [0100.118] lstrlenA (lpString="*.divx") returned 6 [0100.118] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\COMPUTER.ICO", pszSpec="*.mkv") returned 0 [0100.118] lstrlenA (lpString="*.mkv") returned 5 [0100.118] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\COMPUTER.ICO", pszSpec="*.mp3") returned 0 [0100.118] lstrlenA (lpString="*.mp3") returned 5 [0100.118] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\COMPUTER.ICO", pszSpec="*.wav") returned 0 [0100.118] lstrlenA (lpString="*.wav") returned 5 [0100.118] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\COMPUTER.ICO", pszSpec="*.flac") returned 0 [0100.118] lstrlenA (lpString="*.flac") returned 6 [0100.118] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\COMPUTER.ICO", pszSpec="*.ape") returned 0 [0100.118] lstrlenA (lpString="*.ape") returned 5 [0100.118] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\COMPUTER.ICO", pszSpec="*.wma") returned 0 [0100.118] lstrlenA (lpString="*.wma") returned 5 [0100.118] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\COMPUTER.ICO", pszSpec="*.ac3") returned 0 [0100.118] lstrlenA (lpString="*.ac3") returned 5 [0100.118] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0100.118] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0100.118] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="ContactSelector.ico") returned 1 [0100.118] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ContactSelector.ico") returned 1 [0100.118] lstrcmpiA (lpString1="", lpString2="ContactSelector.ico") returned -1 [0100.118] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\COMPUTER.ICO") returned="COMPUTER.ICO" [0100.118] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\", lpString2="ContactSelector.ico" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ContactSelector.ico") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ContactSelector.ico" [0100.118] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ContactSelector.ico", pszSpec="*.zip") returned 0 [0100.118] lstrlenA (lpString="*.zip") returned 5 [0100.118] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ContactSelector.ico", pszSpec="*.rar") returned 0 [0100.119] lstrlenA (lpString="*.rar") returned 5 [0100.119] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ContactSelector.ico", pszSpec="*.7z") returned 0 [0100.119] lstrlenA (lpString="*.7z") returned 4 [0100.119] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ContactSelector.ico", pszSpec="*.tar") returned 0 [0100.119] lstrlenA (lpString="*.tar") returned 5 [0100.119] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ContactSelector.ico", pszSpec="*.gzip") returned 0 [0100.119] lstrlenA (lpString="*.gzip") returned 6 [0100.119] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ContactSelector.ico", pszSpec="*.jpg") returned 0 [0100.119] lstrlenA (lpString="*.jpg") returned 5 [0100.119] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ContactSelector.ico", pszSpec="*.jpeg") returned 0 [0100.119] lstrlenA (lpString="*.jpeg") returned 6 [0100.119] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ContactSelector.ico", pszSpec="*.psd") returned 0 [0100.119] lstrlenA (lpString="*.psd") returned 5 [0100.119] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ContactSelector.ico", pszSpec="*.cdr") returned 0 [0100.119] lstrlenA (lpString="*.cdr") returned 5 [0100.119] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ContactSelector.ico", pszSpec="*.dwg") returned 0 [0100.119] lstrlenA (lpString="*.dwg") returned 5 [0100.119] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ContactSelector.ico", pszSpec="*.max") returned 0 [0100.119] lstrlenA (lpString="*.max") returned 5 [0100.119] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ContactSelector.ico", pszSpec="*.bmp") returned 0 [0100.119] lstrlenA (lpString="*.bmp") returned 5 [0100.119] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ContactSelector.ico", pszSpec="*.gif") returned 0 [0100.119] lstrlenA (lpString="*.gif") returned 5 [0100.119] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ContactSelector.ico", pszSpec="*.png") returned 0 [0100.119] lstrlenA (lpString="*.png") returned 5 [0100.119] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ContactSelector.ico", pszSpec="*.doc") returned 0 [0100.119] lstrlenA (lpString="*.doc") returned 5 [0100.119] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ContactSelector.ico", pszSpec="*.docx") returned 0 [0100.119] lstrlenA (lpString="*.docx") returned 6 [0100.119] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ContactSelector.ico", pszSpec="*.xls") returned 0 [0100.119] lstrlenA (lpString="*.xls") returned 5 [0100.119] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ContactSelector.ico", pszSpec="*.xlsx") returned 0 [0100.119] lstrlenA (lpString="*.xlsx") returned 6 [0100.119] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ContactSelector.ico", pszSpec="*.ppt") returned 0 [0100.119] lstrlenA (lpString="*.ppt") returned 5 [0100.119] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ContactSelector.ico", pszSpec="*.pptx") returned 0 [0100.119] lstrlenA (lpString="*.pptx") returned 6 [0100.120] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ContactSelector.ico", pszSpec="*.txt") returned 0 [0100.120] lstrlenA (lpString="*.txt") returned 5 [0100.120] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ContactSelector.ico", pszSpec="*.pdf") returned 0 [0100.120] lstrlenA (lpString="*.pdf") returned 5 [0100.120] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ContactSelector.ico", pszSpec="*.djvu") returned 0 [0100.120] lstrlenA (lpString="*.djvu") returned 6 [0100.120] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ContactSelector.ico", pszSpec="*.htm") returned 0 [0100.120] lstrlenA (lpString="*.htm") returned 5 [0100.120] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ContactSelector.ico", pszSpec="*.html") returned 0 [0100.120] lstrlenA (lpString="*.html") returned 6 [0100.120] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ContactSelector.ico", pszSpec="*.mdb") returned 0 [0100.120] lstrlenA (lpString="*.mdb") returned 5 [0100.120] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ContactSelector.ico", pszSpec="*.cer") returned 0 [0100.120] lstrlenA (lpString="*.cer") returned 5 [0100.120] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ContactSelector.ico", pszSpec="*.p12") returned 0 [0100.120] lstrlenA (lpString="*.p12") returned 5 [0100.120] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ContactSelector.ico", pszSpec="*.pfx") returned 0 [0100.120] lstrlenA (lpString="*.pfx") returned 5 [0100.120] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ContactSelector.ico", pszSpec="*.kwm") returned 0 [0100.120] lstrlenA (lpString="*.kwm") returned 5 [0100.120] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ContactSelector.ico", pszSpec="*.pwm") returned 0 [0100.120] lstrlenA (lpString="*.pwm") returned 5 [0100.120] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ContactSelector.ico", pszSpec="*.1cd") returned 0 [0100.120] lstrlenA (lpString="*.1cd") returned 5 [0100.120] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ContactSelector.ico", pszSpec="*.md") returned 0 [0100.120] lstrlenA (lpString="*.md") returned 4 [0100.120] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ContactSelector.ico", pszSpec="*.mdf") returned 0 [0100.120] lstrlenA (lpString="*.mdf") returned 5 [0100.120] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ContactSelector.ico", pszSpec="*.dbf") returned 0 [0100.120] lstrlenA (lpString="*.dbf") returned 5 [0100.120] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ContactSelector.ico", pszSpec="*.odt") returned 0 [0100.120] lstrlenA (lpString="*.odt") returned 5 [0100.120] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ContactSelector.ico", pszSpec="*.vob") returned 0 [0100.120] lstrlenA (lpString="*.vob") returned 5 [0100.120] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ContactSelector.ico", pszSpec="*.ifo") returned 0 [0100.120] lstrlenA (lpString="*.ifo") returned 5 [0100.120] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ContactSelector.ico", pszSpec="*.lnk") returned 0 [0100.120] lstrlenA (lpString="*.lnk") returned 5 [0100.121] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ContactSelector.ico", pszSpec="*.torrent") returned 0 [0100.121] lstrlenA (lpString="*.torrent") returned 9 [0100.121] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ContactSelector.ico", pszSpec="*.mov") returned 0 [0100.121] lstrlenA (lpString="*.mov") returned 5 [0100.121] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ContactSelector.ico", pszSpec="*.m2v") returned 0 [0100.121] lstrlenA (lpString="*.m2v") returned 5 [0100.121] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ContactSelector.ico", pszSpec="*.3gp") returned 0 [0100.121] lstrlenA (lpString="*.3gp") returned 5 [0100.121] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ContactSelector.ico", pszSpec="*.mpeg") returned 0 [0100.121] lstrlenA (lpString="*.mpeg") returned 6 [0100.121] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ContactSelector.ico", pszSpec="*.mpg") returned 0 [0100.121] lstrlenA (lpString="*.mpg") returned 5 [0100.121] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ContactSelector.ico", pszSpec="*.flv") returned 0 [0100.121] lstrlenA (lpString="*.flv") returned 5 [0100.121] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ContactSelector.ico", pszSpec="*.avi") returned 0 [0100.121] lstrlenA (lpString="*.avi") returned 5 [0100.121] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ContactSelector.ico", pszSpec="*.mp4") returned 0 [0100.121] lstrlenA (lpString="*.mp4") returned 5 [0100.121] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ContactSelector.ico", pszSpec="*.wmv") returned 0 [0100.121] lstrlenA (lpString="*.wmv") returned 5 [0100.121] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ContactSelector.ico", pszSpec="*.divx") returned 0 [0100.121] lstrlenA (lpString="*.divx") returned 6 [0100.121] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ContactSelector.ico", pszSpec="*.mkv") returned 0 [0100.121] lstrlenA (lpString="*.mkv") returned 5 [0100.121] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ContactSelector.ico", pszSpec="*.mp3") returned 0 [0100.121] lstrlenA (lpString="*.mp3") returned 5 [0100.121] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ContactSelector.ico", pszSpec="*.wav") returned 0 [0100.121] lstrlenA (lpString="*.wav") returned 5 [0100.121] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ContactSelector.ico", pszSpec="*.flac") returned 0 [0100.121] lstrlenA (lpString="*.flac") returned 6 [0100.121] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ContactSelector.ico", pszSpec="*.ape") returned 0 [0100.121] lstrlenA (lpString="*.ape") returned 5 [0100.121] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ContactSelector.ico", pszSpec="*.wma") returned 0 [0100.121] lstrlenA (lpString="*.wma") returned 5 [0100.121] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ContactSelector.ico", pszSpec="*.ac3") returned 0 [0100.121] lstrlenA (lpString="*.ac3") returned 5 [0100.122] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0100.122] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0100.122] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="gfserrorfromgroove.ico") returned -1 [0100.122] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="gfserrorfromgroove.ico") returned 1 [0100.122] lstrcmpiA (lpString1="", lpString2="gfserrorfromgroove.ico") returned -1 [0100.122] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ContactSelector.ico") returned="ContactSelector.ico" [0100.122] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\", lpString2="gfserrorfromgroove.ico" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrorfromgroove.ico") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrorfromgroove.ico" [0100.122] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrorfromgroove.ico", pszSpec="*.zip") returned 0 [0100.122] lstrlenA (lpString="*.zip") returned 5 [0100.122] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrorfromgroove.ico", pszSpec="*.rar") returned 0 [0100.122] lstrlenA (lpString="*.rar") returned 5 [0100.122] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrorfromgroove.ico", pszSpec="*.7z") returned 0 [0100.122] lstrlenA (lpString="*.7z") returned 4 [0100.122] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrorfromgroove.ico", pszSpec="*.tar") returned 0 [0100.122] lstrlenA (lpString="*.tar") returned 5 [0100.122] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrorfromgroove.ico", pszSpec="*.gzip") returned 0 [0100.122] lstrlenA (lpString="*.gzip") returned 6 [0100.122] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrorfromgroove.ico", pszSpec="*.jpg") returned 0 [0100.123] lstrlenA (lpString="*.jpg") returned 5 [0100.123] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrorfromgroove.ico", pszSpec="*.jpeg") returned 0 [0100.123] lstrlenA (lpString="*.jpeg") returned 6 [0100.123] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrorfromgroove.ico", pszSpec="*.psd") returned 0 [0100.123] lstrlenA (lpString="*.psd") returned 5 [0100.123] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrorfromgroove.ico", pszSpec="*.cdr") returned 0 [0100.123] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrorfromgroove.ico", pszSpec="*.dwg") returned 0 [0100.123] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrorfromgroove.ico", pszSpec="*.max") returned 0 [0100.123] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrorfromgroove.ico", pszSpec="*.bmp") returned 0 [0100.123] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrorfromgroove.ico", pszSpec="*.gif") returned 0 [0100.123] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrorfromgroove.ico", pszSpec="*.png") returned 0 [0100.123] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrorfromgroove.ico", pszSpec="*.doc") returned 0 [0100.123] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrorfromgroove.ico", pszSpec="*.docx") returned 0 [0100.123] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrorfromgroove.ico", pszSpec="*.xls") returned 0 [0100.123] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrorfromgroove.ico", pszSpec="*.xlsx") returned 0 [0100.123] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrorfromgroove.ico", pszSpec="*.ppt") returned 0 [0100.123] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrorfromgroove.ico", pszSpec="*.pptx") returned 0 [0100.123] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrorfromgroove.ico", pszSpec="*.txt") returned 0 [0100.123] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0100.123] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0100.123] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="gfserrortogroove.ico") returned -1 [0100.123] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="gfserrortogroove.ico") returned 1 [0100.123] lstrcmpiA (lpString1="", lpString2="gfserrortogroove.ico") returned -1 [0100.123] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrorfromgroove.ico") returned="gfserrorfromgroove.ico" [0100.124] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\", lpString2="gfserrortogroove.ico" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrortogroove.ico") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrortogroove.ico" [0100.124] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0100.124] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0100.124] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="GWE.ICO") returned -1 [0100.124] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="GWE.ICO") returned 1 [0100.124] lstrcmpiA (lpString1="", lpString2="GWE.ICO") returned -1 [0100.124] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrortogroove.ico") returned="gfserrortogroove.ico" [0100.124] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\", lpString2="GWE.ICO" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\GWE.ICO") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\GWE.ICO" [0100.124] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0100.124] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0100.124] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="INCOMING.ICO") returned -1 [0100.124] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="INCOMING.ICO") returned -1 [0100.124] lstrcmpiA (lpString1="", lpString2="INCOMING.ICO") returned -1 [0100.124] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\GWE.ICO") returned="GWE.ICO" [0100.124] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\", lpString2="INCOMING.ICO" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\INCOMING.ICO") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\INCOMING.ICO" [0100.124] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0100.124] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0100.124] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="INDOMAIN.ICO") returned -1 [0100.124] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="INDOMAIN.ICO") returned -1 [0100.124] lstrcmpiA (lpString1="", lpString2="INDOMAIN.ICO") returned -1 [0100.124] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\INCOMING.ICO") returned="INCOMING.ICO" [0100.124] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\", lpString2="INDOMAIN.ICO" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\INDOMAIN.ICO") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\INDOMAIN.ICO" [0100.124] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0100.124] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0100.124] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="MAIL.ICO") returned -1 [0100.124] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MAIL.ICO") returned -1 [0100.124] lstrcmpiA (lpString1="", lpString2="MAIL.ICO") returned -1 [0100.124] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\INDOMAIN.ICO") returned="INDOMAIN.ICO" [0100.124] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\", lpString2="MAIL.ICO" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\MAIL.ICO") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\MAIL.ICO" [0100.125] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0100.125] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0100.125] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="MANUAL.ICO") returned -1 [0100.125] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MANUAL.ICO") returned -1 [0100.125] lstrcmpiA (lpString1="", lpString2="MANUAL.ICO") returned -1 [0100.125] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\MAIL.ICO") returned="MAIL.ICO" [0100.125] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\", lpString2="MANUAL.ICO" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\MANUAL.ICO") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\MANUAL.ICO" [0100.125] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0100.125] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0100.125] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="messageboxalert.ico") returned -1 [0100.125] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="messageboxalert.ico") returned -1 [0100.125] lstrcmpiA (lpString1="", lpString2="messageboxalert.ico") returned -1 [0100.125] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\MANUAL.ICO") returned="MANUAL.ICO" [0100.125] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\", lpString2="messageboxalert.ico" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxalert.ico") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxalert.ico" [0100.125] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0100.125] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0100.125] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="messageboxerror.ico") returned -1 [0100.125] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="messageboxerror.ico") returned -1 [0100.125] lstrcmpiA (lpString1="", lpString2="messageboxerror.ico") returned -1 [0100.125] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxalert.ico") returned="messageboxalert.ico" [0100.125] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\", lpString2="messageboxerror.ico" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxerror.ico") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxerror.ico" [0100.125] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0100.125] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0100.125] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="messageboxinfo.ico") returned -1 [0100.125] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="messageboxinfo.ico") returned -1 [0100.125] lstrcmpiA (lpString1="", lpString2="messageboxinfo.ico") returned -1 [0100.125] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxerror.ico") returned="messageboxerror.ico" [0100.125] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\", lpString2="messageboxinfo.ico" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxinfo.ico") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxinfo.ico" [0100.125] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0100.126] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0100.126] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="ModifiedTelespace.ico") returned -1 [0100.126] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ModifiedTelespace.ico") returned -1 [0100.126] lstrcmpiA (lpString1="", lpString2="ModifiedTelespace.ico") returned -1 [0100.126] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxinfo.ico") returned="messageboxinfo.ico" [0100.126] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\", lpString2="ModifiedTelespace.ico" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ModifiedTelespace.ico") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ModifiedTelespace.ico" [0100.126] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0100.126] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0100.126] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="OFFLINE.ICO") returned -1 [0100.126] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OFFLINE.ICO") returned -1 [0100.126] lstrcmpiA (lpString1="", lpString2="OFFLINE.ICO") returned -1 [0100.126] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ModifiedTelespace.ico") returned="ModifiedTelespace.ico" [0100.126] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\", lpString2="OFFLINE.ICO" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OFFLINE.ICO") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OFFLINE.ICO" [0100.126] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0100.126] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0100.126] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="ONLINE.ICO") returned -1 [0100.126] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ONLINE.ICO") returned -1 [0100.126] lstrcmpiA (lpString1="", lpString2="ONLINE.ICO") returned -1 [0100.126] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OFFLINE.ICO") returned="OFFLINE.ICO" [0100.126] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\", lpString2="ONLINE.ICO" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ONLINE.ICO") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ONLINE.ICO" [0100.126] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0100.126] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0100.126] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="OnLineBusy.ico") returned -1 [0100.126] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OnLineBusy.ico") returned -1 [0100.126] lstrcmpiA (lpString1="", lpString2="OnLineBusy.ico") returned -1 [0100.126] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ONLINE.ICO") returned="ONLINE.ICO" [0100.126] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\", lpString2="OnLineBusy.ico" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OnLineBusy.ico") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OnLineBusy.ico" [0100.126] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0100.126] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0100.126] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="OnLineIdle.ico") returned -1 [0100.126] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OnLineIdle.ico") returned -1 [0100.127] lstrcmpiA (lpString1="", lpString2="OnLineIdle.ico") returned -1 [0100.127] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OnLineBusy.ico") returned="OnLineBusy.ico" [0100.127] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\", lpString2="OnLineIdle.ico" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OnLineIdle.ico") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OnLineIdle.ico" [0100.127] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0100.127] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0100.127] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="OutDomain.ico") returned -1 [0100.127] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OutDomain.ico") returned -1 [0100.127] lstrcmpiA (lpString1="", lpString2="OutDomain.ico") returned -1 [0100.127] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OnLineIdle.ico") returned="OnLineIdle.ico" [0100.127] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\", lpString2="OutDomain.ico" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OutDomain.ico") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OutDomain.ico" [0100.127] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0100.127] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0100.127] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="OUTGOING.ICO") returned -1 [0100.127] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OUTGOING.ICO") returned -1 [0100.127] lstrcmpiA (lpString1="", lpString2="OUTGOING.ICO") returned -1 [0100.127] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OutDomain.ico") returned="OutDomain.ico" [0100.127] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\", lpString2="OUTGOING.ICO" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OUTGOING.ICO") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OUTGOING.ICO" [0100.127] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0100.127] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0100.127] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="OutSyncPC.ico") returned -1 [0100.127] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OutSyncPC.ico") returned -1 [0100.127] lstrcmpiA (lpString1="", lpString2="OutSyncPC.ico") returned -1 [0100.127] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OUTGOING.ICO") returned="OUTGOING.ICO" [0100.127] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\", lpString2="OutSyncPC.ico" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OutSyncPC.ico") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OutSyncPC.ico" [0100.127] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0100.127] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0100.127] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="PersonalContact.ico") returned -1 [0100.127] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PersonalContact.ico") returned -1 [0100.127] lstrcmpiA (lpString1="", lpString2="PersonalContact.ico") returned -1 [0100.127] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OutSyncPC.ico") returned="OutSyncPC.ico" [0100.127] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\", lpString2="PersonalContact.ico" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\PersonalContact.ico") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\PersonalContact.ico" [0100.128] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0100.128] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0100.128] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="SessionMember.ico") returned -1 [0100.128] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SessionMember.ico") returned -1 [0100.128] lstrcmpiA (lpString1="", lpString2="SessionMember.ico") returned -1 [0100.128] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\PersonalContact.ico") returned="PersonalContact.ico" [0100.128] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\", lpString2="SessionMember.ico" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SessionMember.ico") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SessionMember.ico" [0100.128] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0100.128] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0100.128] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="SessionOwner.ico") returned -1 [0100.128] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SessionOwner.ico") returned -1 [0100.128] lstrcmpiA (lpString1="", lpString2="SessionOwner.ico") returned -1 [0100.128] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SessionMember.ico") returned="SessionMember.ico" [0100.128] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\", lpString2="SessionOwner.ico" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SessionOwner.ico") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SessionOwner.ico" [0100.128] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0100.128] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0100.128] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="SpaceSelector.ico") returned -1 [0100.128] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SpaceSelector.ico") returned -1 [0100.128] lstrcmpiA (lpString1="", lpString2="SpaceSelector.ico") returned -1 [0100.128] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SessionOwner.ico") returned="SessionOwner.ico" [0100.128] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\", lpString2="SpaceSelector.ico" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SpaceSelector.ico") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SpaceSelector.ico" [0100.128] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0100.128] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0100.128] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="StatusAway.ico") returned -1 [0100.128] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="StatusAway.ico") returned -1 [0100.128] lstrcmpiA (lpString1="", lpString2="StatusAway.ico") returned -1 [0100.128] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SpaceSelector.ico") returned="SpaceSelector.ico" [0100.128] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\", lpString2="StatusAway.ico" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusAway.ico") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusAway.ico" [0100.129] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0100.129] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0100.129] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="StatusDoNotDisturb.ico") returned -1 [0100.129] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="StatusDoNotDisturb.ico") returned -1 [0100.129] lstrcmpiA (lpString1="", lpString2="StatusDoNotDisturb.ico") returned -1 [0100.129] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusAway.ico") returned="StatusAway.ico" [0100.129] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\", lpString2="StatusDoNotDisturb.ico" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusDoNotDisturb.ico") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusDoNotDisturb.ico" [0100.129] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0100.129] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0100.129] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="StatusOnline.ico") returned -1 [0100.129] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="StatusOnline.ico") returned -1 [0100.129] lstrcmpiA (lpString1="", lpString2="StatusOnline.ico") returned -1 [0100.129] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusDoNotDisturb.ico") returned="StatusDoNotDisturb.ico" [0100.129] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\", lpString2="StatusOnline.ico" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusOnline.ico") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusOnline.ico" [0100.129] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0100.129] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0100.129] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="TOOLICON.ICO") returned -1 [0100.129] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TOOLICON.ICO") returned -1 [0100.129] lstrcmpiA (lpString1="", lpString2="TOOLICON.ICO") returned -1 [0100.129] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusOnline.ico") returned="StatusOnline.ico" [0100.129] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\", lpString2="TOOLICON.ICO" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\TOOLICON.ICO") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\TOOLICON.ICO" [0100.129] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0100.129] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0100.129] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="WSS.ICO") returned -1 [0100.129] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WSS.ICO") returned -1 [0100.129] lstrcmpiA (lpString1="", lpString2="WSS.ICO") returned -1 [0100.129] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\TOOLICON.ICO") returned="TOOLICON.ICO" [0100.129] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\", lpString2="WSS.ICO" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\WSS.ICO") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\WSS.ICO" [0100.129] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0100.130] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0100.130] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="WSS_DocLib.ico") returned -1 [0100.130] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WSS_DocLib.ico") returned -1 [0100.130] lstrcmpiA (lpString1="", lpString2="WSS_DocLib.ico") returned -1 [0100.130] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\WSS.ICO") returned="WSS.ICO" [0100.130] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\", lpString2="WSS_DocLib.ico" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\WSS_DocLib.ico") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\WSS_DocLib.ico" [0100.130] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0 [0100.130] FindClose (in: hFindFile=0x5be160 | out: hFindFile=0x5be160) returned 1 [0100.131] FindNextFileA (in: hFindFile=0x5b7cf0, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0100.131] lstrcmpA (lpString1=".", lpString2="XML Files") returned -1 [0100.131] lstrcmpA (lpString1="..", lpString2="XML Files") returned -1 [0100.131] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\*.*") returned="*.*" [0100.131] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\", lpString2="XML Files" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files" [0100.131] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be160 [0100.132] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0100.132] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0100.132] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0100.132] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0100.132] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0100.132] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0100.132] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="builtincontrolsschema.xsd") returned 1 [0100.132] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="builtincontrolsschema.xsd") returned 1 [0100.132] lstrcmpiA (lpString1="", lpString2="builtincontrolsschema.xsd") returned -1 [0100.132] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\*.*") returned="*.*" [0100.132] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\", lpString2="builtincontrolsschema.xsd" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\builtincontrolsschema.xsd") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\builtincontrolsschema.xsd" [0100.133] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0100.133] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0100.133] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="grvschema.xsd") returned -1 [0100.133] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="grvschema.xsd") returned 1 [0100.133] lstrcmpiA (lpString1="", lpString2="grvschema.xsd") returned -1 [0100.133] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\builtincontrolsschema.xsd") returned="builtincontrolsschema.xsd" [0100.133] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\", lpString2="grvschema.xsd" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\grvschema.xsd") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\grvschema.xsd" [0100.133] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0100.133] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0100.133] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Messenger.xml") returned -1 [0100.133] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Messenger.xml") returned -1 [0100.133] lstrcmpiA (lpString1="", lpString2="Messenger.xml") returned -1 [0100.133] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\grvschema.xsd") returned="grvschema.xsd" [0100.133] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\", lpString2="Messenger.xml" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\Messenger.xml") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\Messenger.xml" [0100.133] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0100.133] lstrcmpA (lpString1=".", lpString2="Space Templates") returned -1 [0100.133] lstrcmpA (lpString1="..", lpString2="Space Templates") returned -1 [0100.133] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\Messenger.xml") returned="Messenger.xml" [0100.133] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\", lpString2="Space Templates" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\Space Templates") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\Space Templates" [0100.133] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\Space Templates\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be1a0 [0100.133] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0100.133] FindNextFileA (in: hFindFile=0x5be1a0, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0100.133] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0100.133] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0100.133] FindNextFileA (in: hFindFile=0x5be1a0, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0 [0100.133] FindClose (in: hFindFile=0x5be1a0 | out: hFindFile=0x5be1a0) returned 1 [0100.133] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0100.133] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0100.134] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="StarterApplicationDescriptors.xml") returned -1 [0100.134] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="StarterApplicationDescriptors.xml") returned -1 [0100.134] lstrcmpiA (lpString1="", lpString2="StarterApplicationDescriptors.xml") returned -1 [0100.134] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\*.*") returned="*.*" [0100.134] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\", lpString2="StarterApplicationDescriptors.xml" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterApplicationDescriptors.xml") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterApplicationDescriptors.xml" [0100.134] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0100.134] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0100.134] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="StarterNotificationDescriptors.xml") returned -1 [0100.134] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="StarterNotificationDescriptors.xml") returned -1 [0100.134] lstrcmpiA (lpString1="", lpString2="StarterNotificationDescriptors.xml") returned -1 [0100.134] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterApplicationDescriptors.xml") returned="StarterApplicationDescriptors.xml" [0100.134] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\", lpString2="StarterNotificationDescriptors.xml" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterNotificationDescriptors.xml") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterNotificationDescriptors.xml" [0100.134] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0100.134] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0100.134] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="StarterToolTemplates.xml") returned -1 [0100.134] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="StarterToolTemplates.xml") returned -1 [0100.134] lstrcmpiA (lpString1="", lpString2="StarterToolTemplates.xml") returned -1 [0100.134] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterNotificationDescriptors.xml") returned="StarterNotificationDescriptors.xml" [0100.134] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\", lpString2="StarterToolTemplates.xml" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterToolTemplates.xml") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterToolTemplates.xml" [0100.134] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0 [0100.134] FindClose (in: hFindFile=0x5be160 | out: hFindFile=0x5be160) returned 1 [0100.134] FindNextFileA (in: hFindFile=0x5b7cf0, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0 [0100.134] FindClose (in: hFindFile=0x5b7cf0 | out: hFindFile=0x5b7cf0) returned 1 [0100.134] FindNextFileA (in: hFindFile=0x5b5bd0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0100.134] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0100.134] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="GROOVE.EXE") returned -1 [0100.134] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="GROOVE.EXE") returned 1 [0100.134] lstrcmpiA (lpString1="", lpString2="GROOVE.EXE") returned -1 [0100.134] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\*.*") returned="*.*" [0100.134] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="GROOVE.EXE" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\GROOVE.EXE") returned="C:\\Program Files\\Microsoft Office\\Office14\\GROOVE.EXE" [0100.134] FindNextFileA (in: hFindFile=0x5b5bd0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0100.134] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0100.134] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="GROOVEEX.DLL") returned -1 [0100.134] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="GROOVEEX.DLL") returned 1 [0100.134] lstrcmpiA (lpString1="", lpString2="GROOVEEX.DLL") returned -1 [0100.134] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\GROOVE.EXE") returned="GROOVE.EXE" [0100.134] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="GROOVEEX.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\GROOVEEX.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\GROOVEEX.DLL" [0100.135] FindNextFileA (in: hFindFile=0x5b5bd0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0100.135] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0100.135] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="GROOVEMN.EXE") returned -1 [0100.135] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="GROOVEMN.EXE") returned 1 [0100.135] lstrcmpiA (lpString1="", lpString2="GROOVEMN.EXE") returned -1 [0100.135] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\GROOVEEX.DLL") returned="GROOVEEX.DLL" [0100.135] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="GROOVEMN.EXE" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\GROOVEMN.EXE") returned="C:\\Program Files\\Microsoft Office\\Office14\\GROOVEMN.EXE" [0100.135] FindNextFileA (in: hFindFile=0x5b5bd0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0100.135] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0100.135] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="HVAC.DLL") returned -1 [0100.135] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="HVAC.DLL") returned -1 [0100.135] lstrcmpiA (lpString1="", lpString2="HVAC.DLL") returned -1 [0100.135] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\GROOVEMN.EXE") returned="GROOVEMN.EXE" [0100.135] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="HVAC.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\HVAC.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\HVAC.DLL" [0100.135] FindNextFileA (in: hFindFile=0x5b5bd0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0100.135] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0100.135] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="IEAWSDC.DLL") returned -1 [0100.135] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="IEAWSDC.DLL") returned -1 [0100.135] lstrcmpiA (lpString1="", lpString2="IEAWSDC.DLL") returned -1 [0100.135] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\HVAC.DLL") returned="HVAC.DLL" [0100.135] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="IEAWSDC.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\IEAWSDC.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\IEAWSDC.DLL" [0100.135] FindNextFileA (in: hFindFile=0x5b5bd0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0100.135] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0100.135] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="IEContentService.exe") returned -1 [0100.135] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="IEContentService.exe") returned -1 [0100.135] lstrcmpiA (lpString1="", lpString2="IEContentService.exe") returned -1 [0100.135] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\IEAWSDC.DLL") returned="IEAWSDC.DLL" [0100.135] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="IEContentService.exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\IEContentService.exe") returned="C:\\Program Files\\Microsoft Office\\Office14\\IEContentService.exe" [0100.135] FindNextFileA (in: hFindFile=0x5b5bd0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0100.135] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0100.135] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="IMCOMMON.DLL") returned -1 [0100.135] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="IMCOMMON.DLL") returned -1 [0100.135] lstrcmpiA (lpString1="", lpString2="IMCOMMON.DLL") returned -1 [0100.135] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\IEContentService.exe") returned="IEContentService.exe" [0100.135] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="IMCOMMON.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\IMCOMMON.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\IMCOMMON.DLL" [0100.135] FindNextFileA (in: hFindFile=0x5b5bd0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0100.135] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0100.135] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="IMDIMP.ADD") returned -1 [0100.135] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="IMDIMP.ADD") returned -1 [0100.136] lstrcmpiA (lpString1="", lpString2="IMDIMP.ADD") returned -1 [0100.136] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\IMCOMMON.DLL") returned="IMCOMMON.DLL" [0100.136] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="IMDIMP.ADD" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\IMDIMP.ADD") returned="C:\\Program Files\\Microsoft Office\\Office14\\IMDIMP.ADD" [0100.136] FindNextFileA (in: hFindFile=0x5b5bd0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0100.136] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0100.136] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="IMPMAIL.DLL") returned -1 [0100.136] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="IMPMAIL.DLL") returned -1 [0100.136] lstrcmpiA (lpString1="", lpString2="IMPMAIL.DLL") returned -1 [0100.136] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\IMDIMP.ADD") returned="IMDIMP.ADD" [0100.136] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="IMPMAIL.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\IMPMAIL.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\IMPMAIL.DLL" [0100.136] FindNextFileA (in: hFindFile=0x5b5bd0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0100.136] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0100.136] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="IMUTIL.DLL") returned -1 [0100.136] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="IMUTIL.DLL") returned -1 [0100.136] lstrcmpiA (lpString1="", lpString2="IMUTIL.DLL") returned -1 [0100.136] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\IMPMAIL.DLL") returned="IMPMAIL.DLL" [0100.136] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="IMUTIL.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\IMUTIL.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\IMUTIL.DLL" [0100.136] FindNextFileA (in: hFindFile=0x5b5bd0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0100.136] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0100.136] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="IMWDD.DLL") returned -1 [0100.136] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="IMWDD.DLL") returned -1 [0100.136] lstrcmpiA (lpString1="", lpString2="IMWDD.DLL") returned -1 [0100.136] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\IMUTIL.DLL") returned="IMUTIL.DLL" [0100.136] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="IMWDD.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\IMWDD.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\IMWDD.DLL" [0100.136] FindNextFileA (in: hFindFile=0x5b5bd0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0100.136] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0100.136] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="IMWIZ.DLL") returned -1 [0100.136] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="IMWIZ.DLL") returned -1 [0100.136] lstrcmpiA (lpString1="", lpString2="IMWIZ.DLL") returned -1 [0100.136] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\IMWDD.DLL") returned="IMWDD.DLL" [0100.136] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="IMWIZ.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\IMWIZ.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\IMWIZ.DLL" [0100.136] FindNextFileA (in: hFindFile=0x5b5bd0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0100.136] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0100.136] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="INFOPATH.EXE") returned -1 [0100.136] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="INFOPATH.EXE") returned -1 [0100.136] lstrcmpiA (lpString1="", lpString2="INFOPATH.EXE") returned -1 [0100.136] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\IMWIZ.DLL") returned="IMWIZ.DLL" [0100.136] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="INFOPATH.EXE" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\INFOPATH.EXE") returned="C:\\Program Files\\Microsoft Office\\Office14\\INFOPATH.EXE" [0100.136] FindNextFileA (in: hFindFile=0x5b5bd0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0100.137] lstrcmpA (lpString1=".", lpString2="InfoPathOM") returned -1 [0100.137] lstrcmpA (lpString1="..", lpString2="InfoPathOM") returned -1 [0100.137] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\INFOPATH.EXE") returned="INFOPATH.EXE" [0100.137] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="InfoPathOM" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM") returned="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM" [0100.137] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be160 [0100.177] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0100.177] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0100.177] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0100.177] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0100.177] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0100.177] lstrcmpA (lpString1=".", lpString2="InfoPathOMFormServices") returned -1 [0100.177] lstrcmpA (lpString1="..", lpString2="InfoPathOMFormServices") returned -1 [0100.177] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\*.*") returned="*.*" [0100.177] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\", lpString2="InfoPathOMFormServices" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices") returned="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices" [0100.177] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be1a0 [0100.404] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0100.404] FindNextFileA (in: hFindFile=0x5be1a0, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0100.404] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0100.404] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0100.404] FindNextFileA (in: hFindFile=0x5be1a0, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0100.404] lstrcmpA (lpString1=".", lpString2="InfoPathOMFormServicesV12") returned -1 [0100.404] lstrcmpA (lpString1="..", lpString2="InfoPathOMFormServicesV12") returned -1 [0100.404] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\*.*") returned="*.*" [0100.404] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\", lpString2="InfoPathOMFormServicesV12" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12") returned="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12" [0100.404] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be1e0 [0100.473] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0100.473] FindNextFileA (in: hFindFile=0x5be1e0, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0100.473] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0100.473] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0100.473] FindNextFileA (in: hFindFile=0x5be1e0, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0100.473] PeekMessageA (in: lpMsg=0xaef84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaef84) returned 0 [0100.473] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Microsoft.Office.Infopath.dll") returned -1 [0100.473] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Office.Infopath.dll") returned -1 [0100.473] lstrcmpiA (lpString1="", lpString2="Microsoft.Office.Infopath.dll") returned -1 [0100.473] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\*.*") returned="*.*" [0100.473] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\", lpString2="Microsoft.Office.Infopath.dll" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\Microsoft.Office.Infopath.dll") returned="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\Microsoft.Office.Infopath.dll" [0100.473] FindNextFileA (in: hFindFile=0x5be1e0, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0100.473] PeekMessageA (in: lpMsg=0xaef84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaef84) returned 0 [0100.473] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Microsoft.Office.InfoPath.xml") returned -1 [0100.473] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Office.InfoPath.xml") returned -1 [0100.473] lstrcmpiA (lpString1="", lpString2="Microsoft.Office.InfoPath.xml") returned -1 [0100.473] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\Microsoft.Office.Infopath.dll") returned="Microsoft.Office.Infopath.dll" [0100.473] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\", lpString2="Microsoft.Office.InfoPath.xml" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\Microsoft.Office.InfoPath.xml") returned="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\Microsoft.Office.InfoPath.xml" [0100.473] FindNextFileA (in: hFindFile=0x5be1e0, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0 [0100.473] FindClose (in: hFindFile=0x5be1e0 | out: hFindFile=0x5be1e0) returned 1 [0100.474] FindNextFileA (in: hFindFile=0x5be1a0, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0100.474] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0100.474] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Microsoft.Office.Infopath.dll") returned -1 [0100.474] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Office.Infopath.dll") returned -1 [0100.474] lstrcmpiA (lpString1="", lpString2="Microsoft.Office.Infopath.dll") returned -1 [0100.474] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\*.*") returned="*.*" [0100.474] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\", lpString2="Microsoft.Office.Infopath.dll" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\Microsoft.Office.Infopath.dll") returned="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\Microsoft.Office.Infopath.dll" [0100.474] FindNextFileA (in: hFindFile=0x5be1a0, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0100.474] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0100.474] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Microsoft.Office.InfoPath.xml") returned -1 [0100.474] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Office.InfoPath.xml") returned -1 [0100.474] lstrcmpiA (lpString1="", lpString2="Microsoft.Office.InfoPath.xml") returned -1 [0100.474] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\Microsoft.Office.Infopath.dll") returned="Microsoft.Office.Infopath.dll" [0100.474] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\", lpString2="Microsoft.Office.InfoPath.xml" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\Microsoft.Office.InfoPath.xml") returned="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\Microsoft.Office.InfoPath.xml" [0100.474] FindNextFileA (in: hFindFile=0x5be1a0, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0 [0100.474] FindClose (in: hFindFile=0x5be1a0 | out: hFindFile=0x5be1a0) returned 1 [0100.474] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0100.474] lstrcmpA (lpString1=".", lpString2="InfoPathOMV12") returned -1 [0100.474] lstrcmpA (lpString1="..", lpString2="InfoPathOMV12") returned -1 [0100.474] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\*.*") returned="*.*" [0100.474] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\", lpString2="InfoPathOMV12" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12") returned="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12" [0100.475] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be1a0 [0100.475] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0100.475] FindNextFileA (in: hFindFile=0x5be1a0, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0100.475] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0100.475] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0100.475] FindNextFileA (in: hFindFile=0x5be1a0, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0100.475] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0100.475] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Microsoft.Office.Infopath.dll") returned -1 [0100.475] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Office.Infopath.dll") returned -1 [0100.475] lstrcmpiA (lpString1="", lpString2="Microsoft.Office.Infopath.dll") returned -1 [0100.475] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\*.*") returned="*.*" [0100.475] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\", lpString2="Microsoft.Office.Infopath.dll" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\Microsoft.Office.Infopath.dll") returned="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\Microsoft.Office.Infopath.dll" [0100.475] FindNextFileA (in: hFindFile=0x5be1a0, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0100.475] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0100.475] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Microsoft.Office.InfoPath.xml") returned -1 [0100.475] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Office.InfoPath.xml") returned -1 [0100.475] lstrcmpiA (lpString1="", lpString2="Microsoft.Office.InfoPath.xml") returned -1 [0100.475] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\Microsoft.Office.Infopath.dll") returned="Microsoft.Office.Infopath.dll" [0100.475] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\", lpString2="Microsoft.Office.InfoPath.xml" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\Microsoft.Office.InfoPath.xml") returned="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\Microsoft.Office.InfoPath.xml" [0100.476] FindNextFileA (in: hFindFile=0x5be1a0, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0 [0100.476] FindClose (in: hFindFile=0x5be1a0 | out: hFindFile=0x5be1a0) returned 1 [0100.476] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0100.476] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0100.476] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Microsoft.Office.Infopath.dll") returned -1 [0100.476] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Office.Infopath.dll") returned -1 [0100.476] lstrcmpiA (lpString1="", lpString2="Microsoft.Office.Infopath.dll") returned -1 [0100.476] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\*.*") returned="*.*" [0100.476] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\", lpString2="Microsoft.Office.Infopath.dll" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\Microsoft.Office.Infopath.dll") returned="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\Microsoft.Office.Infopath.dll" [0100.476] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0100.476] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0100.476] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Microsoft.Office.InfoPath.xml") returned -1 [0100.476] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Office.InfoPath.xml") returned -1 [0100.476] lstrcmpiA (lpString1="", lpString2="Microsoft.Office.InfoPath.xml") returned -1 [0100.476] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\Microsoft.Office.Infopath.dll") returned="Microsoft.Office.Infopath.dll" [0100.476] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\", lpString2="Microsoft.Office.InfoPath.xml" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\Microsoft.Office.InfoPath.xml") returned="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\Microsoft.Office.InfoPath.xml" [0100.476] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0 [0100.476] FindClose (in: hFindFile=0x5be160 | out: hFindFile=0x5be160) returned 1 [0100.477] FindNextFileA (in: hFindFile=0x5b5bd0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0100.477] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0100.477] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="INLAUNCH.DLL") returned -1 [0100.477] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="INLAUNCH.DLL") returned -1 [0100.477] lstrcmpiA (lpString1="", lpString2="INLAUNCH.DLL") returned -1 [0100.477] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\*.*") returned="*.*" [0100.477] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="INLAUNCH.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\INLAUNCH.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\INLAUNCH.DLL" [0100.477] FindNextFileA (in: hFindFile=0x5b5bd0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0100.477] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0100.477] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Installed_resources14.xss") returned -1 [0100.477] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Installed_resources14.xss") returned -1 [0100.477] lstrcmpiA (lpString1="", lpString2="Installed_resources14.xss") returned -1 [0100.477] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\INLAUNCH.DLL") returned="INLAUNCH.DLL" [0100.477] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="Installed_resources14.xss" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Installed_resources14.xss") returned="C:\\Program Files\\Microsoft Office\\Office14\\Installed_resources14.xss" [0100.477] FindNextFileA (in: hFindFile=0x5b5bd0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0100.477] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0100.477] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Installed_schemas14.xss") returned -1 [0100.477] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Installed_schemas14.xss") returned -1 [0100.477] lstrcmpiA (lpString1="", lpString2="Installed_schemas14.xss") returned -1 [0100.477] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Installed_resources14.xss") returned="Installed_resources14.xss" [0100.477] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="Installed_schemas14.xss" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Installed_schemas14.xss") returned="C:\\Program Files\\Microsoft Office\\Office14\\Installed_schemas14.xss" [0100.477] FindNextFileA (in: hFindFile=0x5b5bd0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0100.477] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0100.478] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="INTLDATE.DLL") returned -1 [0100.478] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="INTLDATE.DLL") returned -1 [0100.478] lstrcmpiA (lpString1="", lpString2="INTLDATE.DLL") returned -1 [0100.478] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Installed_schemas14.xss") returned="Installed_schemas14.xss" [0100.478] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="INTLDATE.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\INTLDATE.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\INTLDATE.DLL" [0100.478] FindNextFileA (in: hFindFile=0x5b5bd0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0100.478] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0100.478] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="IPDESIGN.DLL") returned -1 [0100.478] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="IPDESIGN.DLL") returned -1 [0100.478] lstrcmpiA (lpString1="", lpString2="IPDESIGN.DLL") returned -1 [0100.478] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\INTLDATE.DLL") returned="INTLDATE.DLL" [0100.478] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="IPDESIGN.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\IPDESIGN.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\IPDESIGN.DLL" [0100.478] FindNextFileA (in: hFindFile=0x5b5bd0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0100.478] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0100.478] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="IPEDITOR.DLL") returned -1 [0100.478] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="IPEDITOR.DLL") returned -1 [0100.478] lstrcmpiA (lpString1="", lpString2="IPEDITOR.DLL") returned -1 [0100.478] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\IPDESIGN.DLL") returned="IPDESIGN.DLL" [0100.478] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="IPEDITOR.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\IPEDITOR.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\IPEDITOR.DLL" [0100.478] FindNextFileA (in: hFindFile=0x5b5bd0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0100.478] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0100.478] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="IPIRM.XML") returned -1 [0100.478] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="IPIRM.XML") returned -1 [0100.478] lstrcmpiA (lpString1="", lpString2="IPIRM.XML") returned -1 [0100.478] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\IPEDITOR.DLL") returned="IPEDITOR.DLL" [0100.478] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="IPIRM.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\IPIRM.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\IPIRM.XML" [0100.479] FindNextFileA (in: hFindFile=0x5b5bd0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0100.479] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0100.479] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="IPIRMV.XML") returned -1 [0100.479] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="IPIRMV.XML") returned -1 [0100.479] lstrcmpiA (lpString1="", lpString2="IPIRMV.XML") returned -1 [0100.479] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\IPIRM.XML") returned="IPIRM.XML" [0100.479] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="IPIRMV.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\IPIRMV.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\IPIRMV.XML" [0100.479] FindNextFileA (in: hFindFile=0x5b5bd0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0100.479] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0100.479] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="IPOLK.DLL") returned -1 [0100.479] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="IPOLK.DLL") returned -1 [0100.479] lstrcmpiA (lpString1="", lpString2="IPOLK.DLL") returned -1 [0100.479] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\IPIRMV.XML") returned="IPIRMV.XML" [0100.479] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="IPOLK.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\IPOLK.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\IPOLK.DLL" [0100.479] FindNextFileA (in: hFindFile=0x5b5bd0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0100.479] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0100.479] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="IXACS.PDL") returned -1 [0100.479] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="IXACS.PDL") returned -1 [0100.479] lstrcmpiA (lpString1="", lpString2="IXACS.PDL") returned -1 [0100.479] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\IPOLK.DLL") returned="IPOLK.DLL" [0100.479] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="IXACS.PDL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\IXACS.PDL") returned="C:\\Program Files\\Microsoft Office\\Office14\\IXACS.PDL" [0100.479] FindNextFileA (in: hFindFile=0x5b5bd0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0100.479] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0100.479] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="IXDB2.PDL") returned -1 [0100.479] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="IXDB2.PDL") returned -1 [0100.479] lstrcmpiA (lpString1="", lpString2="IXDB2.PDL") returned -1 [0100.479] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\IXACS.PDL") returned="IXACS.PDL" [0100.479] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="IXDB2.PDL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\IXDB2.PDL") returned="C:\\Program Files\\Microsoft Office\\Office14\\IXDB2.PDL" [0100.479] FindNextFileA (in: hFindFile=0x5b5bd0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0100.479] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0100.479] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="IXGENERC.PDL") returned -1 [0100.479] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="IXGENERC.PDL") returned -1 [0100.480] lstrcmpiA (lpString1="", lpString2="IXGENERC.PDL") returned -1 [0100.480] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\IXDB2.PDL") returned="IXDB2.PDL" [0100.480] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="IXGENERC.PDL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\IXGENERC.PDL") returned="C:\\Program Files\\Microsoft Office\\Office14\\IXGENERC.PDL" [0100.480] FindNextFileA (in: hFindFile=0x5b5bd0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0100.480] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0100.480] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="IXOLEDB.PDL") returned -1 [0100.480] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="IXOLEDB.PDL") returned -1 [0100.480] lstrcmpiA (lpString1="", lpString2="IXOLEDB.PDL") returned -1 [0100.480] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\IXGENERC.PDL") returned="IXGENERC.PDL" [0100.480] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="IXOLEDB.PDL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\IXOLEDB.PDL") returned="C:\\Program Files\\Microsoft Office\\Office14\\IXOLEDB.PDL" [0100.480] FindNextFileA (in: hFindFile=0x5b5bd0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0100.480] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0100.480] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="IXORACLE.PDL") returned -1 [0100.480] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="IXORACLE.PDL") returned -1 [0100.480] lstrcmpiA (lpString1="", lpString2="IXORACLE.PDL") returned -1 [0100.480] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\IXOLEDB.PDL") returned="IXOLEDB.PDL" [0100.480] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="IXORACLE.PDL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\IXORACLE.PDL") returned="C:\\Program Files\\Microsoft Office\\Office14\\IXORACLE.PDL" [0100.480] FindNextFileA (in: hFindFile=0x5b5bd0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0100.480] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0100.480] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="IXSSRV.PDL") returned -1 [0100.480] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="IXSSRV.PDL") returned -1 [0100.480] lstrcmpiA (lpString1="", lpString2="IXSSRV.PDL") returned -1 [0100.480] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\IXORACLE.PDL") returned="IXORACLE.PDL" [0100.480] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="IXSSRV.PDL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\IXSSRV.PDL") returned="C:\\Program Files\\Microsoft Office\\Office14\\IXSSRV.PDL" [0100.480] FindNextFileA (in: hFindFile=0x5b5bd0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0100.480] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0100.480] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="IXUTIL.DLL") returned -1 [0100.481] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="IXUTIL.DLL") returned -1 [0100.481] lstrcmpiA (lpString1="", lpString2="IXUTIL.DLL") returned -1 [0100.481] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\IXSSRV.PDL") returned="IXSSRV.PDL" [0100.481] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="IXUTIL.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\IXUTIL.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\IXUTIL.DLL" [0100.481] FindNextFileA (in: hFindFile=0x5b5bd0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0100.481] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0100.481] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="JFONT.DAT") returned -1 [0100.481] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="JFONT.DAT") returned -1 [0100.481] lstrcmpiA (lpString1="", lpString2="JFONT.DAT") returned -1 [0100.481] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\IXUTIL.DLL") returned="IXUTIL.DLL" [0100.481] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="JFONT.DAT" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\JFONT.DAT") returned="C:\\Program Files\\Microsoft Office\\Office14\\JFONT.DAT" [0100.481] FindNextFileA (in: hFindFile=0x5b5bd0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0100.481] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0100.481] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="LATIN1.SHP") returned -1 [0100.481] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="LATIN1.SHP") returned -1 [0100.481] lstrcmpiA (lpString1="", lpString2="LATIN1.SHP") returned -1 [0100.481] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\JFONT.DAT") returned="JFONT.DAT" [0100.481] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="LATIN1.SHP" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\LATIN1.SHP") returned="C:\\Program Files\\Microsoft Office\\Office14\\LATIN1.SHP" [0100.481] FindNextFileA (in: hFindFile=0x5b5bd0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0100.481] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0100.481] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="LGND.DLL") returned -1 [0100.481] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="LGND.DLL") returned -1 [0100.481] lstrcmpiA (lpString1="", lpString2="LGND.DLL") returned -1 [0100.481] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\LATIN1.SHP") returned="LATIN1.SHP" [0100.481] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="LGND.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\LGND.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\LGND.DLL" [0100.481] FindNextFileA (in: hFindFile=0x5b5bd0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0100.481] lstrcmpA (lpString1=".", lpString2="Library") returned -1 [0100.481] lstrcmpA (lpString1="..", lpString2="Library") returned -1 [0100.481] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\LGND.DLL") returned="LGND.DLL" [0100.481] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="Library" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Library") returned="C:\\Program Files\\Microsoft Office\\Office14\\Library" [0100.481] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Library\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be160 [0100.482] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0100.482] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0100.482] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0100.482] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0100.482] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0100.482] lstrcmpA (lpString1=".", lpString2="Analysis") returned -1 [0100.482] lstrcmpA (lpString1="..", lpString2="Analysis") returned -1 [0100.482] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Library\\*.*") returned="*.*" [0100.482] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Library\\", lpString2="Analysis" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis") returned="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis" [0100.482] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be1a0 [0100.514] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0100.514] FindNextFileA (in: hFindFile=0x5be1a0, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0100.514] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0100.514] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0100.514] FindNextFileA (in: hFindFile=0x5be1a0, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0100.514] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0100.514] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="ANALYS32.XLL") returned 1 [0100.514] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ANALYS32.XLL") returned 1 [0100.514] lstrcmpiA (lpString1="", lpString2="ANALYS32.XLL") returned -1 [0100.514] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\*.*") returned="*.*" [0100.514] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\", lpString2="ANALYS32.XLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ANALYS32.XLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ANALYS32.XLL" [0100.514] FindNextFileA (in: hFindFile=0x5be1a0, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0100.514] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0100.514] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="ATPVBAEN.XLAM") returned 1 [0100.514] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ATPVBAEN.XLAM") returned 1 [0100.514] lstrcmpiA (lpString1="", lpString2="ATPVBAEN.XLAM") returned -1 [0100.514] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ANALYS32.XLL") returned="ANALYS32.XLL" [0100.514] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\", lpString2="ATPVBAEN.XLAM" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ATPVBAEN.XLAM") returned="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ATPVBAEN.XLAM" [0100.514] FindNextFileA (in: hFindFile=0x5be1a0, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0100.514] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0100.514] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="FUNCRES.XLAM") returned -1 [0100.514] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FUNCRES.XLAM") returned 1 [0100.514] lstrcmpiA (lpString1="", lpString2="FUNCRES.XLAM") returned -1 [0100.514] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ATPVBAEN.XLAM") returned="ATPVBAEN.XLAM" [0100.514] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\", lpString2="FUNCRES.XLAM" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\FUNCRES.XLAM") returned="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\FUNCRES.XLAM" [0100.514] FindNextFileA (in: hFindFile=0x5be1a0, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0100.514] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0100.514] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="PROCDB.XLAM") returned -1 [0100.514] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PROCDB.XLAM") returned -1 [0100.514] lstrcmpiA (lpString1="", lpString2="PROCDB.XLAM") returned -1 [0100.514] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\FUNCRES.XLAM") returned="FUNCRES.XLAM" [0100.515] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\", lpString2="PROCDB.XLAM" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\PROCDB.XLAM") returned="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\PROCDB.XLAM" [0100.515] FindNextFileA (in: hFindFile=0x5be1a0, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0 [0100.515] FindClose (in: hFindFile=0x5be1a0 | out: hFindFile=0x5be1a0) returned 1 [0100.515] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0100.515] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0100.515] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="EUROTOOL.XLAM") returned -1 [0100.515] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="EUROTOOL.XLAM") returned 1 [0100.515] lstrcmpiA (lpString1="", lpString2="EUROTOOL.XLAM") returned -1 [0100.515] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Library\\*.*") returned="*.*" [0100.515] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Library\\", lpString2="EUROTOOL.XLAM" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Library\\EUROTOOL.XLAM") returned="C:\\Program Files\\Microsoft Office\\Office14\\Library\\EUROTOOL.XLAM" [0100.515] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0100.515] lstrcmpA (lpString1=".", lpString2="SOLVER") returned -1 [0100.515] lstrcmpA (lpString1="..", lpString2="SOLVER") returned -1 [0100.515] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Library\\EUROTOOL.XLAM") returned="EUROTOOL.XLAM" [0100.515] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Library\\", lpString2="SOLVER" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER") returned="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER" [0100.516] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be1a0 [0100.516] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0100.516] FindNextFileA (in: hFindFile=0x5be1a0, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0100.516] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0100.516] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0100.516] FindNextFileA (in: hFindFile=0x5be1a0, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0100.516] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0100.516] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\*.*") returned="*.*" [0100.516] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\", lpString2="SOLVER.XLAM" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER.XLAM") returned="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER.XLAM" [0100.516] FindNextFileA (in: hFindFile=0x5be1a0, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0100.516] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0100.516] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER.XLAM") returned="SOLVER.XLAM" [0100.516] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\", lpString2="SOLVER32.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER32.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER32.DLL" [0100.516] FindNextFileA (in: hFindFile=0x5be1a0, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0 [0100.516] FindClose (in: hFindFile=0x5be1a0 | out: hFindFile=0x5be1a0) returned 1 [0100.516] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0 [0100.516] FindClose (in: hFindFile=0x5be160 | out: hFindFile=0x5be160) returned 1 [0100.516] FindNextFileA (in: hFindFile=0x5b5bd0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0100.516] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0100.516] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\*.*") returned="*.*" [0100.516] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="LOGELEMS.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\LOGELEMS.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\LOGELEMS.DLL" [0100.516] FindNextFileA (in: hFindFile=0x5b5bd0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0100.516] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0100.516] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\LOGELEMS.DLL") returned="LOGELEMS.DLL" [0100.517] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="LOGMODEL.MDL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\LOGMODEL.MDL") returned="C:\\Program Files\\Microsoft Office\\Office14\\LOGMODEL.MDL" [0100.517] FindNextFileA (in: hFindFile=0x5b5bd0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0100.645] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0100.645] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\LOGMODEL.MDL") returned="LOGMODEL.MDL" [0100.645] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="LOGVIEW.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\LOGVIEW.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\LOGVIEW.DLL" [0100.646] FindNextFileA (in: hFindFile=0x5b5bd0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0100.646] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0100.646] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\LOGVIEW.DLL") returned="LOGVIEW.DLL" [0100.646] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="LOOKUP.DAT" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\LOOKUP.DAT") returned="C:\\Program Files\\Microsoft Office\\Office14\\LOOKUP.DAT" [0100.646] FindNextFileA (in: hFindFile=0x5b5bd0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0100.646] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0100.646] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\LOOKUP.DAT") returned="LOOKUP.DAT" [0100.646] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="MAPIPH.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MAPIPH.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\MAPIPH.DLL" [0100.646] FindNextFileA (in: hFindFile=0x5b5bd0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0100.646] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0100.646] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MAPIPH.DLL") returned="MAPIPH.DLL" [0100.646] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="MAPISHELL.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MAPISHELL.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\MAPISHELL.DLL" [0100.646] FindNextFileA (in: hFindFile=0x5b5bd0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0100.646] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0100.646] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MAPISHELL.DLL") returned="MAPISHELL.DLL" [0100.646] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="MCPS.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MCPS.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\MCPS.DLL" [0100.646] FindNextFileA (in: hFindFile=0x5b5bd0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0100.646] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0100.646] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MCPS.DLL") returned="MCPS.DLL" [0100.646] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="MEDCAT.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDCAT.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDCAT.DLL" [0100.646] FindNextFileA (in: hFindFile=0x5b5bd0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0100.646] lstrcmpA (lpString1=".", lpString2="MEDIA") returned -1 [0100.646] lstrcmpA (lpString1="..", lpString2="MEDIA") returned -1 [0100.647] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MEDCAT.DLL") returned="MEDCAT.DLL" [0100.647] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="MEDIA" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA" [0100.647] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be160 [0100.662] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0100.662] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0100.662] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0100.662] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0100.662] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0100.662] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0100.662] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\*.*") returned="*.*" [0100.662] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\", lpString2="APPLAUSE.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\APPLAUSE.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\APPLAUSE.WAV" [0100.662] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\APPLAUSE.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\APPLAUSE.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\APPLAUSE.WAV" [0100.662] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\APPLAUSE.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\APPLAUSE.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\APPLAUSE.WAV" [0100.662] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\APPLAUSE.WAV", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\APPLAUSE.WAV.") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\APPLAUSE.WAV." [0100.662] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\APPLAUSE.WAV.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\APPLAUSE.WAV. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\APPLAUSE.WAV. " [0100.662] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\APPLAUSE.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\applause.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c [0100.664] GetFileSize (in: hFile=0x8c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x6daa [0100.664] GetFileTime (in: hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xb796bf00, dwHighDateTime=0x1bd8ab7), lpLastAccessTime=0x407536*(dwLowDateTime=0x5ebdaad0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xb796bf00, dwHighDateTime=0x1bd8ab7)) returned 1 [0100.664] SetFilePointer (in: hFile=0x8c, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0100.664] ReadFile (in: hFile=0x8c, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x6d50, lpOverlapped=0x0) returned 1 [0100.668] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\APPLAUSE.WAV") returned="APPLAUSE.WAV" [0100.668] SetFilePointer (in: hFile=0x8c, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0100.668] WriteFile (in: hFile=0x8c, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x6d50, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x6d50, lpOverlapped=0x0) returned 1 [0100.668] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0100.669] CloseHandle (hObject=0x8c) returned 1 [0100.669] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\APPLAUSE.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\applause.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\APPLAUSE.WAV. " (normalized: "c:\\program files\\microsoft office\\office14\\media\\applause.wav. ")) returned 1 [0100.671] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0100.671] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0100.671] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="ARROW.WAV") returned 1 [0100.671] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ARROW.WAV") returned 1 [0100.671] lstrcmpiA (lpString1="", lpString2="ARROW.WAV") returned -1 [0100.671] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\APPLAUSE.WAV") returned="APPLAUSE.WAV" [0100.671] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\", lpString2="ARROW.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV" [0100.671] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV", pszSpec="*.zip") returned 0 [0100.671] lstrlenA (lpString="*.zip") returned 5 [0100.671] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV", pszSpec="*.rar") returned 0 [0100.671] lstrlenA (lpString="*.rar") returned 5 [0100.671] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV", pszSpec="*.7z") returned 0 [0100.671] lstrlenA (lpString="*.7z") returned 4 [0100.671] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV", pszSpec="*.tar") returned 0 [0100.671] lstrlenA (lpString="*.tar") returned 5 [0100.671] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV", pszSpec="*.gzip") returned 0 [0100.671] lstrlenA (lpString="*.gzip") returned 6 [0100.671] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV", pszSpec="*.jpg") returned 0 [0100.671] lstrlenA (lpString="*.jpg") returned 5 [0100.671] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV", pszSpec="*.jpeg") returned 0 [0100.671] lstrlenA (lpString="*.jpeg") returned 6 [0100.671] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV", pszSpec="*.psd") returned 0 [0100.671] lstrlenA (lpString="*.psd") returned 5 [0100.671] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV", pszSpec="*.cdr") returned 0 [0100.671] lstrlenA (lpString="*.cdr") returned 5 [0100.671] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV", pszSpec="*.dwg") returned 0 [0100.671] lstrlenA (lpString="*.dwg") returned 5 [0100.671] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV", pszSpec="*.max") returned 0 [0100.671] lstrlenA (lpString="*.max") returned 5 [0100.672] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV", pszSpec="*.bmp") returned 0 [0100.672] lstrlenA (lpString="*.bmp") returned 5 [0100.672] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV", pszSpec="*.gif") returned 0 [0100.672] lstrlenA (lpString="*.gif") returned 5 [0100.672] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV", pszSpec="*.png") returned 0 [0100.672] lstrlenA (lpString="*.png") returned 5 [0100.672] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV", pszSpec="*.doc") returned 0 [0100.672] lstrlenA (lpString="*.doc") returned 5 [0100.672] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV", pszSpec="*.docx") returned 0 [0100.672] lstrlenA (lpString="*.docx") returned 6 [0100.672] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV", pszSpec="*.xls") returned 0 [0100.672] lstrlenA (lpString="*.xls") returned 5 [0100.672] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV", pszSpec="*.xlsx") returned 0 [0100.672] lstrlenA (lpString="*.xlsx") returned 6 [0100.672] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV", pszSpec="*.ppt") returned 0 [0100.672] lstrlenA (lpString="*.ppt") returned 5 [0100.672] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV", pszSpec="*.pptx") returned 0 [0100.672] lstrlenA (lpString="*.pptx") returned 6 [0100.672] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV", pszSpec="*.txt") returned 0 [0100.672] lstrlenA (lpString="*.txt") returned 5 [0100.672] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV", pszSpec="*.pdf") returned 0 [0100.672] lstrlenA (lpString="*.pdf") returned 5 [0100.672] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV", pszSpec="*.djvu") returned 0 [0100.672] lstrlenA (lpString="*.djvu") returned 6 [0100.672] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV", pszSpec="*.htm") returned 0 [0100.672] lstrlenA (lpString="*.htm") returned 5 [0100.672] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV", pszSpec="*.html") returned 0 [0100.672] lstrlenA (lpString="*.html") returned 6 [0100.672] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV", pszSpec="*.mdb") returned 0 [0100.672] lstrlenA (lpString="*.mdb") returned 5 [0100.672] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV", pszSpec="*.cer") returned 0 [0100.672] lstrlenA (lpString="*.cer") returned 5 [0100.672] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV", pszSpec="*.p12") returned 0 [0100.672] lstrlenA (lpString="*.p12") returned 5 [0100.672] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV", pszSpec="*.pfx") returned 0 [0100.672] lstrlenA (lpString="*.pfx") returned 5 [0100.672] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV", pszSpec="*.kwm") returned 0 [0100.672] lstrlenA (lpString="*.kwm") returned 5 [0100.672] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV", pszSpec="*.pwm") returned 0 [0100.673] lstrlenA (lpString="*.pwm") returned 5 [0100.673] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV", pszSpec="*.1cd") returned 0 [0100.673] lstrlenA (lpString="*.1cd") returned 5 [0100.673] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV", pszSpec="*.md") returned 0 [0100.673] lstrlenA (lpString="*.md") returned 4 [0100.673] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV", pszSpec="*.mdf") returned 0 [0100.673] lstrlenA (lpString="*.mdf") returned 5 [0100.673] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV", pszSpec="*.dbf") returned 0 [0100.673] lstrlenA (lpString="*.dbf") returned 5 [0100.673] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV", pszSpec="*.odt") returned 0 [0100.673] lstrlenA (lpString="*.odt") returned 5 [0100.673] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV", pszSpec="*.vob") returned 0 [0100.673] lstrlenA (lpString="*.vob") returned 5 [0100.673] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV", pszSpec="*.ifo") returned 0 [0100.674] lstrlenA (lpString="*.ifo") returned 5 [0100.674] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV", pszSpec="*.lnk") returned 0 [0100.674] lstrlenA (lpString="*.lnk") returned 5 [0100.674] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV", pszSpec="*.torrent") returned 0 [0100.674] lstrlenA (lpString="*.torrent") returned 9 [0100.674] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV", pszSpec="*.mov") returned 0 [0100.674] lstrlenA (lpString="*.mov") returned 5 [0100.674] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV", pszSpec="*.m2v") returned 0 [0100.674] lstrlenA (lpString="*.m2v") returned 5 [0100.674] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV", pszSpec="*.3gp") returned 0 [0100.674] lstrlenA (lpString="*.3gp") returned 5 [0100.674] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV", pszSpec="*.mpeg") returned 0 [0100.674] lstrlenA (lpString="*.mpeg") returned 6 [0100.674] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV", pszSpec="*.mpg") returned 0 [0100.674] lstrlenA (lpString="*.mpg") returned 5 [0100.674] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV", pszSpec="*.flv") returned 0 [0100.674] lstrlenA (lpString="*.flv") returned 5 [0100.675] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV", pszSpec="*.avi") returned 0 [0100.675] lstrlenA (lpString="*.avi") returned 5 [0100.675] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV", pszSpec="*.mp4") returned 0 [0100.675] lstrlenA (lpString="*.mp4") returned 5 [0100.675] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV", pszSpec="*.wmv") returned 0 [0100.675] lstrlenA (lpString="*.wmv") returned 5 [0100.675] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV", pszSpec="*.divx") returned 0 [0100.675] lstrlenA (lpString="*.divx") returned 6 [0100.675] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV", pszSpec="*.mkv") returned 0 [0100.675] lstrlenA (lpString="*.mkv") returned 5 [0100.675] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV", pszSpec="*.mp3") returned 0 [0100.675] lstrlenA (lpString="*.mp3") returned 5 [0100.675] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV", pszSpec="*.wav") returned 1 [0100.675] lstrlenA (lpString="*.wav") returned 5 [0100.675] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV" [0100.675] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV" [0100.675] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV.") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV." [0100.675] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV. " [0100.675] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\arrow.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c [0100.676] GetFileSize (in: hFile=0x8c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x59f6 [0100.676] GetFileTime (in: hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xdb46b000, dwHighDateTime=0x1bfbeee), lpLastAccessTime=0x407536*(dwLowDateTime=0x5ed57890, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xdb46b000, dwHighDateTime=0x1bfbeee)) returned 1 [0100.676] SetFilePointer (in: hFile=0x8c, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0100.676] ReadFile (in: hFile=0x8c, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x599c, lpOverlapped=0x0) returned 1 [0100.724] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV") returned="ARROW.WAV" [0100.724] SetFilePointer (in: hFile=0x8c, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0100.724] WriteFile (in: hFile=0x8c, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x599c, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x599c, lpOverlapped=0x0) returned 1 [0100.724] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0100.724] CloseHandle (hObject=0x8c) returned 1 [0100.724] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\arrow.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV. " (normalized: "c:\\program files\\microsoft office\\office14\\media\\arrow.wav. ")) returned 1 [0100.725] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0100.725] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0100.725] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BOMB.WAV") returned 1 [0100.725] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BOMB.WAV") returned 1 [0100.725] lstrcmpiA (lpString1="", lpString2="BOMB.WAV") returned -1 [0100.725] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV") returned="ARROW.WAV" [0100.725] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\", lpString2="BOMB.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV" [0100.725] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV", pszSpec="*.zip") returned 0 [0100.726] lstrlenA (lpString="*.zip") returned 5 [0100.726] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV", pszSpec="*.rar") returned 0 [0100.726] lstrlenA (lpString="*.rar") returned 5 [0100.726] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV", pszSpec="*.7z") returned 0 [0100.726] lstrlenA (lpString="*.7z") returned 4 [0100.726] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV", pszSpec="*.tar") returned 0 [0100.726] lstrlenA (lpString="*.tar") returned 5 [0100.726] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV", pszSpec="*.gzip") returned 0 [0100.726] lstrlenA (lpString="*.gzip") returned 6 [0100.726] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV", pszSpec="*.jpg") returned 0 [0100.726] lstrlenA (lpString="*.jpg") returned 5 [0100.726] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV", pszSpec="*.jpeg") returned 0 [0100.726] lstrlenA (lpString="*.jpeg") returned 6 [0100.726] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV", pszSpec="*.psd") returned 0 [0100.726] lstrlenA (lpString="*.psd") returned 5 [0100.726] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV", pszSpec="*.cdr") returned 0 [0100.726] lstrlenA (lpString="*.cdr") returned 5 [0100.726] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV", pszSpec="*.dwg") returned 0 [0100.726] lstrlenA (lpString="*.dwg") returned 5 [0100.726] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV", pszSpec="*.max") returned 0 [0100.726] lstrlenA (lpString="*.max") returned 5 [0100.726] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV", pszSpec="*.bmp") returned 0 [0100.726] lstrlenA (lpString="*.bmp") returned 5 [0100.726] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV", pszSpec="*.gif") returned 0 [0100.726] lstrlenA (lpString="*.gif") returned 5 [0100.726] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV", pszSpec="*.png") returned 0 [0100.726] lstrlenA (lpString="*.png") returned 5 [0100.726] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV", pszSpec="*.doc") returned 0 [0100.726] lstrlenA (lpString="*.doc") returned 5 [0100.726] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV", pszSpec="*.docx") returned 0 [0100.726] lstrlenA (lpString="*.docx") returned 6 [0100.726] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV", pszSpec="*.xls") returned 0 [0100.726] lstrlenA (lpString="*.xls") returned 5 [0100.726] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV", pszSpec="*.xlsx") returned 0 [0100.726] lstrlenA (lpString="*.xlsx") returned 6 [0100.726] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV", pszSpec="*.ppt") returned 0 [0100.726] lstrlenA (lpString="*.ppt") returned 5 [0100.726] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV", pszSpec="*.pptx") returned 0 [0100.726] lstrlenA (lpString="*.pptx") returned 6 [0100.726] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV", pszSpec="*.txt") returned 0 [0100.726] lstrlenA (lpString="*.txt") returned 5 [0100.727] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV", pszSpec="*.pdf") returned 0 [0100.727] lstrlenA (lpString="*.pdf") returned 5 [0100.727] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV", pszSpec="*.djvu") returned 0 [0100.727] lstrlenA (lpString="*.djvu") returned 6 [0100.727] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV", pszSpec="*.htm") returned 0 [0100.727] lstrlenA (lpString="*.htm") returned 5 [0100.727] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV", pszSpec="*.html") returned 0 [0100.727] lstrlenA (lpString="*.html") returned 6 [0100.727] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV", pszSpec="*.mdb") returned 0 [0100.727] lstrlenA (lpString="*.mdb") returned 5 [0100.727] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV", pszSpec="*.cer") returned 0 [0100.727] lstrlenA (lpString="*.cer") returned 5 [0100.727] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV", pszSpec="*.p12") returned 0 [0100.727] lstrlenA (lpString="*.p12") returned 5 [0100.727] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV", pszSpec="*.pfx") returned 0 [0100.727] lstrlenA (lpString="*.pfx") returned 5 [0100.727] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV", pszSpec="*.kwm") returned 0 [0100.727] lstrlenA (lpString="*.kwm") returned 5 [0100.727] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV", pszSpec="*.pwm") returned 0 [0100.727] lstrlenA (lpString="*.pwm") returned 5 [0100.727] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV", pszSpec="*.1cd") returned 0 [0100.727] lstrlenA (lpString="*.1cd") returned 5 [0100.727] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV", pszSpec="*.md") returned 0 [0100.727] lstrlenA (lpString="*.md") returned 4 [0100.727] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV", pszSpec="*.mdf") returned 0 [0100.727] lstrlenA (lpString="*.mdf") returned 5 [0100.727] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV", pszSpec="*.dbf") returned 0 [0100.727] lstrlenA (lpString="*.dbf") returned 5 [0100.727] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV", pszSpec="*.odt") returned 0 [0100.727] lstrlenA (lpString="*.odt") returned 5 [0100.727] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV", pszSpec="*.vob") returned 0 [0100.727] lstrlenA (lpString="*.vob") returned 5 [0100.727] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV", pszSpec="*.ifo") returned 0 [0100.727] lstrlenA (lpString="*.ifo") returned 5 [0100.727] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV", pszSpec="*.lnk") returned 0 [0100.727] lstrlenA (lpString="*.lnk") returned 5 [0100.727] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV", pszSpec="*.torrent") returned 0 [0100.727] lstrlenA (lpString="*.torrent") returned 9 [0100.727] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV", pszSpec="*.mov") returned 0 [0100.727] lstrlenA (lpString="*.mov") returned 5 [0100.727] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV", pszSpec="*.m2v") returned 0 [0100.728] lstrlenA (lpString="*.m2v") returned 5 [0100.728] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV", pszSpec="*.3gp") returned 0 [0100.728] lstrlenA (lpString="*.3gp") returned 5 [0100.728] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV", pszSpec="*.mpeg") returned 0 [0100.728] lstrlenA (lpString="*.mpeg") returned 6 [0100.728] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV", pszSpec="*.mpg") returned 0 [0100.728] lstrlenA (lpString="*.mpg") returned 5 [0100.728] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV", pszSpec="*.flv") returned 0 [0100.728] lstrlenA (lpString="*.flv") returned 5 [0100.728] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV", pszSpec="*.avi") returned 0 [0100.728] lstrlenA (lpString="*.avi") returned 5 [0100.728] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV", pszSpec="*.mp4") returned 0 [0100.728] lstrlenA (lpString="*.mp4") returned 5 [0100.728] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV", pszSpec="*.wmv") returned 0 [0100.728] lstrlenA (lpString="*.wmv") returned 5 [0100.728] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV", pszSpec="*.divx") returned 0 [0100.728] lstrlenA (lpString="*.divx") returned 6 [0100.728] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV", pszSpec="*.mkv") returned 0 [0100.728] lstrlenA (lpString="*.mkv") returned 5 [0100.728] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV", pszSpec="*.mp3") returned 0 [0100.728] lstrlenA (lpString="*.mp3") returned 5 [0100.728] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV", pszSpec="*.wav") returned 1 [0100.728] lstrlenA (lpString="*.wav") returned 5 [0100.728] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV" [0100.728] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV" [0100.728] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV.") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV." [0100.728] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV. " [0100.728] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\bomb.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c [0100.729] GetFileSize (in: hFile=0x8c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2f676 [0100.729] GetFileTime (in: hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x90776900, dwHighDateTime=0x1bfbeeb), lpLastAccessTime=0x407536*(dwLowDateTime=0x51a15810, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x90776900, dwHighDateTime=0x1bfbeeb)) returned 1 [0100.729] SetFilePointer (in: hFile=0x8c, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0100.729] ReadFile (in: hFile=0x8c, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x2f61c, lpOverlapped=0x0) returned 1 [0100.837] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV") returned="BOMB.WAV" [0100.838] SetFilePointer (in: hFile=0x8c, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0100.838] WriteFile (in: hFile=0x8c, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x2f61c, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x2f61c, lpOverlapped=0x0) returned 1 [0100.839] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0100.839] CloseHandle (hObject=0x8c) returned 1 [0100.839] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\bomb.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV. " (normalized: "c:\\program files\\microsoft office\\office14\\media\\bomb.wav. ")) returned 1 [0100.840] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0100.840] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0100.840] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BREEZE.WAV") returned 1 [0100.840] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BREEZE.WAV") returned 1 [0100.840] lstrcmpiA (lpString1="", lpString2="BREEZE.WAV") returned -1 [0100.840] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV") returned="BOMB.WAV" [0100.841] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\", lpString2="BREEZE.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV" [0100.841] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV", pszSpec="*.zip") returned 0 [0100.841] lstrlenA (lpString="*.zip") returned 5 [0100.841] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV", pszSpec="*.rar") returned 0 [0100.841] lstrlenA (lpString="*.rar") returned 5 [0100.841] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV", pszSpec="*.7z") returned 0 [0100.841] lstrlenA (lpString="*.7z") returned 4 [0100.841] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV", pszSpec="*.tar") returned 0 [0100.841] lstrlenA (lpString="*.tar") returned 5 [0100.841] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV", pszSpec="*.gzip") returned 0 [0100.841] lstrlenA (lpString="*.gzip") returned 6 [0100.841] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV", pszSpec="*.jpg") returned 0 [0100.841] lstrlenA (lpString="*.jpg") returned 5 [0100.841] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV", pszSpec="*.jpeg") returned 0 [0100.841] lstrlenA (lpString="*.jpeg") returned 6 [0100.841] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV", pszSpec="*.psd") returned 0 [0100.841] lstrlenA (lpString="*.psd") returned 5 [0100.841] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV", pszSpec="*.cdr") returned 0 [0100.841] lstrlenA (lpString="*.cdr") returned 5 [0100.841] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV", pszSpec="*.dwg") returned 0 [0100.841] lstrlenA (lpString="*.dwg") returned 5 [0100.841] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV", pszSpec="*.max") returned 0 [0100.841] lstrlenA (lpString="*.max") returned 5 [0100.841] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV", pszSpec="*.bmp") returned 0 [0100.841] lstrlenA (lpString="*.bmp") returned 5 [0100.841] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV", pszSpec="*.gif") returned 0 [0100.841] lstrlenA (lpString="*.gif") returned 5 [0100.841] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV", pszSpec="*.png") returned 0 [0100.841] lstrlenA (lpString="*.png") returned 5 [0100.841] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV", pszSpec="*.doc") returned 0 [0100.841] lstrlenA (lpString="*.doc") returned 5 [0100.841] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV", pszSpec="*.docx") returned 0 [0100.841] lstrlenA (lpString="*.docx") returned 6 [0100.841] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV", pszSpec="*.xls") returned 0 [0100.841] lstrlenA (lpString="*.xls") returned 5 [0100.841] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV", pszSpec="*.xlsx") returned 0 [0100.841] lstrlenA (lpString="*.xlsx") returned 6 [0100.841] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV", pszSpec="*.ppt") returned 0 [0100.842] lstrlenA (lpString="*.ppt") returned 5 [0100.842] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV", pszSpec="*.pptx") returned 0 [0100.842] lstrlenA (lpString="*.pptx") returned 6 [0100.842] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV", pszSpec="*.txt") returned 0 [0100.842] lstrlenA (lpString="*.txt") returned 5 [0100.842] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV", pszSpec="*.pdf") returned 0 [0100.842] lstrlenA (lpString="*.pdf") returned 5 [0100.842] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV", pszSpec="*.djvu") returned 0 [0100.842] lstrlenA (lpString="*.djvu") returned 6 [0100.842] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV", pszSpec="*.htm") returned 0 [0100.842] lstrlenA (lpString="*.htm") returned 5 [0100.842] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV", pszSpec="*.html") returned 0 [0100.842] lstrlenA (lpString="*.html") returned 6 [0100.842] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV", pszSpec="*.mdb") returned 0 [0100.842] lstrlenA (lpString="*.mdb") returned 5 [0100.842] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV", pszSpec="*.cer") returned 0 [0100.842] lstrlenA (lpString="*.cer") returned 5 [0100.842] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV", pszSpec="*.p12") returned 0 [0100.842] lstrlenA (lpString="*.p12") returned 5 [0100.842] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV", pszSpec="*.pfx") returned 0 [0100.842] lstrlenA (lpString="*.pfx") returned 5 [0100.842] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV", pszSpec="*.kwm") returned 0 [0100.842] lstrlenA (lpString="*.kwm") returned 5 [0100.842] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV", pszSpec="*.pwm") returned 0 [0100.842] lstrlenA (lpString="*.pwm") returned 5 [0100.842] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV", pszSpec="*.1cd") returned 0 [0100.842] lstrlenA (lpString="*.1cd") returned 5 [0100.842] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV", pszSpec="*.md") returned 0 [0100.842] lstrlenA (lpString="*.md") returned 4 [0100.842] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV", pszSpec="*.mdf") returned 0 [0100.842] lstrlenA (lpString="*.mdf") returned 5 [0100.842] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV", pszSpec="*.dbf") returned 0 [0100.842] lstrlenA (lpString="*.dbf") returned 5 [0100.842] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV", pszSpec="*.odt") returned 0 [0100.842] lstrlenA (lpString="*.odt") returned 5 [0100.842] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV", pszSpec="*.vob") returned 0 [0100.842] lstrlenA (lpString="*.vob") returned 5 [0100.842] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV", pszSpec="*.ifo") returned 0 [0100.843] lstrlenA (lpString="*.ifo") returned 5 [0100.843] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV", pszSpec="*.lnk") returned 0 [0100.843] lstrlenA (lpString="*.lnk") returned 5 [0100.843] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV", pszSpec="*.torrent") returned 0 [0100.843] lstrlenA (lpString="*.torrent") returned 9 [0100.843] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV", pszSpec="*.mov") returned 0 [0100.843] lstrlenA (lpString="*.mov") returned 5 [0100.843] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV", pszSpec="*.m2v") returned 0 [0100.843] lstrlenA (lpString="*.m2v") returned 5 [0100.843] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV", pszSpec="*.3gp") returned 0 [0100.843] lstrlenA (lpString="*.3gp") returned 5 [0100.843] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV", pszSpec="*.mpeg") returned 0 [0100.843] lstrlenA (lpString="*.mpeg") returned 6 [0100.843] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV", pszSpec="*.mpg") returned 0 [0100.843] lstrlenA (lpString="*.mpg") returned 5 [0100.843] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV", pszSpec="*.flv") returned 0 [0100.843] lstrlenA (lpString="*.flv") returned 5 [0100.843] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV", pszSpec="*.avi") returned 0 [0100.843] lstrlenA (lpString="*.avi") returned 5 [0100.843] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV", pszSpec="*.mp4") returned 0 [0100.843] lstrlenA (lpString="*.mp4") returned 5 [0100.843] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV", pszSpec="*.wmv") returned 0 [0100.843] lstrlenA (lpString="*.wmv") returned 5 [0100.843] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV", pszSpec="*.divx") returned 0 [0100.843] lstrlenA (lpString="*.divx") returned 6 [0100.843] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV", pszSpec="*.mkv") returned 0 [0100.843] lstrlenA (lpString="*.mkv") returned 5 [0100.843] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV", pszSpec="*.mp3") returned 0 [0100.843] lstrlenA (lpString="*.mp3") returned 5 [0100.843] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV", pszSpec="*.wav") returned 1 [0100.843] lstrlenA (lpString="*.wav") returned 5 [0100.843] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV" [0100.843] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV" [0100.843] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV.") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV." [0100.843] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV. " [0100.843] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\breeze.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c [0100.844] GetFileSize (in: hFile=0x8c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x10c2 [0100.844] GetFileTime (in: hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x106db200, dwHighDateTime=0x1bfc6e8), lpLastAccessTime=0x407536*(dwLowDateTime=0x6003c730, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x106db200, dwHighDateTime=0x1bfc6e8)) returned 1 [0100.844] SetFilePointer (in: hFile=0x8c, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0100.844] ReadFile (in: hFile=0x8c, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x1068, lpOverlapped=0x0) returned 1 [0100.857] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV") returned="BREEZE.WAV" [0100.857] SetFilePointer (in: hFile=0x8c, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0100.857] WriteFile (in: hFile=0x8c, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x1068, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x1068, lpOverlapped=0x0) returned 1 [0100.857] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0100.857] CloseHandle (hObject=0x8c) returned 1 [0100.857] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\breeze.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV. " (normalized: "c:\\program files\\microsoft office\\office14\\media\\breeze.wav. ")) returned 1 [0100.858] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0100.858] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0100.858] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="CAMERA.WAV") returned 1 [0100.858] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="CAMERA.WAV") returned 1 [0100.858] lstrcmpiA (lpString1="", lpString2="CAMERA.WAV") returned -1 [0100.858] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV") returned="BREEZE.WAV" [0100.858] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\", lpString2="CAMERA.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV" [0100.858] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV", pszSpec="*.zip") returned 0 [0100.859] lstrlenA (lpString="*.zip") returned 5 [0100.859] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV", pszSpec="*.rar") returned 0 [0100.859] lstrlenA (lpString="*.rar") returned 5 [0100.859] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV", pszSpec="*.7z") returned 0 [0100.859] lstrlenA (lpString="*.7z") returned 4 [0100.859] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV", pszSpec="*.tar") returned 0 [0100.859] lstrlenA (lpString="*.tar") returned 5 [0100.859] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV", pszSpec="*.gzip") returned 0 [0100.859] lstrlenA (lpString="*.gzip") returned 6 [0100.859] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV", pszSpec="*.jpg") returned 0 [0100.859] lstrlenA (lpString="*.jpg") returned 5 [0100.859] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV", pszSpec="*.jpeg") returned 0 [0100.859] lstrlenA (lpString="*.jpeg") returned 6 [0100.859] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV", pszSpec="*.psd") returned 0 [0100.859] lstrlenA (lpString="*.psd") returned 5 [0100.859] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV", pszSpec="*.cdr") returned 0 [0100.859] lstrlenA (lpString="*.cdr") returned 5 [0100.859] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV", pszSpec="*.dwg") returned 0 [0100.859] lstrlenA (lpString="*.dwg") returned 5 [0100.859] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV", pszSpec="*.max") returned 0 [0100.859] lstrlenA (lpString="*.max") returned 5 [0100.859] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV", pszSpec="*.bmp") returned 0 [0100.859] lstrlenA (lpString="*.bmp") returned 5 [0100.859] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV", pszSpec="*.gif") returned 0 [0100.859] lstrlenA (lpString="*.gif") returned 5 [0100.859] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV", pszSpec="*.png") returned 0 [0100.859] lstrlenA (lpString="*.png") returned 5 [0100.859] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV", pszSpec="*.doc") returned 0 [0100.859] lstrlenA (lpString="*.doc") returned 5 [0100.859] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV", pszSpec="*.docx") returned 0 [0100.859] lstrlenA (lpString="*.docx") returned 6 [0100.859] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV", pszSpec="*.xls") returned 0 [0100.859] lstrlenA (lpString="*.xls") returned 5 [0100.859] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV", pszSpec="*.xlsx") returned 0 [0100.859] lstrlenA (lpString="*.xlsx") returned 6 [0100.859] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV", pszSpec="*.ppt") returned 0 [0100.859] lstrlenA (lpString="*.ppt") returned 5 [0100.859] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV", pszSpec="*.pptx") returned 0 [0100.859] lstrlenA (lpString="*.pptx") returned 6 [0100.860] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV", pszSpec="*.txt") returned 0 [0100.860] lstrlenA (lpString="*.txt") returned 5 [0100.860] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV", pszSpec="*.pdf") returned 0 [0100.860] lstrlenA (lpString="*.pdf") returned 5 [0100.860] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV", pszSpec="*.djvu") returned 0 [0100.860] lstrlenA (lpString="*.djvu") returned 6 [0100.860] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV", pszSpec="*.htm") returned 0 [0100.860] lstrlenA (lpString="*.htm") returned 5 [0100.860] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV", pszSpec="*.html") returned 0 [0100.860] lstrlenA (lpString="*.html") returned 6 [0100.860] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV", pszSpec="*.mdb") returned 0 [0100.860] lstrlenA (lpString="*.mdb") returned 5 [0100.860] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV", pszSpec="*.cer") returned 0 [0100.860] lstrlenA (lpString="*.cer") returned 5 [0100.860] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV", pszSpec="*.p12") returned 0 [0100.860] lstrlenA (lpString="*.p12") returned 5 [0100.860] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV", pszSpec="*.pfx") returned 0 [0100.860] lstrlenA (lpString="*.pfx") returned 5 [0100.860] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV", pszSpec="*.kwm") returned 0 [0100.860] lstrlenA (lpString="*.kwm") returned 5 [0100.860] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV", pszSpec="*.pwm") returned 0 [0100.860] lstrlenA (lpString="*.pwm") returned 5 [0100.860] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV", pszSpec="*.1cd") returned 0 [0100.860] lstrlenA (lpString="*.1cd") returned 5 [0100.860] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV", pszSpec="*.md") returned 0 [0100.860] lstrlenA (lpString="*.md") returned 4 [0100.860] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV", pszSpec="*.mdf") returned 0 [0100.860] lstrlenA (lpString="*.mdf") returned 5 [0100.860] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV", pszSpec="*.dbf") returned 0 [0100.860] lstrlenA (lpString="*.dbf") returned 5 [0100.860] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV", pszSpec="*.odt") returned 0 [0100.860] lstrlenA (lpString="*.odt") returned 5 [0100.860] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV", pszSpec="*.vob") returned 0 [0100.860] lstrlenA (lpString="*.vob") returned 5 [0100.860] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV", pszSpec="*.ifo") returned 0 [0100.860] lstrlenA (lpString="*.ifo") returned 5 [0100.860] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV", pszSpec="*.lnk") returned 0 [0100.860] lstrlenA (lpString="*.lnk") returned 5 [0100.860] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV", pszSpec="*.torrent") returned 0 [0100.861] lstrlenA (lpString="*.torrent") returned 9 [0100.861] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV", pszSpec="*.mov") returned 0 [0100.861] lstrlenA (lpString="*.mov") returned 5 [0100.861] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV", pszSpec="*.m2v") returned 0 [0100.861] lstrlenA (lpString="*.m2v") returned 5 [0100.861] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV", pszSpec="*.3gp") returned 0 [0100.861] lstrlenA (lpString="*.3gp") returned 5 [0100.861] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV", pszSpec="*.mpeg") returned 0 [0100.861] lstrlenA (lpString="*.mpeg") returned 6 [0100.861] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV", pszSpec="*.mpg") returned 0 [0100.861] lstrlenA (lpString="*.mpg") returned 5 [0100.861] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV", pszSpec="*.flv") returned 0 [0100.861] lstrlenA (lpString="*.flv") returned 5 [0100.861] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV", pszSpec="*.avi") returned 0 [0100.861] lstrlenA (lpString="*.avi") returned 5 [0100.861] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV", pszSpec="*.mp4") returned 0 [0100.861] lstrlenA (lpString="*.mp4") returned 5 [0100.861] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV", pszSpec="*.wmv") returned 0 [0100.861] lstrlenA (lpString="*.wmv") returned 5 [0100.861] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV", pszSpec="*.divx") returned 0 [0100.861] lstrlenA (lpString="*.divx") returned 6 [0100.861] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV", pszSpec="*.mkv") returned 0 [0100.861] lstrlenA (lpString="*.mkv") returned 5 [0100.861] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV", pszSpec="*.mp3") returned 0 [0100.861] lstrlenA (lpString="*.mp3") returned 5 [0100.861] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV", pszSpec="*.wav") returned 1 [0100.861] lstrlenA (lpString="*.wav") returned 5 [0100.861] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV" [0100.861] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV" [0100.861] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV.") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV." [0100.861] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV. " [0100.861] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\camera.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c [0100.863] GetFileSize (in: hFile=0x8c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1594 [0100.863] GetFileTime (in: hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x1b50b600, dwHighDateTime=0x1bc8d47), lpLastAccessTime=0x407536*(dwLowDateTime=0x51c2ab50, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x1b50b600, dwHighDateTime=0x1bc8d47)) returned 1 [0100.863] SetFilePointer (in: hFile=0x8c, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0100.863] ReadFile (in: hFile=0x8c, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x153a, lpOverlapped=0x0) returned 1 [0100.865] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV") returned="CAMERA.WAV" [0100.865] SetFilePointer (in: hFile=0x8c, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0100.865] WriteFile (in: hFile=0x8c, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x153a, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x153a, lpOverlapped=0x0) returned 1 [0100.865] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0100.865] CloseHandle (hObject=0x8c) returned 1 [0100.865] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\camera.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV. " (normalized: "c:\\program files\\microsoft office\\office14\\media\\camera.wav. ")) returned 1 [0100.867] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0100.867] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0100.867] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="CASHREG.WAV") returned 1 [0100.867] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="CASHREG.WAV") returned 1 [0100.867] lstrcmpiA (lpString1="", lpString2="CASHREG.WAV") returned -1 [0100.867] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV") returned="CAMERA.WAV" [0100.867] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\", lpString2="CASHREG.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV" [0100.867] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV", pszSpec="*.zip") returned 0 [0100.867] lstrlenA (lpString="*.zip") returned 5 [0100.867] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV", pszSpec="*.rar") returned 0 [0100.867] lstrlenA (lpString="*.rar") returned 5 [0100.867] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV", pszSpec="*.7z") returned 0 [0100.868] lstrlenA (lpString="*.7z") returned 4 [0100.868] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV", pszSpec="*.tar") returned 0 [0100.868] lstrlenA (lpString="*.tar") returned 5 [0100.868] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV", pszSpec="*.gzip") returned 0 [0100.868] lstrlenA (lpString="*.gzip") returned 6 [0100.868] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV", pszSpec="*.jpg") returned 0 [0100.868] lstrlenA (lpString="*.jpg") returned 5 [0100.868] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV", pszSpec="*.jpeg") returned 0 [0100.868] lstrlenA (lpString="*.jpeg") returned 6 [0100.868] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV", pszSpec="*.psd") returned 0 [0100.868] lstrlenA (lpString="*.psd") returned 5 [0100.868] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV", pszSpec="*.cdr") returned 0 [0100.868] lstrlenA (lpString="*.cdr") returned 5 [0100.868] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV", pszSpec="*.dwg") returned 0 [0100.868] lstrlenA (lpString="*.dwg") returned 5 [0100.868] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV", pszSpec="*.max") returned 0 [0100.868] lstrlenA (lpString="*.max") returned 5 [0100.868] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV", pszSpec="*.bmp") returned 0 [0100.868] lstrlenA (lpString="*.bmp") returned 5 [0100.868] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV", pszSpec="*.gif") returned 0 [0100.868] lstrlenA (lpString="*.gif") returned 5 [0100.868] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV", pszSpec="*.png") returned 0 [0100.868] lstrlenA (lpString="*.png") returned 5 [0100.868] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV", pszSpec="*.doc") returned 0 [0100.868] lstrlenA (lpString="*.doc") returned 5 [0100.868] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV", pszSpec="*.docx") returned 0 [0100.868] lstrlenA (lpString="*.docx") returned 6 [0100.868] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV", pszSpec="*.xls") returned 0 [0100.868] lstrlenA (lpString="*.xls") returned 5 [0100.868] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV", pszSpec="*.xlsx") returned 0 [0100.868] lstrlenA (lpString="*.xlsx") returned 6 [0100.868] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV", pszSpec="*.ppt") returned 0 [0100.868] lstrlenA (lpString="*.ppt") returned 5 [0100.868] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV", pszSpec="*.pptx") returned 0 [0100.868] lstrlenA (lpString="*.pptx") returned 6 [0100.868] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV", pszSpec="*.txt") returned 0 [0100.868] lstrlenA (lpString="*.txt") returned 5 [0100.868] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV", pszSpec="*.pdf") returned 0 [0100.869] lstrlenA (lpString="*.pdf") returned 5 [0100.869] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV", pszSpec="*.djvu") returned 0 [0100.869] lstrlenA (lpString="*.djvu") returned 6 [0100.869] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV", pszSpec="*.htm") returned 0 [0100.869] lstrlenA (lpString="*.htm") returned 5 [0100.869] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV", pszSpec="*.html") returned 0 [0100.869] lstrlenA (lpString="*.html") returned 6 [0100.869] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV", pszSpec="*.mdb") returned 0 [0100.869] lstrlenA (lpString="*.mdb") returned 5 [0100.869] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV", pszSpec="*.cer") returned 0 [0100.869] lstrlenA (lpString="*.cer") returned 5 [0100.869] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV", pszSpec="*.p12") returned 0 [0100.869] lstrlenA (lpString="*.p12") returned 5 [0100.869] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV", pszSpec="*.pfx") returned 0 [0100.869] lstrlenA (lpString="*.pfx") returned 5 [0100.869] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV", pszSpec="*.kwm") returned 0 [0100.869] lstrlenA (lpString="*.kwm") returned 5 [0100.869] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV", pszSpec="*.pwm") returned 0 [0100.869] lstrlenA (lpString="*.pwm") returned 5 [0100.869] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV", pszSpec="*.1cd") returned 0 [0100.869] lstrlenA (lpString="*.1cd") returned 5 [0100.869] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV", pszSpec="*.md") returned 0 [0100.869] lstrlenA (lpString="*.md") returned 4 [0100.869] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV", pszSpec="*.mdf") returned 0 [0100.869] lstrlenA (lpString="*.mdf") returned 5 [0100.869] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV", pszSpec="*.dbf") returned 0 [0100.869] lstrlenA (lpString="*.dbf") returned 5 [0100.869] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV", pszSpec="*.odt") returned 0 [0100.869] lstrlenA (lpString="*.odt") returned 5 [0100.869] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV", pszSpec="*.vob") returned 0 [0100.869] lstrlenA (lpString="*.vob") returned 5 [0100.869] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV", pszSpec="*.ifo") returned 0 [0100.869] lstrlenA (lpString="*.ifo") returned 5 [0100.871] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV", pszSpec="*.lnk") returned 0 [0100.871] lstrlenA (lpString="*.lnk") returned 5 [0100.871] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV", pszSpec="*.torrent") returned 0 [0100.871] lstrlenA (lpString="*.torrent") returned 9 [0100.871] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV", pszSpec="*.mov") returned 0 [0100.871] lstrlenA (lpString="*.mov") returned 5 [0100.871] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV", pszSpec="*.m2v") returned 0 [0100.871] lstrlenA (lpString="*.m2v") returned 5 [0100.871] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV", pszSpec="*.3gp") returned 0 [0100.871] lstrlenA (lpString="*.3gp") returned 5 [0100.871] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV", pszSpec="*.mpeg") returned 0 [0100.871] lstrlenA (lpString="*.mpeg") returned 6 [0100.871] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV", pszSpec="*.mpg") returned 0 [0100.871] lstrlenA (lpString="*.mpg") returned 5 [0100.871] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV", pszSpec="*.flv") returned 0 [0100.871] lstrlenA (lpString="*.flv") returned 5 [0100.871] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV", pszSpec="*.avi") returned 0 [0100.871] lstrlenA (lpString="*.avi") returned 5 [0100.871] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV", pszSpec="*.mp4") returned 0 [0100.871] lstrlenA (lpString="*.mp4") returned 5 [0100.871] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV", pszSpec="*.wmv") returned 0 [0100.871] lstrlenA (lpString="*.wmv") returned 5 [0100.871] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV", pszSpec="*.divx") returned 0 [0100.871] lstrlenA (lpString="*.divx") returned 6 [0100.871] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV", pszSpec="*.mkv") returned 0 [0100.871] lstrlenA (lpString="*.mkv") returned 5 [0100.871] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV", pszSpec="*.mp3") returned 0 [0100.871] lstrlenA (lpString="*.mp3") returned 5 [0100.871] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV", pszSpec="*.wav") returned 1 [0100.871] lstrlenA (lpString="*.wav") returned 5 [0100.871] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV" [0100.872] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV" [0100.872] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV.") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV." [0100.872] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV. " [0100.872] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\cashreg.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c [0100.872] GetFileSize (in: hFile=0x8c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1d7f [0100.872] GetFileTime (in: hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x1b50b600, dwHighDateTime=0x1bc8d47), lpLastAccessTime=0x407536*(dwLowDateTime=0x51c50cb0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x1b50b600, dwHighDateTime=0x1bc8d47)) returned 1 [0100.872] SetFilePointer (in: hFile=0x8c, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0100.873] ReadFile (in: hFile=0x8c, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x1d25, lpOverlapped=0x0) returned 1 [0100.874] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV") returned="CASHREG.WAV" [0100.874] SetFilePointer (in: hFile=0x8c, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0100.874] WriteFile (in: hFile=0x8c, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x1d25, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x1d25, lpOverlapped=0x0) returned 1 [0100.874] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0100.874] CloseHandle (hObject=0x8c) returned 1 [0100.874] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\cashreg.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV. " (normalized: "c:\\program files\\microsoft office\\office14\\media\\cashreg.wav. ")) returned 1 [0100.875] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0100.875] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0100.875] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="CHIMES.WAV") returned 1 [0100.875] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="CHIMES.WAV") returned 1 [0100.875] lstrcmpiA (lpString1="", lpString2="CHIMES.WAV") returned -1 [0100.875] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV") returned="CASHREG.WAV" [0100.875] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\", lpString2="CHIMES.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV" [0100.875] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV", pszSpec="*.zip") returned 0 [0100.875] lstrlenA (lpString="*.zip") returned 5 [0100.875] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV", pszSpec="*.rar") returned 0 [0100.875] lstrlenA (lpString="*.rar") returned 5 [0100.875] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV", pszSpec="*.7z") returned 0 [0100.875] lstrlenA (lpString="*.7z") returned 4 [0100.875] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV", pszSpec="*.tar") returned 0 [0100.875] lstrlenA (lpString="*.tar") returned 5 [0100.875] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV", pszSpec="*.gzip") returned 0 [0100.876] lstrlenA (lpString="*.gzip") returned 6 [0100.876] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV", pszSpec="*.jpg") returned 0 [0100.876] lstrlenA (lpString="*.jpg") returned 5 [0100.876] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV", pszSpec="*.jpeg") returned 0 [0100.876] lstrlenA (lpString="*.jpeg") returned 6 [0100.876] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV", pszSpec="*.psd") returned 0 [0100.876] lstrlenA (lpString="*.psd") returned 5 [0100.876] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV", pszSpec="*.cdr") returned 0 [0100.876] lstrlenA (lpString="*.cdr") returned 5 [0100.876] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV", pszSpec="*.dwg") returned 0 [0100.876] lstrlenA (lpString="*.dwg") returned 5 [0100.876] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV", pszSpec="*.max") returned 0 [0100.876] lstrlenA (lpString="*.max") returned 5 [0100.876] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV", pszSpec="*.bmp") returned 0 [0100.876] lstrlenA (lpString="*.bmp") returned 5 [0100.876] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV", pszSpec="*.gif") returned 0 [0100.876] lstrlenA (lpString="*.gif") returned 5 [0100.876] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV", pszSpec="*.png") returned 0 [0100.876] lstrlenA (lpString="*.png") returned 5 [0100.876] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV", pszSpec="*.doc") returned 0 [0100.876] lstrlenA (lpString="*.doc") returned 5 [0100.876] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV", pszSpec="*.docx") returned 0 [0100.876] lstrlenA (lpString="*.docx") returned 6 [0100.876] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV", pszSpec="*.xls") returned 0 [0100.876] lstrlenA (lpString="*.xls") returned 5 [0100.876] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV", pszSpec="*.xlsx") returned 0 [0100.876] lstrlenA (lpString="*.xlsx") returned 6 [0100.876] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV", pszSpec="*.ppt") returned 0 [0100.876] lstrlenA (lpString="*.ppt") returned 5 [0100.876] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV", pszSpec="*.pptx") returned 0 [0100.876] lstrlenA (lpString="*.pptx") returned 6 [0100.876] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV", pszSpec="*.txt") returned 0 [0100.876] lstrlenA (lpString="*.txt") returned 5 [0100.876] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV", pszSpec="*.pdf") returned 0 [0100.876] lstrlenA (lpString="*.pdf") returned 5 [0100.876] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV", pszSpec="*.djvu") returned 0 [0100.876] lstrlenA (lpString="*.djvu") returned 6 [0100.876] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV", pszSpec="*.htm") returned 0 [0100.876] lstrlenA (lpString="*.htm") returned 5 [0100.877] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV", pszSpec="*.html") returned 0 [0100.877] lstrlenA (lpString="*.html") returned 6 [0100.877] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV", pszSpec="*.mdb") returned 0 [0100.877] lstrlenA (lpString="*.mdb") returned 5 [0100.877] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV", pszSpec="*.cer") returned 0 [0100.877] lstrlenA (lpString="*.cer") returned 5 [0100.877] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV", pszSpec="*.p12") returned 0 [0100.877] lstrlenA (lpString="*.p12") returned 5 [0100.877] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV", pszSpec="*.pfx") returned 0 [0100.877] lstrlenA (lpString="*.pfx") returned 5 [0100.877] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV", pszSpec="*.kwm") returned 0 [0100.877] lstrlenA (lpString="*.kwm") returned 5 [0100.877] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV", pszSpec="*.pwm") returned 0 [0100.877] lstrlenA (lpString="*.pwm") returned 5 [0100.877] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV", pszSpec="*.1cd") returned 0 [0100.877] lstrlenA (lpString="*.1cd") returned 5 [0100.877] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV", pszSpec="*.md") returned 0 [0100.877] lstrlenA (lpString="*.md") returned 4 [0100.877] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV", pszSpec="*.mdf") returned 0 [0100.877] lstrlenA (lpString="*.mdf") returned 5 [0100.877] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV", pszSpec="*.dbf") returned 0 [0100.877] lstrlenA (lpString="*.dbf") returned 5 [0100.877] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV", pszSpec="*.odt") returned 0 [0100.877] lstrlenA (lpString="*.odt") returned 5 [0100.877] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV", pszSpec="*.vob") returned 0 [0100.877] lstrlenA (lpString="*.vob") returned 5 [0100.877] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV", pszSpec="*.ifo") returned 0 [0100.877] lstrlenA (lpString="*.ifo") returned 5 [0100.877] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV", pszSpec="*.lnk") returned 0 [0100.877] lstrlenA (lpString="*.lnk") returned 5 [0100.877] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV", pszSpec="*.torrent") returned 0 [0100.877] lstrlenA (lpString="*.torrent") returned 9 [0100.877] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV", pszSpec="*.mov") returned 0 [0100.877] lstrlenA (lpString="*.mov") returned 5 [0100.877] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV", pszSpec="*.m2v") returned 0 [0100.877] lstrlenA (lpString="*.m2v") returned 5 [0100.877] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV", pszSpec="*.3gp") returned 0 [0100.877] lstrlenA (lpString="*.3gp") returned 5 [0100.878] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV", pszSpec="*.mpeg") returned 0 [0100.878] lstrlenA (lpString="*.mpeg") returned 6 [0100.878] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV", pszSpec="*.mpg") returned 0 [0100.878] lstrlenA (lpString="*.mpg") returned 5 [0100.878] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV", pszSpec="*.flv") returned 0 [0100.878] lstrlenA (lpString="*.flv") returned 5 [0100.878] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV", pszSpec="*.avi") returned 0 [0100.878] lstrlenA (lpString="*.avi") returned 5 [0100.878] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV", pszSpec="*.mp4") returned 0 [0100.878] lstrlenA (lpString="*.mp4") returned 5 [0100.878] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV", pszSpec="*.wmv") returned 0 [0100.878] lstrlenA (lpString="*.wmv") returned 5 [0100.878] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV", pszSpec="*.divx") returned 0 [0100.878] lstrlenA (lpString="*.divx") returned 6 [0100.878] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV", pszSpec="*.mkv") returned 0 [0100.878] lstrlenA (lpString="*.mkv") returned 5 [0100.878] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV", pszSpec="*.mp3") returned 0 [0100.878] lstrlenA (lpString="*.mp3") returned 5 [0100.878] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV", pszSpec="*.wav") returned 1 [0100.878] lstrlenA (lpString="*.wav") returned 5 [0100.878] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV" [0100.878] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV" [0100.878] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV.") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV." [0100.878] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV. " [0100.878] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\chimes.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c [0100.879] GetFileSize (in: hFile=0x8c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x91be [0100.879] GetFileTime (in: hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xb796bf00, dwHighDateTime=0x1bd8ab7), lpLastAccessTime=0x407536*(dwLowDateTime=0x51c76e10, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xb796bf00, dwHighDateTime=0x1bd8ab7)) returned 1 [0100.879] SetFilePointer (in: hFile=0x8c, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0100.880] ReadFile (in: hFile=0x8c, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x9164, lpOverlapped=0x0) returned 1 [0100.918] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV") returned="CHIMES.WAV" [0100.918] SetFilePointer (in: hFile=0x8c, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0100.918] WriteFile (in: hFile=0x8c, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x9164, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x9164, lpOverlapped=0x0) returned 1 [0100.918] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0100.919] CloseHandle (hObject=0x8c) returned 1 [0100.919] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\chimes.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV. " (normalized: "c:\\program files\\microsoft office\\office14\\media\\chimes.wav. ")) returned 1 [0100.919] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0100.919] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0100.920] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="CLICK.WAV") returned 1 [0100.920] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="CLICK.WAV") returned 1 [0100.920] lstrcmpiA (lpString1="", lpString2="CLICK.WAV") returned -1 [0100.920] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV") returned="CHIMES.WAV" [0100.920] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\", lpString2="CLICK.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV" [0100.920] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV", pszSpec="*.zip") returned 0 [0100.920] lstrlenA (lpString="*.zip") returned 5 [0100.920] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV", pszSpec="*.rar") returned 0 [0100.920] lstrlenA (lpString="*.rar") returned 5 [0100.920] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV", pszSpec="*.7z") returned 0 [0100.920] lstrlenA (lpString="*.7z") returned 4 [0100.920] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV", pszSpec="*.tar") returned 0 [0100.920] lstrlenA (lpString="*.tar") returned 5 [0100.920] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV", pszSpec="*.gzip") returned 0 [0100.920] lstrlenA (lpString="*.gzip") returned 6 [0100.920] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV", pszSpec="*.jpg") returned 0 [0100.920] lstrlenA (lpString="*.jpg") returned 5 [0100.920] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV", pszSpec="*.jpeg") returned 0 [0100.920] lstrlenA (lpString="*.jpeg") returned 6 [0100.920] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV", pszSpec="*.psd") returned 0 [0100.920] lstrlenA (lpString="*.psd") returned 5 [0100.920] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV", pszSpec="*.cdr") returned 0 [0100.920] lstrlenA (lpString="*.cdr") returned 5 [0100.920] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV", pszSpec="*.dwg") returned 0 [0100.920] lstrlenA (lpString="*.dwg") returned 5 [0100.920] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV", pszSpec="*.max") returned 0 [0100.920] lstrlenA (lpString="*.max") returned 5 [0100.920] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV", pszSpec="*.bmp") returned 0 [0100.920] lstrlenA (lpString="*.bmp") returned 5 [0100.920] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV", pszSpec="*.gif") returned 0 [0100.920] lstrlenA (lpString="*.gif") returned 5 [0100.920] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV", pszSpec="*.png") returned 0 [0100.920] lstrlenA (lpString="*.png") returned 5 [0100.920] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV", pszSpec="*.doc") returned 0 [0100.920] lstrlenA (lpString="*.doc") returned 5 [0100.920] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV", pszSpec="*.docx") returned 0 [0100.920] lstrlenA (lpString="*.docx") returned 6 [0100.920] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV", pszSpec="*.xls") returned 0 [0100.920] lstrlenA (lpString="*.xls") returned 5 [0100.920] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV", pszSpec="*.xlsx") returned 0 [0100.920] lstrlenA (lpString="*.xlsx") returned 6 [0100.920] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV", pszSpec="*.ppt") returned 0 [0100.920] lstrlenA (lpString="*.ppt") returned 5 [0100.920] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV", pszSpec="*.pptx") returned 0 [0100.921] lstrlenA (lpString="*.pptx") returned 6 [0100.921] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV", pszSpec="*.txt") returned 0 [0100.921] lstrlenA (lpString="*.txt") returned 5 [0100.921] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV", pszSpec="*.pdf") returned 0 [0100.921] lstrlenA (lpString="*.pdf") returned 5 [0100.921] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV", pszSpec="*.djvu") returned 0 [0100.921] lstrlenA (lpString="*.djvu") returned 6 [0100.921] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV", pszSpec="*.htm") returned 0 [0100.921] lstrlenA (lpString="*.htm") returned 5 [0100.921] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV", pszSpec="*.html") returned 0 [0100.921] lstrlenA (lpString="*.html") returned 6 [0100.921] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV", pszSpec="*.mdb") returned 0 [0100.921] lstrlenA (lpString="*.mdb") returned 5 [0100.921] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV", pszSpec="*.cer") returned 0 [0100.921] lstrlenA (lpString="*.cer") returned 5 [0100.921] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV", pszSpec="*.p12") returned 0 [0100.921] lstrlenA (lpString="*.p12") returned 5 [0100.921] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV", pszSpec="*.pfx") returned 0 [0100.921] lstrlenA (lpString="*.pfx") returned 5 [0100.921] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV", pszSpec="*.kwm") returned 0 [0100.921] lstrlenA (lpString="*.kwm") returned 5 [0100.921] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV", pszSpec="*.pwm") returned 0 [0100.921] lstrlenA (lpString="*.pwm") returned 5 [0100.921] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV", pszSpec="*.1cd") returned 0 [0100.921] lstrlenA (lpString="*.1cd") returned 5 [0100.921] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV", pszSpec="*.md") returned 0 [0100.921] lstrlenA (lpString="*.md") returned 4 [0100.921] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV", pszSpec="*.mdf") returned 0 [0100.921] lstrlenA (lpString="*.mdf") returned 5 [0100.921] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV", pszSpec="*.dbf") returned 0 [0100.921] lstrlenA (lpString="*.dbf") returned 5 [0100.921] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV", pszSpec="*.odt") returned 0 [0100.921] lstrlenA (lpString="*.odt") returned 5 [0100.921] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV", pszSpec="*.vob") returned 0 [0100.921] lstrlenA (lpString="*.vob") returned 5 [0100.921] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV", pszSpec="*.ifo") returned 0 [0100.921] lstrlenA (lpString="*.ifo") returned 5 [0100.921] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV", pszSpec="*.lnk") returned 0 [0100.921] lstrlenA (lpString="*.lnk") returned 5 [0100.921] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV", pszSpec="*.torrent") returned 0 [0100.921] lstrlenA (lpString="*.torrent") returned 9 [0100.921] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV", pszSpec="*.mov") returned 0 [0100.921] lstrlenA (lpString="*.mov") returned 5 [0100.921] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV", pszSpec="*.m2v") returned 0 [0100.922] lstrlenA (lpString="*.m2v") returned 5 [0100.922] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV", pszSpec="*.3gp") returned 0 [0100.922] lstrlenA (lpString="*.3gp") returned 5 [0100.922] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV", pszSpec="*.mpeg") returned 0 [0100.922] lstrlenA (lpString="*.mpeg") returned 6 [0100.923] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV", pszSpec="*.mpg") returned 0 [0100.923] lstrlenA (lpString="*.mpg") returned 5 [0100.923] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV", pszSpec="*.flv") returned 0 [0100.923] lstrlenA (lpString="*.flv") returned 5 [0100.923] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV", pszSpec="*.avi") returned 0 [0100.923] lstrlenA (lpString="*.avi") returned 5 [0100.923] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV", pszSpec="*.mp4") returned 0 [0100.923] lstrlenA (lpString="*.mp4") returned 5 [0100.923] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV", pszSpec="*.wmv") returned 0 [0100.923] lstrlenA (lpString="*.wmv") returned 5 [0100.923] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV", pszSpec="*.divx") returned 0 [0100.923] lstrlenA (lpString="*.divx") returned 6 [0100.923] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV", pszSpec="*.mkv") returned 0 [0100.923] lstrlenA (lpString="*.mkv") returned 5 [0100.923] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV", pszSpec="*.mp3") returned 0 [0100.923] lstrlenA (lpString="*.mp3") returned 5 [0100.923] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV", pszSpec="*.wav") returned 1 [0100.923] lstrlenA (lpString="*.wav") returned 5 [0100.923] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV" [0100.923] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV" [0100.923] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV.") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV." [0100.923] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV. " [0100.923] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\click.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c [0100.924] GetFileSize (in: hFile=0x8c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x268 [0100.924] GetFileTime (in: hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xffbd3c00, dwHighDateTime=0x1bfc6e7), lpLastAccessTime=0x407536*(dwLowDateTime=0x51c76e10, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xffbd3c00, dwHighDateTime=0x1bfc6e7)) returned 1 [0100.924] SetFilePointer (in: hFile=0x8c, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0100.924] ReadFile (in: hFile=0x8c, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x20e, lpOverlapped=0x0) returned 1 [0100.925] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV") returned="CLICK.WAV" [0100.925] SetFilePointer (in: hFile=0x8c, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0100.925] WriteFile (in: hFile=0x8c, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x20e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x20e, lpOverlapped=0x0) returned 1 [0100.925] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0100.925] CloseHandle (hObject=0x8c) returned 1 [0100.925] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\click.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV. " (normalized: "c:\\program files\\microsoft office\\office14\\media\\click.wav. ")) returned 1 [0100.926] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0100.926] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0100.926] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="COIN.WAV") returned 1 [0100.926] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="COIN.WAV") returned 1 [0100.926] lstrcmpiA (lpString1="", lpString2="COIN.WAV") returned -1 [0100.926] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV") returned="CLICK.WAV" [0100.926] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\", lpString2="COIN.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV" [0100.926] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV", pszSpec="*.zip") returned 0 [0100.926] lstrlenA (lpString="*.zip") returned 5 [0100.926] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV", pszSpec="*.rar") returned 0 [0100.926] lstrlenA (lpString="*.rar") returned 5 [0100.926] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV", pszSpec="*.7z") returned 0 [0100.926] lstrlenA (lpString="*.7z") returned 4 [0100.926] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV", pszSpec="*.tar") returned 0 [0100.926] lstrlenA (lpString="*.tar") returned 5 [0100.926] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV", pszSpec="*.gzip") returned 0 [0100.926] lstrlenA (lpString="*.gzip") returned 6 [0100.926] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV", pszSpec="*.jpg") returned 0 [0100.926] lstrlenA (lpString="*.jpg") returned 5 [0100.926] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV", pszSpec="*.jpeg") returned 0 [0100.926] lstrlenA (lpString="*.jpeg") returned 6 [0100.926] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV", pszSpec="*.psd") returned 0 [0100.926] lstrlenA (lpString="*.psd") returned 5 [0100.926] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV", pszSpec="*.cdr") returned 0 [0100.926] lstrlenA (lpString="*.cdr") returned 5 [0100.926] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV", pszSpec="*.dwg") returned 0 [0100.926] lstrlenA (lpString="*.dwg") returned 5 [0100.927] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV", pszSpec="*.max") returned 0 [0100.927] lstrlenA (lpString="*.max") returned 5 [0100.927] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV", pszSpec="*.bmp") returned 0 [0100.927] lstrlenA (lpString="*.bmp") returned 5 [0100.927] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV", pszSpec="*.gif") returned 0 [0100.927] lstrlenA (lpString="*.gif") returned 5 [0100.927] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV", pszSpec="*.png") returned 0 [0100.927] lstrlenA (lpString="*.png") returned 5 [0100.927] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV", pszSpec="*.doc") returned 0 [0100.927] lstrlenA (lpString="*.doc") returned 5 [0100.927] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV", pszSpec="*.docx") returned 0 [0100.927] lstrlenA (lpString="*.docx") returned 6 [0100.927] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV", pszSpec="*.xls") returned 0 [0100.927] lstrlenA (lpString="*.xls") returned 5 [0100.927] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV", pszSpec="*.xlsx") returned 0 [0100.927] lstrlenA (lpString="*.xlsx") returned 6 [0100.927] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV", pszSpec="*.ppt") returned 0 [0100.927] lstrlenA (lpString="*.ppt") returned 5 [0100.927] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV", pszSpec="*.pptx") returned 0 [0100.927] lstrlenA (lpString="*.pptx") returned 6 [0100.927] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV", pszSpec="*.txt") returned 0 [0100.927] lstrlenA (lpString="*.txt") returned 5 [0100.927] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV", pszSpec="*.pdf") returned 0 [0100.927] lstrlenA (lpString="*.pdf") returned 5 [0100.927] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV", pszSpec="*.djvu") returned 0 [0100.927] lstrlenA (lpString="*.djvu") returned 6 [0100.928] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV", pszSpec="*.htm") returned 0 [0100.928] lstrlenA (lpString="*.htm") returned 5 [0100.928] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV", pszSpec="*.html") returned 0 [0100.928] lstrlenA (lpString="*.html") returned 6 [0100.928] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV", pszSpec="*.mdb") returned 0 [0100.928] lstrlenA (lpString="*.mdb") returned 5 [0100.928] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV", pszSpec="*.cer") returned 0 [0100.928] lstrlenA (lpString="*.cer") returned 5 [0100.928] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV", pszSpec="*.p12") returned 0 [0100.928] lstrlenA (lpString="*.p12") returned 5 [0100.928] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV", pszSpec="*.pfx") returned 0 [0100.928] lstrlenA (lpString="*.pfx") returned 5 [0100.928] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV", pszSpec="*.kwm") returned 0 [0100.928] lstrlenA (lpString="*.kwm") returned 5 [0100.928] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV", pszSpec="*.pwm") returned 0 [0100.928] lstrlenA (lpString="*.pwm") returned 5 [0100.928] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV", pszSpec="*.1cd") returned 0 [0100.929] lstrlenA (lpString="*.1cd") returned 5 [0100.929] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV", pszSpec="*.md") returned 0 [0100.929] lstrlenA (lpString="*.md") returned 4 [0100.929] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV", pszSpec="*.mdf") returned 0 [0100.929] lstrlenA (lpString="*.mdf") returned 5 [0100.929] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV", pszSpec="*.dbf") returned 0 [0100.929] lstrlenA (lpString="*.dbf") returned 5 [0100.929] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV", pszSpec="*.odt") returned 0 [0100.929] lstrlenA (lpString="*.odt") returned 5 [0100.929] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV", pszSpec="*.vob") returned 0 [0100.929] lstrlenA (lpString="*.vob") returned 5 [0100.929] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV", pszSpec="*.ifo") returned 0 [0100.929] lstrlenA (lpString="*.ifo") returned 5 [0100.929] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV", pszSpec="*.lnk") returned 0 [0100.929] lstrlenA (lpString="*.lnk") returned 5 [0100.929] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV", pszSpec="*.torrent") returned 0 [0100.929] lstrlenA (lpString="*.torrent") returned 9 [0100.929] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV", pszSpec="*.mov") returned 0 [0100.929] lstrlenA (lpString="*.mov") returned 5 [0100.929] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV", pszSpec="*.m2v") returned 0 [0100.929] lstrlenA (lpString="*.m2v") returned 5 [0100.929] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV", pszSpec="*.3gp") returned 0 [0100.929] lstrlenA (lpString="*.3gp") returned 5 [0100.929] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV", pszSpec="*.mpeg") returned 0 [0100.929] lstrlenA (lpString="*.mpeg") returned 6 [0100.929] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV", pszSpec="*.mpg") returned 0 [0100.929] lstrlenA (lpString="*.mpg") returned 5 [0100.929] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV", pszSpec="*.flv") returned 0 [0100.929] lstrlenA (lpString="*.flv") returned 5 [0100.929] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV", pszSpec="*.avi") returned 0 [0100.929] lstrlenA (lpString="*.avi") returned 5 [0100.929] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV", pszSpec="*.mp4") returned 0 [0100.929] lstrlenA (lpString="*.mp4") returned 5 [0100.929] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV", pszSpec="*.wmv") returned 0 [0100.929] lstrlenA (lpString="*.wmv") returned 5 [0100.929] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV", pszSpec="*.divx") returned 0 [0100.929] lstrlenA (lpString="*.divx") returned 6 [0100.929] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV", pszSpec="*.mkv") returned 0 [0100.929] lstrlenA (lpString="*.mkv") returned 5 [0100.929] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV", pszSpec="*.mp3") returned 0 [0100.930] lstrlenA (lpString="*.mp3") returned 5 [0100.930] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV", pszSpec="*.wav") returned 1 [0100.930] lstrlenA (lpString="*.wav") returned 5 [0100.930] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV" [0100.930] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV" [0100.930] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV.") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV." [0100.930] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV. " [0100.930] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\coin.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c [0100.931] GetFileSize (in: hFile=0x8c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x15bc [0100.932] GetFileTime (in: hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xef0cc600, dwHighDateTime=0x1bfc6e7), lpLastAccessTime=0x407536*(dwLowDateTime=0x51c76e10, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xef0cc600, dwHighDateTime=0x1bfc6e7)) returned 1 [0100.932] SetFilePointer (in: hFile=0x8c, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0100.932] ReadFile (in: hFile=0x8c, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x1562, lpOverlapped=0x0) returned 1 [0100.940] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV") returned="COIN.WAV" [0100.940] SetFilePointer (in: hFile=0x8c, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0100.940] WriteFile (in: hFile=0x8c, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x1562, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x1562, lpOverlapped=0x0) returned 1 [0100.940] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0100.940] CloseHandle (hObject=0x8c) returned 1 [0100.940] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\coin.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV. " (normalized: "c:\\program files\\microsoft office\\office14\\media\\coin.wav. ")) returned 1 [0100.941] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0100.941] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0100.941] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="DRUMROLL.WAV") returned 1 [0100.941] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DRUMROLL.WAV") returned 1 [0100.941] lstrcmpiA (lpString1="", lpString2="DRUMROLL.WAV") returned -1 [0100.941] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV") returned="COIN.WAV" [0100.941] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\", lpString2="DRUMROLL.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV" [0100.941] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV", pszSpec="*.zip") returned 0 [0100.941] lstrlenA (lpString="*.zip") returned 5 [0100.941] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV", pszSpec="*.rar") returned 0 [0100.941] lstrlenA (lpString="*.rar") returned 5 [0100.941] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV", pszSpec="*.7z") returned 0 [0100.941] lstrlenA (lpString="*.7z") returned 4 [0100.941] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV", pszSpec="*.tar") returned 0 [0100.941] lstrlenA (lpString="*.tar") returned 5 [0100.941] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV", pszSpec="*.gzip") returned 0 [0100.941] lstrlenA (lpString="*.gzip") returned 6 [0100.941] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV", pszSpec="*.jpg") returned 0 [0100.941] lstrlenA (lpString="*.jpg") returned 5 [0100.941] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV", pszSpec="*.jpeg") returned 0 [0100.941] lstrlenA (lpString="*.jpeg") returned 6 [0100.941] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV", pszSpec="*.psd") returned 0 [0100.941] lstrlenA (lpString="*.psd") returned 5 [0100.941] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV", pszSpec="*.cdr") returned 0 [0100.941] lstrlenA (lpString="*.cdr") returned 5 [0100.941] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV", pszSpec="*.dwg") returned 0 [0100.941] lstrlenA (lpString="*.dwg") returned 5 [0100.941] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV", pszSpec="*.max") returned 0 [0100.941] lstrlenA (lpString="*.max") returned 5 [0100.941] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV", pszSpec="*.bmp") returned 0 [0100.942] lstrlenA (lpString="*.bmp") returned 5 [0100.942] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV", pszSpec="*.gif") returned 0 [0100.942] lstrlenA (lpString="*.gif") returned 5 [0100.942] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV", pszSpec="*.png") returned 0 [0100.942] lstrlenA (lpString="*.png") returned 5 [0100.942] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV", pszSpec="*.doc") returned 0 [0100.942] lstrlenA (lpString="*.doc") returned 5 [0100.942] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV", pszSpec="*.docx") returned 0 [0100.942] lstrlenA (lpString="*.docx") returned 6 [0100.942] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV", pszSpec="*.xls") returned 0 [0100.942] lstrlenA (lpString="*.xls") returned 5 [0100.942] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV", pszSpec="*.xlsx") returned 0 [0100.942] lstrlenA (lpString="*.xlsx") returned 6 [0100.942] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV", pszSpec="*.ppt") returned 0 [0100.942] lstrlenA (lpString="*.ppt") returned 5 [0100.942] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV", pszSpec="*.pptx") returned 0 [0100.942] lstrlenA (lpString="*.pptx") returned 6 [0100.942] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV", pszSpec="*.txt") returned 0 [0100.942] lstrlenA (lpString="*.txt") returned 5 [0100.942] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV", pszSpec="*.pdf") returned 0 [0100.942] lstrlenA (lpString="*.pdf") returned 5 [0100.942] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV", pszSpec="*.djvu") returned 0 [0100.942] lstrlenA (lpString="*.djvu") returned 6 [0100.942] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV", pszSpec="*.htm") returned 0 [0100.942] lstrlenA (lpString="*.htm") returned 5 [0100.942] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV", pszSpec="*.html") returned 0 [0100.942] lstrlenA (lpString="*.html") returned 6 [0100.942] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV", pszSpec="*.mdb") returned 0 [0100.942] lstrlenA (lpString="*.mdb") returned 5 [0100.942] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV", pszSpec="*.cer") returned 0 [0100.942] lstrlenA (lpString="*.cer") returned 5 [0100.942] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV", pszSpec="*.p12") returned 0 [0100.942] lstrlenA (lpString="*.p12") returned 5 [0100.942] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV", pszSpec="*.pfx") returned 0 [0100.942] lstrlenA (lpString="*.pfx") returned 5 [0100.942] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV", pszSpec="*.kwm") returned 0 [0100.942] lstrlenA (lpString="*.kwm") returned 5 [0100.942] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV", pszSpec="*.pwm") returned 0 [0100.942] lstrlenA (lpString="*.pwm") returned 5 [0100.942] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV", pszSpec="*.1cd") returned 0 [0100.942] lstrlenA (lpString="*.1cd") returned 5 [0100.942] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV", pszSpec="*.md") returned 0 [0100.942] lstrlenA (lpString="*.md") returned 4 [0100.942] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV", pszSpec="*.mdf") returned 0 [0100.942] lstrlenA (lpString="*.mdf") returned 5 [0100.942] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV", pszSpec="*.dbf") returned 0 [0100.942] lstrlenA (lpString="*.dbf") returned 5 [0100.942] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV", pszSpec="*.odt") returned 0 [0100.943] lstrlenA (lpString="*.odt") returned 5 [0100.943] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV", pszSpec="*.vob") returned 0 [0100.943] lstrlenA (lpString="*.vob") returned 5 [0100.943] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV", pszSpec="*.ifo") returned 0 [0100.943] lstrlenA (lpString="*.ifo") returned 5 [0100.943] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV", pszSpec="*.lnk") returned 0 [0100.943] lstrlenA (lpString="*.lnk") returned 5 [0100.943] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV", pszSpec="*.torrent") returned 0 [0100.943] lstrlenA (lpString="*.torrent") returned 9 [0100.943] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV", pszSpec="*.mov") returned 0 [0100.943] lstrlenA (lpString="*.mov") returned 5 [0100.943] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV", pszSpec="*.m2v") returned 0 [0100.943] lstrlenA (lpString="*.m2v") returned 5 [0100.943] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV", pszSpec="*.3gp") returned 0 [0100.943] lstrlenA (lpString="*.3gp") returned 5 [0100.943] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV", pszSpec="*.mpeg") returned 0 [0100.943] lstrlenA (lpString="*.mpeg") returned 6 [0100.943] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV", pszSpec="*.mpg") returned 0 [0100.943] lstrlenA (lpString="*.mpg") returned 5 [0100.943] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV", pszSpec="*.flv") returned 0 [0100.943] lstrlenA (lpString="*.flv") returned 5 [0100.943] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV", pszSpec="*.avi") returned 0 [0100.943] lstrlenA (lpString="*.avi") returned 5 [0100.943] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV", pszSpec="*.mp4") returned 0 [0100.943] lstrlenA (lpString="*.mp4") returned 5 [0100.943] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV", pszSpec="*.wmv") returned 0 [0100.943] lstrlenA (lpString="*.wmv") returned 5 [0100.943] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV", pszSpec="*.divx") returned 0 [0100.943] lstrlenA (lpString="*.divx") returned 6 [0100.943] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV", pszSpec="*.mkv") returned 0 [0100.943] lstrlenA (lpString="*.mkv") returned 5 [0100.943] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV", pszSpec="*.mp3") returned 0 [0100.943] lstrlenA (lpString="*.mp3") returned 5 [0100.943] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV", pszSpec="*.wav") returned 1 [0100.943] lstrlenA (lpString="*.wav") returned 5 [0100.943] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV" [0100.943] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV" [0100.943] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV.") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV." [0100.943] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV. " [0100.943] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\drumroll.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c [0100.944] GetFileSize (in: hFile=0x8c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4be2 [0100.944] GetFileTime (in: hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x1b50b600, dwHighDateTime=0x1bc8d47), lpLastAccessTime=0x407536*(dwLowDateTime=0x607d2d50, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x1b50b600, dwHighDateTime=0x1bc8d47)) returned 1 [0100.944] SetFilePointer (in: hFile=0x8c, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0100.945] ReadFile (in: hFile=0x8c, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x4b88, lpOverlapped=0x0) returned 1 [0100.973] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV") returned="DRUMROLL.WAV" [0100.973] SetFilePointer (in: hFile=0x8c, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0100.973] WriteFile (in: hFile=0x8c, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x4b88, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x4b88, lpOverlapped=0x0) returned 1 [0100.974] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0100.974] CloseHandle (hObject=0x8c) returned 1 [0100.974] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\drumroll.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV. " (normalized: "c:\\program files\\microsoft office\\office14\\media\\drumroll.wav. ")) returned 1 [0100.975] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0100.975] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0100.975] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="EXPLODE.WAV") returned -1 [0100.975] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="EXPLODE.WAV") returned 1 [0100.975] lstrcmpiA (lpString1="", lpString2="EXPLODE.WAV") returned -1 [0100.975] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV") returned="DRUMROLL.WAV" [0100.975] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\", lpString2="EXPLODE.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\EXPLODE.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\EXPLODE.WAV" [0100.975] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\EXPLODE.WAV", pszSpec="*.zip") returned 0 [0100.975] lstrlenA (lpString="*.zip") returned 5 [0100.975] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\EXPLODE.WAV", pszSpec="*.rar") returned 0 [0100.975] lstrlenA (lpString="*.rar") returned 5 [0100.975] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\EXPLODE.WAV", pszSpec="*.7z") returned 0 [0100.975] lstrlenA (lpString="*.7z") returned 4 [0100.975] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\EXPLODE.WAV", pszSpec="*.tar") returned 0 [0100.975] lstrlenA (lpString="*.tar") returned 5 [0100.975] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\EXPLODE.WAV", pszSpec="*.gzip") returned 0 [0100.975] lstrlenA (lpString="*.gzip") returned 6 [0100.975] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\EXPLODE.WAV", pszSpec="*.jpg") returned 0 [0100.975] lstrlenA (lpString="*.jpg") returned 5 [0100.975] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\EXPLODE.WAV", pszSpec="*.jpeg") returned 0 [0100.975] lstrlenA (lpString="*.jpeg") returned 6 [0100.975] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\EXPLODE.WAV", pszSpec="*.psd") returned 0 [0100.975] lstrlenA (lpString="*.psd") returned 5 [0100.975] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\EXPLODE.WAV", pszSpec="*.cdr") returned 0 [0100.975] lstrlenA (lpString="*.cdr") returned 5 [0100.975] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\EXPLODE.WAV", pszSpec="*.dwg") returned 0 [0100.975] lstrlenA (lpString="*.dwg") returned 5 [0100.975] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\EXPLODE.WAV", pszSpec="*.max") returned 0 [0100.975] lstrlenA (lpString="*.max") returned 5 [0100.975] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\EXPLODE.WAV", pszSpec="*.bmp") returned 0 [0100.975] lstrlenA (lpString="*.bmp") returned 5 [0100.975] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\EXPLODE.WAV", pszSpec="*.gif") returned 0 [0100.975] lstrlenA (lpString="*.gif") returned 5 [0100.975] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\EXPLODE.WAV", pszSpec="*.png") returned 0 [0100.975] lstrlenA (lpString="*.png") returned 5 [0100.975] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\EXPLODE.WAV", pszSpec="*.doc") returned 0 [0100.975] lstrlenA (lpString="*.doc") returned 5 [0100.975] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\EXPLODE.WAV", pszSpec="*.docx") returned 0 [0100.975] lstrlenA (lpString="*.docx") returned 6 [0100.976] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\EXPLODE.WAV", pszSpec="*.xls") returned 0 [0100.976] lstrlenA (lpString="*.xls") returned 5 [0100.976] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\EXPLODE.WAV", pszSpec="*.xlsx") returned 0 [0100.976] lstrlenA (lpString="*.xlsx") returned 6 [0100.976] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\EXPLODE.WAV", pszSpec="*.ppt") returned 0 [0100.976] lstrlenA (lpString="*.ppt") returned 5 [0100.976] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\EXPLODE.WAV", pszSpec="*.pptx") returned 0 [0100.976] lstrlenA (lpString="*.pptx") returned 6 [0100.976] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\EXPLODE.WAV", pszSpec="*.txt") returned 0 [0100.976] lstrlenA (lpString="*.txt") returned 5 [0100.976] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\EXPLODE.WAV", pszSpec="*.pdf") returned 0 [0100.976] lstrlenA (lpString="*.pdf") returned 5 [0100.976] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\EXPLODE.WAV", pszSpec="*.djvu") returned 0 [0100.976] lstrlenA (lpString="*.djvu") returned 6 [0100.976] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\EXPLODE.WAV", pszSpec="*.htm") returned 0 [0100.976] lstrlenA (lpString="*.htm") returned 5 [0100.976] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\EXPLODE.WAV", pszSpec="*.html") returned 0 [0100.976] lstrlenA (lpString="*.html") returned 6 [0100.976] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\EXPLODE.WAV", pszSpec="*.mdb") returned 0 [0100.976] lstrlenA (lpString="*.mdb") returned 5 [0100.976] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\EXPLODE.WAV", pszSpec="*.cer") returned 0 [0100.976] lstrlenA (lpString="*.cer") returned 5 [0100.976] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\EXPLODE.WAV", pszSpec="*.p12") returned 0 [0100.976] lstrlenA (lpString="*.p12") returned 5 [0100.976] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\EXPLODE.WAV", pszSpec="*.pfx") returned 0 [0100.976] lstrlenA (lpString="*.pfx") returned 5 [0100.976] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\EXPLODE.WAV", pszSpec="*.kwm") returned 0 [0100.976] lstrlenA (lpString="*.kwm") returned 5 [0100.976] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\EXPLODE.WAV", pszSpec="*.pwm") returned 0 [0100.976] lstrlenA (lpString="*.pwm") returned 5 [0100.976] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\EXPLODE.WAV", pszSpec="*.1cd") returned 0 [0100.976] lstrlenA (lpString="*.1cd") returned 5 [0100.976] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\EXPLODE.WAV", pszSpec="*.md") returned 0 [0100.976] lstrlenA (lpString="*.md") returned 4 [0100.976] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\EXPLODE.WAV", pszSpec="*.mdf") returned 0 [0100.976] lstrlenA (lpString="*.mdf") returned 5 [0100.976] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\EXPLODE.WAV", pszSpec="*.dbf") returned 0 [0100.976] lstrlenA (lpString="*.dbf") returned 5 [0100.976] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\EXPLODE.WAV", pszSpec="*.odt") returned 0 [0100.976] lstrlenA (lpString="*.odt") returned 5 [0100.976] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\EXPLODE.WAV", pszSpec="*.vob") returned 0 [0100.976] lstrlenA (lpString="*.vob") returned 5 [0100.976] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\EXPLODE.WAV", pszSpec="*.ifo") returned 0 [0100.976] lstrlenA (lpString="*.ifo") returned 5 [0100.976] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\EXPLODE.WAV", pszSpec="*.lnk") returned 0 [0100.976] lstrlenA (lpString="*.lnk") returned 5 [0100.976] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\EXPLODE.WAV", pszSpec="*.torrent") returned 0 [0100.976] lstrlenA (lpString="*.torrent") returned 9 [0100.977] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\EXPLODE.WAV", pszSpec="*.mov") returned 0 [0100.977] lstrlenA (lpString="*.mov") returned 5 [0100.977] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\EXPLODE.WAV", pszSpec="*.m2v") returned 0 [0100.977] lstrlenA (lpString="*.m2v") returned 5 [0100.977] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\EXPLODE.WAV", pszSpec="*.3gp") returned 0 [0100.977] lstrlenA (lpString="*.3gp") returned 5 [0100.977] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\EXPLODE.WAV", pszSpec="*.mpeg") returned 0 [0100.977] lstrlenA (lpString="*.mpeg") returned 6 [0100.977] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\EXPLODE.WAV", pszSpec="*.mpg") returned 0 [0100.977] lstrlenA (lpString="*.mpg") returned 5 [0100.977] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\EXPLODE.WAV", pszSpec="*.flv") returned 0 [0100.977] lstrlenA (lpString="*.flv") returned 5 [0100.977] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\EXPLODE.WAV", pszSpec="*.avi") returned 0 [0100.977] lstrlenA (lpString="*.avi") returned 5 [0100.977] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\EXPLODE.WAV", pszSpec="*.mp4") returned 0 [0100.977] lstrlenA (lpString="*.mp4") returned 5 [0100.977] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\EXPLODE.WAV", pszSpec="*.wmv") returned 0 [0100.977] lstrlenA (lpString="*.wmv") returned 5 [0100.977] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\EXPLODE.WAV", pszSpec="*.divx") returned 0 [0100.977] lstrlenA (lpString="*.divx") returned 6 [0100.977] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\EXPLODE.WAV", pszSpec="*.mkv") returned 0 [0100.977] lstrlenA (lpString="*.mkv") returned 5 [0100.977] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\EXPLODE.WAV", pszSpec="*.mp3") returned 0 [0100.977] lstrlenA (lpString="*.mp3") returned 5 [0100.977] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\EXPLODE.WAV", pszSpec="*.wav") returned 1 [0100.977] lstrlenA (lpString="*.wav") returned 5 [0100.977] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\EXPLODE.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\EXPLODE.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\EXPLODE.WAV" [0100.977] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\EXPLODE.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\EXPLODE.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\EXPLODE.WAV" [0100.977] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\EXPLODE.WAV", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\EXPLODE.WAV.") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\EXPLODE.WAV." [0100.977] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\EXPLODE.WAV.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\EXPLODE.WAV. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\EXPLODE.WAV. " [0100.977] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\EXPLODE.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\explode.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c [0100.978] GetFileSize (in: hFile=0x8c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x5c20 [0100.978] GetFileTime (in: hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x1b50b600, dwHighDateTime=0x1bc8d47), lpLastAccessTime=0x407536*(dwLowDateTime=0x60af2a30, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x1b50b600, dwHighDateTime=0x1bc8d47)) returned 1 [0100.978] SetFilePointer (in: hFile=0x8c, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0100.978] ReadFile (in: hFile=0x8c, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x5bc6, lpOverlapped=0x0) returned 1 [0101.273] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\EXPLODE.WAV") returned="EXPLODE.WAV" [0101.273] SetFilePointer (in: hFile=0x8c, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0101.273] WriteFile (in: hFile=0x8c, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x5bc6, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x5bc6, lpOverlapped=0x0) returned 1 [0101.273] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0101.273] CloseHandle (hObject=0x8c) returned 1 [0101.273] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\EXPLODE.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\explode.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\EXPLODE.WAV. " (normalized: "c:\\program files\\microsoft office\\office14\\media\\explode.wav. ")) returned 1 [0101.274] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0101.274] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0101.274] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="HAMMER.WAV") returned -1 [0101.274] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="HAMMER.WAV") returned 1 [0101.274] lstrcmpiA (lpString1="", lpString2="HAMMER.WAV") returned -1 [0101.274] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\EXPLODE.WAV") returned="EXPLODE.WAV" [0101.274] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\", lpString2="HAMMER.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HAMMER.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HAMMER.WAV" [0101.274] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HAMMER.WAV", pszSpec="*.zip") returned 0 [0101.274] lstrlenA (lpString="*.zip") returned 5 [0101.274] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HAMMER.WAV", pszSpec="*.rar") returned 0 [0101.274] lstrlenA (lpString="*.rar") returned 5 [0101.274] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HAMMER.WAV", pszSpec="*.7z") returned 0 [0101.274] lstrlenA (lpString="*.7z") returned 4 [0101.274] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HAMMER.WAV", pszSpec="*.tar") returned 0 [0101.274] lstrlenA (lpString="*.tar") returned 5 [0101.275] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HAMMER.WAV", pszSpec="*.gzip") returned 0 [0101.275] lstrlenA (lpString="*.gzip") returned 6 [0101.275] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HAMMER.WAV", pszSpec="*.jpg") returned 0 [0101.275] lstrlenA (lpString="*.jpg") returned 5 [0101.275] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HAMMER.WAV", pszSpec="*.jpeg") returned 0 [0101.275] lstrlenA (lpString="*.jpeg") returned 6 [0101.275] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HAMMER.WAV", pszSpec="*.psd") returned 0 [0101.275] lstrlenA (lpString="*.psd") returned 5 [0101.275] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HAMMER.WAV", pszSpec="*.cdr") returned 0 [0101.275] lstrlenA (lpString="*.cdr") returned 5 [0101.275] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HAMMER.WAV", pszSpec="*.dwg") returned 0 [0101.275] lstrlenA (lpString="*.dwg") returned 5 [0101.275] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HAMMER.WAV", pszSpec="*.max") returned 0 [0101.275] lstrlenA (lpString="*.max") returned 5 [0101.275] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HAMMER.WAV", pszSpec="*.bmp") returned 0 [0101.275] lstrlenA (lpString="*.bmp") returned 5 [0101.275] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HAMMER.WAV", pszSpec="*.gif") returned 0 [0101.275] lstrlenA (lpString="*.gif") returned 5 [0101.275] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HAMMER.WAV", pszSpec="*.png") returned 0 [0101.275] lstrlenA (lpString="*.png") returned 5 [0101.275] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HAMMER.WAV", pszSpec="*.doc") returned 0 [0101.275] lstrlenA (lpString="*.doc") returned 5 [0101.275] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HAMMER.WAV", pszSpec="*.docx") returned 0 [0101.275] lstrlenA (lpString="*.docx") returned 6 [0101.275] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HAMMER.WAV", pszSpec="*.xls") returned 0 [0101.275] lstrlenA (lpString="*.xls") returned 5 [0101.275] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HAMMER.WAV", pszSpec="*.xlsx") returned 0 [0101.275] lstrlenA (lpString="*.xlsx") returned 6 [0101.275] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HAMMER.WAV", pszSpec="*.ppt") returned 0 [0101.275] lstrlenA (lpString="*.ppt") returned 5 [0101.275] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HAMMER.WAV", pszSpec="*.pptx") returned 0 [0101.275] lstrlenA (lpString="*.pptx") returned 6 [0101.275] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HAMMER.WAV", pszSpec="*.txt") returned 0 [0101.275] lstrlenA (lpString="*.txt") returned 5 [0101.275] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HAMMER.WAV", pszSpec="*.pdf") returned 0 [0101.275] lstrlenA (lpString="*.pdf") returned 5 [0101.275] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HAMMER.WAV", pszSpec="*.djvu") returned 0 [0101.275] lstrlenA (lpString="*.djvu") returned 6 [0101.275] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HAMMER.WAV", pszSpec="*.htm") returned 0 [0101.275] lstrlenA (lpString="*.htm") returned 5 [0101.275] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HAMMER.WAV", pszSpec="*.html") returned 0 [0101.276] lstrlenA (lpString="*.html") returned 6 [0101.276] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HAMMER.WAV", pszSpec="*.mdb") returned 0 [0101.276] lstrlenA (lpString="*.mdb") returned 5 [0101.276] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HAMMER.WAV", pszSpec="*.cer") returned 0 [0101.276] lstrlenA (lpString="*.cer") returned 5 [0101.276] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HAMMER.WAV", pszSpec="*.p12") returned 0 [0101.276] lstrlenA (lpString="*.p12") returned 5 [0101.276] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HAMMER.WAV", pszSpec="*.pfx") returned 0 [0101.276] lstrlenA (lpString="*.pfx") returned 5 [0101.276] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HAMMER.WAV", pszSpec="*.kwm") returned 0 [0101.276] lstrlenA (lpString="*.kwm") returned 5 [0101.276] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HAMMER.WAV", pszSpec="*.pwm") returned 0 [0101.276] lstrlenA (lpString="*.pwm") returned 5 [0101.276] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HAMMER.WAV", pszSpec="*.1cd") returned 0 [0101.276] lstrlenA (lpString="*.1cd") returned 5 [0101.276] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HAMMER.WAV", pszSpec="*.md") returned 0 [0101.276] lstrlenA (lpString="*.md") returned 4 [0101.276] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HAMMER.WAV", pszSpec="*.mdf") returned 0 [0101.276] lstrlenA (lpString="*.mdf") returned 5 [0101.276] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HAMMER.WAV", pszSpec="*.dbf") returned 0 [0101.276] lstrlenA (lpString="*.dbf") returned 5 [0101.276] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HAMMER.WAV", pszSpec="*.odt") returned 0 [0101.276] lstrlenA (lpString="*.odt") returned 5 [0101.276] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HAMMER.WAV", pszSpec="*.vob") returned 0 [0101.276] lstrlenA (lpString="*.vob") returned 5 [0101.276] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HAMMER.WAV", pszSpec="*.ifo") returned 0 [0101.276] lstrlenA (lpString="*.ifo") returned 5 [0101.276] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HAMMER.WAV", pszSpec="*.lnk") returned 0 [0101.276] lstrlenA (lpString="*.lnk") returned 5 [0101.276] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HAMMER.WAV", pszSpec="*.torrent") returned 0 [0101.276] lstrlenA (lpString="*.torrent") returned 9 [0101.276] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HAMMER.WAV", pszSpec="*.mov") returned 0 [0101.276] lstrlenA (lpString="*.mov") returned 5 [0101.276] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HAMMER.WAV", pszSpec="*.m2v") returned 0 [0101.276] lstrlenA (lpString="*.m2v") returned 5 [0101.276] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HAMMER.WAV", pszSpec="*.3gp") returned 0 [0101.276] lstrlenA (lpString="*.3gp") returned 5 [0101.277] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HAMMER.WAV", pszSpec="*.mpeg") returned 0 [0101.277] lstrlenA (lpString="*.mpeg") returned 6 [0101.277] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HAMMER.WAV", pszSpec="*.mpg") returned 0 [0101.277] lstrlenA (lpString="*.mpg") returned 5 [0101.277] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HAMMER.WAV", pszSpec="*.flv") returned 0 [0101.277] lstrlenA (lpString="*.flv") returned 5 [0101.277] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HAMMER.WAV", pszSpec="*.avi") returned 0 [0101.277] lstrlenA (lpString="*.avi") returned 5 [0101.277] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HAMMER.WAV", pszSpec="*.mp4") returned 0 [0101.277] lstrlenA (lpString="*.mp4") returned 5 [0101.277] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HAMMER.WAV", pszSpec="*.wmv") returned 0 [0101.277] lstrlenA (lpString="*.wmv") returned 5 [0101.277] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HAMMER.WAV", pszSpec="*.divx") returned 0 [0101.277] lstrlenA (lpString="*.divx") returned 6 [0101.277] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HAMMER.WAV", pszSpec="*.mkv") returned 0 [0101.277] lstrlenA (lpString="*.mkv") returned 5 [0101.277] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HAMMER.WAV", pszSpec="*.mp3") returned 0 [0101.277] lstrlenA (lpString="*.mp3") returned 5 [0101.277] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HAMMER.WAV", pszSpec="*.wav") returned 1 [0101.277] lstrlenA (lpString="*.wav") returned 5 [0101.277] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HAMMER.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HAMMER.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HAMMER.WAV" [0101.277] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HAMMER.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HAMMER.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HAMMER.WAV" [0101.277] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HAMMER.WAV", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HAMMER.WAV.") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HAMMER.WAV." [0101.277] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HAMMER.WAV.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HAMMER.WAV. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HAMMER.WAV. " [0101.277] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HAMMER.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\hammer.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c [0101.278] GetFileSize (in: hFile=0x8c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xfbc [0101.278] GetFileTime (in: hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xb836b000, dwHighDateTime=0x1bfc6e7), lpLastAccessTime=0x407536*(dwLowDateTime=0x53822dd0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xb836b000, dwHighDateTime=0x1bfc6e7)) returned 1 [0101.278] SetFilePointer (in: hFile=0x8c, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0101.278] ReadFile (in: hFile=0x8c, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0xf62, lpOverlapped=0x0) returned 1 [0101.320] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HAMMER.WAV") returned="HAMMER.WAV" [0101.320] SetFilePointer (in: hFile=0x8c, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0101.320] WriteFile (in: hFile=0x8c, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0xf62, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0xf62, lpOverlapped=0x0) returned 1 [0101.320] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0101.321] CloseHandle (hObject=0x8c) returned 1 [0101.321] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HAMMER.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\hammer.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HAMMER.WAV. " (normalized: "c:\\program files\\microsoft office\\office14\\media\\hammer.wav. ")) returned 1 [0101.321] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0101.321] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0101.321] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="LASER.WAV") returned -1 [0101.322] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="LASER.WAV") returned -1 [0101.322] lstrcmpiA (lpString1="", lpString2="LASER.WAV") returned -1 [0101.322] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HAMMER.WAV") returned="HAMMER.WAV" [0101.322] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\", lpString2="LASER.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\LASER.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\LASER.WAV" [0101.322] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\LASER.WAV", pszSpec="*.zip") returned 0 [0101.322] lstrlenA (lpString="*.zip") returned 5 [0101.322] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\LASER.WAV", pszSpec="*.rar") returned 0 [0101.322] lstrlenA (lpString="*.rar") returned 5 [0101.322] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\LASER.WAV", pszSpec="*.7z") returned 0 [0101.322] lstrlenA (lpString="*.7z") returned 4 [0101.322] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\LASER.WAV", pszSpec="*.tar") returned 0 [0101.322] lstrlenA (lpString="*.tar") returned 5 [0101.322] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\LASER.WAV", pszSpec="*.gzip") returned 0 [0101.322] lstrlenA (lpString="*.gzip") returned 6 [0101.322] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\LASER.WAV", pszSpec="*.jpg") returned 0 [0101.322] lstrlenA (lpString="*.jpg") returned 5 [0101.322] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\LASER.WAV", pszSpec="*.jpeg") returned 0 [0101.322] lstrlenA (lpString="*.jpeg") returned 6 [0101.322] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\LASER.WAV", pszSpec="*.psd") returned 0 [0101.322] lstrlenA (lpString="*.psd") returned 5 [0101.322] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\LASER.WAV", pszSpec="*.cdr") returned 0 [0101.322] lstrlenA (lpString="*.cdr") returned 5 [0101.322] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\LASER.WAV", pszSpec="*.dwg") returned 0 [0101.322] lstrlenA (lpString="*.dwg") returned 5 [0101.322] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\LASER.WAV", pszSpec="*.max") returned 0 [0101.322] lstrlenA (lpString="*.max") returned 5 [0101.322] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\LASER.WAV", pszSpec="*.bmp") returned 0 [0101.322] lstrlenA (lpString="*.bmp") returned 5 [0101.322] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\LASER.WAV", pszSpec="*.gif") returned 0 [0101.322] lstrlenA (lpString="*.gif") returned 5 [0101.322] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\LASER.WAV", pszSpec="*.png") returned 0 [0101.322] lstrlenA (lpString="*.png") returned 5 [0101.322] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\LASER.WAV", pszSpec="*.doc") returned 0 [0101.322] lstrlenA (lpString="*.doc") returned 5 [0101.322] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\LASER.WAV", pszSpec="*.docx") returned 0 [0101.322] lstrlenA (lpString="*.docx") returned 6 [0101.322] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\LASER.WAV", pszSpec="*.xls") returned 0 [0101.322] lstrlenA (lpString="*.xls") returned 5 [0101.322] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\LASER.WAV", pszSpec="*.xlsx") returned 0 [0101.322] lstrlenA (lpString="*.xlsx") returned 6 [0101.322] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\LASER.WAV", pszSpec="*.ppt") returned 0 [0101.322] lstrlenA (lpString="*.ppt") returned 5 [0101.322] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\LASER.WAV", pszSpec="*.pptx") returned 0 [0101.322] lstrlenA (lpString="*.pptx") returned 6 [0101.322] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\LASER.WAV", pszSpec="*.txt") returned 0 [0101.323] lstrlenA (lpString="*.txt") returned 5 [0101.323] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\LASER.WAV", pszSpec="*.pdf") returned 0 [0101.323] lstrlenA (lpString="*.pdf") returned 5 [0101.323] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\LASER.WAV", pszSpec="*.djvu") returned 0 [0101.323] lstrlenA (lpString="*.djvu") returned 6 [0101.323] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\LASER.WAV", pszSpec="*.htm") returned 0 [0101.323] lstrlenA (lpString="*.htm") returned 5 [0101.323] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\LASER.WAV", pszSpec="*.html") returned 0 [0101.323] lstrlenA (lpString="*.html") returned 6 [0101.323] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\LASER.WAV", pszSpec="*.mdb") returned 0 [0101.323] lstrlenA (lpString="*.mdb") returned 5 [0101.323] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\LASER.WAV", pszSpec="*.cer") returned 0 [0101.323] lstrlenA (lpString="*.cer") returned 5 [0101.323] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\LASER.WAV", pszSpec="*.p12") returned 0 [0101.323] lstrlenA (lpString="*.p12") returned 5 [0101.323] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\LASER.WAV", pszSpec="*.pfx") returned 0 [0101.323] lstrlenA (lpString="*.pfx") returned 5 [0101.323] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\LASER.WAV", pszSpec="*.kwm") returned 0 [0101.323] lstrlenA (lpString="*.kwm") returned 5 [0101.323] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\LASER.WAV", pszSpec="*.pwm") returned 0 [0101.323] lstrlenA (lpString="*.pwm") returned 5 [0101.323] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\LASER.WAV", pszSpec="*.1cd") returned 0 [0101.323] lstrlenA (lpString="*.1cd") returned 5 [0101.323] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\LASER.WAV", pszSpec="*.md") returned 0 [0101.323] lstrlenA (lpString="*.md") returned 4 [0101.323] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\LASER.WAV", pszSpec="*.mdf") returned 0 [0101.323] lstrlenA (lpString="*.mdf") returned 5 [0101.323] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\LASER.WAV", pszSpec="*.dbf") returned 0 [0101.323] lstrlenA (lpString="*.dbf") returned 5 [0101.323] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\LASER.WAV", pszSpec="*.odt") returned 0 [0101.323] lstrlenA (lpString="*.odt") returned 5 [0101.323] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\LASER.WAV", pszSpec="*.vob") returned 0 [0101.323] lstrlenA (lpString="*.vob") returned 5 [0101.323] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\LASER.WAV", pszSpec="*.ifo") returned 0 [0101.323] lstrlenA (lpString="*.ifo") returned 5 [0101.323] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\LASER.WAV", pszSpec="*.lnk") returned 0 [0101.323] lstrlenA (lpString="*.lnk") returned 5 [0101.323] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\LASER.WAV", pszSpec="*.torrent") returned 0 [0101.323] lstrlenA (lpString="*.torrent") returned 9 [0101.323] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\LASER.WAV", pszSpec="*.mov") returned 0 [0101.323] lstrlenA (lpString="*.mov") returned 5 [0101.323] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\LASER.WAV", pszSpec="*.m2v") returned 0 [0101.323] lstrlenA (lpString="*.m2v") returned 5 [0101.323] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\LASER.WAV", pszSpec="*.3gp") returned 0 [0101.323] lstrlenA (lpString="*.3gp") returned 5 [0101.323] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\LASER.WAV", pszSpec="*.mpeg") returned 0 [0101.323] lstrlenA (lpString="*.mpeg") returned 6 [0101.323] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\LASER.WAV", pszSpec="*.mpg") returned 0 [0101.323] lstrlenA (lpString="*.mpg") returned 5 [0101.324] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\LASER.WAV", pszSpec="*.flv") returned 0 [0101.324] lstrlenA (lpString="*.flv") returned 5 [0101.324] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\LASER.WAV", pszSpec="*.avi") returned 0 [0101.324] lstrlenA (lpString="*.avi") returned 5 [0101.324] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\LASER.WAV", pszSpec="*.mp4") returned 0 [0101.324] lstrlenA (lpString="*.mp4") returned 5 [0101.324] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\LASER.WAV", pszSpec="*.wmv") returned 0 [0101.324] lstrlenA (lpString="*.wmv") returned 5 [0101.324] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\LASER.WAV", pszSpec="*.divx") returned 0 [0101.324] lstrlenA (lpString="*.divx") returned 6 [0101.324] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\LASER.WAV", pszSpec="*.mkv") returned 0 [0101.324] lstrlenA (lpString="*.mkv") returned 5 [0101.324] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\LASER.WAV", pszSpec="*.mp3") returned 0 [0101.324] lstrlenA (lpString="*.mp3") returned 5 [0101.324] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\LASER.WAV", pszSpec="*.wav") returned 1 [0101.324] lstrlenA (lpString="*.wav") returned 5 [0101.324] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\LASER.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\LASER.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\LASER.WAV" [0101.324] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\LASER.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\LASER.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\LASER.WAV" [0101.324] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\LASER.WAV", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\LASER.WAV.") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\LASER.WAV." [0101.324] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\LASER.WAV.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\LASER.WAV. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\LASER.WAV. " [0101.324] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\LASER.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\laser.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c [0101.325] GetFileSize (in: hFile=0x8c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x72d [0101.325] GetFileTime (in: hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x1b50b600, dwHighDateTime=0x1bc8d47), lpLastAccessTime=0x407536*(dwLowDateTime=0x66220ff0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x1b50b600, dwHighDateTime=0x1bc8d47)) returned 1 [0101.325] SetFilePointer (in: hFile=0x8c, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0101.325] ReadFile (in: hFile=0x8c, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x6d3, lpOverlapped=0x0) returned 1 [0101.326] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\LASER.WAV") returned="LASER.WAV" [0101.326] SetFilePointer (in: hFile=0x8c, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0101.326] WriteFile (in: hFile=0x8c, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x6d3, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x6d3, lpOverlapped=0x0) returned 1 [0101.326] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0101.326] CloseHandle (hObject=0x8c) returned 1 [0101.326] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\LASER.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\laser.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\LASER.WAV. " (normalized: "c:\\program files\\microsoft office\\office14\\media\\laser.wav. ")) returned 1 [0101.327] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0101.327] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0101.327] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="PUSH.WAV") returned -1 [0101.327] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PUSH.WAV") returned -1 [0101.327] lstrcmpiA (lpString1="", lpString2="PUSH.WAV") returned -1 [0101.327] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\LASER.WAV") returned="LASER.WAV" [0101.327] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\", lpString2="PUSH.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\PUSH.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\PUSH.WAV" [0101.327] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\PUSH.WAV", pszSpec="*.zip") returned 0 [0101.327] lstrlenA (lpString="*.zip") returned 5 [0101.327] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\PUSH.WAV", pszSpec="*.rar") returned 0 [0101.327] lstrlenA (lpString="*.rar") returned 5 [0101.327] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\PUSH.WAV", pszSpec="*.7z") returned 0 [0101.327] lstrlenA (lpString="*.7z") returned 4 [0101.327] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\PUSH.WAV", pszSpec="*.tar") returned 0 [0101.327] lstrlenA (lpString="*.tar") returned 5 [0101.327] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\PUSH.WAV", pszSpec="*.gzip") returned 0 [0101.327] lstrlenA (lpString="*.gzip") returned 6 [0101.327] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\PUSH.WAV", pszSpec="*.jpg") returned 0 [0101.327] lstrlenA (lpString="*.jpg") returned 5 [0101.328] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\PUSH.WAV", pszSpec="*.jpeg") returned 0 [0101.328] lstrlenA (lpString="*.jpeg") returned 6 [0101.328] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\PUSH.WAV", pszSpec="*.psd") returned 0 [0101.328] lstrlenA (lpString="*.psd") returned 5 [0101.328] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\PUSH.WAV", pszSpec="*.cdr") returned 0 [0101.328] lstrlenA (lpString="*.cdr") returned 5 [0101.328] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\PUSH.WAV", pszSpec="*.dwg") returned 0 [0101.328] lstrlenA (lpString="*.dwg") returned 5 [0101.328] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\PUSH.WAV", pszSpec="*.max") returned 0 [0101.328] lstrlenA (lpString="*.max") returned 5 [0101.328] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\PUSH.WAV", pszSpec="*.bmp") returned 0 [0101.328] lstrlenA (lpString="*.bmp") returned 5 [0101.328] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\PUSH.WAV", pszSpec="*.gif") returned 0 [0101.328] lstrlenA (lpString="*.gif") returned 5 [0101.328] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\PUSH.WAV", pszSpec="*.png") returned 0 [0101.328] lstrlenA (lpString="*.png") returned 5 [0101.328] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\PUSH.WAV", pszSpec="*.doc") returned 0 [0101.328] lstrlenA (lpString="*.doc") returned 5 [0101.328] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\PUSH.WAV", pszSpec="*.docx") returned 0 [0101.328] lstrlenA (lpString="*.docx") returned 6 [0101.328] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\PUSH.WAV", pszSpec="*.xls") returned 0 [0101.328] lstrlenA (lpString="*.xls") returned 5 [0101.328] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\PUSH.WAV", pszSpec="*.xlsx") returned 0 [0101.328] lstrlenA (lpString="*.xlsx") returned 6 [0101.328] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\PUSH.WAV", pszSpec="*.ppt") returned 0 [0101.328] lstrlenA (lpString="*.ppt") returned 5 [0101.328] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\PUSH.WAV", pszSpec="*.pptx") returned 0 [0101.328] lstrlenA (lpString="*.pptx") returned 6 [0101.328] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\PUSH.WAV", pszSpec="*.txt") returned 0 [0101.328] lstrlenA (lpString="*.txt") returned 5 [0101.328] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\PUSH.WAV", pszSpec="*.pdf") returned 0 [0101.328] lstrlenA (lpString="*.pdf") returned 5 [0101.328] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\PUSH.WAV", pszSpec="*.djvu") returned 0 [0101.328] lstrlenA (lpString="*.djvu") returned 6 [0101.328] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\PUSH.WAV", pszSpec="*.htm") returned 0 [0101.328] lstrlenA (lpString="*.htm") returned 5 [0101.328] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\PUSH.WAV", pszSpec="*.html") returned 0 [0101.328] lstrlenA (lpString="*.html") returned 6 [0101.328] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\PUSH.WAV", pszSpec="*.mdb") returned 0 [0101.328] lstrlenA (lpString="*.mdb") returned 5 [0101.328] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\PUSH.WAV", pszSpec="*.cer") returned 0 [0101.328] lstrlenA (lpString="*.cer") returned 5 [0101.329] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\PUSH.WAV", pszSpec="*.p12") returned 0 [0101.329] lstrlenA (lpString="*.p12") returned 5 [0101.329] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\PUSH.WAV", pszSpec="*.pfx") returned 0 [0101.329] lstrlenA (lpString="*.pfx") returned 5 [0101.329] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\PUSH.WAV", pszSpec="*.kwm") returned 0 [0101.329] lstrlenA (lpString="*.kwm") returned 5 [0101.329] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\PUSH.WAV", pszSpec="*.pwm") returned 0 [0101.329] lstrlenA (lpString="*.pwm") returned 5 [0101.329] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\PUSH.WAV", pszSpec="*.1cd") returned 0 [0101.329] lstrlenA (lpString="*.1cd") returned 5 [0101.329] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\PUSH.WAV", pszSpec="*.md") returned 0 [0101.329] lstrlenA (lpString="*.md") returned 4 [0101.329] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\PUSH.WAV", pszSpec="*.mdf") returned 0 [0101.329] lstrlenA (lpString="*.mdf") returned 5 [0101.329] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\PUSH.WAV", pszSpec="*.dbf") returned 0 [0101.329] lstrlenA (lpString="*.dbf") returned 5 [0101.329] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\PUSH.WAV", pszSpec="*.odt") returned 0 [0101.329] lstrlenA (lpString="*.odt") returned 5 [0101.329] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\PUSH.WAV", pszSpec="*.vob") returned 0 [0101.329] lstrlenA (lpString="*.vob") returned 5 [0101.329] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\PUSH.WAV", pszSpec="*.ifo") returned 0 [0101.329] lstrlenA (lpString="*.ifo") returned 5 [0101.329] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\PUSH.WAV", pszSpec="*.lnk") returned 0 [0101.329] lstrlenA (lpString="*.lnk") returned 5 [0101.329] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\PUSH.WAV", pszSpec="*.torrent") returned 0 [0101.329] lstrlenA (lpString="*.torrent") returned 9 [0101.329] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\PUSH.WAV", pszSpec="*.mov") returned 0 [0101.329] lstrlenA (lpString="*.mov") returned 5 [0101.329] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\PUSH.WAV", pszSpec="*.m2v") returned 0 [0101.329] lstrlenA (lpString="*.m2v") returned 5 [0101.329] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\PUSH.WAV", pszSpec="*.3gp") returned 0 [0101.329] lstrlenA (lpString="*.3gp") returned 5 [0101.329] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\PUSH.WAV", pszSpec="*.mpeg") returned 0 [0101.329] lstrlenA (lpString="*.mpeg") returned 6 [0101.329] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\PUSH.WAV", pszSpec="*.mpg") returned 0 [0101.329] lstrlenA (lpString="*.mpg") returned 5 [0101.329] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\PUSH.WAV", pszSpec="*.flv") returned 0 [0101.329] lstrlenA (lpString="*.flv") returned 5 [0101.329] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\PUSH.WAV", pszSpec="*.avi") returned 0 [0101.329] lstrlenA (lpString="*.avi") returned 5 [0101.329] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\PUSH.WAV", pszSpec="*.mp4") returned 0 [0101.329] lstrlenA (lpString="*.mp4") returned 5 [0101.330] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\PUSH.WAV", pszSpec="*.wmv") returned 0 [0101.330] lstrlenA (lpString="*.wmv") returned 5 [0101.330] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\PUSH.WAV", pszSpec="*.divx") returned 0 [0101.330] lstrlenA (lpString="*.divx") returned 6 [0101.330] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\PUSH.WAV", pszSpec="*.mkv") returned 0 [0101.330] lstrlenA (lpString="*.mkv") returned 5 [0101.330] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\PUSH.WAV", pszSpec="*.mp3") returned 0 [0101.330] lstrlenA (lpString="*.mp3") returned 5 [0101.330] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\PUSH.WAV", pszSpec="*.wav") returned 1 [0101.330] lstrlenA (lpString="*.wav") returned 5 [0101.330] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\PUSH.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\PUSH.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\PUSH.WAV" [0101.330] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\PUSH.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\PUSH.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\PUSH.WAV" [0101.330] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\PUSH.WAV", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\PUSH.WAV.") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\PUSH.WAV." [0101.330] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\PUSH.WAV.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\PUSH.WAV. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\PUSH.WAV. " [0101.330] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\PUSH.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\push.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c [0101.331] GetFileSize (in: hFile=0x8c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3d84 [0101.331] GetFileTime (in: hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xf4b5dc00, dwHighDateTime=0x1bfc6e6), lpLastAccessTime=0x407536*(dwLowDateTime=0x5a7913b0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xf4b5dc00, dwHighDateTime=0x1bfc6e6)) returned 1 [0101.331] SetFilePointer (in: hFile=0x8c, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0101.331] ReadFile (in: hFile=0x8c, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x3d2a, lpOverlapped=0x0) returned 1 [0101.375] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\PUSH.WAV") returned="PUSH.WAV" [0101.375] SetFilePointer (in: hFile=0x8c, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0101.375] WriteFile (in: hFile=0x8c, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x3d2a, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x3d2a, lpOverlapped=0x0) returned 1 [0101.375] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0101.375] CloseHandle (hObject=0x8c) returned 1 [0101.376] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\PUSH.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\push.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\PUSH.WAV. " (normalized: "c:\\program files\\microsoft office\\office14\\media\\push.wav. ")) returned 1 [0101.377] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0101.377] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0101.377] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="SUCTION.WAV") returned -1 [0101.377] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SUCTION.WAV") returned -1 [0101.377] lstrcmpiA (lpString1="", lpString2="SUCTION.WAV") returned -1 [0101.377] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\PUSH.WAV") returned="PUSH.WAV" [0101.377] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\", lpString2="SUCTION.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\SUCTION.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\SUCTION.WAV" [0101.377] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\SUCTION.WAV", pszSpec="*.zip") returned 0 [0101.377] lstrlenA (lpString="*.zip") returned 5 [0101.377] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\SUCTION.WAV", pszSpec="*.rar") returned 0 [0101.377] lstrlenA (lpString="*.rar") returned 5 [0101.377] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\SUCTION.WAV", pszSpec="*.7z") returned 0 [0101.377] lstrlenA (lpString="*.7z") returned 4 [0101.377] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\SUCTION.WAV", pszSpec="*.tar") returned 0 [0101.377] lstrlenA (lpString="*.tar") returned 5 [0101.377] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\SUCTION.WAV", pszSpec="*.gzip") returned 0 [0101.377] lstrlenA (lpString="*.gzip") returned 6 [0101.377] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\SUCTION.WAV", pszSpec="*.jpg") returned 0 [0101.377] lstrlenA (lpString="*.jpg") returned 5 [0101.377] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\SUCTION.WAV", pszSpec="*.jpeg") returned 0 [0101.377] lstrlenA (lpString="*.jpeg") returned 6 [0101.377] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\SUCTION.WAV", pszSpec="*.psd") returned 0 [0101.377] lstrlenA (lpString="*.psd") returned 5 [0101.377] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\SUCTION.WAV", pszSpec="*.cdr") returned 0 [0101.377] lstrlenA (lpString="*.cdr") returned 5 [0101.377] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\SUCTION.WAV", pszSpec="*.dwg") returned 0 [0101.377] lstrlenA (lpString="*.dwg") returned 5 [0101.377] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\SUCTION.WAV", pszSpec="*.max") returned 0 [0101.377] lstrlenA (lpString="*.max") returned 5 [0101.377] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\SUCTION.WAV", pszSpec="*.bmp") returned 0 [0101.378] lstrlenA (lpString="*.bmp") returned 5 [0101.378] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\SUCTION.WAV", pszSpec="*.gif") returned 0 [0101.378] lstrlenA (lpString="*.gif") returned 5 [0101.378] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\SUCTION.WAV", pszSpec="*.png") returned 0 [0101.378] lstrlenA (lpString="*.png") returned 5 [0101.378] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\SUCTION.WAV", pszSpec="*.doc") returned 0 [0101.378] lstrlenA (lpString="*.doc") returned 5 [0101.378] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\SUCTION.WAV", pszSpec="*.docx") returned 0 [0101.378] lstrlenA (lpString="*.docx") returned 6 [0101.378] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\SUCTION.WAV", pszSpec="*.xls") returned 0 [0101.378] lstrlenA (lpString="*.xls") returned 5 [0101.378] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\SUCTION.WAV", pszSpec="*.xlsx") returned 0 [0101.378] lstrlenA (lpString="*.xlsx") returned 6 [0101.378] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\SUCTION.WAV", pszSpec="*.ppt") returned 0 [0101.378] lstrlenA (lpString="*.ppt") returned 5 [0101.378] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\SUCTION.WAV", pszSpec="*.pptx") returned 0 [0101.378] lstrlenA (lpString="*.pptx") returned 6 [0101.378] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\SUCTION.WAV", pszSpec="*.txt") returned 0 [0101.378] lstrlenA (lpString="*.txt") returned 5 [0101.378] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\SUCTION.WAV", pszSpec="*.pdf") returned 0 [0101.378] lstrlenA (lpString="*.pdf") returned 5 [0101.378] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\SUCTION.WAV", pszSpec="*.djvu") returned 0 [0101.378] lstrlenA (lpString="*.djvu") returned 6 [0101.378] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\SUCTION.WAV", pszSpec="*.htm") returned 0 [0101.378] lstrlenA (lpString="*.htm") returned 5 [0101.378] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\SUCTION.WAV", pszSpec="*.html") returned 0 [0101.378] lstrlenA (lpString="*.html") returned 6 [0101.378] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\SUCTION.WAV", pszSpec="*.mdb") returned 0 [0101.378] lstrlenA (lpString="*.mdb") returned 5 [0101.378] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\SUCTION.WAV", pszSpec="*.cer") returned 0 [0101.378] lstrlenA (lpString="*.cer") returned 5 [0101.378] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\SUCTION.WAV", pszSpec="*.p12") returned 0 [0101.378] lstrlenA (lpString="*.p12") returned 5 [0101.378] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\SUCTION.WAV", pszSpec="*.pfx") returned 0 [0101.378] lstrlenA (lpString="*.pfx") returned 5 [0101.378] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\SUCTION.WAV", pszSpec="*.kwm") returned 0 [0101.378] lstrlenA (lpString="*.kwm") returned 5 [0101.378] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\SUCTION.WAV", pszSpec="*.pwm") returned 0 [0101.379] lstrlenA (lpString="*.pwm") returned 5 [0101.379] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\SUCTION.WAV", pszSpec="*.1cd") returned 0 [0101.379] lstrlenA (lpString="*.1cd") returned 5 [0101.379] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\SUCTION.WAV", pszSpec="*.md") returned 0 [0101.379] lstrlenA (lpString="*.md") returned 4 [0101.379] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\SUCTION.WAV", pszSpec="*.mdf") returned 0 [0101.379] lstrlenA (lpString="*.mdf") returned 5 [0101.379] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\SUCTION.WAV", pszSpec="*.dbf") returned 0 [0101.379] lstrlenA (lpString="*.dbf") returned 5 [0101.379] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\SUCTION.WAV", pszSpec="*.odt") returned 0 [0101.379] lstrlenA (lpString="*.odt") returned 5 [0101.379] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\SUCTION.WAV", pszSpec="*.vob") returned 0 [0101.379] lstrlenA (lpString="*.vob") returned 5 [0101.379] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\SUCTION.WAV", pszSpec="*.ifo") returned 0 [0101.379] lstrlenA (lpString="*.ifo") returned 5 [0101.379] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\SUCTION.WAV", pszSpec="*.lnk") returned 0 [0101.379] lstrlenA (lpString="*.lnk") returned 5 [0101.379] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\SUCTION.WAV", pszSpec="*.torrent") returned 0 [0101.379] lstrlenA (lpString="*.torrent") returned 9 [0101.379] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\SUCTION.WAV", pszSpec="*.mov") returned 0 [0101.379] lstrlenA (lpString="*.mov") returned 5 [0101.379] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\SUCTION.WAV", pszSpec="*.m2v") returned 0 [0101.379] lstrlenA (lpString="*.m2v") returned 5 [0101.379] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\SUCTION.WAV", pszSpec="*.3gp") returned 0 [0101.379] lstrlenA (lpString="*.3gp") returned 5 [0101.379] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\SUCTION.WAV", pszSpec="*.mpeg") returned 0 [0101.379] lstrlenA (lpString="*.mpeg") returned 6 [0101.379] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\SUCTION.WAV", pszSpec="*.mpg") returned 0 [0101.379] lstrlenA (lpString="*.mpg") returned 5 [0101.379] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\SUCTION.WAV", pszSpec="*.flv") returned 0 [0101.379] lstrlenA (lpString="*.flv") returned 5 [0101.379] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\SUCTION.WAV", pszSpec="*.avi") returned 0 [0101.379] lstrlenA (lpString="*.avi") returned 5 [0101.379] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\SUCTION.WAV", pszSpec="*.mp4") returned 0 [0101.379] lstrlenA (lpString="*.mp4") returned 5 [0101.379] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\SUCTION.WAV", pszSpec="*.wmv") returned 0 [0101.379] lstrlenA (lpString="*.wmv") returned 5 [0101.379] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\SUCTION.WAV", pszSpec="*.divx") returned 0 [0101.380] lstrlenA (lpString="*.divx") returned 6 [0101.380] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\SUCTION.WAV", pszSpec="*.mkv") returned 0 [0101.380] lstrlenA (lpString="*.mkv") returned 5 [0101.380] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\SUCTION.WAV", pszSpec="*.mp3") returned 0 [0101.380] lstrlenA (lpString="*.mp3") returned 5 [0101.380] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\SUCTION.WAV", pszSpec="*.wav") returned 1 [0101.380] lstrlenA (lpString="*.wav") returned 5 [0101.380] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\SUCTION.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\SUCTION.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\SUCTION.WAV" [0101.380] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\SUCTION.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\SUCTION.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\SUCTION.WAV" [0101.380] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\SUCTION.WAV", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\SUCTION.WAV.") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\SUCTION.WAV." [0101.380] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\SUCTION.WAV.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\SUCTION.WAV. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\SUCTION.WAV. " [0101.380] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\SUCTION.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\suction.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c [0101.381] GetFileSize (in: hFile=0x8c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1664 [0101.381] GetFileTime (in: hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x3eba3e00, dwHighDateTime=0x1bfa2b0), lpLastAccessTime=0x407536*(dwLowDateTime=0x5ac7a110, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x3eba3e00, dwHighDateTime=0x1bfa2b0)) returned 1 [0101.381] SetFilePointer (in: hFile=0x8c, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0101.381] ReadFile (in: hFile=0x8c, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x160a, lpOverlapped=0x0) returned 1 [0101.440] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\SUCTION.WAV") returned="SUCTION.WAV" [0101.440] SetFilePointer (in: hFile=0x8c, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0101.440] WriteFile (in: hFile=0x8c, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x160a, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x160a, lpOverlapped=0x0) returned 1 [0101.440] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0101.440] CloseHandle (hObject=0x8c) returned 1 [0101.440] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\SUCTION.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\suction.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\SUCTION.WAV. " (normalized: "c:\\program files\\microsoft office\\office14\\media\\suction.wav. ")) returned 1 [0101.441] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0101.441] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0101.441] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="TYPE.WAV") returned -1 [0101.441] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TYPE.WAV") returned -1 [0101.441] lstrcmpiA (lpString1="", lpString2="TYPE.WAV") returned -1 [0101.441] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\SUCTION.WAV") returned="SUCTION.WAV" [0101.441] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\", lpString2="TYPE.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\TYPE.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\TYPE.WAV" [0101.441] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\TYPE.WAV", pszSpec="*.zip") returned 0 [0101.441] lstrlenA (lpString="*.zip") returned 5 [0101.442] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\TYPE.WAV", pszSpec="*.rar") returned 0 [0101.442] lstrlenA (lpString="*.rar") returned 5 [0101.442] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\TYPE.WAV", pszSpec="*.7z") returned 0 [0101.442] lstrlenA (lpString="*.7z") returned 4 [0101.442] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\TYPE.WAV", pszSpec="*.tar") returned 0 [0101.442] lstrlenA (lpString="*.tar") returned 5 [0101.442] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\TYPE.WAV", pszSpec="*.gzip") returned 0 [0101.442] lstrlenA (lpString="*.gzip") returned 6 [0101.442] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\TYPE.WAV", pszSpec="*.jpg") returned 0 [0101.442] lstrlenA (lpString="*.jpg") returned 5 [0101.442] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\TYPE.WAV", pszSpec="*.jpeg") returned 0 [0101.442] lstrlenA (lpString="*.jpeg") returned 6 [0101.442] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\TYPE.WAV", pszSpec="*.psd") returned 0 [0101.442] lstrlenA (lpString="*.psd") returned 5 [0101.442] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\TYPE.WAV", pszSpec="*.cdr") returned 0 [0101.442] lstrlenA (lpString="*.cdr") returned 5 [0101.442] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\TYPE.WAV", pszSpec="*.dwg") returned 0 [0101.442] lstrlenA (lpString="*.dwg") returned 5 [0101.442] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\TYPE.WAV", pszSpec="*.max") returned 0 [0101.442] lstrlenA (lpString="*.max") returned 5 [0101.442] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\TYPE.WAV", pszSpec="*.bmp") returned 0 [0101.442] lstrlenA (lpString="*.bmp") returned 5 [0101.442] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\TYPE.WAV", pszSpec="*.gif") returned 0 [0101.442] lstrlenA (lpString="*.gif") returned 5 [0101.442] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\TYPE.WAV", pszSpec="*.png") returned 0 [0101.442] lstrlenA (lpString="*.png") returned 5 [0101.442] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\TYPE.WAV", pszSpec="*.doc") returned 0 [0101.442] lstrlenA (lpString="*.doc") returned 5 [0101.442] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\TYPE.WAV", pszSpec="*.docx") returned 0 [0101.442] lstrlenA (lpString="*.docx") returned 6 [0101.442] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\TYPE.WAV", pszSpec="*.xls") returned 0 [0101.442] lstrlenA (lpString="*.xls") returned 5 [0101.442] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\TYPE.WAV", pszSpec="*.xlsx") returned 0 [0101.442] lstrlenA (lpString="*.xlsx") returned 6 [0101.442] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\TYPE.WAV", pszSpec="*.ppt") returned 0 [0101.442] lstrlenA (lpString="*.ppt") returned 5 [0101.442] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\TYPE.WAV", pszSpec="*.pptx") returned 0 [0101.442] lstrlenA (lpString="*.pptx") returned 6 [0101.442] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\TYPE.WAV", pszSpec="*.txt") returned 0 [0101.442] lstrlenA (lpString="*.txt") returned 5 [0101.442] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\TYPE.WAV", pszSpec="*.pdf") returned 0 [0101.442] lstrlenA (lpString="*.pdf") returned 5 [0101.443] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\TYPE.WAV", pszSpec="*.djvu") returned 0 [0101.443] lstrlenA (lpString="*.djvu") returned 6 [0101.443] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\TYPE.WAV", pszSpec="*.htm") returned 0 [0101.443] lstrlenA (lpString="*.htm") returned 5 [0101.443] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\TYPE.WAV", pszSpec="*.html") returned 0 [0101.443] lstrlenA (lpString="*.html") returned 6 [0101.443] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\TYPE.WAV", pszSpec="*.mdb") returned 0 [0101.443] lstrlenA (lpString="*.mdb") returned 5 [0101.443] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\TYPE.WAV", pszSpec="*.cer") returned 0 [0101.443] lstrlenA (lpString="*.cer") returned 5 [0101.443] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\TYPE.WAV", pszSpec="*.p12") returned 0 [0101.443] lstrlenA (lpString="*.p12") returned 5 [0101.443] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\TYPE.WAV", pszSpec="*.pfx") returned 0 [0101.443] lstrlenA (lpString="*.pfx") returned 5 [0101.443] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\TYPE.WAV", pszSpec="*.kwm") returned 0 [0101.443] lstrlenA (lpString="*.kwm") returned 5 [0101.443] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\TYPE.WAV", pszSpec="*.pwm") returned 0 [0101.443] lstrlenA (lpString="*.pwm") returned 5 [0101.443] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\TYPE.WAV", pszSpec="*.1cd") returned 0 [0101.443] lstrlenA (lpString="*.1cd") returned 5 [0101.443] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\TYPE.WAV", pszSpec="*.md") returned 0 [0101.443] lstrlenA (lpString="*.md") returned 4 [0101.443] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\TYPE.WAV", pszSpec="*.mdf") returned 0 [0101.443] lstrlenA (lpString="*.mdf") returned 5 [0101.443] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\TYPE.WAV", pszSpec="*.dbf") returned 0 [0101.443] lstrlenA (lpString="*.dbf") returned 5 [0101.443] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\TYPE.WAV", pszSpec="*.odt") returned 0 [0101.443] lstrlenA (lpString="*.odt") returned 5 [0101.443] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\TYPE.WAV", pszSpec="*.vob") returned 0 [0101.443] lstrlenA (lpString="*.vob") returned 5 [0101.443] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\TYPE.WAV", pszSpec="*.ifo") returned 0 [0101.443] lstrlenA (lpString="*.ifo") returned 5 [0101.443] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\TYPE.WAV", pszSpec="*.lnk") returned 0 [0101.443] lstrlenA (lpString="*.lnk") returned 5 [0101.443] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\TYPE.WAV", pszSpec="*.torrent") returned 0 [0101.443] lstrlenA (lpString="*.torrent") returned 9 [0101.443] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\TYPE.WAV", pszSpec="*.mov") returned 0 [0101.443] lstrlenA (lpString="*.mov") returned 5 [0101.443] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\TYPE.WAV", pszSpec="*.m2v") returned 0 [0101.443] lstrlenA (lpString="*.m2v") returned 5 [0101.443] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\TYPE.WAV", pszSpec="*.3gp") returned 0 [0101.443] lstrlenA (lpString="*.3gp") returned 5 [0101.444] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\TYPE.WAV", pszSpec="*.mpeg") returned 0 [0101.444] lstrlenA (lpString="*.mpeg") returned 6 [0101.444] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\TYPE.WAV", pszSpec="*.mpg") returned 0 [0101.444] lstrlenA (lpString="*.mpg") returned 5 [0101.444] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\TYPE.WAV", pszSpec="*.flv") returned 0 [0101.444] lstrlenA (lpString="*.flv") returned 5 [0101.444] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\TYPE.WAV", pszSpec="*.avi") returned 0 [0101.444] lstrlenA (lpString="*.avi") returned 5 [0101.444] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\TYPE.WAV", pszSpec="*.mp4") returned 0 [0101.444] lstrlenA (lpString="*.mp4") returned 5 [0101.444] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\TYPE.WAV", pszSpec="*.wmv") returned 0 [0101.444] lstrlenA (lpString="*.wmv") returned 5 [0101.444] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\TYPE.WAV", pszSpec="*.divx") returned 0 [0101.444] lstrlenA (lpString="*.divx") returned 6 [0101.444] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\TYPE.WAV", pszSpec="*.mkv") returned 0 [0101.444] lstrlenA (lpString="*.mkv") returned 5 [0101.444] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\TYPE.WAV", pszSpec="*.mp3") returned 0 [0101.444] lstrlenA (lpString="*.mp3") returned 5 [0101.444] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\TYPE.WAV", pszSpec="*.wav") returned 1 [0101.444] lstrlenA (lpString="*.wav") returned 5 [0101.444] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\TYPE.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\TYPE.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\TYPE.WAV" [0101.444] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\TYPE.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\TYPE.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\TYPE.WAV" [0101.444] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\TYPE.WAV", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\TYPE.WAV.") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\TYPE.WAV." [0101.444] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\TYPE.WAV.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\TYPE.WAV. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\TYPE.WAV. " [0101.444] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\TYPE.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\type.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c [0101.445] GetFileSize (in: hFile=0x8c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x121c [0101.445] GetFileTime (in: hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xb796bf00, dwHighDateTime=0x1bd8ab7), lpLastAccessTime=0x407536*(dwLowDateTime=0x6d56d990, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xb796bf00, dwHighDateTime=0x1bd8ab7)) returned 1 [0101.445] SetFilePointer (in: hFile=0x8c, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0101.445] ReadFile (in: hFile=0x8c, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x11c2, lpOverlapped=0x0) returned 1 [0101.520] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\TYPE.WAV") returned="TYPE.WAV" [0101.520] SetFilePointer (in: hFile=0x8c, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0101.520] WriteFile (in: hFile=0x8c, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x11c2, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x11c2, lpOverlapped=0x0) returned 1 [0101.520] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0101.520] CloseHandle (hObject=0x8c) returned 1 [0101.520] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\TYPE.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\type.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\TYPE.WAV. " (normalized: "c:\\program files\\microsoft office\\office14\\media\\type.wav. ")) returned 1 [0101.521] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0101.521] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0101.521] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="VOLTAGE.WAV") returned -1 [0101.521] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="VOLTAGE.WAV") returned -1 [0101.521] lstrcmpiA (lpString1="", lpString2="VOLTAGE.WAV") returned -1 [0101.521] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\TYPE.WAV") returned="TYPE.WAV" [0101.521] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\", lpString2="VOLTAGE.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\VOLTAGE.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\VOLTAGE.WAV" [0101.521] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\VOLTAGE.WAV", pszSpec="*.zip") returned 0 [0101.521] lstrlenA (lpString="*.zip") returned 5 [0101.521] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\VOLTAGE.WAV", pszSpec="*.rar") returned 0 [0101.521] lstrlenA (lpString="*.rar") returned 5 [0101.521] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\VOLTAGE.WAV", pszSpec="*.7z") returned 0 [0101.521] lstrlenA (lpString="*.7z") returned 4 [0101.521] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\VOLTAGE.WAV", pszSpec="*.tar") returned 0 [0101.521] lstrlenA (lpString="*.tar") returned 5 [0101.521] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\VOLTAGE.WAV", pszSpec="*.gzip") returned 0 [0101.521] lstrlenA (lpString="*.gzip") returned 6 [0101.521] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\VOLTAGE.WAV", pszSpec="*.jpg") returned 0 [0101.521] lstrlenA (lpString="*.jpg") returned 5 [0101.521] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\VOLTAGE.WAV", pszSpec="*.jpeg") returned 0 [0101.521] lstrlenA (lpString="*.jpeg") returned 6 [0101.521] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\VOLTAGE.WAV", pszSpec="*.psd") returned 0 [0101.521] lstrlenA (lpString="*.psd") returned 5 [0101.521] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\VOLTAGE.WAV", pszSpec="*.cdr") returned 0 [0101.521] lstrlenA (lpString="*.cdr") returned 5 [0101.521] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\VOLTAGE.WAV", pszSpec="*.dwg") returned 0 [0101.521] lstrlenA (lpString="*.dwg") returned 5 [0101.522] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\VOLTAGE.WAV", pszSpec="*.max") returned 0 [0101.522] lstrlenA (lpString="*.max") returned 5 [0101.522] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\VOLTAGE.WAV", pszSpec="*.bmp") returned 0 [0101.522] lstrlenA (lpString="*.bmp") returned 5 [0101.522] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\VOLTAGE.WAV", pszSpec="*.gif") returned 0 [0101.522] lstrlenA (lpString="*.gif") returned 5 [0101.522] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\VOLTAGE.WAV", pszSpec="*.png") returned 0 [0101.522] lstrlenA (lpString="*.png") returned 5 [0101.522] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\VOLTAGE.WAV", pszSpec="*.doc") returned 0 [0101.522] lstrlenA (lpString="*.doc") returned 5 [0101.522] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\VOLTAGE.WAV", pszSpec="*.docx") returned 0 [0101.522] lstrlenA (lpString="*.docx") returned 6 [0101.522] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\VOLTAGE.WAV", pszSpec="*.xls") returned 0 [0101.522] lstrlenA (lpString="*.xls") returned 5 [0101.522] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\VOLTAGE.WAV", pszSpec="*.xlsx") returned 0 [0101.522] lstrlenA (lpString="*.xlsx") returned 6 [0101.522] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\VOLTAGE.WAV", pszSpec="*.ppt") returned 0 [0101.522] lstrlenA (lpString="*.ppt") returned 5 [0101.522] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\VOLTAGE.WAV", pszSpec="*.pptx") returned 0 [0101.522] lstrlenA (lpString="*.pptx") returned 6 [0101.522] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\VOLTAGE.WAV", pszSpec="*.txt") returned 0 [0101.522] lstrlenA (lpString="*.txt") returned 5 [0101.522] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\VOLTAGE.WAV", pszSpec="*.pdf") returned 0 [0101.522] lstrlenA (lpString="*.pdf") returned 5 [0101.522] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\VOLTAGE.WAV", pszSpec="*.djvu") returned 0 [0101.522] lstrlenA (lpString="*.djvu") returned 6 [0101.522] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\VOLTAGE.WAV", pszSpec="*.htm") returned 0 [0101.522] lstrlenA (lpString="*.htm") returned 5 [0101.522] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\VOLTAGE.WAV", pszSpec="*.html") returned 0 [0101.522] lstrlenA (lpString="*.html") returned 6 [0101.522] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\VOLTAGE.WAV", pszSpec="*.mdb") returned 0 [0101.522] lstrlenA (lpString="*.mdb") returned 5 [0101.522] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\VOLTAGE.WAV", pszSpec="*.cer") returned 0 [0101.522] lstrlenA (lpString="*.cer") returned 5 [0101.522] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\VOLTAGE.WAV", pszSpec="*.p12") returned 0 [0101.522] lstrlenA (lpString="*.p12") returned 5 [0101.522] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\VOLTAGE.WAV", pszSpec="*.pfx") returned 0 [0101.522] lstrlenA (lpString="*.pfx") returned 5 [0101.522] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\VOLTAGE.WAV", pszSpec="*.kwm") returned 0 [0101.522] lstrlenA (lpString="*.kwm") returned 5 [0101.522] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\VOLTAGE.WAV", pszSpec="*.pwm") returned 0 [0101.522] lstrlenA (lpString="*.pwm") returned 5 [0101.522] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\VOLTAGE.WAV", pszSpec="*.1cd") returned 0 [0101.522] lstrlenA (lpString="*.1cd") returned 5 [0101.522] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\VOLTAGE.WAV", pszSpec="*.md") returned 0 [0101.522] lstrlenA (lpString="*.md") returned 4 [0101.522] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\VOLTAGE.WAV", pszSpec="*.mdf") returned 0 [0101.522] lstrlenA (lpString="*.mdf") returned 5 [0101.522] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\VOLTAGE.WAV", pszSpec="*.dbf") returned 0 [0101.522] lstrlenA (lpString="*.dbf") returned 5 [0101.522] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\VOLTAGE.WAV", pszSpec="*.odt") returned 0 [0101.523] lstrlenA (lpString="*.odt") returned 5 [0101.523] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\VOLTAGE.WAV", pszSpec="*.vob") returned 0 [0101.523] lstrlenA (lpString="*.vob") returned 5 [0101.523] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\VOLTAGE.WAV", pszSpec="*.ifo") returned 0 [0101.523] lstrlenA (lpString="*.ifo") returned 5 [0101.523] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\VOLTAGE.WAV", pszSpec="*.lnk") returned 0 [0101.523] lstrlenA (lpString="*.lnk") returned 5 [0101.523] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\VOLTAGE.WAV", pszSpec="*.torrent") returned 0 [0101.523] lstrlenA (lpString="*.torrent") returned 9 [0101.523] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\VOLTAGE.WAV", pszSpec="*.mov") returned 0 [0101.523] lstrlenA (lpString="*.mov") returned 5 [0101.523] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\VOLTAGE.WAV", pszSpec="*.m2v") returned 0 [0101.523] lstrlenA (lpString="*.m2v") returned 5 [0101.523] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\VOLTAGE.WAV", pszSpec="*.3gp") returned 0 [0101.523] lstrlenA (lpString="*.3gp") returned 5 [0101.523] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\VOLTAGE.WAV", pszSpec="*.mpeg") returned 0 [0101.523] lstrlenA (lpString="*.mpeg") returned 6 [0101.523] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\VOLTAGE.WAV", pszSpec="*.mpg") returned 0 [0101.523] lstrlenA (lpString="*.mpg") returned 5 [0101.523] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\VOLTAGE.WAV", pszSpec="*.flv") returned 0 [0101.523] lstrlenA (lpString="*.flv") returned 5 [0101.523] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\VOLTAGE.WAV", pszSpec="*.avi") returned 0 [0101.523] lstrlenA (lpString="*.avi") returned 5 [0101.523] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\VOLTAGE.WAV", pszSpec="*.mp4") returned 0 [0101.523] lstrlenA (lpString="*.mp4") returned 5 [0101.523] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\VOLTAGE.WAV", pszSpec="*.wmv") returned 0 [0101.523] lstrlenA (lpString="*.wmv") returned 5 [0101.523] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\VOLTAGE.WAV", pszSpec="*.divx") returned 0 [0101.523] lstrlenA (lpString="*.divx") returned 6 [0101.523] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\VOLTAGE.WAV", pszSpec="*.mkv") returned 0 [0101.523] lstrlenA (lpString="*.mkv") returned 5 [0101.523] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\VOLTAGE.WAV", pszSpec="*.mp3") returned 0 [0101.523] lstrlenA (lpString="*.mp3") returned 5 [0101.523] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\VOLTAGE.WAV", pszSpec="*.wav") returned 1 [0101.523] lstrlenA (lpString="*.wav") returned 5 [0101.523] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\VOLTAGE.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\VOLTAGE.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\VOLTAGE.WAV" [0101.523] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\VOLTAGE.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\VOLTAGE.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\VOLTAGE.WAV" [0101.523] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\VOLTAGE.WAV", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\VOLTAGE.WAV.") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\VOLTAGE.WAV." [0101.523] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\VOLTAGE.WAV.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\VOLTAGE.WAV. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\VOLTAGE.WAV. " [0101.523] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\VOLTAGE.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\voltage.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c [0101.524] GetFileSize (in: hFile=0x8c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x35c6 [0101.524] GetFileTime (in: hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xecdb8800, dwHighDateTime=0x1bfbeed), lpLastAccessTime=0x407536*(dwLowDateTime=0x7071e4d0, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xecdb8800, dwHighDateTime=0x1bfbeed)) returned 1 [0101.524] SetFilePointer (in: hFile=0x8c, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0101.524] ReadFile (in: hFile=0x8c, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x356c, lpOverlapped=0x0) returned 1 [0101.575] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\VOLTAGE.WAV") returned="VOLTAGE.WAV" [0101.575] SetFilePointer (in: hFile=0x8c, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0101.575] WriteFile (in: hFile=0x8c, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x356c, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x356c, lpOverlapped=0x0) returned 1 [0101.575] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0101.575] CloseHandle (hObject=0x8c) returned 1 [0101.575] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\VOLTAGE.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\voltage.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\VOLTAGE.WAV. " (normalized: "c:\\program files\\microsoft office\\office14\\media\\voltage.wav. ")) returned 1 [0101.576] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0101.576] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0101.576] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="WHOOSH.WAV") returned -1 [0101.576] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WHOOSH.WAV") returned -1 [0101.576] lstrcmpiA (lpString1="", lpString2="WHOOSH.WAV") returned -1 [0101.576] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\VOLTAGE.WAV") returned="VOLTAGE.WAV" [0101.576] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\", lpString2="WHOOSH.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WHOOSH.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WHOOSH.WAV" [0101.576] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WHOOSH.WAV", pszSpec="*.zip") returned 0 [0101.576] lstrlenA (lpString="*.zip") returned 5 [0101.576] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WHOOSH.WAV", pszSpec="*.rar") returned 0 [0101.576] lstrlenA (lpString="*.rar") returned 5 [0101.576] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WHOOSH.WAV", pszSpec="*.7z") returned 0 [0101.576] lstrlenA (lpString="*.7z") returned 4 [0101.576] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WHOOSH.WAV", pszSpec="*.tar") returned 0 [0101.576] lstrlenA (lpString="*.tar") returned 5 [0101.576] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WHOOSH.WAV", pszSpec="*.gzip") returned 0 [0101.576] lstrlenA (lpString="*.gzip") returned 6 [0101.576] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WHOOSH.WAV", pszSpec="*.jpg") returned 0 [0101.576] lstrlenA (lpString="*.jpg") returned 5 [0101.576] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WHOOSH.WAV", pszSpec="*.jpeg") returned 0 [0101.576] lstrlenA (lpString="*.jpeg") returned 6 [0101.577] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WHOOSH.WAV", pszSpec="*.psd") returned 0 [0101.577] lstrlenA (lpString="*.psd") returned 5 [0101.577] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WHOOSH.WAV", pszSpec="*.cdr") returned 0 [0101.577] lstrlenA (lpString="*.cdr") returned 5 [0101.577] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WHOOSH.WAV", pszSpec="*.dwg") returned 0 [0101.577] lstrlenA (lpString="*.dwg") returned 5 [0101.577] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WHOOSH.WAV", pszSpec="*.max") returned 0 [0101.577] lstrlenA (lpString="*.max") returned 5 [0101.577] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WHOOSH.WAV", pszSpec="*.bmp") returned 0 [0101.577] lstrlenA (lpString="*.bmp") returned 5 [0101.577] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WHOOSH.WAV", pszSpec="*.gif") returned 0 [0101.577] lstrlenA (lpString="*.gif") returned 5 [0101.577] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WHOOSH.WAV", pszSpec="*.png") returned 0 [0101.577] lstrlenA (lpString="*.png") returned 5 [0101.577] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WHOOSH.WAV", pszSpec="*.doc") returned 0 [0101.577] lstrlenA (lpString="*.doc") returned 5 [0101.577] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WHOOSH.WAV", pszSpec="*.docx") returned 0 [0101.577] lstrlenA (lpString="*.docx") returned 6 [0101.577] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WHOOSH.WAV", pszSpec="*.xls") returned 0 [0101.577] lstrlenA (lpString="*.xls") returned 5 [0101.577] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WHOOSH.WAV", pszSpec="*.xlsx") returned 0 [0101.577] lstrlenA (lpString="*.xlsx") returned 6 [0101.577] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WHOOSH.WAV", pszSpec="*.ppt") returned 0 [0101.577] lstrlenA (lpString="*.ppt") returned 5 [0101.577] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WHOOSH.WAV", pszSpec="*.pptx") returned 0 [0101.577] lstrlenA (lpString="*.pptx") returned 6 [0101.577] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WHOOSH.WAV", pszSpec="*.txt") returned 0 [0101.577] lstrlenA (lpString="*.txt") returned 5 [0101.577] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WHOOSH.WAV", pszSpec="*.pdf") returned 0 [0101.577] lstrlenA (lpString="*.pdf") returned 5 [0101.577] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WHOOSH.WAV", pszSpec="*.djvu") returned 0 [0101.577] lstrlenA (lpString="*.djvu") returned 6 [0101.577] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WHOOSH.WAV", pszSpec="*.htm") returned 0 [0101.577] lstrlenA (lpString="*.htm") returned 5 [0101.577] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WHOOSH.WAV", pszSpec="*.html") returned 0 [0101.577] lstrlenA (lpString="*.html") returned 6 [0101.577] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WHOOSH.WAV", pszSpec="*.mdb") returned 0 [0101.577] lstrlenA (lpString="*.mdb") returned 5 [0101.577] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WHOOSH.WAV", pszSpec="*.cer") returned 0 [0101.577] lstrlenA (lpString="*.cer") returned 5 [0101.577] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WHOOSH.WAV", pszSpec="*.p12") returned 0 [0101.577] lstrlenA (lpString="*.p12") returned 5 [0101.577] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WHOOSH.WAV", pszSpec="*.pfx") returned 0 [0101.577] lstrlenA (lpString="*.pfx") returned 5 [0101.577] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WHOOSH.WAV", pszSpec="*.kwm") returned 0 [0101.577] lstrlenA (lpString="*.kwm") returned 5 [0101.578] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WHOOSH.WAV", pszSpec="*.pwm") returned 0 [0101.578] lstrlenA (lpString="*.pwm") returned 5 [0101.578] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WHOOSH.WAV", pszSpec="*.1cd") returned 0 [0101.578] lstrlenA (lpString="*.1cd") returned 5 [0101.578] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WHOOSH.WAV", pszSpec="*.md") returned 0 [0101.578] lstrlenA (lpString="*.md") returned 4 [0101.578] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WHOOSH.WAV", pszSpec="*.mdf") returned 0 [0101.578] lstrlenA (lpString="*.mdf") returned 5 [0101.578] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WHOOSH.WAV", pszSpec="*.dbf") returned 0 [0101.578] lstrlenA (lpString="*.dbf") returned 5 [0101.578] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WHOOSH.WAV", pszSpec="*.odt") returned 0 [0101.578] lstrlenA (lpString="*.odt") returned 5 [0101.578] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WHOOSH.WAV", pszSpec="*.vob") returned 0 [0101.578] lstrlenA (lpString="*.vob") returned 5 [0101.578] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WHOOSH.WAV", pszSpec="*.ifo") returned 0 [0101.578] lstrlenA (lpString="*.ifo") returned 5 [0101.578] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WHOOSH.WAV", pszSpec="*.lnk") returned 0 [0101.578] lstrlenA (lpString="*.lnk") returned 5 [0101.578] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WHOOSH.WAV", pszSpec="*.torrent") returned 0 [0101.578] lstrlenA (lpString="*.torrent") returned 9 [0101.578] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WHOOSH.WAV", pszSpec="*.mov") returned 0 [0101.578] lstrlenA (lpString="*.mov") returned 5 [0101.578] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WHOOSH.WAV", pszSpec="*.m2v") returned 0 [0101.578] lstrlenA (lpString="*.m2v") returned 5 [0101.578] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WHOOSH.WAV", pszSpec="*.3gp") returned 0 [0101.578] lstrlenA (lpString="*.3gp") returned 5 [0101.578] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WHOOSH.WAV", pszSpec="*.mpeg") returned 0 [0101.578] lstrlenA (lpString="*.mpeg") returned 6 [0101.578] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WHOOSH.WAV", pszSpec="*.mpg") returned 0 [0101.578] lstrlenA (lpString="*.mpg") returned 5 [0101.578] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WHOOSH.WAV", pszSpec="*.flv") returned 0 [0101.578] lstrlenA (lpString="*.flv") returned 5 [0101.578] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WHOOSH.WAV", pszSpec="*.avi") returned 0 [0101.578] lstrlenA (lpString="*.avi") returned 5 [0101.578] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WHOOSH.WAV", pszSpec="*.mp4") returned 0 [0101.578] lstrlenA (lpString="*.mp4") returned 5 [0101.578] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WHOOSH.WAV", pszSpec="*.wmv") returned 0 [0101.578] lstrlenA (lpString="*.wmv") returned 5 [0101.578] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WHOOSH.WAV", pszSpec="*.divx") returned 0 [0101.578] lstrlenA (lpString="*.divx") returned 6 [0101.578] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WHOOSH.WAV", pszSpec="*.mkv") returned 0 [0101.579] lstrlenA (lpString="*.mkv") returned 5 [0101.579] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WHOOSH.WAV", pszSpec="*.mp3") returned 0 [0101.579] lstrlenA (lpString="*.mp3") returned 5 [0101.579] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WHOOSH.WAV", pszSpec="*.wav") returned 1 [0101.579] lstrlenA (lpString="*.wav") returned 5 [0101.579] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WHOOSH.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WHOOSH.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WHOOSH.WAV" [0101.579] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WHOOSH.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WHOOSH.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WHOOSH.WAV" [0101.579] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WHOOSH.WAV", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WHOOSH.WAV.") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WHOOSH.WAV." [0101.579] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WHOOSH.WAV.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WHOOSH.WAV. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WHOOSH.WAV. " [0101.579] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WHOOSH.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\whoosh.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c [0101.580] GetFileSize (in: hFile=0x8c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x6de [0101.580] GetFileTime (in: hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x1b50b600, dwHighDateTime=0x1bc8d47), lpLastAccessTime=0x407536*(dwLowDateTime=0x5e5c1270, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x1b50b600, dwHighDateTime=0x1bc8d47)) returned 1 [0101.580] SetFilePointer (in: hFile=0x8c, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0101.580] ReadFile (in: hFile=0x8c, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x684, lpOverlapped=0x0) returned 1 [0101.620] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WHOOSH.WAV") returned="WHOOSH.WAV" [0101.620] SetFilePointer (in: hFile=0x8c, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0101.620] WriteFile (in: hFile=0x8c, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x684, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x684, lpOverlapped=0x0) returned 1 [0101.620] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0101.620] CloseHandle (hObject=0x8c) returned 1 [0101.620] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WHOOSH.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\whoosh.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WHOOSH.WAV. " (normalized: "c:\\program files\\microsoft office\\office14\\media\\whoosh.wav. ")) returned 1 [0101.621] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0101.621] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0101.621] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="WIND.WAV") returned -1 [0101.621] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WIND.WAV") returned -1 [0101.621] lstrcmpiA (lpString1="", lpString2="WIND.WAV") returned -1 [0101.621] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WHOOSH.WAV") returned="WHOOSH.WAV" [0101.621] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\", lpString2="WIND.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WIND.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WIND.WAV" [0101.621] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WIND.WAV", pszSpec="*.zip") returned 0 [0101.621] lstrlenA (lpString="*.zip") returned 5 [0101.621] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WIND.WAV", pszSpec="*.rar") returned 0 [0101.621] lstrlenA (lpString="*.rar") returned 5 [0101.621] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WIND.WAV", pszSpec="*.7z") returned 0 [0101.621] lstrlenA (lpString="*.7z") returned 4 [0101.621] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WIND.WAV", pszSpec="*.tar") returned 0 [0101.621] lstrlenA (lpString="*.tar") returned 5 [0101.621] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WIND.WAV", pszSpec="*.gzip") returned 0 [0101.621] lstrlenA (lpString="*.gzip") returned 6 [0101.621] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WIND.WAV", pszSpec="*.jpg") returned 0 [0101.622] lstrlenA (lpString="*.jpg") returned 5 [0101.622] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WIND.WAV", pszSpec="*.jpeg") returned 0 [0101.622] lstrlenA (lpString="*.jpeg") returned 6 [0101.622] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WIND.WAV", pszSpec="*.psd") returned 0 [0101.622] lstrlenA (lpString="*.psd") returned 5 [0101.622] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WIND.WAV", pszSpec="*.cdr") returned 0 [0101.622] lstrlenA (lpString="*.cdr") returned 5 [0101.622] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WIND.WAV", pszSpec="*.dwg") returned 0 [0101.622] lstrlenA (lpString="*.dwg") returned 5 [0101.622] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WIND.WAV", pszSpec="*.max") returned 0 [0101.622] lstrlenA (lpString="*.max") returned 5 [0101.622] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WIND.WAV", pszSpec="*.bmp") returned 0 [0101.622] lstrlenA (lpString="*.bmp") returned 5 [0101.622] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WIND.WAV", pszSpec="*.gif") returned 0 [0101.622] lstrlenA (lpString="*.gif") returned 5 [0101.622] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WIND.WAV", pszSpec="*.png") returned 0 [0101.622] lstrlenA (lpString="*.png") returned 5 [0101.622] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WIND.WAV", pszSpec="*.doc") returned 0 [0101.622] lstrlenA (lpString="*.doc") returned 5 [0101.622] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WIND.WAV", pszSpec="*.docx") returned 0 [0101.622] lstrlenA (lpString="*.docx") returned 6 [0101.622] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WIND.WAV", pszSpec="*.xls") returned 0 [0101.622] lstrlenA (lpString="*.xls") returned 5 [0101.622] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WIND.WAV", pszSpec="*.xlsx") returned 0 [0101.622] lstrlenA (lpString="*.xlsx") returned 6 [0101.622] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WIND.WAV", pszSpec="*.ppt") returned 0 [0101.622] lstrlenA (lpString="*.ppt") returned 5 [0101.622] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WIND.WAV", pszSpec="*.pptx") returned 0 [0101.622] lstrlenA (lpString="*.pptx") returned 6 [0101.622] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WIND.WAV", pszSpec="*.txt") returned 0 [0101.622] lstrlenA (lpString="*.txt") returned 5 [0101.622] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WIND.WAV", pszSpec="*.pdf") returned 0 [0101.622] lstrlenA (lpString="*.pdf") returned 5 [0101.622] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WIND.WAV", pszSpec="*.djvu") returned 0 [0101.622] lstrlenA (lpString="*.djvu") returned 6 [0101.622] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WIND.WAV", pszSpec="*.htm") returned 0 [0101.622] lstrlenA (lpString="*.htm") returned 5 [0101.622] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WIND.WAV", pszSpec="*.html") returned 0 [0101.622] lstrlenA (lpString="*.html") returned 6 [0101.622] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WIND.WAV", pszSpec="*.mdb") returned 0 [0101.622] lstrlenA (lpString="*.mdb") returned 5 [0101.622] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WIND.WAV", pszSpec="*.cer") returned 0 [0101.622] lstrlenA (lpString="*.cer") returned 5 [0101.622] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WIND.WAV", pszSpec="*.p12") returned 0 [0101.622] lstrlenA (lpString="*.p12") returned 5 [0101.622] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WIND.WAV", pszSpec="*.pfx") returned 0 [0101.623] lstrlenA (lpString="*.pfx") returned 5 [0101.623] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WIND.WAV", pszSpec="*.kwm") returned 0 [0101.623] lstrlenA (lpString="*.kwm") returned 5 [0101.623] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WIND.WAV", pszSpec="*.pwm") returned 0 [0101.623] lstrlenA (lpString="*.pwm") returned 5 [0101.623] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WIND.WAV", pszSpec="*.1cd") returned 0 [0101.623] lstrlenA (lpString="*.1cd") returned 5 [0101.623] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WIND.WAV", pszSpec="*.md") returned 0 [0101.623] lstrlenA (lpString="*.md") returned 4 [0101.623] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WIND.WAV", pszSpec="*.mdf") returned 0 [0101.623] lstrlenA (lpString="*.mdf") returned 5 [0101.623] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WIND.WAV", pszSpec="*.dbf") returned 0 [0101.623] lstrlenA (lpString="*.dbf") returned 5 [0101.623] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WIND.WAV", pszSpec="*.odt") returned 0 [0101.623] lstrlenA (lpString="*.odt") returned 5 [0101.623] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WIND.WAV", pszSpec="*.vob") returned 0 [0101.623] lstrlenA (lpString="*.vob") returned 5 [0101.623] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WIND.WAV", pszSpec="*.ifo") returned 0 [0101.623] lstrlenA (lpString="*.ifo") returned 5 [0101.623] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WIND.WAV", pszSpec="*.lnk") returned 0 [0101.623] lstrlenA (lpString="*.lnk") returned 5 [0101.623] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WIND.WAV", pszSpec="*.torrent") returned 0 [0101.623] lstrlenA (lpString="*.torrent") returned 9 [0101.623] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WIND.WAV", pszSpec="*.mov") returned 0 [0101.623] lstrlenA (lpString="*.mov") returned 5 [0101.623] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WIND.WAV", pszSpec="*.m2v") returned 0 [0101.623] lstrlenA (lpString="*.m2v") returned 5 [0101.623] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WIND.WAV", pszSpec="*.3gp") returned 0 [0101.623] lstrlenA (lpString="*.3gp") returned 5 [0101.623] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WIND.WAV", pszSpec="*.mpeg") returned 0 [0101.623] lstrlenA (lpString="*.mpeg") returned 6 [0101.623] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WIND.WAV", pszSpec="*.mpg") returned 0 [0101.623] lstrlenA (lpString="*.mpg") returned 5 [0101.623] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WIND.WAV", pszSpec="*.flv") returned 0 [0101.623] lstrlenA (lpString="*.flv") returned 5 [0101.623] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WIND.WAV", pszSpec="*.avi") returned 0 [0101.623] lstrlenA (lpString="*.avi") returned 5 [0101.623] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WIND.WAV", pszSpec="*.mp4") returned 0 [0101.623] lstrlenA (lpString="*.mp4") returned 5 [0101.623] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WIND.WAV", pszSpec="*.wmv") returned 0 [0101.623] lstrlenA (lpString="*.wmv") returned 5 [0101.623] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WIND.WAV", pszSpec="*.divx") returned 0 [0101.623] lstrlenA (lpString="*.divx") returned 6 [0101.623] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WIND.WAV", pszSpec="*.mkv") returned 0 [0101.623] lstrlenA (lpString="*.mkv") returned 5 [0101.623] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WIND.WAV", pszSpec="*.mp3") returned 0 [0101.623] lstrlenA (lpString="*.mp3") returned 5 [0101.623] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WIND.WAV", pszSpec="*.wav") returned 1 [0101.623] lstrlenA (lpString="*.wav") returned 5 [0101.623] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WIND.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WIND.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WIND.WAV" [0101.624] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WIND.WAV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WIND.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WIND.WAV" [0101.624] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WIND.WAV", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WIND.WAV.") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WIND.WAV." [0101.624] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WIND.WAV.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WIND.WAV. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WIND.WAV. " [0101.624] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WIND.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\wind.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c [0101.625] GetFileSize (in: hFile=0x8c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2b84 [0101.625] GetFileTime (in: hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xdcde5800, dwHighDateTime=0x1bfc6e6), lpLastAccessTime=0x407536*(dwLowDateTime=0x708e7550, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0xdcde5800, dwHighDateTime=0x1bfc6e6)) returned 1 [0101.625] SetFilePointer (in: hFile=0x8c, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0101.625] ReadFile (in: hFile=0x8c, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x2b2a, lpOverlapped=0x0) returned 1 [0101.716] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WIND.WAV") returned="WIND.WAV" [0101.716] SetFilePointer (in: hFile=0x8c, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0101.716] WriteFile (in: hFile=0x8c, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x2b2a, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x2b2a, lpOverlapped=0x0) returned 1 [0101.717] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0101.717] CloseHandle (hObject=0x8c) returned 1 [0101.717] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WIND.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\wind.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WIND.WAV. " (normalized: "c:\\program files\\microsoft office\\office14\\media\\wind.wav. ")) returned 1 [0101.719] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0 [0101.719] FindClose (in: hFindFile=0x5be160 | out: hFindFile=0x5be160) returned 1 [0101.719] FindNextFileA (in: hFindFile=0x5b5bd0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0101.719] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0101.719] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Microsoft.BusinessData.dll") returned -1 [0101.719] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.BusinessData.dll") returned -1 [0101.719] lstrcmpiA (lpString1="", lpString2="Microsoft.BusinessData.dll") returned -1 [0101.719] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\*.*") returned="*.*" [0101.719] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="Microsoft.BusinessData.dll" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.dll") returned="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.dll" [0101.719] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.dll", pszSpec="*.zip") returned 0 [0101.719] lstrlenA (lpString="*.zip") returned 5 [0101.720] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.dll", pszSpec="*.rar") returned 0 [0101.720] lstrlenA (lpString="*.rar") returned 5 [0101.720] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.dll", pszSpec="*.7z") returned 0 [0101.720] lstrlenA (lpString="*.7z") returned 4 [0101.720] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.dll", pszSpec="*.tar") returned 0 [0101.720] lstrlenA (lpString="*.tar") returned 5 [0101.720] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.dll", pszSpec="*.gzip") returned 0 [0101.720] lstrlenA (lpString="*.gzip") returned 6 [0101.720] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.dll", pszSpec="*.jpg") returned 0 [0101.720] lstrlenA (lpString="*.jpg") returned 5 [0101.720] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.dll", pszSpec="*.jpeg") returned 0 [0101.720] lstrlenA (lpString="*.jpeg") returned 6 [0101.720] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.dll", pszSpec="*.psd") returned 0 [0101.720] lstrlenA (lpString="*.psd") returned 5 [0101.720] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.dll", pszSpec="*.cdr") returned 0 [0101.720] lstrlenA (lpString="*.cdr") returned 5 [0101.720] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.dll", pszSpec="*.dwg") returned 0 [0101.720] lstrlenA (lpString="*.dwg") returned 5 [0101.720] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.dll", pszSpec="*.max") returned 0 [0101.720] lstrlenA (lpString="*.max") returned 5 [0101.720] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.dll", pszSpec="*.bmp") returned 0 [0101.720] lstrlenA (lpString="*.bmp") returned 5 [0101.720] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.dll", pszSpec="*.gif") returned 0 [0101.720] lstrlenA (lpString="*.gif") returned 5 [0101.720] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.dll", pszSpec="*.png") returned 0 [0101.720] lstrlenA (lpString="*.png") returned 5 [0101.720] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.dll", pszSpec="*.doc") returned 0 [0101.720] lstrlenA (lpString="*.doc") returned 5 [0101.720] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.dll", pszSpec="*.docx") returned 0 [0101.720] lstrlenA (lpString="*.docx") returned 6 [0101.720] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.dll", pszSpec="*.xls") returned 0 [0101.720] lstrlenA (lpString="*.xls") returned 5 [0101.720] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.dll", pszSpec="*.xlsx") returned 0 [0101.720] lstrlenA (lpString="*.xlsx") returned 6 [0101.720] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.dll", pszSpec="*.ppt") returned 0 [0101.720] lstrlenA (lpString="*.ppt") returned 5 [0101.720] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.dll", pszSpec="*.pptx") returned 0 [0101.720] lstrlenA (lpString="*.pptx") returned 6 [0101.720] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.dll", pszSpec="*.txt") returned 0 [0101.721] lstrlenA (lpString="*.txt") returned 5 [0101.721] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.dll", pszSpec="*.pdf") returned 0 [0101.721] lstrlenA (lpString="*.pdf") returned 5 [0101.721] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.dll", pszSpec="*.djvu") returned 0 [0101.721] lstrlenA (lpString="*.djvu") returned 6 [0101.721] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.dll", pszSpec="*.htm") returned 0 [0101.721] lstrlenA (lpString="*.htm") returned 5 [0101.721] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.dll", pszSpec="*.html") returned 0 [0101.721] lstrlenA (lpString="*.html") returned 6 [0101.721] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.dll", pszSpec="*.mdb") returned 0 [0101.721] lstrlenA (lpString="*.mdb") returned 5 [0101.721] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.dll", pszSpec="*.cer") returned 0 [0101.721] lstrlenA (lpString="*.cer") returned 5 [0101.721] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.dll", pszSpec="*.p12") returned 0 [0101.721] lstrlenA (lpString="*.p12") returned 5 [0101.721] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.dll", pszSpec="*.pfx") returned 0 [0101.721] lstrlenA (lpString="*.pfx") returned 5 [0101.721] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.dll", pszSpec="*.kwm") returned 0 [0101.721] lstrlenA (lpString="*.kwm") returned 5 [0101.721] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.dll", pszSpec="*.pwm") returned 0 [0101.721] lstrlenA (lpString="*.pwm") returned 5 [0101.721] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.dll", pszSpec="*.1cd") returned 0 [0101.721] lstrlenA (lpString="*.1cd") returned 5 [0101.721] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.dll", pszSpec="*.md") returned 0 [0101.721] lstrlenA (lpString="*.md") returned 4 [0101.721] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.dll", pszSpec="*.mdf") returned 0 [0101.721] lstrlenA (lpString="*.mdf") returned 5 [0101.721] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.dll", pszSpec="*.dbf") returned 0 [0101.721] lstrlenA (lpString="*.dbf") returned 5 [0101.721] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.dll", pszSpec="*.odt") returned 0 [0101.721] lstrlenA (lpString="*.odt") returned 5 [0101.721] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.dll", pszSpec="*.vob") returned 0 [0101.721] lstrlenA (lpString="*.vob") returned 5 [0101.721] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.dll", pszSpec="*.ifo") returned 0 [0101.721] lstrlenA (lpString="*.ifo") returned 5 [0101.721] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.dll", pszSpec="*.lnk") returned 0 [0101.721] lstrlenA (lpString="*.lnk") returned 5 [0101.721] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.dll", pszSpec="*.torrent") returned 0 [0101.722] lstrlenA (lpString="*.torrent") returned 9 [0101.722] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.dll", pszSpec="*.mov") returned 0 [0101.722] lstrlenA (lpString="*.mov") returned 5 [0101.722] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.dll", pszSpec="*.m2v") returned 0 [0101.722] lstrlenA (lpString="*.m2v") returned 5 [0101.722] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.dll", pszSpec="*.3gp") returned 0 [0101.722] lstrlenA (lpString="*.3gp") returned 5 [0101.722] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.dll", pszSpec="*.mpeg") returned 0 [0101.722] lstrlenA (lpString="*.mpeg") returned 6 [0101.722] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.dll", pszSpec="*.mpg") returned 0 [0101.722] lstrlenA (lpString="*.mpg") returned 5 [0101.722] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.dll", pszSpec="*.flv") returned 0 [0101.722] lstrlenA (lpString="*.flv") returned 5 [0101.722] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.dll", pszSpec="*.avi") returned 0 [0101.722] lstrlenA (lpString="*.avi") returned 5 [0101.722] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.dll", pszSpec="*.mp4") returned 0 [0101.722] lstrlenA (lpString="*.mp4") returned 5 [0101.722] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.dll", pszSpec="*.wmv") returned 0 [0101.722] lstrlenA (lpString="*.wmv") returned 5 [0101.722] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.dll", pszSpec="*.divx") returned 0 [0101.722] lstrlenA (lpString="*.divx") returned 6 [0101.722] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.dll", pszSpec="*.mkv") returned 0 [0101.722] lstrlenA (lpString="*.mkv") returned 5 [0101.722] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.dll", pszSpec="*.mp3") returned 0 [0101.722] lstrlenA (lpString="*.mp3") returned 5 [0101.722] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.dll", pszSpec="*.wav") returned 0 [0101.722] lstrlenA (lpString="*.wav") returned 5 [0101.722] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.dll", pszSpec="*.flac") returned 0 [0101.722] lstrlenA (lpString="*.flac") returned 6 [0101.722] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.dll", pszSpec="*.ape") returned 0 [0101.722] lstrlenA (lpString="*.ape") returned 5 [0101.722] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.dll", pszSpec="*.wma") returned 0 [0101.722] lstrlenA (lpString="*.wma") returned 5 [0101.722] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.dll", pszSpec="*.ac3") returned 0 [0101.722] lstrlenA (lpString="*.ac3") returned 5 [0101.722] FindNextFileA (in: hFindFile=0x5b5bd0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0101.722] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0101.722] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Microsoft.BusinessData.xml") returned -1 [0101.722] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.BusinessData.xml") returned -1 [0101.723] lstrcmpiA (lpString1="", lpString2="Microsoft.BusinessData.xml") returned -1 [0101.723] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.dll") returned="Microsoft.BusinessData.dll" [0101.723] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="Microsoft.BusinessData.xml" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.xml") returned="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.xml" [0101.723] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.xml", pszSpec="*.zip") returned 0 [0101.723] lstrlenA (lpString="*.zip") returned 5 [0101.723] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.xml", pszSpec="*.rar") returned 0 [0101.723] lstrlenA (lpString="*.rar") returned 5 [0101.723] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.xml", pszSpec="*.7z") returned 0 [0101.723] lstrlenA (lpString="*.7z") returned 4 [0101.723] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.xml", pszSpec="*.tar") returned 0 [0101.723] lstrlenA (lpString="*.tar") returned 5 [0101.723] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.xml", pszSpec="*.gzip") returned 0 [0101.723] lstrlenA (lpString="*.gzip") returned 6 [0101.723] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.xml", pszSpec="*.jpg") returned 0 [0101.723] lstrlenA (lpString="*.jpg") returned 5 [0101.723] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.xml", pszSpec="*.jpeg") returned 0 [0101.723] lstrlenA (lpString="*.jpeg") returned 6 [0101.723] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.xml", pszSpec="*.psd") returned 0 [0101.723] lstrlenA (lpString="*.psd") returned 5 [0101.723] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.xml", pszSpec="*.cdr") returned 0 [0101.723] lstrlenA (lpString="*.cdr") returned 5 [0101.723] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.xml", pszSpec="*.dwg") returned 0 [0101.723] lstrlenA (lpString="*.dwg") returned 5 [0101.723] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.xml", pszSpec="*.max") returned 0 [0101.723] lstrlenA (lpString="*.max") returned 5 [0101.723] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.xml", pszSpec="*.bmp") returned 0 [0101.723] lstrlenA (lpString="*.bmp") returned 5 [0101.723] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.xml", pszSpec="*.gif") returned 0 [0101.723] lstrlenA (lpString="*.gif") returned 5 [0101.723] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.xml", pszSpec="*.png") returned 0 [0101.723] lstrlenA (lpString="*.png") returned 5 [0101.723] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.xml", pszSpec="*.doc") returned 0 [0101.723] lstrlenA (lpString="*.doc") returned 5 [0101.723] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.xml", pszSpec="*.docx") returned 0 [0101.723] lstrlenA (lpString="*.docx") returned 6 [0101.723] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.xml", pszSpec="*.xls") returned 0 [0101.724] lstrlenA (lpString="*.xls") returned 5 [0101.724] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.xml", pszSpec="*.xlsx") returned 0 [0101.724] lstrlenA (lpString="*.xlsx") returned 6 [0101.724] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.xml", pszSpec="*.ppt") returned 0 [0101.724] lstrlenA (lpString="*.ppt") returned 5 [0101.724] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.xml", pszSpec="*.pptx") returned 0 [0101.724] lstrlenA (lpString="*.pptx") returned 6 [0101.724] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.xml", pszSpec="*.txt") returned 0 [0101.724] lstrlenA (lpString="*.txt") returned 5 [0101.724] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.xml", pszSpec="*.pdf") returned 0 [0101.724] lstrlenA (lpString="*.pdf") returned 5 [0101.724] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.xml", pszSpec="*.djvu") returned 0 [0101.724] lstrlenA (lpString="*.djvu") returned 6 [0101.724] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.xml", pszSpec="*.htm") returned 0 [0101.724] lstrlenA (lpString="*.htm") returned 5 [0101.724] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.xml", pszSpec="*.html") returned 0 [0101.724] lstrlenA (lpString="*.html") returned 6 [0101.724] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.xml", pszSpec="*.mdb") returned 0 [0101.724] lstrlenA (lpString="*.mdb") returned 5 [0101.724] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.xml", pszSpec="*.cer") returned 0 [0101.724] lstrlenA (lpString="*.cer") returned 5 [0101.724] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.xml", pszSpec="*.p12") returned 0 [0101.724] lstrlenA (lpString="*.p12") returned 5 [0101.724] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.xml", pszSpec="*.pfx") returned 0 [0101.724] lstrlenA (lpString="*.pfx") returned 5 [0101.724] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.xml", pszSpec="*.kwm") returned 0 [0101.724] lstrlenA (lpString="*.kwm") returned 5 [0101.724] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.xml", pszSpec="*.pwm") returned 0 [0101.724] lstrlenA (lpString="*.pwm") returned 5 [0101.724] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.xml", pszSpec="*.1cd") returned 0 [0101.724] lstrlenA (lpString="*.1cd") returned 5 [0101.724] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.xml", pszSpec="*.md") returned 0 [0101.724] lstrlenA (lpString="*.md") returned 4 [0101.724] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.xml", pszSpec="*.mdf") returned 0 [0101.724] lstrlenA (lpString="*.mdf") returned 5 [0101.724] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.xml", pszSpec="*.dbf") returned 0 [0101.724] lstrlenA (lpString="*.dbf") returned 5 [0101.724] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.xml", pszSpec="*.odt") returned 0 [0101.725] lstrlenA (lpString="*.odt") returned 5 [0101.725] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.xml", pszSpec="*.vob") returned 0 [0101.725] lstrlenA (lpString="*.vob") returned 5 [0101.725] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.xml", pszSpec="*.ifo") returned 0 [0101.725] lstrlenA (lpString="*.ifo") returned 5 [0101.725] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.xml", pszSpec="*.lnk") returned 0 [0101.725] lstrlenA (lpString="*.lnk") returned 5 [0101.725] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.xml", pszSpec="*.torrent") returned 0 [0101.725] lstrlenA (lpString="*.torrent") returned 9 [0101.725] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.xml", pszSpec="*.mov") returned 0 [0101.725] lstrlenA (lpString="*.mov") returned 5 [0101.725] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.xml", pszSpec="*.m2v") returned 0 [0101.725] lstrlenA (lpString="*.m2v") returned 5 [0101.725] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.xml", pszSpec="*.3gp") returned 0 [0101.725] lstrlenA (lpString="*.3gp") returned 5 [0101.725] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.xml", pszSpec="*.mpeg") returned 0 [0101.725] lstrlenA (lpString="*.mpeg") returned 6 [0101.725] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.xml", pszSpec="*.mpg") returned 0 [0101.725] lstrlenA (lpString="*.mpg") returned 5 [0101.725] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.xml", pszSpec="*.flv") returned 0 [0101.725] lstrlenA (lpString="*.flv") returned 5 [0101.725] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.xml", pszSpec="*.avi") returned 0 [0101.725] lstrlenA (lpString="*.avi") returned 5 [0101.725] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.xml", pszSpec="*.mp4") returned 0 [0101.725] lstrlenA (lpString="*.mp4") returned 5 [0101.725] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.xml", pszSpec="*.wmv") returned 0 [0101.725] lstrlenA (lpString="*.wmv") returned 5 [0101.725] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.xml", pszSpec="*.divx") returned 0 [0101.725] lstrlenA (lpString="*.divx") returned 6 [0101.725] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.xml", pszSpec="*.mkv") returned 0 [0101.725] lstrlenA (lpString="*.mkv") returned 5 [0101.725] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.xml", pszSpec="*.mp3") returned 0 [0101.725] lstrlenA (lpString="*.mp3") returned 5 [0101.725] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.xml", pszSpec="*.wav") returned 0 [0101.725] lstrlenA (lpString="*.wav") returned 5 [0101.725] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.xml", pszSpec="*.flac") returned 0 [0101.725] lstrlenA (lpString="*.flac") returned 6 [0101.725] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.xml", pszSpec="*.ape") returned 0 [0101.726] lstrlenA (lpString="*.ape") returned 5 [0101.726] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.xml", pszSpec="*.wma") returned 0 [0101.726] lstrlenA (lpString="*.wma") returned 5 [0101.726] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.xml", pszSpec="*.ac3") returned 0 [0101.726] lstrlenA (lpString="*.ac3") returned 5 [0101.726] FindNextFileA (in: hFindFile=0x5b5bd0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0101.726] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0101.726] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Microsoft.Office.BusinessApplications.Runtime.dll") returned -1 [0101.726] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Office.BusinessApplications.Runtime.dll") returned -1 [0101.726] lstrcmpiA (lpString1="", lpString2="Microsoft.Office.BusinessApplications.Runtime.dll") returned -1 [0101.726] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.xml") returned="Microsoft.BusinessData.xml" [0101.726] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="Microsoft.Office.BusinessApplications.Runtime.dll" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.dll") returned="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.dll" [0101.726] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.dll", pszSpec="*.zip") returned 0 [0101.726] lstrlenA (lpString="*.zip") returned 5 [0101.726] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.dll", pszSpec="*.rar") returned 0 [0101.726] lstrlenA (lpString="*.rar") returned 5 [0101.726] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.dll", pszSpec="*.7z") returned 0 [0101.726] lstrlenA (lpString="*.7z") returned 4 [0101.726] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.dll", pszSpec="*.tar") returned 0 [0101.726] lstrlenA (lpString="*.tar") returned 5 [0101.726] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.dll", pszSpec="*.gzip") returned 0 [0101.726] lstrlenA (lpString="*.gzip") returned 6 [0101.726] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.dll", pszSpec="*.jpg") returned 0 [0101.726] lstrlenA (lpString="*.jpg") returned 5 [0101.726] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.dll", pszSpec="*.jpeg") returned 0 [0101.726] lstrlenA (lpString="*.jpeg") returned 6 [0101.726] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.dll", pszSpec="*.psd") returned 0 [0101.726] lstrlenA (lpString="*.psd") returned 5 [0101.726] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.dll", pszSpec="*.cdr") returned 0 [0101.726] lstrlenA (lpString="*.cdr") returned 5 [0101.726] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.dll", pszSpec="*.dwg") returned 0 [0101.726] lstrlenA (lpString="*.dwg") returned 5 [0101.726] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.dll", pszSpec="*.max") returned 0 [0101.726] lstrlenA (lpString="*.max") returned 5 [0101.726] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.dll", pszSpec="*.bmp") returned 0 [0101.726] lstrlenA (lpString="*.bmp") returned 5 [0101.726] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.dll", pszSpec="*.gif") returned 0 [0101.727] lstrlenA (lpString="*.gif") returned 5 [0101.727] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.dll", pszSpec="*.png") returned 0 [0101.727] lstrlenA (lpString="*.png") returned 5 [0101.727] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.dll", pszSpec="*.doc") returned 0 [0101.727] lstrlenA (lpString="*.doc") returned 5 [0101.727] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.dll", pszSpec="*.docx") returned 0 [0101.727] lstrlenA (lpString="*.docx") returned 6 [0101.727] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.dll", pszSpec="*.xls") returned 0 [0101.727] lstrlenA (lpString="*.xls") returned 5 [0101.727] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.dll", pszSpec="*.xlsx") returned 0 [0101.727] lstrlenA (lpString="*.xlsx") returned 6 [0101.727] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.dll", pszSpec="*.ppt") returned 0 [0101.727] lstrlenA (lpString="*.ppt") returned 5 [0101.727] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.dll", pszSpec="*.pptx") returned 0 [0101.727] lstrlenA (lpString="*.pptx") returned 6 [0101.727] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.dll", pszSpec="*.txt") returned 0 [0101.727] lstrlenA (lpString="*.txt") returned 5 [0101.727] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.dll", pszSpec="*.pdf") returned 0 [0101.727] lstrlenA (lpString="*.pdf") returned 5 [0101.727] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.dll", pszSpec="*.djvu") returned 0 [0101.727] lstrlenA (lpString="*.djvu") returned 6 [0101.727] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.dll", pszSpec="*.htm") returned 0 [0101.727] lstrlenA (lpString="*.htm") returned 5 [0101.727] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.dll", pszSpec="*.html") returned 0 [0101.727] lstrlenA (lpString="*.html") returned 6 [0101.727] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.dll", pszSpec="*.mdb") returned 0 [0101.727] lstrlenA (lpString="*.mdb") returned 5 [0101.727] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.dll", pszSpec="*.cer") returned 0 [0101.727] lstrlenA (lpString="*.cer") returned 5 [0101.727] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.dll", pszSpec="*.p12") returned 0 [0101.727] lstrlenA (lpString="*.p12") returned 5 [0101.727] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.dll", pszSpec="*.pfx") returned 0 [0101.727] lstrlenA (lpString="*.pfx") returned 5 [0101.727] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.dll", pszSpec="*.kwm") returned 0 [0101.727] lstrlenA (lpString="*.kwm") returned 5 [0101.728] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.dll", pszSpec="*.pwm") returned 0 [0101.728] lstrlenA (lpString="*.pwm") returned 5 [0101.728] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.dll", pszSpec="*.1cd") returned 0 [0101.728] lstrlenA (lpString="*.1cd") returned 5 [0101.728] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.dll", pszSpec="*.md") returned 0 [0101.728] lstrlenA (lpString="*.md") returned 4 [0101.728] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.dll", pszSpec="*.mdf") returned 0 [0101.728] lstrlenA (lpString="*.mdf") returned 5 [0101.728] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.dll", pszSpec="*.dbf") returned 0 [0101.728] lstrlenA (lpString="*.dbf") returned 5 [0101.728] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.dll", pszSpec="*.odt") returned 0 [0101.728] lstrlenA (lpString="*.odt") returned 5 [0101.728] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.dll", pszSpec="*.vob") returned 0 [0101.728] lstrlenA (lpString="*.vob") returned 5 [0101.728] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.dll", pszSpec="*.ifo") returned 0 [0101.728] lstrlenA (lpString="*.ifo") returned 5 [0101.728] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.dll", pszSpec="*.lnk") returned 0 [0101.728] lstrlenA (lpString="*.lnk") returned 5 [0101.728] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.dll", pszSpec="*.torrent") returned 0 [0101.728] lstrlenA (lpString="*.torrent") returned 9 [0101.728] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.dll", pszSpec="*.mov") returned 0 [0101.728] lstrlenA (lpString="*.mov") returned 5 [0101.728] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.dll", pszSpec="*.m2v") returned 0 [0101.728] lstrlenA (lpString="*.m2v") returned 5 [0101.728] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.dll", pszSpec="*.3gp") returned 0 [0101.728] lstrlenA (lpString="*.3gp") returned 5 [0101.728] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.dll", pszSpec="*.mpeg") returned 0 [0101.728] lstrlenA (lpString="*.mpeg") returned 6 [0101.728] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.dll", pszSpec="*.mpg") returned 0 [0101.728] lstrlenA (lpString="*.mpg") returned 5 [0101.728] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.dll", pszSpec="*.flv") returned 0 [0101.728] lstrlenA (lpString="*.flv") returned 5 [0101.728] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.dll", pszSpec="*.avi") returned 0 [0101.728] lstrlenA (lpString="*.avi") returned 5 [0101.728] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.dll", pszSpec="*.mp4") returned 0 [0101.728] lstrlenA (lpString="*.mp4") returned 5 [0101.728] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.dll", pszSpec="*.wmv") returned 0 [0101.729] lstrlenA (lpString="*.wmv") returned 5 [0101.729] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.dll", pszSpec="*.divx") returned 0 [0101.729] lstrlenA (lpString="*.divx") returned 6 [0101.729] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.dll", pszSpec="*.mkv") returned 0 [0101.729] lstrlenA (lpString="*.mkv") returned 5 [0101.729] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.dll", pszSpec="*.mp3") returned 0 [0101.729] lstrlenA (lpString="*.mp3") returned 5 [0101.729] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.dll", pszSpec="*.wav") returned 0 [0101.729] lstrlenA (lpString="*.wav") returned 5 [0101.729] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.dll", pszSpec="*.flac") returned 0 [0101.729] lstrlenA (lpString="*.flac") returned 6 [0101.729] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.dll", pszSpec="*.ape") returned 0 [0101.729] lstrlenA (lpString="*.ape") returned 5 [0101.729] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.dll", pszSpec="*.wma") returned 0 [0101.729] lstrlenA (lpString="*.wma") returned 5 [0101.729] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.dll", pszSpec="*.ac3") returned 0 [0101.729] lstrlenA (lpString="*.ac3") returned 5 [0101.729] FindNextFileA (in: hFindFile=0x5b5bd0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0101.729] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0101.729] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Microsoft.Office.BusinessApplications.Runtime.xml") returned -1 [0101.729] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Office.BusinessApplications.Runtime.xml") returned -1 [0101.729] lstrcmpiA (lpString1="", lpString2="Microsoft.Office.BusinessApplications.Runtime.xml") returned -1 [0101.729] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.dll") returned="Microsoft.Office.BusinessApplications.Runtime.dll" [0101.729] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="Microsoft.Office.BusinessApplications.Runtime.xml" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.xml") returned="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.xml" [0101.729] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.xml", pszSpec="*.zip") returned 0 [0101.729] lstrlenA (lpString="*.zip") returned 5 [0101.729] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.xml", pszSpec="*.rar") returned 0 [0101.729] lstrlenA (lpString="*.rar") returned 5 [0101.729] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.xml", pszSpec="*.7z") returned 0 [0101.729] lstrlenA (lpString="*.7z") returned 4 [0101.729] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.xml", pszSpec="*.tar") returned 0 [0101.729] lstrlenA (lpString="*.tar") returned 5 [0101.729] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.xml", pszSpec="*.gzip") returned 0 [0101.729] lstrlenA (lpString="*.gzip") returned 6 [0101.729] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.xml", pszSpec="*.jpg") returned 0 [0101.729] lstrlenA (lpString="*.jpg") returned 5 [0101.729] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.xml", pszSpec="*.jpeg") returned 0 [0101.730] lstrlenA (lpString="*.jpeg") returned 6 [0101.730] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.xml", pszSpec="*.psd") returned 0 [0101.730] lstrlenA (lpString="*.psd") returned 5 [0101.730] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.xml", pszSpec="*.cdr") returned 0 [0101.730] lstrlenA (lpString="*.cdr") returned 5 [0101.730] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.xml", pszSpec="*.dwg") returned 0 [0101.730] lstrlenA (lpString="*.dwg") returned 5 [0101.730] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.xml", pszSpec="*.max") returned 0 [0101.730] lstrlenA (lpString="*.max") returned 5 [0101.730] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.xml", pszSpec="*.bmp") returned 0 [0101.730] lstrlenA (lpString="*.bmp") returned 5 [0101.730] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.xml", pszSpec="*.gif") returned 0 [0101.730] lstrlenA (lpString="*.gif") returned 5 [0101.730] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.xml", pszSpec="*.png") returned 0 [0101.730] lstrlenA (lpString="*.png") returned 5 [0101.730] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.xml", pszSpec="*.doc") returned 0 [0101.730] lstrlenA (lpString="*.doc") returned 5 [0101.730] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.xml", pszSpec="*.docx") returned 0 [0101.730] lstrlenA (lpString="*.docx") returned 6 [0101.730] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.xml", pszSpec="*.xls") returned 0 [0101.730] lstrlenA (lpString="*.xls") returned 5 [0101.730] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.xml", pszSpec="*.xlsx") returned 0 [0101.730] lstrlenA (lpString="*.xlsx") returned 6 [0101.730] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.xml", pszSpec="*.ppt") returned 0 [0101.730] lstrlenA (lpString="*.ppt") returned 5 [0101.730] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.xml", pszSpec="*.pptx") returned 0 [0101.730] lstrlenA (lpString="*.pptx") returned 6 [0101.730] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.xml", pszSpec="*.txt") returned 0 [0101.730] lstrlenA (lpString="*.txt") returned 5 [0101.730] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.xml", pszSpec="*.pdf") returned 0 [0101.730] lstrlenA (lpString="*.pdf") returned 5 [0101.730] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.xml", pszSpec="*.djvu") returned 0 [0101.730] lstrlenA (lpString="*.djvu") returned 6 [0101.730] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.xml", pszSpec="*.htm") returned 0 [0101.730] lstrlenA (lpString="*.htm") returned 5 [0101.730] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.xml", pszSpec="*.html") returned 0 [0101.730] lstrlenA (lpString="*.html") returned 6 [0101.730] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.xml", pszSpec="*.mdb") returned 0 [0101.730] lstrlenA (lpString="*.mdb") returned 5 [0101.731] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.xml", pszSpec="*.cer") returned 0 [0101.731] lstrlenA (lpString="*.cer") returned 5 [0101.731] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.xml", pszSpec="*.p12") returned 0 [0101.731] lstrlenA (lpString="*.p12") returned 5 [0101.731] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.xml", pszSpec="*.pfx") returned 0 [0101.731] lstrlenA (lpString="*.pfx") returned 5 [0101.731] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.xml", pszSpec="*.kwm") returned 0 [0101.731] lstrlenA (lpString="*.kwm") returned 5 [0101.731] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.xml", pszSpec="*.pwm") returned 0 [0101.731] lstrlenA (lpString="*.pwm") returned 5 [0101.731] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.xml", pszSpec="*.1cd") returned 0 [0101.731] lstrlenA (lpString="*.1cd") returned 5 [0101.731] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.xml", pszSpec="*.md") returned 0 [0101.731] lstrlenA (lpString="*.md") returned 4 [0101.731] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.xml", pszSpec="*.mdf") returned 0 [0101.731] lstrlenA (lpString="*.mdf") returned 5 [0101.731] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.xml", pszSpec="*.dbf") returned 0 [0101.731] lstrlenA (lpString="*.dbf") returned 5 [0101.731] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.xml", pszSpec="*.odt") returned 0 [0101.731] lstrlenA (lpString="*.odt") returned 5 [0101.731] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.xml", pszSpec="*.vob") returned 0 [0101.731] lstrlenA (lpString="*.vob") returned 5 [0101.731] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.xml", pszSpec="*.ifo") returned 0 [0101.731] lstrlenA (lpString="*.ifo") returned 5 [0101.731] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.xml", pszSpec="*.lnk") returned 0 [0101.731] lstrlenA (lpString="*.lnk") returned 5 [0101.731] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.xml", pszSpec="*.torrent") returned 0 [0101.731] lstrlenA (lpString="*.torrent") returned 9 [0101.731] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.xml", pszSpec="*.mov") returned 0 [0101.731] lstrlenA (lpString="*.mov") returned 5 [0101.731] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.xml", pszSpec="*.m2v") returned 0 [0101.731] lstrlenA (lpString="*.m2v") returned 5 [0101.731] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.xml", pszSpec="*.3gp") returned 0 [0101.731] lstrlenA (lpString="*.3gp") returned 5 [0101.731] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.xml", pszSpec="*.mpeg") returned 0 [0101.731] lstrlenA (lpString="*.mpeg") returned 6 [0101.731] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.xml", pszSpec="*.mpg") returned 0 [0101.732] lstrlenA (lpString="*.mpg") returned 5 [0101.732] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.xml", pszSpec="*.flv") returned 0 [0101.732] lstrlenA (lpString="*.flv") returned 5 [0101.732] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.xml", pszSpec="*.avi") returned 0 [0101.732] lstrlenA (lpString="*.avi") returned 5 [0101.732] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.xml", pszSpec="*.mp4") returned 0 [0101.732] lstrlenA (lpString="*.mp4") returned 5 [0101.732] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.xml", pszSpec="*.wmv") returned 0 [0101.732] lstrlenA (lpString="*.wmv") returned 5 [0101.732] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.xml", pszSpec="*.divx") returned 0 [0101.732] lstrlenA (lpString="*.divx") returned 6 [0101.732] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.xml", pszSpec="*.mkv") returned 0 [0101.732] lstrlenA (lpString="*.mkv") returned 5 [0101.732] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.xml", pszSpec="*.mp3") returned 0 [0101.732] lstrlenA (lpString="*.mp3") returned 5 [0101.732] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.xml", pszSpec="*.wav") returned 0 [0101.732] lstrlenA (lpString="*.wav") returned 5 [0101.732] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.xml", pszSpec="*.flac") returned 0 [0101.732] lstrlenA (lpString="*.flac") returned 6 [0101.732] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.xml", pszSpec="*.ape") returned 0 [0101.732] lstrlenA (lpString="*.ape") returned 5 [0101.732] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.xml", pszSpec="*.wma") returned 0 [0101.732] lstrlenA (lpString="*.wma") returned 5 [0101.732] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.xml", pszSpec="*.ac3") returned 0 [0101.732] lstrlenA (lpString="*.ac3") returned 5 [0101.732] FindNextFileA (in: hFindFile=0x5b5bd0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0101.732] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0101.732] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Microsoft.Office.BusinessApplications.RuntimeUi.dll") returned -1 [0101.732] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Office.BusinessApplications.RuntimeUi.dll") returned -1 [0101.732] lstrcmpiA (lpString1="", lpString2="Microsoft.Office.BusinessApplications.RuntimeUi.dll") returned -1 [0101.732] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.xml") returned="Microsoft.Office.BusinessApplications.Runtime.xml" [0101.732] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="Microsoft.Office.BusinessApplications.RuntimeUi.dll" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.RuntimeUi.dll") returned="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.RuntimeUi.dll" [0101.732] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.RuntimeUi.dll", pszSpec="*.zip") returned 0 [0101.732] lstrlenA (lpString="*.zip") returned 5 [0101.732] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.RuntimeUi.dll", pszSpec="*.rar") returned 0 [0101.732] lstrlenA (lpString="*.rar") returned 5 [0101.732] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.RuntimeUi.dll", pszSpec="*.7z") returned 0 [0101.733] lstrlenA (lpString="*.7z") returned 4 [0101.733] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.RuntimeUi.dll", pszSpec="*.tar") returned 0 [0101.733] lstrlenA (lpString="*.tar") returned 5 [0101.733] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.RuntimeUi.dll", pszSpec="*.gzip") returned 0 [0101.733] lstrlenA (lpString="*.gzip") returned 6 [0101.733] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.RuntimeUi.dll", pszSpec="*.jpg") returned 0 [0101.733] lstrlenA (lpString="*.jpg") returned 5 [0101.733] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.RuntimeUi.dll", pszSpec="*.jpeg") returned 0 [0101.733] lstrlenA (lpString="*.jpeg") returned 6 [0101.733] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.RuntimeUi.dll", pszSpec="*.psd") returned 0 [0101.733] lstrlenA (lpString="*.psd") returned 5 [0101.733] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.RuntimeUi.dll", pszSpec="*.cdr") returned 0 [0101.733] lstrlenA (lpString="*.cdr") returned 5 [0101.733] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.RuntimeUi.dll", pszSpec="*.dwg") returned 0 [0101.733] lstrlenA (lpString="*.dwg") returned 5 [0101.733] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.RuntimeUi.dll", pszSpec="*.max") returned 0 [0101.733] lstrlenA (lpString="*.max") returned 5 [0101.733] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.RuntimeUi.dll", pszSpec="*.bmp") returned 0 [0101.733] lstrlenA (lpString="*.bmp") returned 5 [0101.733] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.RuntimeUi.dll", pszSpec="*.gif") returned 0 [0101.733] lstrlenA (lpString="*.gif") returned 5 [0101.733] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.RuntimeUi.dll", pszSpec="*.png") returned 0 [0101.733] lstrlenA (lpString="*.png") returned 5 [0101.733] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.RuntimeUi.dll", pszSpec="*.doc") returned 0 [0101.733] lstrlenA (lpString="*.doc") returned 5 [0101.733] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.RuntimeUi.dll", pszSpec="*.docx") returned 0 [0101.733] lstrlenA (lpString="*.docx") returned 6 [0101.733] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.RuntimeUi.dll", pszSpec="*.xls") returned 0 [0101.733] lstrlenA (lpString="*.xls") returned 5 [0101.733] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.RuntimeUi.dll", pszSpec="*.xlsx") returned 0 [0101.733] lstrlenA (lpString="*.xlsx") returned 6 [0101.733] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.RuntimeUi.dll", pszSpec="*.ppt") returned 0 [0101.733] lstrlenA (lpString="*.ppt") returned 5 [0101.733] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.RuntimeUi.dll", pszSpec="*.pptx") returned 0 [0101.733] lstrlenA (lpString="*.pptx") returned 6 [0101.733] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.RuntimeUi.dll", pszSpec="*.txt") returned 0 [0101.733] lstrlenA (lpString="*.txt") returned 5 [0101.734] FindNextFileA (in: hFindFile=0x5b5bd0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0101.734] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0101.734] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Microsoft.Office.BusinessApplications.RuntimeUi.xml") returned -1 [0101.734] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Office.BusinessApplications.RuntimeUi.xml") returned -1 [0101.734] lstrcmpiA (lpString1="", lpString2="Microsoft.Office.BusinessApplications.RuntimeUi.xml") returned -1 [0101.734] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.RuntimeUi.dll") returned="Microsoft.Office.BusinessApplications.RuntimeUi.dll" [0101.734] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="Microsoft.Office.BusinessApplications.RuntimeUi.xml" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.RuntimeUi.xml") returned="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.RuntimeUi.xml" [0101.734] FindNextFileA (in: hFindFile=0x5b5bd0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0101.734] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0101.734] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Microsoft.Office.BusinessData.dll") returned -1 [0101.734] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Office.BusinessData.dll") returned -1 [0101.734] lstrcmpiA (lpString1="", lpString2="Microsoft.Office.BusinessData.dll") returned -1 [0101.734] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.RuntimeUi.xml") returned="Microsoft.Office.BusinessApplications.RuntimeUi.xml" [0101.734] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="Microsoft.Office.BusinessData.dll" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessData.dll") returned="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessData.dll" [0101.734] FindNextFileA (in: hFindFile=0x5b5bd0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0101.734] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0101.734] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Microsoft.Office.BusinessData.xml") returned -1 [0101.734] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Office.BusinessData.xml") returned -1 [0101.734] lstrcmpiA (lpString1="", lpString2="Microsoft.Office.BusinessData.xml") returned -1 [0101.734] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessData.dll") returned="Microsoft.Office.BusinessData.dll" [0101.734] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="Microsoft.Office.BusinessData.xml" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessData.xml") returned="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessData.xml" [0101.735] FindNextFileA (in: hFindFile=0x5b5bd0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0101.735] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0101.735] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Microsoft.Office.InfoPath.Client.Internal.CLRHost.dll") returned -1 [0101.735] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Office.InfoPath.Client.Internal.CLRHost.dll") returned -1 [0101.735] lstrcmpiA (lpString1="", lpString2="Microsoft.Office.InfoPath.Client.Internal.CLRHost.dll") returned -1 [0101.735] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessData.xml") returned="Microsoft.Office.BusinessData.xml" [0101.735] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="Microsoft.Office.InfoPath.Client.Internal.CLRHost.dll" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.InfoPath.Client.Internal.CLRHost.dll") returned="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.InfoPath.Client.Internal.CLRHost.dll" [0101.735] FindNextFileA (in: hFindFile=0x5b5bd0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0101.735] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0101.735] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Microsoft.Office.InfoPath.FormControl.dll") returned -1 [0101.735] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Office.InfoPath.FormControl.dll") returned -1 [0101.735] lstrcmpiA (lpString1="", lpString2="Microsoft.Office.InfoPath.FormControl.dll") returned -1 [0101.735] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.InfoPath.Client.Internal.CLRHost.dll") returned="Microsoft.Office.InfoPath.Client.Internal.CLRHost.dll" [0101.735] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="Microsoft.Office.InfoPath.FormControl.dll" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.InfoPath.FormControl.dll") returned="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.InfoPath.FormControl.dll" [0101.735] FindNextFileA (in: hFindFile=0x5b5bd0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0101.735] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0101.735] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Microsoft.Office.Interop.InfoPath.SemiTrust.dll") returned -1 [0101.735] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Office.Interop.InfoPath.SemiTrust.dll") returned -1 [0101.735] lstrcmpiA (lpString1="", lpString2="Microsoft.Office.Interop.InfoPath.SemiTrust.dll") returned -1 [0101.735] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.InfoPath.FormControl.dll") returned="Microsoft.Office.InfoPath.FormControl.dll" [0101.735] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="Microsoft.Office.Interop.InfoPath.SemiTrust.dll" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.SemiTrust.dll") returned="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.SemiTrust.dll" [0101.735] FindNextFileA (in: hFindFile=0x5b5bd0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0101.735] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0101.736] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Microsoft.Office.Interop.InfoPath.SemiTrust.xml") returned -1 [0101.736] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Office.Interop.InfoPath.SemiTrust.xml") returned -1 [0101.736] lstrcmpiA (lpString1="", lpString2="Microsoft.Office.Interop.InfoPath.SemiTrust.xml") returned -1 [0101.736] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.SemiTrust.dll") returned="Microsoft.Office.Interop.InfoPath.SemiTrust.dll" [0101.736] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="Microsoft.Office.Interop.InfoPath.SemiTrust.xml" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.SemiTrust.xml") returned="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.SemiTrust.xml" [0101.736] FindNextFileA (in: hFindFile=0x5b5bd0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0101.736] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0101.736] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Microsoft.Office.Interop.InfoPath.Xml.dll") returned -1 [0101.736] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Office.Interop.InfoPath.Xml.dll") returned -1 [0101.736] lstrcmpiA (lpString1="", lpString2="Microsoft.Office.Interop.InfoPath.Xml.dll") returned -1 [0101.736] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.SemiTrust.xml") returned="Microsoft.Office.Interop.InfoPath.SemiTrust.xml" [0101.736] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="Microsoft.Office.Interop.InfoPath.Xml.dll" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.Xml.dll") returned="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.Xml.dll" [0101.736] FindNextFileA (in: hFindFile=0x5b5bd0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0101.736] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0101.736] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Microsoft.Office.Interop.InfoPath.Xml.xml") returned -1 [0101.736] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Office.Interop.InfoPath.Xml.xml") returned -1 [0101.736] lstrcmpiA (lpString1="", lpString2="Microsoft.Office.Interop.InfoPath.Xml.xml") returned -1 [0101.736] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.Xml.dll") returned="Microsoft.Office.Interop.InfoPath.Xml.dll" [0101.736] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="Microsoft.Office.Interop.InfoPath.Xml.xml" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.Xml.xml") returned="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.Xml.xml" [0101.736] FindNextFileA (in: hFindFile=0x5b5bd0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0101.736] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0101.736] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Microsoft.Office.Interop.Visio.WorkflowAuthoring.dll") returned -1 [0101.736] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Office.Interop.Visio.WorkflowAuthoring.dll") returned -1 [0101.736] lstrcmpiA (lpString1="", lpString2="Microsoft.Office.Interop.Visio.WorkflowAuthoring.dll") returned -1 [0101.736] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.Xml.xml") returned="Microsoft.Office.Interop.InfoPath.Xml.xml" [0101.736] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="Microsoft.Office.Interop.Visio.WorkflowAuthoring.dll" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.Visio.WorkflowAuthoring.dll") returned="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.Visio.WorkflowAuthoring.dll" [0101.737] FindNextFileA (in: hFindFile=0x5b5bd0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0101.737] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0101.737] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="microsoft.office.workflow.actions.proxy.dll") returned -1 [0101.737] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="microsoft.office.workflow.actions.proxy.dll") returned -1 [0101.737] lstrcmpiA (lpString1="", lpString2="microsoft.office.workflow.actions.proxy.dll") returned -1 [0101.737] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.Visio.WorkflowAuthoring.dll") returned="Microsoft.Office.Interop.Visio.WorkflowAuthoring.dll" [0101.737] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="microsoft.office.workflow.actions.proxy.dll" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\microsoft.office.workflow.actions.proxy.dll") returned="C:\\Program Files\\Microsoft Office\\Office14\\microsoft.office.workflow.actions.proxy.dll" [0101.737] FindNextFileA (in: hFindFile=0x5b5bd0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0101.737] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0101.737] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Microsoft.SharePoint.BusinessData.Administration.Client.dll") returned -1 [0101.737] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.SharePoint.BusinessData.Administration.Client.dll") returned -1 [0101.737] lstrcmpiA (lpString1="", lpString2="Microsoft.SharePoint.BusinessData.Administration.Client.dll") returned -1 [0101.737] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\microsoft.office.workflow.actions.proxy.dll") returned="microsoft.office.workflow.actions.proxy.dll" [0101.737] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="Microsoft.SharePoint.BusinessData.Administration.Client.dll" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.SharePoint.BusinessData.Administration.Client.dll") returned="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.SharePoint.BusinessData.Administration.Client.dll" [0101.737] FindNextFileA (in: hFindFile=0x5b5bd0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0101.765] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0101.765] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Microsoft.SharePoint.BusinessData.Administration.Client.xml") returned -1 [0101.765] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.SharePoint.BusinessData.Administration.Client.xml") returned -1 [0101.765] lstrcmpiA (lpString1="", lpString2="Microsoft.SharePoint.BusinessData.Administration.Client.xml") returned -1 [0101.765] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.SharePoint.BusinessData.Administration.Client.dll") returned="Microsoft.SharePoint.BusinessData.Administration.Client.dll" [0101.765] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="Microsoft.SharePoint.BusinessData.Administration.Client.xml" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.SharePoint.BusinessData.Administration.Client.xml") returned="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.SharePoint.BusinessData.Administration.Client.xml" [0101.765] FindNextFileA (in: hFindFile=0x5b5bd0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0101.765] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0101.765] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="microsoft.sharepoint.workflowactions.proxy.dll") returned -1 [0101.765] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="microsoft.sharepoint.workflowactions.proxy.dll") returned -1 [0101.765] lstrcmpiA (lpString1="", lpString2="microsoft.sharepoint.workflowactions.proxy.dll") returned -1 [0101.765] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.SharePoint.BusinessData.Administration.Client.xml") returned="Microsoft.SharePoint.BusinessData.Administration.Client.xml" [0101.765] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="microsoft.sharepoint.workflowactions.proxy.dll" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\microsoft.sharepoint.workflowactions.proxy.dll") returned="C:\\Program Files\\Microsoft Office\\Office14\\microsoft.sharepoint.workflowactions.proxy.dll" [0101.765] FindNextFileA (in: hFindFile=0x5b5bd0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0101.765] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0101.765] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="MIMEDIR.DLL") returned -1 [0101.765] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MIMEDIR.DLL") returned -1 [0101.765] lstrcmpiA (lpString1="", lpString2="MIMEDIR.DLL") returned -1 [0101.765] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\microsoft.sharepoint.workflowactions.proxy.dll") returned="microsoft.sharepoint.workflowactions.proxy.dll" [0101.765] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="MIMEDIR.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MIMEDIR.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\MIMEDIR.DLL" [0101.765] FindNextFileA (in: hFindFile=0x5b5bd0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0101.765] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0101.766] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="misc.exe") returned -1 [0101.766] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="misc.exe") returned -1 [0101.766] lstrcmpiA (lpString1="", lpString2="misc.exe") returned -1 [0101.766] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MIMEDIR.DLL") returned="MIMEDIR.DLL" [0101.766] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="misc.exe" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\misc.exe") returned="C:\\Program Files\\Microsoft Office\\Office14\\misc.exe" [0101.766] FindNextFileA (in: hFindFile=0x5b5bd0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0101.766] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0101.766] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="MLCFG32.CPL") returned -1 [0101.766] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MLCFG32.CPL") returned -1 [0101.766] lstrcmpiA (lpString1="", lpString2="MLCFG32.CPL") returned -1 [0101.766] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\misc.exe") returned="misc.exe" [0101.766] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="MLCFG32.CPL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MLCFG32.CPL") returned="C:\\Program Files\\Microsoft Office\\Office14\\MLCFG32.CPL" [0101.766] FindNextFileA (in: hFindFile=0x5b5bd0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0101.766] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0101.766] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="MLSHEXT.DLL") returned -1 [0101.766] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MLSHEXT.DLL") returned -1 [0101.766] lstrcmpiA (lpString1="", lpString2="MLSHEXT.DLL") returned -1 [0101.766] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MLCFG32.CPL") returned="MLCFG32.CPL" [0101.766] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="MLSHEXT.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MLSHEXT.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\MLSHEXT.DLL" [0101.766] FindNextFileA (in: hFindFile=0x5b5bd0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0101.766] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0101.766] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="MML2OMML.XSL") returned -1 [0101.766] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MML2OMML.XSL") returned -1 [0101.766] lstrcmpiA (lpString1="", lpString2="MML2OMML.XSL") returned -1 [0101.766] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MLSHEXT.DLL") returned="MLSHEXT.DLL" [0101.766] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="MML2OMML.XSL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MML2OMML.XSL") returned="C:\\Program Files\\Microsoft Office\\Office14\\MML2OMML.XSL" [0101.766] FindNextFileA (in: hFindFile=0x5b5bd0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0101.766] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0101.767] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="MODELENG.DLL") returned -1 [0101.767] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MODELENG.DLL") returned -1 [0101.767] lstrcmpiA (lpString1="", lpString2="MODELENG.DLL") returned -1 [0101.767] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MML2OMML.XSL") returned="MML2OMML.XSL" [0101.767] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="MODELENG.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MODELENG.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\MODELENG.DLL" [0101.767] FindNextFileA (in: hFindFile=0x5b5bd0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0101.767] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0101.767] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="MORPH9.DLL") returned -1 [0101.767] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MORPH9.DLL") returned -1 [0101.767] lstrcmpiA (lpString1="", lpString2="MORPH9.DLL") returned -1 [0101.767] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MODELENG.DLL") returned="MODELENG.DLL" [0101.767] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="MORPH9.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MORPH9.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\MORPH9.DLL" [0101.767] FindNextFileA (in: hFindFile=0x5b5bd0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0101.767] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0101.767] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="MPXINT.DLL") returned -1 [0101.767] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MPXINT.DLL") returned -1 [0101.767] lstrcmpiA (lpString1="", lpString2="MPXINT.DLL") returned -1 [0101.767] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MORPH9.DLL") returned="MORPH9.DLL" [0101.767] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="MPXINT.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MPXINT.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\MPXINT.DLL" [0101.767] FindNextFileA (in: hFindFile=0x5b5bd0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0101.767] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0101.767] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="MSACC.OLB") returned -1 [0101.767] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSACC.OLB") returned -1 [0101.767] lstrcmpiA (lpString1="", lpString2="MSACC.OLB") returned -1 [0101.767] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MPXINT.DLL") returned="MPXINT.DLL" [0101.767] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="MSACC.OLB" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MSACC.OLB") returned="C:\\Program Files\\Microsoft Office\\Office14\\MSACC.OLB" [0101.767] FindNextFileA (in: hFindFile=0x5b5bd0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0101.767] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0101.767] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="MSACCESS.EXE") returned -1 [0101.768] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSACCESS.EXE") returned -1 [0101.768] lstrcmpiA (lpString1="", lpString2="MSACCESS.EXE") returned -1 [0101.768] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MSACC.OLB") returned="MSACC.OLB" [0101.768] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="MSACCESS.EXE" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MSACCESS.EXE") returned="C:\\Program Files\\Microsoft Office\\Office14\\MSACCESS.EXE" [0101.768] FindNextFileA (in: hFindFile=0x5b5bd0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0101.768] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0101.768] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="msaccess.exe.manifest") returned -1 [0101.768] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="msaccess.exe.manifest") returned -1 [0101.768] lstrcmpiA (lpString1="", lpString2="msaccess.exe.manifest") returned -1 [0101.768] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MSACCESS.EXE") returned="MSACCESS.EXE" [0101.768] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="msaccess.exe.manifest" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\msaccess.exe.manifest") returned="C:\\Program Files\\Microsoft Office\\Office14\\msaccess.exe.manifest" [0101.768] FindNextFileA (in: hFindFile=0x5b5bd0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0101.768] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0101.768] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="MSAEXP30.DLL") returned -1 [0101.768] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSAEXP30.DLL") returned -1 [0101.768] lstrcmpiA (lpString1="", lpString2="MSAEXP30.DLL") returned -1 [0101.768] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\msaccess.exe.manifest") returned="msaccess.exe.manifest" [0101.768] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="MSAEXP30.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MSAEXP30.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\MSAEXP30.DLL" [0101.768] FindNextFileA (in: hFindFile=0x5b5bd0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0101.768] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0101.768] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="MSCOL11.INF") returned -1 [0101.768] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSCOL11.INF") returned -1 [0101.768] lstrcmpiA (lpString1="", lpString2="MSCOL11.INF") returned -1 [0101.768] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MSAEXP30.DLL") returned="MSAEXP30.DLL" [0101.768] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="MSCOL11.INF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.INF") returned="C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.INF" [0101.768] FindNextFileA (in: hFindFile=0x5b5bd0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0101.768] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0101.768] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="MSCOL11.PPD") returned -1 [0101.768] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSCOL11.PPD") returned -1 [0101.768] lstrcmpiA (lpString1="", lpString2="MSCOL11.PPD") returned -1 [0101.769] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.INF") returned="MSCOL11.INF" [0101.769] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="MSCOL11.PPD" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.PPD") returned="C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.PPD" [0101.769] FindNextFileA (in: hFindFile=0x5b5bd0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0101.769] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0101.769] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="mscss7cm_en.dub") returned -1 [0101.769] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="mscss7cm_en.dub") returned -1 [0101.769] lstrcmpiA (lpString1="", lpString2="mscss7cm_en.dub") returned -1 [0101.769] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.PPD") returned="MSCOL11.PPD" [0101.769] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="mscss7cm_en.dub" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\mscss7cm_en.dub") returned="C:\\Program Files\\Microsoft Office\\Office14\\mscss7cm_en.dub" [0101.769] FindNextFileA (in: hFindFile=0x5b5bd0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0101.769] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0101.769] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="mscss7cm_es.dub") returned -1 [0101.769] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="mscss7cm_es.dub") returned -1 [0101.769] lstrcmpiA (lpString1="", lpString2="mscss7cm_es.dub") returned -1 [0101.769] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\mscss7cm_en.dub") returned="mscss7cm_en.dub" [0101.769] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="mscss7cm_es.dub" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\mscss7cm_es.dub") returned="C:\\Program Files\\Microsoft Office\\Office14\\mscss7cm_es.dub" [0101.769] FindNextFileA (in: hFindFile=0x5b5bd0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0101.769] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0101.769] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="mscss7cm_fr.dub") returned -1 [0101.769] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="mscss7cm_fr.dub") returned -1 [0101.769] lstrcmpiA (lpString1="", lpString2="mscss7cm_fr.dub") returned -1 [0101.769] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\mscss7cm_es.dub") returned="mscss7cm_es.dub" [0101.769] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="mscss7cm_fr.dub" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\mscss7cm_fr.dub") returned="C:\\Program Files\\Microsoft Office\\Office14\\mscss7cm_fr.dub" [0101.769] FindNextFileA (in: hFindFile=0x5b5bd0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0101.769] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0101.769] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="mscss7en.dll") returned -1 [0101.769] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="mscss7en.dll") returned -1 [0101.769] lstrcmpiA (lpString1="", lpString2="mscss7en.dll") returned -1 [0101.769] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\mscss7cm_fr.dub") returned="mscss7cm_fr.dub" [0101.770] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="mscss7en.dll" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\mscss7en.dll") returned="C:\\Program Files\\Microsoft Office\\Office14\\mscss7en.dll" [0101.770] FindNextFileA (in: hFindFile=0x5b5bd0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0101.770] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0101.770] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="mscss7es.dll") returned -1 [0101.770] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="mscss7es.dll") returned -1 [0101.770] lstrcmpiA (lpString1="", lpString2="mscss7es.dll") returned -1 [0101.770] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\mscss7en.dll") returned="mscss7en.dll" [0101.770] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="mscss7es.dll" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\mscss7es.dll") returned="C:\\Program Files\\Microsoft Office\\Office14\\mscss7es.dll" [0101.770] FindNextFileA (in: hFindFile=0x5b5bd0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0101.770] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0101.770] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="mscss7fr.dll") returned -1 [0101.770] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="mscss7fr.dll") returned -1 [0101.770] lstrcmpiA (lpString1="", lpString2="mscss7fr.dll") returned -1 [0101.770] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\mscss7es.dll") returned="mscss7es.dll" [0101.770] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="mscss7fr.dll" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\mscss7fr.dll") returned="C:\\Program Files\\Microsoft Office\\Office14\\mscss7fr.dll" [0101.770] FindNextFileA (in: hFindFile=0x5b5bd0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0101.770] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0101.770] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="mscss7wre_en.dub") returned -1 [0101.770] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="mscss7wre_en.dub") returned -1 [0101.770] lstrcmpiA (lpString1="", lpString2="mscss7wre_en.dub") returned -1 [0101.770] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\mscss7fr.dll") returned="mscss7fr.dll" [0101.770] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="mscss7wre_en.dub" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\mscss7wre_en.dub") returned="C:\\Program Files\\Microsoft Office\\Office14\\mscss7wre_en.dub" [0101.770] FindNextFileA (in: hFindFile=0x5b5bd0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0101.770] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0101.770] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="mscss7wre_es.dub") returned -1 [0101.770] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="mscss7wre_es.dub") returned -1 [0101.770] lstrcmpiA (lpString1="", lpString2="mscss7wre_es.dub") returned -1 [0101.770] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\mscss7wre_en.dub") returned="mscss7wre_en.dub" [0101.770] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="mscss7wre_es.dub" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\mscss7wre_es.dub") returned="C:\\Program Files\\Microsoft Office\\Office14\\mscss7wre_es.dub" [0101.771] FindNextFileA (in: hFindFile=0x5b5bd0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0101.771] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0101.771] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="mscss7wre_fr.dub") returned -1 [0101.771] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="mscss7wre_fr.dub") returned -1 [0101.771] lstrcmpiA (lpString1="", lpString2="mscss7wre_fr.dub") returned -1 [0101.771] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\mscss7wre_es.dub") returned="mscss7wre_es.dub" [0101.771] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="mscss7wre_fr.dub" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\mscss7wre_fr.dub") returned="C:\\Program Files\\Microsoft Office\\Office14\\mscss7wre_fr.dub" [0101.771] FindNextFileA (in: hFindFile=0x5b5bd0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0101.771] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0101.771] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="mset7.dll") returned -1 [0101.771] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="mset7.dll") returned -1 [0101.771] lstrcmpiA (lpString1="", lpString2="mset7.dll") returned -1 [0101.771] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\mscss7wre_fr.dub") returned="mscss7wre_fr.dub" [0101.771] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="mset7.dll" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\mset7.dll") returned="C:\\Program Files\\Microsoft Office\\Office14\\mset7.dll" [0101.771] FindNextFileA (in: hFindFile=0x5b5bd0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0101.771] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0101.771] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="mset7db.kic") returned -1 [0101.771] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="mset7db.kic") returned -1 [0101.771] lstrcmpiA (lpString1="", lpString2="mset7db.kic") returned -1 [0101.771] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\mset7.dll") returned="mset7.dll" [0101.771] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="mset7db.kic" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\mset7db.kic") returned="C:\\Program Files\\Microsoft Office\\Office14\\mset7db.kic" [0101.771] FindNextFileA (in: hFindFile=0x5b5bd0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0101.771] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0101.771] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="mset7en.kic") returned -1 [0101.771] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="mset7en.kic") returned -1 [0101.771] lstrcmpiA (lpString1="", lpString2="mset7en.kic") returned -1 [0101.771] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\mset7db.kic") returned="mset7db.kic" [0101.771] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="mset7en.kic" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\mset7en.kic") returned="C:\\Program Files\\Microsoft Office\\Office14\\mset7en.kic" [0101.772] FindNextFileA (in: hFindFile=0x5b5bd0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0101.772] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0101.772] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="mset7es.kic") returned -1 [0101.772] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="mset7es.kic") returned -1 [0101.772] lstrcmpiA (lpString1="", lpString2="mset7es.kic") returned -1 [0101.772] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\mset7en.kic") returned="mset7en.kic" [0101.772] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="mset7es.kic" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\mset7es.kic") returned="C:\\Program Files\\Microsoft Office\\Office14\\mset7es.kic" [0101.772] FindNextFileA (in: hFindFile=0x5b5bd0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0101.772] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0101.772] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="mset7fr.kic") returned -1 [0101.772] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="mset7fr.kic") returned -1 [0101.772] lstrcmpiA (lpString1="", lpString2="mset7fr.kic") returned -1 [0101.772] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\mset7es.kic") returned="mset7es.kic" [0101.772] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="mset7fr.kic" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\mset7fr.kic") returned="C:\\Program Files\\Microsoft Office\\Office14\\mset7fr.kic" [0101.772] FindNextFileA (in: hFindFile=0x5b5bd0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0101.772] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0101.772] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="mset7ge.kic") returned -1 [0101.772] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="mset7ge.kic") returned -1 [0101.772] lstrcmpiA (lpString1="", lpString2="mset7ge.kic") returned -1 [0101.772] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\mset7fr.kic") returned="mset7fr.kic" [0101.772] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="mset7ge.kic" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\mset7ge.kic") returned="C:\\Program Files\\Microsoft Office\\Office14\\mset7ge.kic" [0101.772] FindNextFileA (in: hFindFile=0x5b5bd0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0101.772] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0101.772] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="mset7jp.kic") returned -1 [0101.772] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="mset7jp.kic") returned -1 [0101.772] lstrcmpiA (lpString1="", lpString2="mset7jp.kic") returned -1 [0101.772] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\mset7ge.kic") returned="mset7ge.kic" [0101.772] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="mset7jp.kic" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\mset7jp.kic") returned="C:\\Program Files\\Microsoft Office\\Office14\\mset7jp.kic" [0101.772] FindNextFileA (in: hFindFile=0x5b5bd0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0101.773] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0101.773] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="mset7tk.dll") returned -1 [0101.773] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="mset7tk.dll") returned -1 [0101.773] lstrcmpiA (lpString1="", lpString2="mset7tk.dll") returned -1 [0101.773] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\mset7jp.kic") returned="mset7jp.kic" [0101.773] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="mset7tk.dll" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\mset7tk.dll") returned="C:\\Program Files\\Microsoft Office\\Office14\\mset7tk.dll" [0101.773] FindNextFileA (in: hFindFile=0x5b5bd0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0101.773] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0101.773] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="mset7tkjp.dll") returned -1 [0101.773] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="mset7tkjp.dll") returned -1 [0101.773] lstrcmpiA (lpString1="", lpString2="mset7tkjp.dll") returned -1 [0101.773] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\mset7tk.dll") returned="mset7tk.dll" [0101.773] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="mset7tkjp.dll" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\mset7tkjp.dll") returned="C:\\Program Files\\Microsoft Office\\Office14\\mset7tkjp.dll" [0101.773] FindNextFileA (in: hFindFile=0x5b5bd0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0101.773] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0101.773] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="MSN.ICO") returned -1 [0101.773] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSN.ICO") returned -1 [0101.773] lstrcmpiA (lpString1="", lpString2="MSN.ICO") returned -1 [0101.773] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\mset7tkjp.dll") returned="mset7tkjp.dll" [0101.773] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="MSN.ICO" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MSN.ICO") returned="C:\\Program Files\\Microsoft Office\\Office14\\MSN.ICO" [0101.773] FindNextFileA (in: hFindFile=0x5b5bd0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0101.773] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0101.773] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="MSO0127.ACL") returned -1 [0101.773] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSO0127.ACL") returned -1 [0101.773] lstrcmpiA (lpString1="", lpString2="MSO0127.ACL") returned -1 [0101.773] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MSN.ICO") returned="MSN.ICO" [0101.773] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="MSO0127.ACL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MSO0127.ACL") returned="C:\\Program Files\\Microsoft Office\\Office14\\MSO0127.ACL" [0101.774] FindNextFileA (in: hFindFile=0x5b5bd0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0101.774] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0101.774] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="MSOCF.DLL") returned -1 [0101.774] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSOCF.DLL") returned -1 [0101.774] lstrcmpiA (lpString1="", lpString2="MSOCF.DLL") returned -1 [0101.774] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MSO0127.ACL") returned="MSO0127.ACL" [0101.774] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="MSOCF.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MSOCF.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\MSOCF.DLL" [0101.774] FindNextFileA (in: hFindFile=0x5b5bd0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0101.774] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0101.774] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="MSOCFU.DLL") returned -1 [0101.774] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSOCFU.DLL") returned -1 [0101.774] lstrcmpiA (lpString1="", lpString2="MSOCFU.DLL") returned -1 [0101.774] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MSOCF.DLL") returned="MSOCF.DLL" [0101.774] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="MSOCFU.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MSOCFU.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\MSOCFU.DLL" [0101.774] FindNextFileA (in: hFindFile=0x5b5bd0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0101.774] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0101.774] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="MSOCFUIUTILITIESDLL.DLL") returned -1 [0101.774] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSOCFUIUTILITIESDLL.DLL") returned -1 [0101.774] lstrcmpiA (lpString1="", lpString2="MSOCFUIUTILITIESDLL.DLL") returned -1 [0101.774] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MSOCFU.DLL") returned="MSOCFU.DLL" [0101.774] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="MSOCFUIUTILITIESDLL.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MSOCFUIUTILITIESDLL.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\MSOCFUIUTILITIESDLL.DLL" [0101.774] FindNextFileA (in: hFindFile=0x5b5bd0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0101.774] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0101.774] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="MSODCW.DLL") returned -1 [0101.774] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSODCW.DLL") returned -1 [0101.774] lstrcmpiA (lpString1="", lpString2="MSODCW.DLL") returned -1 [0101.774] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MSOCFUIUTILITIESDLL.DLL") returned="MSOCFUIUTILITIESDLL.DLL" [0101.774] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="MSODCW.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MSODCW.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\MSODCW.DLL" [0101.774] FindNextFileA (in: hFindFile=0x5b5bd0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0101.775] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0101.775] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="MSOHEV.DLL") returned -1 [0101.775] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSOHEV.DLL") returned -1 [0101.775] lstrcmpiA (lpString1="", lpString2="MSOHEV.DLL") returned -1 [0101.775] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MSODCW.DLL") returned="MSODCW.DLL" [0101.775] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="MSOHEV.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MSOHEV.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\MSOHEV.DLL" [0101.775] FindNextFileA (in: hFindFile=0x5b5bd0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0101.775] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0101.775] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="MSOHEVI.DLL") returned -1 [0101.775] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSOHEVI.DLL") returned -1 [0101.775] lstrcmpiA (lpString1="", lpString2="MSOHEVI.DLL") returned -1 [0101.775] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MSOHEV.DLL") returned="MSOHEV.DLL" [0101.775] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="MSOHEVI.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MSOHEVI.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\MSOHEVI.DLL" [0101.775] FindNextFileA (in: hFindFile=0x5b5bd0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0101.775] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0101.775] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="MSOHTMED.EXE") returned -1 [0101.775] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSOHTMED.EXE") returned -1 [0101.775] lstrcmpiA (lpString1="", lpString2="MSOHTMED.EXE") returned -1 [0101.775] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MSOHEVI.DLL") returned="MSOHEVI.DLL" [0101.775] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="MSOHTMED.EXE" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MSOHTMED.EXE") returned="C:\\Program Files\\Microsoft Office\\Office14\\MSOHTMED.EXE" [0101.775] FindNextFileA (in: hFindFile=0x5b5bd0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0101.775] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0101.775] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="MSOSTYLE.DLL") returned -1 [0101.775] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSOSTYLE.DLL") returned -1 [0101.775] lstrcmpiA (lpString1="", lpString2="MSOSTYLE.DLL") returned -1 [0101.776] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MSOHTMED.EXE") returned="MSOHTMED.EXE" [0101.776] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="MSOSTYLE.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MSOSTYLE.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\MSOSTYLE.DLL" [0101.776] FindNextFileA (in: hFindFile=0x5b5bd0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0101.776] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0101.776] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="MSOSYNC.EXE") returned -1 [0101.776] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSOSYNC.EXE") returned -1 [0101.776] lstrcmpiA (lpString1="", lpString2="MSOSYNC.EXE") returned -1 [0101.776] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MSOSTYLE.DLL") returned="MSOSTYLE.DLL" [0101.776] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="MSOSYNC.EXE" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MSOSYNC.EXE") returned="C:\\Program Files\\Microsoft Office\\Office14\\MSOSYNC.EXE" [0101.776] FindNextFileA (in: hFindFile=0x5b5bd0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0101.776] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0101.776] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="MSOUC.EXE") returned -1 [0101.776] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSOUC.EXE") returned -1 [0101.776] lstrcmpiA (lpString1="", lpString2="MSOUC.EXE") returned -1 [0101.776] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MSOSYNC.EXE") returned="MSOSYNC.EXE" [0101.776] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="MSOUC.EXE" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MSOUC.EXE") returned="C:\\Program Files\\Microsoft Office\\Office14\\MSOUC.EXE" [0101.776] FindNextFileA (in: hFindFile=0x5b5bd0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0101.776] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0101.776] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="MSOUTL.OLB") returned -1 [0101.776] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSOUTL.OLB") returned -1 [0101.776] lstrcmpiA (lpString1="", lpString2="MSOUTL.OLB") returned -1 [0101.776] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MSOUC.EXE") returned="MSOUC.EXE" [0101.776] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="MSOUTL.OLB" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MSOUTL.OLB") returned="C:\\Program Files\\Microsoft Office\\Office14\\MSOUTL.OLB" [0101.776] FindNextFileA (in: hFindFile=0x5b5bd0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0101.776] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0101.776] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="MSOUTLS.DLL") returned -1 [0101.776] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSOUTLS.DLL") returned -1 [0101.776] lstrcmpiA (lpString1="", lpString2="MSOUTLS.DLL") returned -1 [0101.776] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MSOUTL.OLB") returned="MSOUTL.OLB" [0101.776] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="MSOUTLS.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MSOUTLS.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\MSOUTLS.DLL" [0101.777] FindNextFileA (in: hFindFile=0x5b5bd0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0101.777] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0101.777] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="MSPJEVTS.DLL") returned -1 [0101.777] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSPJEVTS.DLL") returned -1 [0101.777] lstrcmpiA (lpString1="", lpString2="MSPJEVTS.DLL") returned -1 [0101.777] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MSOUTLS.DLL") returned="MSOUTLS.DLL" [0101.777] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="MSPJEVTS.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MSPJEVTS.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\MSPJEVTS.DLL" [0101.777] FindNextFileA (in: hFindFile=0x5b5bd0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0101.777] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0101.777] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="MSPPT.OLB") returned -1 [0101.777] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSPPT.OLB") returned -1 [0101.777] lstrcmpiA (lpString1="", lpString2="MSPPT.OLB") returned -1 [0101.777] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MSPJEVTS.DLL") returned="MSPJEVTS.DLL" [0101.777] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="MSPPT.OLB" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MSPPT.OLB") returned="C:\\Program Files\\Microsoft Office\\Office14\\MSPPT.OLB" [0101.777] FindNextFileA (in: hFindFile=0x5b5bd0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0101.777] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0101.777] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="MSPRJ.OLB") returned -1 [0101.777] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSPRJ.OLB") returned -1 [0101.777] lstrcmpiA (lpString1="", lpString2="MSPRJ.OLB") returned -1 [0101.777] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MSPPT.OLB") returned="MSPPT.OLB" [0101.777] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="MSPRJ.OLB" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MSPRJ.OLB") returned="C:\\Program Files\\Microsoft Office\\Office14\\MSPRJ.OLB" [0101.777] FindNextFileA (in: hFindFile=0x5b5bd0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0101.777] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0101.777] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="msproof7.dll") returned -1 [0101.777] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="msproof7.dll") returned -1 [0101.777] lstrcmpiA (lpString1="", lpString2="msproof7.dll") returned -1 [0101.777] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MSPRJ.OLB") returned="MSPRJ.OLB" [0101.777] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="msproof7.dll" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\msproof7.dll") returned="C:\\Program Files\\Microsoft Office\\Office14\\msproof7.dll" [0101.778] FindNextFileA (in: hFindFile=0x5b5bd0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0101.778] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0101.778] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="MSPST32.DLL") returned -1 [0101.778] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSPST32.DLL") returned -1 [0101.778] lstrcmpiA (lpString1="", lpString2="MSPST32.DLL") returned -1 [0101.778] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\msproof7.dll") returned="msproof7.dll" [0101.778] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="MSPST32.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MSPST32.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\MSPST32.DLL" [0101.778] FindNextFileA (in: hFindFile=0x5b5bd0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0101.778] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0101.778] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="MSPUB.EXE") returned -1 [0101.778] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSPUB.EXE") returned -1 [0101.778] lstrcmpiA (lpString1="", lpString2="MSPUB.EXE") returned -1 [0101.778] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MSPST32.DLL") returned="MSPST32.DLL" [0101.778] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="MSPUB.EXE" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MSPUB.EXE") returned="C:\\Program Files\\Microsoft Office\\Office14\\MSPUB.EXE" [0101.778] FindNextFileA (in: hFindFile=0x5b5bd0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0101.778] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0101.778] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="mspub.exe.manifest") returned -1 [0101.778] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="mspub.exe.manifest") returned -1 [0101.778] lstrcmpiA (lpString1="", lpString2="mspub.exe.manifest") returned -1 [0101.778] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MSPUB.EXE") returned="MSPUB.EXE" [0101.778] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="mspub.exe.manifest" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\mspub.exe.manifest") returned="C:\\Program Files\\Microsoft Office\\Office14\\mspub.exe.manifest" [0101.778] FindNextFileA (in: hFindFile=0x5b5bd0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0101.778] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0101.778] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="MSPUB.TLB") returned -1 [0101.778] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSPUB.TLB") returned -1 [0101.778] lstrcmpiA (lpString1="", lpString2="MSPUB.TLB") returned -1 [0101.778] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\mspub.exe.manifest") returned="mspub.exe.manifest" [0101.778] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="MSPUB.TLB" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MSPUB.TLB") returned="C:\\Program Files\\Microsoft Office\\Office14\\MSPUB.TLB" [0101.779] FindNextFileA (in: hFindFile=0x5b5bd0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0101.779] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0101.779] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="MSQRY32.EXE") returned -1 [0101.779] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSQRY32.EXE") returned -1 [0101.779] lstrcmpiA (lpString1="", lpString2="MSQRY32.EXE") returned -1 [0101.779] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MSPUB.TLB") returned="MSPUB.TLB" [0101.779] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="MSQRY32.EXE" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MSQRY32.EXE") returned="C:\\Program Files\\Microsoft Office\\Office14\\MSQRY32.EXE" [0101.779] FindNextFileA (in: hFindFile=0x5b5bd0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0101.779] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0101.779] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="MSRTEDIT.DLL") returned -1 [0101.779] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSRTEDIT.DLL") returned -1 [0101.779] lstrcmpiA (lpString1="", lpString2="MSRTEDIT.DLL") returned -1 [0101.779] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MSQRY32.EXE") returned="MSQRY32.EXE" [0101.779] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="MSRTEDIT.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MSRTEDIT.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\MSRTEDIT.DLL" [0101.779] FindNextFileA (in: hFindFile=0x5b5bd0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0101.779] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0101.779] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="MSTORDB.EXE") returned -1 [0101.779] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSTORDB.EXE") returned -1 [0101.779] lstrcmpiA (lpString1="", lpString2="MSTORDB.EXE") returned -1 [0101.779] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MSRTEDIT.DLL") returned="MSRTEDIT.DLL" [0101.779] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="MSTORDB.EXE" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MSTORDB.EXE") returned="C:\\Program Files\\Microsoft Office\\Office14\\MSTORDB.EXE" [0101.779] FindNextFileA (in: hFindFile=0x5b5bd0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0101.779] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0101.779] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="MSTORE.EXE") returned -1 [0101.779] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSTORE.EXE") returned -1 [0101.779] lstrcmpiA (lpString1="", lpString2="MSTORE.EXE") returned -1 [0101.779] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MSTORDB.EXE") returned="MSTORDB.EXE" [0101.779] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="MSTORE.EXE" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MSTORE.EXE") returned="C:\\Program Files\\Microsoft Office\\Office14\\MSTORE.EXE" [0101.780] FindNextFileA (in: hFindFile=0x5b5bd0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0101.780] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0101.780] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="MSTORES.DLL") returned -1 [0101.780] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSTORES.DLL") returned -1 [0101.780] lstrcmpiA (lpString1="", lpString2="MSTORES.DLL") returned -1 [0101.780] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MSTORE.EXE") returned="MSTORE.EXE" [0101.780] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="MSTORES.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MSTORES.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\MSTORES.DLL" [0101.780] FindNextFileA (in: hFindFile=0x5b5bd0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0101.780] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0101.780] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="MSWORD.OLB") returned -1 [0101.780] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSWORD.OLB") returned -1 [0101.780] lstrcmpiA (lpString1="", lpString2="MSWORD.OLB") returned -1 [0101.780] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MSTORES.DLL") returned="MSTORES.DLL" [0101.780] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="MSWORD.OLB" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MSWORD.OLB") returned="C:\\Program Files\\Microsoft Office\\Office14\\MSWORD.OLB" [0101.780] FindNextFileA (in: hFindFile=0x5b5bd0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0101.780] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0101.780] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="MSYUBIN7.DLL") returned -1 [0101.780] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSYUBIN7.DLL") returned -1 [0101.780] lstrcmpiA (lpString1="", lpString2="MSYUBIN7.DLL") returned -1 [0101.780] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MSWORD.OLB") returned="MSWORD.OLB" [0101.780] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="MSYUBIN7.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MSYUBIN7.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\MSYUBIN7.DLL" [0101.780] FindNextFileA (in: hFindFile=0x5b5bd0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0101.780] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0101.780] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="MYSL.ICO") returned -1 [0101.780] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MYSL.ICO") returned -1 [0101.780] lstrcmpiA (lpString1="", lpString2="MYSL.ICO") returned -1 [0101.780] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MSYUBIN7.DLL") returned="MSYUBIN7.DLL" [0101.780] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="MYSL.ICO" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\MYSL.ICO") returned="C:\\Program Files\\Microsoft Office\\Office14\\MYSL.ICO" [0101.780] FindNextFileA (in: hFindFile=0x5b5bd0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0101.781] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0101.781] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="NAME.DLL") returned -1 [0101.781] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="NAME.DLL") returned -1 [0101.781] lstrcmpiA (lpString1="", lpString2="NAME.DLL") returned -1 [0101.781] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\MYSL.ICO") returned="MYSL.ICO" [0101.781] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="NAME.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\NAME.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\NAME.DLL" [0101.781] FindNextFileA (in: hFindFile=0x5b5bd0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0101.781] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0101.781] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="NAMECONTROLPROXY.DLL") returned -1 [0101.781] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="NAMECONTROLPROXY.DLL") returned -1 [0101.781] lstrcmpiA (lpString1="", lpString2="NAMECONTROLPROXY.DLL") returned -1 [0101.781] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\NAME.DLL") returned="NAME.DLL" [0101.781] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="NAMECONTROLPROXY.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\NAMECONTROLPROXY.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\NAMECONTROLPROXY.DLL" [0101.781] FindNextFileA (in: hFindFile=0x5b5bd0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0101.781] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0101.781] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\NAMECONTROLPROXY.DLL") returned="NAMECONTROLPROXY.DLL" [0101.781] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="NAMECONTROLSERVER.EXE" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\NAMECONTROLSERVER.EXE") returned="C:\\Program Files\\Microsoft Office\\Office14\\NAMECONTROLSERVER.EXE" [0101.781] FindNextFileA (in: hFindFile=0x5b5bd0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0101.781] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0101.781] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\NAMECONTROLSERVER.EXE") returned="NAMECONTROLSERVER.EXE" [0101.781] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="NAMEEXT.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\NAMEEXT.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\NAMEEXT.DLL" [0101.781] FindNextFileA (in: hFindFile=0x5b5bd0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0101.781] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0101.782] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\NAMEEXT.DLL") returned="NAMEEXT.DLL" [0101.782] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="NL7Data0011.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\NL7Data0011.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\NL7Data0011.DLL" [0101.782] FindNextFileA (in: hFindFile=0x5b5bd0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0101.782] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0101.782] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\NL7Data0011.DLL") returned="NL7Data0011.DLL" [0101.782] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="NL7Lexicons0011.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\NL7Lexicons0011.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\NL7Lexicons0011.DLL" [0101.782] FindNextFileA (in: hFindFile=0x5b5bd0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0101.782] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0101.782] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\NL7Lexicons0011.DLL") returned="NL7Lexicons0011.DLL" [0101.782] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="NL7MODELS0009.dll" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS0009.dll") returned="C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS0009.dll" [0101.782] FindNextFileA (in: hFindFile=0x5b5bd0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0101.782] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0101.782] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS0009.dll") returned="NL7MODELS0009.dll" [0101.782] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="NL7MODELS000A.dll" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS000A.dll") returned="C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS000A.dll" [0101.782] FindNextFileA (in: hFindFile=0x5b5bd0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0101.782] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0101.782] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS000A.dll") returned="NL7MODELS000A.dll" [0101.782] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="NL7MODELS000C.dll" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS000C.dll") returned="C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS000C.dll" [0101.782] FindNextFileA (in: hFindFile=0x5b5bd0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0101.782] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0101.782] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS000C.dll") returned="NL7MODELS000C.dll" [0101.782] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="NL7Models0011.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\NL7Models0011.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\NL7Models0011.DLL" [0101.783] FindNextFileA (in: hFindFile=0x5b5bd0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0101.783] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0101.783] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\NL7Models0011.DLL") returned="NL7Models0011.DLL" [0101.783] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="NPAUTHZ.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\NPAUTHZ.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\NPAUTHZ.DLL" [0101.783] FindNextFileA (in: hFindFile=0x5b5bd0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0101.783] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0101.783] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\NPAUTHZ.DLL") returned="NPAUTHZ.DLL" [0101.783] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="OART.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OART.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\OART.DLL" [0101.783] FindNextFileA (in: hFindFile=0x5b5bd0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0101.783] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0101.783] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OART.DLL") returned="OART.DLL" [0101.783] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="OARTCONV.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OARTCONV.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\OARTCONV.DLL" [0101.783] FindNextFileA (in: hFindFile=0x5b5bd0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0101.783] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0101.783] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OARTCONV.DLL") returned="OARTCONV.DLL" [0101.783] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="OCRHC.DAT" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OCRHC.DAT") returned="C:\\Program Files\\Microsoft Office\\Office14\\OCRHC.DAT" [0101.783] FindNextFileA (in: hFindFile=0x5b5bd0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0101.783] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0101.783] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OCRHC.DAT") returned="OCRHC.DAT" [0101.783] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="OCRVC.DAT" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OCRVC.DAT") returned="C:\\Program Files\\Microsoft Office\\Office14\\OCRVC.DAT" [0101.783] FindNextFileA (in: hFindFile=0x5b5bd0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0101.783] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0101.783] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OCRVC.DAT") returned="OCRVC.DAT" [0101.784] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="OEMPRINT.CAT" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OEMPRINT.CAT") returned="C:\\Program Files\\Microsoft Office\\Office14\\OEMPRINT.CAT" [0101.784] FindNextFileA (in: hFindFile=0x5b5bd0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0101.784] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0101.784] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OEMPRINT.CAT") returned="OEMPRINT.CAT" [0101.784] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="OFFOWC.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OFFOWC.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\OFFOWC.DLL" [0101.784] FindNextFileA (in: hFindFile=0x5b5bd0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0101.784] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0101.784] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OFFOWC.DLL") returned="OFFOWC.DLL" [0101.784] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="OFFRHD.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OFFRHD.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\OFFRHD.DLL" [0101.784] FindNextFileA (in: hFindFile=0x5b5bd0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0101.784] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0101.784] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OFFRHD.DLL") returned="OFFRHD.DLL" [0101.784] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="OFFXML.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OFFXML.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\OFFXML.DLL" [0101.784] FindNextFileA (in: hFindFile=0x5b5bd0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0101.784] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0101.784] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OFFXML.DLL") returned="OFFXML.DLL" [0101.784] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="ogalegit.dll" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\ogalegit.dll") returned="C:\\Program Files\\Microsoft Office\\Office14\\ogalegit.dll" [0101.784] FindNextFileA (in: hFindFile=0x5b5bd0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0101.784] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0101.784] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\ogalegit.dll") returned="ogalegit.dll" [0101.784] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="OIMG.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OIMG.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\OIMG.DLL" [0101.784] FindNextFileA (in: hFindFile=0x5b5bd0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0101.784] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0101.785] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OIMG.DLL") returned="OIMG.DLL" [0101.785] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="OIS.EXE" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OIS.EXE") returned="C:\\Program Files\\Microsoft Office\\Office14\\OIS.EXE" [0101.785] FindNextFileA (in: hFindFile=0x5b5bd0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0101.785] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0101.785] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OIS.EXE") returned="OIS.EXE" [0101.785] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="OISAPP.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OISAPP.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\OISAPP.DLL" [0101.785] FindNextFileA (in: hFindFile=0x5b5bd0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0101.785] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0101.785] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OISAPP.DLL") returned="OISAPP.DLL" [0101.785] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="oisctrl.dll" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\oisctrl.dll") returned="C:\\Program Files\\Microsoft Office\\Office14\\oisctrl.dll" [0101.785] FindNextFileA (in: hFindFile=0x5b5bd0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0101.785] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0101.785] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\oisctrl.dll") returned="oisctrl.dll" [0101.785] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="OISGRAPH.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OISGRAPH.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\OISGRAPH.DLL" [0101.785] FindNextFileA (in: hFindFile=0x5b5bd0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0101.785] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0101.785] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OISGRAPH.DLL") returned="OISGRAPH.DLL" [0101.785] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="OLKFSTUB.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OLKFSTUB.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\OLKFSTUB.DLL" [0101.785] FindNextFileA (in: hFindFile=0x5b5bd0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0101.785] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0101.785] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OLKFSTUB.DLL") returned="OLKFSTUB.DLL" [0101.785] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="OLKIRM.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OLKIRM.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\OLKIRM.XML" [0101.786] FindNextFileA (in: hFindFile=0x5b5bd0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0101.786] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0101.786] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OLKIRM.XML") returned="OLKIRM.XML" [0101.786] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="OLKIRMV.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OLKIRMV.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\OLKIRMV.XML" [0101.786] FindNextFileA (in: hFindFile=0x5b5bd0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0101.786] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0101.786] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OLKIRMV.XML") returned="OLKIRMV.XML" [0101.786] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="OLMAPI32.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OLMAPI32.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\OLMAPI32.DLL" [0101.786] FindNextFileA (in: hFindFile=0x5b5bd0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0101.786] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0101.786] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OLMAPI32.DLL") returned="OLMAPI32.DLL" [0101.786] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="OMML2MML.XSL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OMML2MML.XSL") returned="C:\\Program Files\\Microsoft Office\\Office14\\OMML2MML.XSL" [0101.786] FindNextFileA (in: hFindFile=0x5b5bd0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0101.786] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0101.786] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OMML2MML.XSL") returned="OMML2MML.XSL" [0101.786] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="OMSMAIN.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OMSMAIN.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\OMSMAIN.DLL" [0101.786] FindNextFileA (in: hFindFile=0x5b5bd0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0101.786] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0101.786] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OMSMAIN.DLL") returned="OMSMAIN.DLL" [0101.786] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="OMSXP32.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OMSXP32.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\OMSXP32.DLL" [0101.786] FindNextFileA (in: hFindFile=0x5b5bd0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0101.786] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0101.786] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OMSXP32.DLL") returned="OMSXP32.DLL" [0101.787] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="ONBttnIE.dll" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\ONBttnIE.dll") returned="C:\\Program Files\\Microsoft Office\\Office14\\ONBttnIE.dll" [0101.787] FindNextFileA (in: hFindFile=0x5b5bd0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0101.787] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0101.787] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\ONBttnIE.dll") returned="ONBttnIE.dll" [0101.787] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="ONBttnIELinkedNotes.dll" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\ONBttnIELinkedNotes.dll") returned="C:\\Program Files\\Microsoft Office\\Office14\\ONBttnIELinkedNotes.dll" [0101.787] FindNextFileA (in: hFindFile=0x5b5bd0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0101.787] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0101.787] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\ONBttnIELinkedNotes.dll") returned="ONBttnIELinkedNotes.dll" [0101.787] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="ONBttnOL.dll" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\ONBttnOL.dll") returned="C:\\Program Files\\Microsoft Office\\Office14\\ONBttnOL.dll" [0101.787] FindNextFileA (in: hFindFile=0x5b5bd0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0101.881] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0101.881] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\ONBttnOL.dll") returned="ONBttnOL.dll" [0101.881] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="ONBttnPPT.dll" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\ONBttnPPT.dll") returned="C:\\Program Files\\Microsoft Office\\Office14\\ONBttnPPT.dll" [0101.881] FindNextFileA (in: hFindFile=0x5b5bd0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0101.881] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0101.881] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\ONBttnPPT.dll") returned="ONBttnPPT.dll" [0101.881] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="ONBttnWD.dll" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\ONBttnWD.dll") returned="C:\\Program Files\\Microsoft Office\\Office14\\ONBttnWD.dll" [0101.882] FindNextFileA (in: hFindFile=0x5b5bd0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0101.882] lstrcmpA (lpString1=".", lpString2="OneNote") returned -1 [0101.882] lstrcmpA (lpString1="..", lpString2="OneNote") returned -1 [0101.882] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\ONBttnWD.dll") returned="ONBttnWD.dll" [0101.882] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="OneNote" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OneNote") returned="C:\\Program Files\\Microsoft Office\\Office14\\OneNote" [0101.882] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be160 [0101.934] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0101.934] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0101.934] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0101.934] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0101.934] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0101.934] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0101.934] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\*.*") returned="*.*" [0101.934] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\", lpString2="SendToOneNote-PipelineConfig.xml" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\SendToOneNote-PipelineConfig.xml") returned="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\SendToOneNote-PipelineConfig.xml" [0101.934] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0101.935] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0101.935] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\SendToOneNote-PipelineConfig.xml") returned="SendToOneNote-PipelineConfig.xml" [0101.935] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\", lpString2="SendToOneNote.gpd" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\SendToOneNote.gpd") returned="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\SendToOneNote.gpd" [0101.935] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0101.935] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0101.935] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\SendToOneNote.gpd") returned="SendToOneNote.gpd" [0101.935] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\", lpString2="SendToOneNote.ini" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\SendToOneNote.ini") returned="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\SendToOneNote.ini" [0101.935] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0101.935] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0101.935] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\SendToOneNote.ini") returned="SendToOneNote.ini" [0101.935] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\", lpString2="SendToOneNOteFilter.dll" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\SendToOneNOteFilter.dll") returned="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\SendToOneNOteFilter.dll" [0101.935] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0101.935] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0101.935] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\SendToOneNOteFilter.dll") returned="SendToOneNOteFilter.dll" [0101.935] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\", lpString2="SendtoOneNoteFilter.gpd" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\SendtoOneNoteFilter.gpd") returned="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\SendtoOneNoteFilter.gpd" [0101.935] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0101.935] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0101.935] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\SendtoOneNoteFilter.gpd") returned="SendtoOneNoteFilter.gpd" [0101.935] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\", lpString2="SendToOneNoteNames.gpd" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\SendToOneNoteNames.gpd") returned="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\SendToOneNoteNames.gpd" [0101.935] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0101.935] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0101.935] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\SendToOneNoteNames.gpd") returned="SendToOneNoteNames.gpd" [0101.936] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\", lpString2="SendToOneNoteUI.dll" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\SendToOneNoteUI.dll") returned="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\SendToOneNoteUI.dll" [0101.936] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0 [0101.936] FindClose (in: hFindFile=0x5be160 | out: hFindFile=0x5be160) returned 1 [0101.936] FindNextFileA (in: hFindFile=0x5b5bd0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0101.936] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0101.936] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\*.*") returned="*.*" [0101.936] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="ONENOTE.EXE" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTE.EXE") returned="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTE.EXE" [0101.936] FindNextFileA (in: hFindFile=0x5b5bd0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0101.937] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0101.937] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTE.EXE") returned="ONENOTE.EXE" [0101.937] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="ONENOTEIRM.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEIRM.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEIRM.XML" [0101.937] FindNextFileA (in: hFindFile=0x5b5bd0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0101.937] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0101.937] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEIRM.XML") returned="ONENOTEIRM.XML" [0101.937] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="ONENOTEM.EXE" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEM.EXE") returned="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEM.EXE" [0101.937] FindNextFileA (in: hFindFile=0x5b5bd0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0101.937] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0101.937] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEM.EXE") returned="ONENOTEM.EXE" [0101.937] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="ONENOTEMANAGED.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEMANAGED.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEMANAGED.DLL" [0101.937] FindNextFileA (in: hFindFile=0x5b5bd0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0101.937] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0101.937] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEMANAGED.DLL") returned="ONENOTEMANAGED.DLL" [0101.937] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="ONFILTER.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\ONFILTER.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\ONFILTER.DLL" [0101.937] FindNextFileA (in: hFindFile=0x5b5bd0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0101.937] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0101.937] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\ONFILTER.DLL") returned="ONFILTER.DLL" [0101.937] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="ONLNTCOMLIB.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\ONLNTCOMLIB.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\ONLNTCOMLIB.DLL" [0101.937] FindNextFileA (in: hFindFile=0x5b5bd0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0101.937] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0101.937] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\ONLNTCOMLIB.DLL") returned="ONLNTCOMLIB.DLL" [0101.937] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="ONMAIN.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\ONMAIN.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\ONMAIN.DLL" [0101.938] FindNextFileA (in: hFindFile=0x5b5bd0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0101.938] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0101.938] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\ONMAIN.DLL") returned="ONMAIN.DLL" [0101.938] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="ONPPTAddin.dll" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\ONPPTAddin.dll") returned="C:\\Program Files\\Microsoft Office\\Office14\\ONPPTAddin.dll" [0101.938] FindNextFileA (in: hFindFile=0x5b5bd0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0101.938] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0101.938] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\ONPPTAddin.dll") returned="ONPPTAddin.dll" [0101.938] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="ONWordAddin.dll" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\ONWordAddin.dll") returned="C:\\Program Files\\Microsoft Office\\Office14\\ONWordAddin.dll" [0101.938] FindNextFileA (in: hFindFile=0x5b5bd0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0101.938] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0101.938] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\ONWordAddin.dll") returned="ONWordAddin.dll" [0101.938] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="ORGCHART.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\ORGCHART.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\ORGCHART.DLL" [0101.938] FindNextFileA (in: hFindFile=0x5b5bd0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0101.938] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0101.938] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\ORGCHART.DLL") returned="ORGCHART.DLL" [0101.938] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="ORGCHWIZ.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\ORGCHWIZ.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\ORGCHWIZ.DLL" [0101.938] FindNextFileA (in: hFindFile=0x5b5bd0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0101.938] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0101.938] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\ORGCHWIZ.DLL") returned="ORGCHWIZ.DLL" [0101.938] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="ORGWIZ.EXE" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\ORGWIZ.EXE") returned="C:\\Program Files\\Microsoft Office\\Office14\\ORGWIZ.EXE" [0101.938] FindNextFileA (in: hFindFile=0x5b5bd0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0101.938] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0101.939] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\ORGWIZ.EXE") returned="ORGWIZ.EXE" [0101.939] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="ORMELEMS.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\ORMELEMS.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\ORMELEMS.DLL" [0101.939] FindNextFileA (in: hFindFile=0x5b5bd0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0101.939] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0101.939] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\ORMELEMS.DLL") returned="ORMELEMS.DLL" [0101.939] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="ORMMODEL.MDL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\ORMMODEL.MDL") returned="C:\\Program Files\\Microsoft Office\\Office14\\ORMMODEL.MDL" [0101.939] FindNextFileA (in: hFindFile=0x5b5bd0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0101.939] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0101.939] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\ORMMODEL.MDL") returned="ORMMODEL.MDL" [0101.939] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="OSPP.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OSPP.HTM") returned="C:\\Program Files\\Microsoft Office\\Office14\\OSPP.HTM" [0101.939] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\OSPP.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OSPP.HTM") returned="C:\\Program Files\\Microsoft Office\\Office14\\OSPP.HTM" [0101.939] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Microsoft Office\\Office14\\OSPP.HTM" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OSPP.HTM") returned="C:\\Program Files\\Microsoft Office\\Office14\\OSPP.HTM" [0101.939] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OSPP.HTM", lpString2="." | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OSPP.HTM.") returned="C:\\Program Files\\Microsoft Office\\Office14\\OSPP.HTM." [0101.939] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OSPP.HTM.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OSPP.HTM. ") returned="C:\\Program Files\\Microsoft Office\\Office14\\OSPP.HTM. " [0101.939] CreateFileA (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OSPP.HTM" (normalized: "c:\\program files\\microsoft office\\office14\\ospp.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x88 [0101.940] GetFileSize (in: hFile=0x88, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3d05 [0101.940] GetFileTime (in: hFile=0x88, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x84eac400, dwHighDateTime=0x1cabc89), lpLastAccessTime=0x407536*(dwLowDateTime=0x6c23c830, dwHighDateTime=0x1d301bf), lpLastWriteTime=0x40753e*(dwLowDateTime=0x84eac400, dwHighDateTime=0x1cabc89)) returned 1 [0101.940] SetFilePointer (in: hFile=0x88, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0101.940] ReadFile (in: hFile=0x88, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x3cab, lpOverlapped=0x0) returned 1 [0101.997] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OSPP.HTM") returned="OSPP.HTM" [0101.997] SetFilePointer (in: hFile=0x88, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0101.997] WriteFile (in: hFile=0x88, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x3cab, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x3cab, lpOverlapped=0x0) returned 1 [0101.997] SetFileTime (hFile=0x88, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0101.997] CloseHandle (hObject=0x88) returned 1 [0101.997] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\OSPP.HTM" (normalized: "c:\\program files\\microsoft office\\office14\\ospp.htm"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\OSPP.HTM. " (normalized: "c:\\program files\\microsoft office\\office14\\ospp.htm. ")) returned 1 [0101.998] FindNextFileA (in: hFindFile=0x5b5bd0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0101.998] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0101.998] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="OSPP.VBS") returned -1 [0101.998] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OSPP.VBS") returned -1 [0101.998] lstrcmpiA (lpString1="", lpString2="OSPP.VBS") returned -1 [0101.999] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OSPP.HTM") returned="OSPP.HTM" [0101.999] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="OSPP.VBS" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OSPP.VBS") returned="C:\\Program Files\\Microsoft Office\\Office14\\OSPP.VBS" [0101.999] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OSPP.VBS", pszSpec="*.zip") returned 0 [0101.999] lstrlenA (lpString="*.zip") returned 5 [0101.999] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OSPP.VBS", pszSpec="*.rar") returned 0 [0101.999] lstrlenA (lpString="*.rar") returned 5 [0101.999] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OSPP.VBS", pszSpec="*.7z") returned 0 [0101.999] lstrlenA (lpString="*.7z") returned 4 [0101.999] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OSPP.VBS", pszSpec="*.tar") returned 0 [0101.999] lstrlenA (lpString="*.tar") returned 5 [0101.999] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OSPP.VBS", pszSpec="*.gzip") returned 0 [0101.999] lstrlenA (lpString="*.gzip") returned 6 [0101.999] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OSPP.VBS", pszSpec="*.jpg") returned 0 [0101.999] lstrlenA (lpString="*.jpg") returned 5 [0101.999] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OSPP.VBS", pszSpec="*.jpeg") returned 0 [0101.999] lstrlenA (lpString="*.jpeg") returned 6 [0101.999] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OSPP.VBS", pszSpec="*.psd") returned 0 [0101.999] lstrlenA (lpString="*.psd") returned 5 [0101.999] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OSPP.VBS", pszSpec="*.cdr") returned 0 [0101.999] lstrlenA (lpString="*.cdr") returned 5 [0101.999] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OSPP.VBS", pszSpec="*.dwg") returned 0 [0101.999] lstrlenA (lpString="*.dwg") returned 5 [0101.999] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OSPP.VBS", pszSpec="*.max") returned 0 [0101.999] lstrlenA (lpString="*.max") returned 5 [0101.999] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OSPP.VBS", pszSpec="*.bmp") returned 0 [0101.999] lstrlenA (lpString="*.bmp") returned 5 [0101.999] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OSPP.VBS", pszSpec="*.gif") returned 0 [0101.999] lstrlenA (lpString="*.gif") returned 5 [0101.999] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OSPP.VBS", pszSpec="*.png") returned 0 [0101.999] lstrlenA (lpString="*.png") returned 5 [0101.999] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OSPP.VBS", pszSpec="*.doc") returned 0 [0101.999] lstrlenA (lpString="*.doc") returned 5 [0101.999] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OSPP.VBS", pszSpec="*.docx") returned 0 [0101.999] lstrlenA (lpString="*.docx") returned 6 [0101.999] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OSPP.VBS", pszSpec="*.xls") returned 0 [0101.999] lstrlenA (lpString="*.xls") returned 5 [0101.999] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OSPP.VBS", pszSpec="*.xlsx") returned 0 [0102.000] lstrlenA (lpString="*.xlsx") returned 6 [0102.000] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OSPP.VBS", pszSpec="*.ppt") returned 0 [0102.000] lstrlenA (lpString="*.ppt") returned 5 [0102.000] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OSPP.VBS", pszSpec="*.pptx") returned 0 [0102.000] lstrlenA (lpString="*.pptx") returned 6 [0102.001] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OSPP.VBS", pszSpec="*.txt") returned 0 [0102.001] lstrlenA (lpString="*.txt") returned 5 [0102.001] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OSPP.VBS", pszSpec="*.pdf") returned 0 [0102.001] lstrlenA (lpString="*.pdf") returned 5 [0102.001] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OSPP.VBS", pszSpec="*.djvu") returned 0 [0102.001] lstrlenA (lpString="*.djvu") returned 6 [0102.001] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OSPP.VBS", pszSpec="*.htm") returned 0 [0102.001] lstrlenA (lpString="*.htm") returned 5 [0102.001] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OSPP.VBS", pszSpec="*.html") returned 0 [0102.001] lstrlenA (lpString="*.html") returned 6 [0102.001] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OSPP.VBS", pszSpec="*.mdb") returned 0 [0102.001] lstrlenA (lpString="*.mdb") returned 5 [0102.001] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OSPP.VBS", pszSpec="*.cer") returned 0 [0102.001] lstrlenA (lpString="*.cer") returned 5 [0102.001] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OSPP.VBS", pszSpec="*.p12") returned 0 [0102.001] lstrlenA (lpString="*.p12") returned 5 [0102.001] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OSPP.VBS", pszSpec="*.pfx") returned 0 [0102.001] lstrlenA (lpString="*.pfx") returned 5 [0102.001] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OSPP.VBS", pszSpec="*.kwm") returned 0 [0102.001] lstrlenA (lpString="*.kwm") returned 5 [0102.001] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OSPP.VBS", pszSpec="*.pwm") returned 0 [0102.001] lstrlenA (lpString="*.pwm") returned 5 [0102.001] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OSPP.VBS", pszSpec="*.1cd") returned 0 [0102.001] lstrlenA (lpString="*.1cd") returned 5 [0102.001] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OSPP.VBS", pszSpec="*.md") returned 0 [0102.001] lstrlenA (lpString="*.md") returned 4 [0102.002] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OSPP.VBS", pszSpec="*.mdf") returned 0 [0102.002] lstrlenA (lpString="*.mdf") returned 5 [0102.002] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OSPP.VBS", pszSpec="*.dbf") returned 0 [0102.002] lstrlenA (lpString="*.dbf") returned 5 [0102.002] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OSPP.VBS", pszSpec="*.odt") returned 0 [0102.002] lstrlenA (lpString="*.odt") returned 5 [0102.002] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OSPP.VBS", pszSpec="*.vob") returned 0 [0102.002] lstrlenA (lpString="*.vob") returned 5 [0102.002] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OSPP.VBS", pszSpec="*.ifo") returned 0 [0102.002] lstrlenA (lpString="*.ifo") returned 5 [0102.002] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OSPP.VBS", pszSpec="*.lnk") returned 0 [0102.002] lstrlenA (lpString="*.lnk") returned 5 [0102.002] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OSPP.VBS", pszSpec="*.torrent") returned 0 [0102.002] lstrlenA (lpString="*.torrent") returned 9 [0102.002] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OSPP.VBS", pszSpec="*.mov") returned 0 [0102.002] lstrlenA (lpString="*.mov") returned 5 [0102.002] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OSPP.VBS", pszSpec="*.m2v") returned 0 [0102.002] lstrlenA (lpString="*.m2v") returned 5 [0102.002] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OSPP.VBS", pszSpec="*.3gp") returned 0 [0102.002] lstrlenA (lpString="*.3gp") returned 5 [0102.002] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OSPP.VBS", pszSpec="*.mpeg") returned 0 [0102.002] lstrlenA (lpString="*.mpeg") returned 6 [0102.002] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OSPP.VBS", pszSpec="*.mpg") returned 0 [0102.002] lstrlenA (lpString="*.mpg") returned 5 [0102.002] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OSPP.VBS", pszSpec="*.flv") returned 0 [0102.002] lstrlenA (lpString="*.flv") returned 5 [0102.002] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OSPP.VBS", pszSpec="*.avi") returned 0 [0102.002] lstrlenA (lpString="*.avi") returned 5 [0102.002] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OSPP.VBS", pszSpec="*.mp4") returned 0 [0102.002] lstrlenA (lpString="*.mp4") returned 5 [0102.002] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OSPP.VBS", pszSpec="*.wmv") returned 0 [0102.002] lstrlenA (lpString="*.wmv") returned 5 [0102.002] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OSPP.VBS", pszSpec="*.divx") returned 0 [0102.002] lstrlenA (lpString="*.divx") returned 6 [0102.002] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OSPP.VBS", pszSpec="*.mkv") returned 0 [0102.002] lstrlenA (lpString="*.mkv") returned 5 [0102.002] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OSPP.VBS", pszSpec="*.mp3") returned 0 [0102.002] lstrlenA (lpString="*.mp3") returned 5 [0102.002] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OSPP.VBS", pszSpec="*.wav") returned 0 [0102.003] lstrlenA (lpString="*.wav") returned 5 [0102.003] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OSPP.VBS", pszSpec="*.flac") returned 0 [0102.003] lstrlenA (lpString="*.flac") returned 6 [0102.003] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OSPP.VBS", pszSpec="*.ape") returned 0 [0102.003] lstrlenA (lpString="*.ape") returned 5 [0102.003] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OSPP.VBS", pszSpec="*.wma") returned 0 [0102.003] lstrlenA (lpString="*.wma") returned 5 [0102.003] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OSPP.VBS", pszSpec="*.ac3") returned 0 [0102.003] lstrlenA (lpString="*.ac3") returned 5 [0102.003] FindNextFileA (in: hFindFile=0x5b5bd0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0102.003] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0102.003] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="OUTLACCT.DLL") returned -1 [0102.003] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OUTLACCT.DLL") returned -1 [0102.003] lstrcmpiA (lpString1="", lpString2="OUTLACCT.DLL") returned -1 [0102.003] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OSPP.VBS") returned="OSPP.VBS" [0102.003] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="OUTLACCT.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OUTLACCT.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\OUTLACCT.DLL" [0102.003] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLACCT.DLL", pszSpec="*.zip") returned 0 [0102.003] lstrlenA (lpString="*.zip") returned 5 [0102.003] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLACCT.DLL", pszSpec="*.rar") returned 0 [0102.003] lstrlenA (lpString="*.rar") returned 5 [0102.003] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLACCT.DLL", pszSpec="*.7z") returned 0 [0102.003] lstrlenA (lpString="*.7z") returned 4 [0102.003] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLACCT.DLL", pszSpec="*.tar") returned 0 [0102.003] lstrlenA (lpString="*.tar") returned 5 [0102.003] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLACCT.DLL", pszSpec="*.gzip") returned 0 [0102.003] lstrlenA (lpString="*.gzip") returned 6 [0102.003] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLACCT.DLL", pszSpec="*.jpg") returned 0 [0102.003] lstrlenA (lpString="*.jpg") returned 5 [0102.003] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLACCT.DLL", pszSpec="*.jpeg") returned 0 [0102.003] lstrlenA (lpString="*.jpeg") returned 6 [0102.003] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLACCT.DLL", pszSpec="*.psd") returned 0 [0102.004] lstrlenA (lpString="*.psd") returned 5 [0102.004] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLACCT.DLL", pszSpec="*.cdr") returned 0 [0102.004] lstrlenA (lpString="*.cdr") returned 5 [0102.004] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLACCT.DLL", pszSpec="*.dwg") returned 0 [0102.004] lstrlenA (lpString="*.dwg") returned 5 [0102.005] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLACCT.DLL", pszSpec="*.max") returned 0 [0102.005] lstrlenA (lpString="*.max") returned 5 [0102.005] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLACCT.DLL", pszSpec="*.bmp") returned 0 [0102.005] lstrlenA (lpString="*.bmp") returned 5 [0102.005] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLACCT.DLL", pszSpec="*.gif") returned 0 [0102.005] lstrlenA (lpString="*.gif") returned 5 [0102.005] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLACCT.DLL", pszSpec="*.png") returned 0 [0102.005] lstrlenA (lpString="*.png") returned 5 [0102.005] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLACCT.DLL", pszSpec="*.doc") returned 0 [0102.005] lstrlenA (lpString="*.doc") returned 5 [0102.005] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLACCT.DLL", pszSpec="*.docx") returned 0 [0102.005] lstrlenA (lpString="*.docx") returned 6 [0102.005] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLACCT.DLL", pszSpec="*.xls") returned 0 [0102.005] lstrlenA (lpString="*.xls") returned 5 [0102.005] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLACCT.DLL", pszSpec="*.xlsx") returned 0 [0102.005] lstrlenA (lpString="*.xlsx") returned 6 [0102.005] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLACCT.DLL", pszSpec="*.ppt") returned 0 [0102.005] lstrlenA (lpString="*.ppt") returned 5 [0102.005] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLACCT.DLL", pszSpec="*.pptx") returned 0 [0102.005] lstrlenA (lpString="*.pptx") returned 6 [0102.005] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLACCT.DLL", pszSpec="*.txt") returned 0 [0102.005] lstrlenA (lpString="*.txt") returned 5 [0102.005] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLACCT.DLL", pszSpec="*.pdf") returned 0 [0102.005] lstrlenA (lpString="*.pdf") returned 5 [0102.005] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLACCT.DLL", pszSpec="*.djvu") returned 0 [0102.005] lstrlenA (lpString="*.djvu") returned 6 [0102.005] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLACCT.DLL", pszSpec="*.htm") returned 0 [0102.005] lstrlenA (lpString="*.htm") returned 5 [0102.005] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLACCT.DLL", pszSpec="*.html") returned 0 [0102.005] lstrlenA (lpString="*.html") returned 6 [0102.005] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLACCT.DLL", pszSpec="*.mdb") returned 0 [0102.005] lstrlenA (lpString="*.mdb") returned 5 [0102.005] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLACCT.DLL", pszSpec="*.cer") returned 0 [0102.005] lstrlenA (lpString="*.cer") returned 5 [0102.005] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLACCT.DLL", pszSpec="*.p12") returned 0 [0102.005] lstrlenA (lpString="*.p12") returned 5 [0102.005] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLACCT.DLL", pszSpec="*.pfx") returned 0 [0102.005] lstrlenA (lpString="*.pfx") returned 5 [0102.006] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLACCT.DLL", pszSpec="*.kwm") returned 0 [0102.006] lstrlenA (lpString="*.kwm") returned 5 [0102.006] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLACCT.DLL", pszSpec="*.pwm") returned 0 [0102.006] lstrlenA (lpString="*.pwm") returned 5 [0102.006] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLACCT.DLL", pszSpec="*.1cd") returned 0 [0102.006] lstrlenA (lpString="*.1cd") returned 5 [0102.006] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLACCT.DLL", pszSpec="*.md") returned 0 [0102.006] lstrlenA (lpString="*.md") returned 4 [0102.006] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLACCT.DLL", pszSpec="*.mdf") returned 0 [0102.006] lstrlenA (lpString="*.mdf") returned 5 [0102.006] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLACCT.DLL", pszSpec="*.dbf") returned 0 [0102.006] lstrlenA (lpString="*.dbf") returned 5 [0102.006] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLACCT.DLL", pszSpec="*.odt") returned 0 [0102.006] lstrlenA (lpString="*.odt") returned 5 [0102.006] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLACCT.DLL", pszSpec="*.vob") returned 0 [0102.006] lstrlenA (lpString="*.vob") returned 5 [0102.006] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLACCT.DLL", pszSpec="*.ifo") returned 0 [0102.006] lstrlenA (lpString="*.ifo") returned 5 [0102.006] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLACCT.DLL", pszSpec="*.lnk") returned 0 [0102.006] lstrlenA (lpString="*.lnk") returned 5 [0102.006] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLACCT.DLL", pszSpec="*.torrent") returned 0 [0102.006] lstrlenA (lpString="*.torrent") returned 9 [0102.006] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLACCT.DLL", pszSpec="*.mov") returned 0 [0102.006] lstrlenA (lpString="*.mov") returned 5 [0102.006] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLACCT.DLL", pszSpec="*.m2v") returned 0 [0102.006] lstrlenA (lpString="*.m2v") returned 5 [0102.006] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLACCT.DLL", pszSpec="*.3gp") returned 0 [0102.006] lstrlenA (lpString="*.3gp") returned 5 [0102.006] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLACCT.DLL", pszSpec="*.mpeg") returned 0 [0102.006] lstrlenA (lpString="*.mpeg") returned 6 [0102.006] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLACCT.DLL", pszSpec="*.mpg") returned 0 [0102.006] lstrlenA (lpString="*.mpg") returned 5 [0102.006] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLACCT.DLL", pszSpec="*.flv") returned 0 [0102.006] lstrlenA (lpString="*.flv") returned 5 [0102.006] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLACCT.DLL", pszSpec="*.avi") returned 0 [0102.006] lstrlenA (lpString="*.avi") returned 5 [0102.006] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLACCT.DLL", pszSpec="*.mp4") returned 0 [0102.006] lstrlenA (lpString="*.mp4") returned 5 [0102.006] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLACCT.DLL", pszSpec="*.wmv") returned 0 [0102.007] lstrlenA (lpString="*.wmv") returned 5 [0102.007] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLACCT.DLL", pszSpec="*.divx") returned 0 [0102.007] lstrlenA (lpString="*.divx") returned 6 [0102.007] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLACCT.DLL", pszSpec="*.mkv") returned 0 [0102.007] lstrlenA (lpString="*.mkv") returned 5 [0102.007] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLACCT.DLL", pszSpec="*.mp3") returned 0 [0102.007] lstrlenA (lpString="*.mp3") returned 5 [0102.007] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLACCT.DLL", pszSpec="*.wav") returned 0 [0102.007] lstrlenA (lpString="*.wav") returned 5 [0102.007] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLACCT.DLL", pszSpec="*.flac") returned 0 [0102.007] lstrlenA (lpString="*.flac") returned 6 [0102.007] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLACCT.DLL", pszSpec="*.ape") returned 0 [0102.007] lstrlenA (lpString="*.ape") returned 5 [0102.007] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLACCT.DLL", pszSpec="*.wma") returned 0 [0102.007] lstrlenA (lpString="*.wma") returned 5 [0102.007] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLACCT.DLL", pszSpec="*.ac3") returned 0 [0102.007] lstrlenA (lpString="*.ac3") returned 5 [0102.007] FindNextFileA (in: hFindFile=0x5b5bd0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0102.007] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0102.007] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="OUTLCTL.DLL") returned -1 [0102.007] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OUTLCTL.DLL") returned -1 [0102.007] lstrcmpiA (lpString1="", lpString2="OUTLCTL.DLL") returned -1 [0102.007] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OUTLACCT.DLL") returned="OUTLACCT.DLL" [0102.007] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="OUTLCTL.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OUTLCTL.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\OUTLCTL.DLL" [0102.007] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLCTL.DLL", pszSpec="*.zip") returned 0 [0102.007] lstrlenA (lpString="*.zip") returned 5 [0102.007] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLCTL.DLL", pszSpec="*.rar") returned 0 [0102.007] lstrlenA (lpString="*.rar") returned 5 [0102.007] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLCTL.DLL", pszSpec="*.7z") returned 0 [0102.007] lstrlenA (lpString="*.7z") returned 4 [0102.007] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLCTL.DLL", pszSpec="*.tar") returned 0 [0102.007] lstrlenA (lpString="*.tar") returned 5 [0102.007] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLCTL.DLL", pszSpec="*.gzip") returned 0 [0102.007] lstrlenA (lpString="*.gzip") returned 6 [0102.007] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLCTL.DLL", pszSpec="*.jpg") returned 0 [0102.007] lstrlenA (lpString="*.jpg") returned 5 [0102.007] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLCTL.DLL", pszSpec="*.jpeg") returned 0 [0102.007] lstrlenA (lpString="*.jpeg") returned 6 [0102.007] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLCTL.DLL", pszSpec="*.psd") returned 0 [0102.008] lstrlenA (lpString="*.psd") returned 5 [0102.008] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLCTL.DLL", pszSpec="*.cdr") returned 0 [0102.008] lstrlenA (lpString="*.cdr") returned 5 [0102.008] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLCTL.DLL", pszSpec="*.dwg") returned 0 [0102.008] lstrlenA (lpString="*.dwg") returned 5 [0102.008] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLCTL.DLL", pszSpec="*.max") returned 0 [0102.008] lstrlenA (lpString="*.max") returned 5 [0102.008] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLCTL.DLL", pszSpec="*.bmp") returned 0 [0102.008] lstrlenA (lpString="*.bmp") returned 5 [0102.008] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLCTL.DLL", pszSpec="*.gif") returned 0 [0102.008] lstrlenA (lpString="*.gif") returned 5 [0102.008] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLCTL.DLL", pszSpec="*.png") returned 0 [0102.008] lstrlenA (lpString="*.png") returned 5 [0102.008] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLCTL.DLL", pszSpec="*.doc") returned 0 [0102.008] lstrlenA (lpString="*.doc") returned 5 [0102.008] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLCTL.DLL", pszSpec="*.docx") returned 0 [0102.008] lstrlenA (lpString="*.docx") returned 6 [0102.008] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLCTL.DLL", pszSpec="*.xls") returned 0 [0102.008] lstrlenA (lpString="*.xls") returned 5 [0102.008] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLCTL.DLL", pszSpec="*.xlsx") returned 0 [0102.008] lstrlenA (lpString="*.xlsx") returned 6 [0102.008] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLCTL.DLL", pszSpec="*.ppt") returned 0 [0102.008] lstrlenA (lpString="*.ppt") returned 5 [0102.008] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLCTL.DLL", pszSpec="*.pptx") returned 0 [0102.008] lstrlenA (lpString="*.pptx") returned 6 [0102.008] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLCTL.DLL", pszSpec="*.txt") returned 0 [0102.008] lstrlenA (lpString="*.txt") returned 5 [0102.008] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLCTL.DLL", pszSpec="*.pdf") returned 0 [0102.008] lstrlenA (lpString="*.pdf") returned 5 [0102.008] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLCTL.DLL", pszSpec="*.djvu") returned 0 [0102.008] lstrlenA (lpString="*.djvu") returned 6 [0102.008] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLCTL.DLL", pszSpec="*.htm") returned 0 [0102.008] lstrlenA (lpString="*.htm") returned 5 [0102.008] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLCTL.DLL", pszSpec="*.html") returned 0 [0102.008] lstrlenA (lpString="*.html") returned 6 [0102.008] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLCTL.DLL", pszSpec="*.mdb") returned 0 [0102.008] lstrlenA (lpString="*.mdb") returned 5 [0102.008] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLCTL.DLL", pszSpec="*.cer") returned 0 [0102.008] lstrlenA (lpString="*.cer") returned 5 [0102.010] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLCTL.DLL", pszSpec="*.p12") returned 0 [0102.010] lstrlenA (lpString="*.p12") returned 5 [0102.010] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLCTL.DLL", pszSpec="*.pfx") returned 0 [0102.010] lstrlenA (lpString="*.pfx") returned 5 [0102.010] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLCTL.DLL", pszSpec="*.kwm") returned 0 [0102.010] lstrlenA (lpString="*.kwm") returned 5 [0102.010] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLCTL.DLL", pszSpec="*.pwm") returned 0 [0102.010] lstrlenA (lpString="*.pwm") returned 5 [0102.010] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLCTL.DLL", pszSpec="*.1cd") returned 0 [0102.010] lstrlenA (lpString="*.1cd") returned 5 [0102.010] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLCTL.DLL", pszSpec="*.md") returned 0 [0102.010] lstrlenA (lpString="*.md") returned 4 [0102.010] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLCTL.DLL", pszSpec="*.mdf") returned 0 [0102.010] lstrlenA (lpString="*.mdf") returned 5 [0102.010] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLCTL.DLL", pszSpec="*.dbf") returned 0 [0102.010] lstrlenA (lpString="*.dbf") returned 5 [0102.010] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLCTL.DLL", pszSpec="*.odt") returned 0 [0102.010] lstrlenA (lpString="*.odt") returned 5 [0102.010] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLCTL.DLL", pszSpec="*.vob") returned 0 [0102.010] lstrlenA (lpString="*.vob") returned 5 [0102.010] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLCTL.DLL", pszSpec="*.ifo") returned 0 [0102.010] lstrlenA (lpString="*.ifo") returned 5 [0102.010] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLCTL.DLL", pszSpec="*.lnk") returned 0 [0102.010] lstrlenA (lpString="*.lnk") returned 5 [0102.010] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLCTL.DLL", pszSpec="*.torrent") returned 0 [0102.010] lstrlenA (lpString="*.torrent") returned 9 [0102.010] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLCTL.DLL", pszSpec="*.mov") returned 0 [0102.010] lstrlenA (lpString="*.mov") returned 5 [0102.010] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLCTL.DLL", pszSpec="*.m2v") returned 0 [0102.010] lstrlenA (lpString="*.m2v") returned 5 [0102.010] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLCTL.DLL", pszSpec="*.3gp") returned 0 [0102.010] lstrlenA (lpString="*.3gp") returned 5 [0102.010] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLCTL.DLL", pszSpec="*.mpeg") returned 0 [0102.010] lstrlenA (lpString="*.mpeg") returned 6 [0102.011] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLCTL.DLL", pszSpec="*.mpg") returned 0 [0102.011] lstrlenA (lpString="*.mpg") returned 5 [0102.011] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLCTL.DLL", pszSpec="*.flv") returned 0 [0102.011] lstrlenA (lpString="*.flv") returned 5 [0102.011] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLCTL.DLL", pszSpec="*.avi") returned 0 [0102.011] lstrlenA (lpString="*.avi") returned 5 [0102.011] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLCTL.DLL", pszSpec="*.mp4") returned 0 [0102.011] lstrlenA (lpString="*.mp4") returned 5 [0102.011] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLCTL.DLL", pszSpec="*.wmv") returned 0 [0102.011] lstrlenA (lpString="*.wmv") returned 5 [0102.011] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLCTL.DLL", pszSpec="*.divx") returned 0 [0102.011] lstrlenA (lpString="*.divx") returned 6 [0102.011] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLCTL.DLL", pszSpec="*.mkv") returned 0 [0102.011] lstrlenA (lpString="*.mkv") returned 5 [0102.011] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLCTL.DLL", pszSpec="*.mp3") returned 0 [0102.011] lstrlenA (lpString="*.mp3") returned 5 [0102.011] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLCTL.DLL", pszSpec="*.wav") returned 0 [0102.011] lstrlenA (lpString="*.wav") returned 5 [0102.011] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLCTL.DLL", pszSpec="*.flac") returned 0 [0102.011] lstrlenA (lpString="*.flac") returned 6 [0102.011] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLCTL.DLL", pszSpec="*.ape") returned 0 [0102.011] lstrlenA (lpString="*.ape") returned 5 [0102.011] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLCTL.DLL", pszSpec="*.wma") returned 0 [0102.011] lstrlenA (lpString="*.wma") returned 5 [0102.011] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLCTL.DLL", pszSpec="*.ac3") returned 0 [0102.011] lstrlenA (lpString="*.ac3") returned 5 [0102.011] FindNextFileA (in: hFindFile=0x5b5bd0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0102.011] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0102.011] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="OUTLFLTR.DAT") returned -1 [0102.011] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OUTLFLTR.DAT") returned -1 [0102.011] lstrcmpiA (lpString1="", lpString2="OUTLFLTR.DAT") returned -1 [0102.011] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OUTLCTL.DLL") returned="OUTLCTL.DLL" [0102.011] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="OUTLFLTR.DAT" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OUTLFLTR.DAT") returned="C:\\Program Files\\Microsoft Office\\Office14\\OUTLFLTR.DAT" [0102.011] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLFLTR.DAT", pszSpec="*.zip") returned 0 [0102.011] lstrlenA (lpString="*.zip") returned 5 [0102.011] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLFLTR.DAT", pszSpec="*.rar") returned 0 [0102.011] lstrlenA (lpString="*.rar") returned 5 [0102.011] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLFLTR.DAT", pszSpec="*.7z") returned 0 [0102.011] lstrlenA (lpString="*.7z") returned 4 [0102.012] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLFLTR.DAT", pszSpec="*.tar") returned 0 [0102.012] lstrlenA (lpString="*.tar") returned 5 [0102.012] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLFLTR.DAT", pszSpec="*.gzip") returned 0 [0102.012] lstrlenA (lpString="*.gzip") returned 6 [0102.012] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLFLTR.DAT", pszSpec="*.jpg") returned 0 [0102.012] lstrlenA (lpString="*.jpg") returned 5 [0102.012] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLFLTR.DAT", pszSpec="*.jpeg") returned 0 [0102.012] lstrlenA (lpString="*.jpeg") returned 6 [0102.012] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLFLTR.DAT", pszSpec="*.psd") returned 0 [0102.012] lstrlenA (lpString="*.psd") returned 5 [0102.012] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLFLTR.DAT", pszSpec="*.cdr") returned 0 [0102.012] lstrlenA (lpString="*.cdr") returned 5 [0102.012] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLFLTR.DAT", pszSpec="*.dwg") returned 0 [0102.012] lstrlenA (lpString="*.dwg") returned 5 [0102.012] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLFLTR.DAT", pszSpec="*.max") returned 0 [0102.012] lstrlenA (lpString="*.max") returned 5 [0102.012] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLFLTR.DAT", pszSpec="*.bmp") returned 0 [0102.012] lstrlenA (lpString="*.bmp") returned 5 [0102.012] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLFLTR.DAT", pszSpec="*.gif") returned 0 [0102.012] lstrlenA (lpString="*.gif") returned 5 [0102.012] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLFLTR.DAT", pszSpec="*.png") returned 0 [0102.012] lstrlenA (lpString="*.png") returned 5 [0102.012] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLFLTR.DAT", pszSpec="*.doc") returned 0 [0102.012] lstrlenA (lpString="*.doc") returned 5 [0102.012] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLFLTR.DAT", pszSpec="*.docx") returned 0 [0102.012] lstrlenA (lpString="*.docx") returned 6 [0102.012] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLFLTR.DAT", pszSpec="*.xls") returned 0 [0102.012] lstrlenA (lpString="*.xls") returned 5 [0102.012] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLFLTR.DAT", pszSpec="*.xlsx") returned 0 [0102.012] lstrlenA (lpString="*.xlsx") returned 6 [0102.012] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLFLTR.DAT", pszSpec="*.ppt") returned 0 [0102.012] lstrlenA (lpString="*.ppt") returned 5 [0102.012] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLFLTR.DAT", pszSpec="*.pptx") returned 0 [0102.013] lstrlenA (lpString="*.pptx") returned 6 [0102.013] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLFLTR.DAT", pszSpec="*.txt") returned 0 [0102.013] lstrlenA (lpString="*.txt") returned 5 [0102.013] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLFLTR.DAT", pszSpec="*.pdf") returned 0 [0102.013] lstrlenA (lpString="*.pdf") returned 5 [0102.013] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLFLTR.DAT", pszSpec="*.djvu") returned 0 [0102.013] lstrlenA (lpString="*.djvu") returned 6 [0102.013] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLFLTR.DAT", pszSpec="*.htm") returned 0 [0102.013] lstrlenA (lpString="*.htm") returned 5 [0102.013] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLFLTR.DAT", pszSpec="*.html") returned 0 [0102.013] lstrlenA (lpString="*.html") returned 6 [0102.013] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLFLTR.DAT", pszSpec="*.mdb") returned 0 [0102.013] lstrlenA (lpString="*.mdb") returned 5 [0102.013] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLFLTR.DAT", pszSpec="*.cer") returned 0 [0102.013] lstrlenA (lpString="*.cer") returned 5 [0102.013] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLFLTR.DAT", pszSpec="*.p12") returned 0 [0102.013] lstrlenA (lpString="*.p12") returned 5 [0102.013] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLFLTR.DAT", pszSpec="*.pfx") returned 0 [0102.013] lstrlenA (lpString="*.pfx") returned 5 [0102.013] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLFLTR.DAT", pszSpec="*.kwm") returned 0 [0102.013] lstrlenA (lpString="*.kwm") returned 5 [0102.013] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLFLTR.DAT", pszSpec="*.pwm") returned 0 [0102.013] lstrlenA (lpString="*.pwm") returned 5 [0102.013] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLFLTR.DAT", pszSpec="*.1cd") returned 0 [0102.013] lstrlenA (lpString="*.1cd") returned 5 [0102.013] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLFLTR.DAT", pszSpec="*.md") returned 0 [0102.013] lstrlenA (lpString="*.md") returned 4 [0102.013] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLFLTR.DAT", pszSpec="*.mdf") returned 0 [0102.013] lstrlenA (lpString="*.mdf") returned 5 [0102.013] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLFLTR.DAT", pszSpec="*.dbf") returned 0 [0102.013] lstrlenA (lpString="*.dbf") returned 5 [0102.013] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLFLTR.DAT", pszSpec="*.odt") returned 0 [0102.013] lstrlenA (lpString="*.odt") returned 5 [0102.013] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLFLTR.DAT", pszSpec="*.vob") returned 0 [0102.013] lstrlenA (lpString="*.vob") returned 5 [0102.013] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLFLTR.DAT", pszSpec="*.ifo") returned 0 [0102.014] lstrlenA (lpString="*.ifo") returned 5 [0102.014] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLFLTR.DAT", pszSpec="*.lnk") returned 0 [0102.014] lstrlenA (lpString="*.lnk") returned 5 [0102.014] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLFLTR.DAT", pszSpec="*.torrent") returned 0 [0102.014] lstrlenA (lpString="*.torrent") returned 9 [0102.014] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLFLTR.DAT", pszSpec="*.mov") returned 0 [0102.014] lstrlenA (lpString="*.mov") returned 5 [0102.014] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLFLTR.DAT", pszSpec="*.m2v") returned 0 [0102.014] lstrlenA (lpString="*.m2v") returned 5 [0102.014] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLFLTR.DAT", pszSpec="*.3gp") returned 0 [0102.014] lstrlenA (lpString="*.3gp") returned 5 [0102.014] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLFLTR.DAT", pszSpec="*.mpeg") returned 0 [0102.014] lstrlenA (lpString="*.mpeg") returned 6 [0102.014] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLFLTR.DAT", pszSpec="*.mpg") returned 0 [0102.014] lstrlenA (lpString="*.mpg") returned 5 [0102.014] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLFLTR.DAT", pszSpec="*.flv") returned 0 [0102.014] lstrlenA (lpString="*.flv") returned 5 [0102.014] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLFLTR.DAT", pszSpec="*.avi") returned 0 [0102.014] lstrlenA (lpString="*.avi") returned 5 [0102.014] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLFLTR.DAT", pszSpec="*.mp4") returned 0 [0102.014] lstrlenA (lpString="*.mp4") returned 5 [0102.014] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLFLTR.DAT", pszSpec="*.wmv") returned 0 [0102.014] lstrlenA (lpString="*.wmv") returned 5 [0102.014] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLFLTR.DAT", pszSpec="*.divx") returned 0 [0102.014] lstrlenA (lpString="*.divx") returned 6 [0102.014] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLFLTR.DAT", pszSpec="*.mkv") returned 0 [0102.014] lstrlenA (lpString="*.mkv") returned 5 [0102.014] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLFLTR.DAT", pszSpec="*.mp3") returned 0 [0102.014] lstrlenA (lpString="*.mp3") returned 5 [0102.014] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLFLTR.DAT", pszSpec="*.wav") returned 0 [0102.014] lstrlenA (lpString="*.wav") returned 5 [0102.014] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLFLTR.DAT", pszSpec="*.flac") returned 0 [0102.014] lstrlenA (lpString="*.flac") returned 6 [0102.014] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLFLTR.DAT", pszSpec="*.ape") returned 0 [0102.014] lstrlenA (lpString="*.ape") returned 5 [0102.014] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLFLTR.DAT", pszSpec="*.wma") returned 0 [0102.014] lstrlenA (lpString="*.wma") returned 5 [0102.014] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLFLTR.DAT", pszSpec="*.ac3") returned 0 [0102.014] lstrlenA (lpString="*.ac3") returned 5 [0102.015] FindNextFileA (in: hFindFile=0x5b5bd0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0102.015] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0102.015] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="OUTLFLTR.DLL") returned -1 [0102.015] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OUTLFLTR.DLL") returned -1 [0102.015] lstrcmpiA (lpString1="", lpString2="OUTLFLTR.DLL") returned -1 [0102.015] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OUTLFLTR.DAT") returned="OUTLFLTR.DAT" [0102.015] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="OUTLFLTR.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OUTLFLTR.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\OUTLFLTR.DLL" [0102.015] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLFLTR.DLL", pszSpec="*.zip") returned 0 [0102.015] lstrlenA (lpString="*.zip") returned 5 [0102.015] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLFLTR.DLL", pszSpec="*.rar") returned 0 [0102.015] lstrlenA (lpString="*.rar") returned 5 [0102.015] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLFLTR.DLL", pszSpec="*.7z") returned 0 [0102.015] lstrlenA (lpString="*.7z") returned 4 [0102.015] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLFLTR.DLL", pszSpec="*.tar") returned 0 [0102.015] lstrlenA (lpString="*.tar") returned 5 [0102.015] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLFLTR.DLL", pszSpec="*.gzip") returned 0 [0102.015] lstrlenA (lpString="*.gzip") returned 6 [0102.015] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLFLTR.DLL", pszSpec="*.jpg") returned 0 [0102.015] lstrlenA (lpString="*.jpg") returned 5 [0102.015] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLFLTR.DLL", pszSpec="*.jpeg") returned 0 [0102.015] lstrlenA (lpString="*.jpeg") returned 6 [0102.015] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLFLTR.DLL", pszSpec="*.psd") returned 0 [0102.015] lstrlenA (lpString="*.psd") returned 5 [0102.015] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLFLTR.DLL", pszSpec="*.cdr") returned 0 [0102.015] lstrlenA (lpString="*.cdr") returned 5 [0102.015] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLFLTR.DLL", pszSpec="*.dwg") returned 0 [0102.015] lstrlenA (lpString="*.dwg") returned 5 [0102.015] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLFLTR.DLL", pszSpec="*.max") returned 0 [0102.015] lstrlenA (lpString="*.max") returned 5 [0102.015] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLFLTR.DLL", pszSpec="*.bmp") returned 0 [0102.015] lstrlenA (lpString="*.bmp") returned 5 [0102.015] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLFLTR.DLL", pszSpec="*.gif") returned 0 [0102.015] lstrlenA (lpString="*.gif") returned 5 [0102.015] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLFLTR.DLL", pszSpec="*.png") returned 0 [0102.015] lstrlenA (lpString="*.png") returned 5 [0102.015] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLFLTR.DLL", pszSpec="*.doc") returned 0 [0102.015] lstrlenA (lpString="*.doc") returned 5 [0102.015] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLFLTR.DLL", pszSpec="*.docx") returned 0 [0102.016] lstrlenA (lpString="*.docx") returned 6 [0102.016] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLFLTR.DLL", pszSpec="*.xls") returned 0 [0102.016] lstrlenA (lpString="*.xls") returned 5 [0102.016] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLFLTR.DLL", pszSpec="*.xlsx") returned 0 [0102.016] lstrlenA (lpString="*.xlsx") returned 6 [0102.016] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLFLTR.DLL", pszSpec="*.ppt") returned 0 [0102.016] lstrlenA (lpString="*.ppt") returned 5 [0102.016] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLFLTR.DLL", pszSpec="*.pptx") returned 0 [0102.016] lstrlenA (lpString="*.pptx") returned 6 [0102.016] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Office\\Office14\\OUTLFLTR.DLL", pszSpec="*.txt") returned 0 [0102.016] lstrlenA (lpString="*.txt") returned 5 [0102.016] FindNextFileA (in: hFindFile=0x5b5bd0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0102.016] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0102.016] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="OUTLMIME.DLL") returned -1 [0102.016] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OUTLMIME.DLL") returned -1 [0102.016] lstrcmpiA (lpString1="", lpString2="OUTLMIME.DLL") returned -1 [0102.016] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OUTLFLTR.DLL") returned="OUTLFLTR.DLL" [0102.016] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="OUTLMIME.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OUTLMIME.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\OUTLMIME.DLL" [0102.016] FindNextFileA (in: hFindFile=0x5b5bd0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0102.016] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0102.016] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="OUTLOOK.EXE") returned -1 [0102.016] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OUTLOOK.EXE") returned -1 [0102.016] lstrcmpiA (lpString1="", lpString2="OUTLOOK.EXE") returned -1 [0102.016] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OUTLMIME.DLL") returned="OUTLMIME.DLL" [0102.016] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="OUTLOOK.EXE" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OUTLOOK.EXE") returned="C:\\Program Files\\Microsoft Office\\Office14\\OUTLOOK.EXE" [0102.016] FindNextFileA (in: hFindFile=0x5b5bd0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0102.017] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0102.017] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="OUTLOOK.EXE.MANIFEST") returned -1 [0102.017] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OUTLOOK.EXE.MANIFEST") returned -1 [0102.017] lstrcmpiA (lpString1="", lpString2="OUTLOOK.EXE.MANIFEST") returned -1 [0102.017] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OUTLOOK.EXE") returned="OUTLOOK.EXE" [0102.017] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="OUTLOOK.EXE.MANIFEST" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OUTLOOK.EXE.MANIFEST") returned="C:\\Program Files\\Microsoft Office\\Office14\\OUTLOOK.EXE.MANIFEST" [0102.017] FindNextFileA (in: hFindFile=0x5b5bd0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0102.017] lstrcmpA (lpString1=".", lpString2="OutlookAutoDiscover") returned -1 [0102.017] lstrcmpA (lpString1="..", lpString2="OutlookAutoDiscover") returned -1 [0102.017] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OUTLOOK.EXE.MANIFEST") returned="OUTLOOK.EXE.MANIFEST" [0102.017] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="OutlookAutoDiscover" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover" [0102.017] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be160 [0102.018] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0102.018] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0102.024] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0102.024] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0102.024] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0102.024] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0102.024] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="AMERITECH.NET.XML") returned 1 [0102.024] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AMERITECH.NET.XML") returned 1 [0102.024] lstrcmpiA (lpString1="", lpString2="AMERITECH.NET.XML") returned -1 [0102.024] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\*.*") returned="*.*" [0102.024] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\", lpString2="AMERITECH.NET.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\AMERITECH.NET.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\AMERITECH.NET.XML" [0102.024] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0102.024] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0102.024] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BTINTERNET.NET.XML") returned 1 [0102.024] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BTINTERNET.NET.XML") returned 1 [0102.024] lstrcmpiA (lpString1="", lpString2="BTINTERNET.NET.XML") returned -1 [0102.024] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\AMERITECH.NET.XML") returned="AMERITECH.NET.XML" [0102.024] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\", lpString2="BTINTERNET.NET.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\BTINTERNET.NET.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\BTINTERNET.NET.XML" [0102.024] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0102.024] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0102.024] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BTOPENWORLD.COM.XML") returned 1 [0102.024] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BTOPENWORLD.COM.XML") returned 1 [0102.024] lstrcmpiA (lpString1="", lpString2="BTOPENWORLD.COM.XML") returned -1 [0102.025] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\BTINTERNET.NET.XML") returned="BTINTERNET.NET.XML" [0102.025] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\", lpString2="BTOPENWORLD.COM.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\BTOPENWORLD.COM.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\BTOPENWORLD.COM.XML" [0102.025] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0102.025] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0102.025] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="FLASH.NET.XML") returned -1 [0102.025] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FLASH.NET.XML") returned 1 [0102.025] lstrcmpiA (lpString1="", lpString2="FLASH.NET.XML") returned -1 [0102.025] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\BTOPENWORLD.COM.XML") returned="BTOPENWORLD.COM.XML" [0102.025] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\", lpString2="FLASH.NET.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\FLASH.NET.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\FLASH.NET.XML" [0102.025] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0102.025] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0102.025] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="NL.ROGERS.COM.XML") returned -1 [0102.025] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="NL.ROGERS.COM.XML") returned -1 [0102.025] lstrcmpiA (lpString1="", lpString2="NL.ROGERS.COM.XML") returned -1 [0102.025] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\FLASH.NET.XML") returned="FLASH.NET.XML" [0102.025] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\", lpString2="NL.ROGERS.COM.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\NL.ROGERS.COM.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\NL.ROGERS.COM.XML" [0102.025] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0102.025] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0102.025] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="NVBELL.NET.XML") returned -1 [0102.025] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="NVBELL.NET.XML") returned -1 [0102.025] lstrcmpiA (lpString1="", lpString2="NVBELL.NET.XML") returned -1 [0102.025] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\NL.ROGERS.COM.XML") returned="NL.ROGERS.COM.XML" [0102.025] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\", lpString2="NVBELL.NET.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\NVBELL.NET.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\NVBELL.NET.XML" [0102.025] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0102.025] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0102.026] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="PACBELL.NET.XML") returned -1 [0102.026] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PACBELL.NET.XML") returned -1 [0102.026] lstrcmpiA (lpString1="", lpString2="PACBELL.NET.XML") returned -1 [0102.026] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\NVBELL.NET.XML") returned="NVBELL.NET.XML" [0102.026] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\", lpString2="PACBELL.NET.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\PACBELL.NET.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\PACBELL.NET.XML" [0102.026] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0102.026] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0102.026] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="PRODIGY.NET.XML") returned -1 [0102.026] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PRODIGY.NET.XML") returned -1 [0102.026] lstrcmpiA (lpString1="", lpString2="PRODIGY.NET.XML") returned -1 [0102.026] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\PACBELL.NET.XML") returned="PACBELL.NET.XML" [0102.026] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\", lpString2="PRODIGY.NET.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\PRODIGY.NET.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\PRODIGY.NET.XML" [0102.026] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0102.026] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0102.026] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="ROGERS.COM.XML") returned -1 [0102.026] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ROGERS.COM.XML") returned -1 [0102.026] lstrcmpiA (lpString1="", lpString2="ROGERS.COM.XML") returned -1 [0102.026] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\PRODIGY.NET.XML") returned="PRODIGY.NET.XML" [0102.026] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\", lpString2="ROGERS.COM.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\ROGERS.COM.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\ROGERS.COM.XML" [0102.026] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0102.026] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0102.026] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="SBCGLOBAL.NET.XML") returned -1 [0102.026] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SBCGLOBAL.NET.XML") returned -1 [0102.026] lstrcmpiA (lpString1="", lpString2="SBCGLOBAL.NET.XML") returned -1 [0102.026] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\ROGERS.COM.XML") returned="ROGERS.COM.XML" [0102.026] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\", lpString2="SBCGLOBAL.NET.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\SBCGLOBAL.NET.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\SBCGLOBAL.NET.XML" [0102.027] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0102.027] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0102.027] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="SNET.NET.XML") returned -1 [0102.027] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SNET.NET.XML") returned -1 [0102.027] lstrcmpiA (lpString1="", lpString2="SNET.NET.XML") returned -1 [0102.027] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\SBCGLOBAL.NET.XML") returned="SBCGLOBAL.NET.XML" [0102.027] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\", lpString2="SNET.NET.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\SNET.NET.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\SNET.NET.XML" [0102.027] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0102.027] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0102.027] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="SWBELL.NET.XML") returned -1 [0102.027] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SWBELL.NET.XML") returned -1 [0102.027] lstrcmpiA (lpString1="", lpString2="SWBELL.NET.XML") returned -1 [0102.027] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\SNET.NET.XML") returned="SNET.NET.XML" [0102.027] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\", lpString2="SWBELL.NET.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\SWBELL.NET.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\SWBELL.NET.XML" [0102.027] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0102.027] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0102.027] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="TALK21.COM.XML") returned -1 [0102.027] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="TALK21.COM.XML") returned -1 [0102.027] lstrcmpiA (lpString1="", lpString2="TALK21.COM.XML") returned -1 [0102.027] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\SWBELL.NET.XML") returned="SWBELL.NET.XML" [0102.027] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\", lpString2="TALK21.COM.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\TALK21.COM.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\TALK21.COM.XML" [0102.027] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0102.027] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0102.027] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="WANS.NET.XML") returned -1 [0102.027] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WANS.NET.XML") returned -1 [0102.027] lstrcmpiA (lpString1="", lpString2="WANS.NET.XML") returned -1 [0102.027] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\TALK21.COM.XML") returned="TALK21.COM.XML" [0102.027] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\", lpString2="WANS.NET.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\WANS.NET.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\WANS.NET.XML" [0102.028] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0102.028] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0102.028] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="YAHOO.CA.XML") returned -1 [0102.028] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="YAHOO.CA.XML") returned -1 [0102.028] lstrcmpiA (lpString1="", lpString2="YAHOO.CA.XML") returned -1 [0102.028] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\WANS.NET.XML") returned="WANS.NET.XML" [0102.028] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\", lpString2="YAHOO.CA.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.CA.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.CA.XML" [0102.028] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0102.028] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0102.028] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="YAHOO.CO.ID.XML") returned -1 [0102.028] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="YAHOO.CO.ID.XML") returned -1 [0102.028] lstrcmpiA (lpString1="", lpString2="YAHOO.CO.ID.XML") returned -1 [0102.028] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.CA.XML") returned="YAHOO.CA.XML" [0102.028] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\", lpString2="YAHOO.CO.ID.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.CO.ID.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.CO.ID.XML" [0102.028] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0102.028] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0102.028] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="YAHOO.CO.IN.XML") returned -1 [0102.028] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="YAHOO.CO.IN.XML") returned -1 [0102.028] lstrcmpiA (lpString1="", lpString2="YAHOO.CO.IN.XML") returned -1 [0102.028] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.CO.ID.XML") returned="YAHOO.CO.ID.XML" [0102.028] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\", lpString2="YAHOO.CO.IN.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.CO.IN.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.CO.IN.XML" [0102.028] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0102.028] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0102.028] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="YAHOO.CO.JP.XML") returned -1 [0102.028] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="YAHOO.CO.JP.XML") returned -1 [0102.028] lstrcmpiA (lpString1="", lpString2="YAHOO.CO.JP.XML") returned -1 [0102.028] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.CO.IN.XML") returned="YAHOO.CO.IN.XML" [0102.028] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\", lpString2="YAHOO.CO.JP.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.CO.JP.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.CO.JP.XML" [0102.030] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0102.030] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0102.030] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="YAHOO.CO.KR.XML") returned -1 [0102.030] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="YAHOO.CO.KR.XML") returned -1 [0102.030] lstrcmpiA (lpString1="", lpString2="YAHOO.CO.KR.XML") returned -1 [0102.030] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.CO.JP.XML") returned="YAHOO.CO.JP.XML" [0102.030] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\", lpString2="YAHOO.CO.KR.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.CO.KR.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.CO.KR.XML" [0102.030] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0102.030] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0102.031] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="YAHOO.CO.NZ.XML") returned -1 [0102.031] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="YAHOO.CO.NZ.XML") returned -1 [0102.031] lstrcmpiA (lpString1="", lpString2="YAHOO.CO.NZ.XML") returned -1 [0102.031] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.CO.KR.XML") returned="YAHOO.CO.KR.XML" [0102.031] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\", lpString2="YAHOO.CO.NZ.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.CO.NZ.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.CO.NZ.XML" [0102.031] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0102.031] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0102.031] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="YAHOO.CO.TH.XML") returned -1 [0102.031] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="YAHOO.CO.TH.XML") returned -1 [0102.031] lstrcmpiA (lpString1="", lpString2="YAHOO.CO.TH.XML") returned -1 [0102.031] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.CO.NZ.XML") returned="YAHOO.CO.NZ.XML" [0102.031] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\", lpString2="YAHOO.CO.TH.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.CO.TH.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.CO.TH.XML" [0102.031] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0102.031] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0102.031] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="YAHOO.CO.UK.XML") returned -1 [0102.031] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="YAHOO.CO.UK.XML") returned -1 [0102.031] lstrcmpiA (lpString1="", lpString2="YAHOO.CO.UK.XML") returned -1 [0102.031] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.CO.TH.XML") returned="YAHOO.CO.TH.XML" [0102.031] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\", lpString2="YAHOO.CO.UK.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.CO.UK.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.CO.UK.XML" [0102.032] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0102.032] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0102.032] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="YAHOO.COM.AR.XML") returned -1 [0102.032] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="YAHOO.COM.AR.XML") returned -1 [0102.032] lstrcmpiA (lpString1="", lpString2="YAHOO.COM.AR.XML") returned -1 [0102.032] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.CO.UK.XML") returned="YAHOO.CO.UK.XML" [0102.032] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\", lpString2="YAHOO.COM.AR.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.AR.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.AR.XML" [0102.032] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0102.032] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0102.032] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="YAHOO.COM.AU.XML") returned -1 [0102.032] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="YAHOO.COM.AU.XML") returned -1 [0102.032] lstrcmpiA (lpString1="", lpString2="YAHOO.COM.AU.XML") returned -1 [0102.032] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.AR.XML") returned="YAHOO.COM.AR.XML" [0102.032] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\", lpString2="YAHOO.COM.AU.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.AU.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.AU.XML" [0102.032] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0102.032] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0102.032] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="YAHOO.COM.BR.XML") returned -1 [0102.032] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="YAHOO.COM.BR.XML") returned -1 [0102.032] lstrcmpiA (lpString1="", lpString2="YAHOO.COM.BR.XML") returned -1 [0102.032] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.AU.XML") returned="YAHOO.COM.AU.XML" [0102.032] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\", lpString2="YAHOO.COM.BR.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.BR.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.BR.XML" [0102.032] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0102.032] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0102.032] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="YAHOO.COM.CN.XML") returned -1 [0102.032] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="YAHOO.COM.CN.XML") returned -1 [0102.032] lstrcmpiA (lpString1="", lpString2="YAHOO.COM.CN.XML") returned -1 [0102.033] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.BR.XML") returned="YAHOO.COM.BR.XML" [0102.033] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\", lpString2="YAHOO.COM.CN.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.CN.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.CN.XML" [0102.033] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0102.033] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0102.033] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="YAHOO.COM.HK.XML") returned -1 [0102.033] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="YAHOO.COM.HK.XML") returned -1 [0102.033] lstrcmpiA (lpString1="", lpString2="YAHOO.COM.HK.XML") returned -1 [0102.033] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.CN.XML") returned="YAHOO.COM.CN.XML" [0102.033] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\", lpString2="YAHOO.COM.HK.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.HK.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.HK.XML" [0102.033] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0102.033] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0102.033] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="YAHOO.COM.MX.XML") returned -1 [0102.033] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="YAHOO.COM.MX.XML") returned -1 [0102.033] lstrcmpiA (lpString1="", lpString2="YAHOO.COM.MX.XML") returned -1 [0102.033] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.HK.XML") returned="YAHOO.COM.HK.XML" [0102.033] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\", lpString2="YAHOO.COM.MX.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.MX.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.MX.XML" [0102.033] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0102.033] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0102.033] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="YAHOO.COM.MY.XML") returned -1 [0102.033] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="YAHOO.COM.MY.XML") returned -1 [0102.033] lstrcmpiA (lpString1="", lpString2="YAHOO.COM.MY.XML") returned -1 [0102.033] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.MX.XML") returned="YAHOO.COM.MX.XML" [0102.033] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\", lpString2="YAHOO.COM.MY.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.MY.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.MY.XML" [0102.033] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0102.033] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0102.033] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="YAHOO.COM.PH.XML") returned -1 [0102.034] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="YAHOO.COM.PH.XML") returned -1 [0102.034] lstrcmpiA (lpString1="", lpString2="YAHOO.COM.PH.XML") returned -1 [0102.034] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.MY.XML") returned="YAHOO.COM.MY.XML" [0102.034] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\", lpString2="YAHOO.COM.PH.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.PH.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.PH.XML" [0102.034] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0102.034] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0102.034] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="YAHOO.COM.SG.XML") returned -1 [0102.034] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="YAHOO.COM.SG.XML") returned -1 [0102.034] lstrcmpiA (lpString1="", lpString2="YAHOO.COM.SG.XML") returned -1 [0102.034] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.PH.XML") returned="YAHOO.COM.PH.XML" [0102.034] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\", lpString2="YAHOO.COM.SG.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.SG.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.SG.XML" [0102.034] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0102.034] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0102.034] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="YAHOO.COM.TW.XML") returned -1 [0102.034] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="YAHOO.COM.TW.XML") returned -1 [0102.034] lstrcmpiA (lpString1="", lpString2="YAHOO.COM.TW.XML") returned -1 [0102.034] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.SG.XML") returned="YAHOO.COM.SG.XML" [0102.034] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\", lpString2="YAHOO.COM.TW.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.TW.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.TW.XML" [0102.034] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0102.034] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0102.034] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="YAHOO.COM.VN.XML") returned -1 [0102.034] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="YAHOO.COM.VN.XML") returned -1 [0102.034] lstrcmpiA (lpString1="", lpString2="YAHOO.COM.VN.XML") returned -1 [0102.034] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.TW.XML") returned="YAHOO.COM.TW.XML" [0102.034] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\", lpString2="YAHOO.COM.VN.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.VN.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.VN.XML" [0102.035] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0102.035] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0102.035] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="YAHOO.COM.XML") returned -1 [0102.035] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="YAHOO.COM.XML") returned -1 [0102.035] lstrcmpiA (lpString1="", lpString2="YAHOO.COM.XML") returned -1 [0102.035] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.VN.XML") returned="YAHOO.COM.VN.XML" [0102.035] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\", lpString2="YAHOO.COM.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.XML" [0102.035] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0102.035] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0102.035] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="YAHOO.DE.XML") returned -1 [0102.035] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="YAHOO.DE.XML") returned -1 [0102.035] lstrcmpiA (lpString1="", lpString2="YAHOO.DE.XML") returned -1 [0102.035] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.XML") returned="YAHOO.COM.XML" [0102.035] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\", lpString2="YAHOO.DE.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.DE.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.DE.XML" [0102.035] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0102.035] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0102.035] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="YAHOO.ES.XML") returned -1 [0102.035] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="YAHOO.ES.XML") returned -1 [0102.035] lstrcmpiA (lpString1="", lpString2="YAHOO.ES.XML") returned -1 [0102.035] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.DE.XML") returned="YAHOO.DE.XML" [0102.035] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\", lpString2="YAHOO.ES.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.ES.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.ES.XML" [0102.038] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0102.038] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0102.038] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="YAHOO.FR.XML") returned -1 [0102.038] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="YAHOO.FR.XML") returned -1 [0102.038] lstrcmpiA (lpString1="", lpString2="YAHOO.FR.XML") returned -1 [0102.038] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.ES.XML") returned="YAHOO.ES.XML" [0102.038] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\", lpString2="YAHOO.FR.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.FR.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.FR.XML" [0102.038] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0102.038] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0102.038] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="YAHOO.HK.XML") returned -1 [0102.038] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="YAHOO.HK.XML") returned -1 [0102.038] lstrcmpiA (lpString1="", lpString2="YAHOO.HK.XML") returned -1 [0102.038] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.FR.XML") returned="YAHOO.FR.XML" [0102.038] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\", lpString2="YAHOO.HK.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.HK.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.HK.XML" [0102.038] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0102.038] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0102.039] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="YAHOO.IE.XML") returned -1 [0102.039] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="YAHOO.IE.XML") returned -1 [0102.039] lstrcmpiA (lpString1="", lpString2="YAHOO.IE.XML") returned -1 [0102.039] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.HK.XML") returned="YAHOO.HK.XML" [0102.039] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\", lpString2="YAHOO.IE.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.IE.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.IE.XML" [0102.039] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0102.039] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0102.039] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="YAHOO.IT.XML") returned -1 [0102.039] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="YAHOO.IT.XML") returned -1 [0102.039] lstrcmpiA (lpString1="", lpString2="YAHOO.IT.XML") returned -1 [0102.039] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.IE.XML") returned="YAHOO.IE.XML" [0102.039] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\", lpString2="YAHOO.IT.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.IT.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.IT.XML" [0102.039] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0102.039] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0102.039] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="YAHOO.JP.XML") returned -1 [0102.039] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="YAHOO.JP.XML") returned -1 [0102.039] lstrcmpiA (lpString1="", lpString2="YAHOO.JP.XML") returned -1 [0102.039] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.IT.XML") returned="YAHOO.IT.XML" [0102.039] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\", lpString2="YAHOO.JP.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.JP.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.JP.XML" [0102.039] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0102.039] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0102.039] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="YAHOO.NO.XML") returned -1 [0102.039] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="YAHOO.NO.XML") returned -1 [0102.039] lstrcmpiA (lpString1="", lpString2="YAHOO.NO.XML") returned -1 [0102.039] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.JP.XML") returned="YAHOO.JP.XML" [0102.039] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\", lpString2="YAHOO.NO.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.NO.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.NO.XML" [0102.039] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0102.040] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0102.040] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="YAHOO.PL.XML") returned -1 [0102.040] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="YAHOO.PL.XML") returned -1 [0102.040] lstrcmpiA (lpString1="", lpString2="YAHOO.PL.XML") returned -1 [0102.040] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.NO.XML") returned="YAHOO.NO.XML" [0102.040] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\", lpString2="YAHOO.PL.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.PL.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.PL.XML" [0102.040] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0102.040] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0102.040] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="YAHOO.SE.XML") returned -1 [0102.040] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="YAHOO.SE.XML") returned -1 [0102.040] lstrcmpiA (lpString1="", lpString2="YAHOO.SE.XML") returned -1 [0102.040] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.PL.XML") returned="YAHOO.PL.XML" [0102.040] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\", lpString2="YAHOO.SE.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.SE.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.SE.XML" [0102.040] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0 [0102.040] FindClose (in: hFindFile=0x5be160 | out: hFindFile=0x5be160) returned 1 [0102.041] FindNextFileA (in: hFindFile=0x5b5bd0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0102.041] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0102.041] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="OUTLPH.DLL") returned -1 [0102.041] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OUTLPH.DLL") returned -1 [0102.041] lstrcmpiA (lpString1="", lpString2="OUTLPH.DLL") returned -1 [0102.041] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\*.*") returned="*.*" [0102.041] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="OUTLPH.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OUTLPH.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\OUTLPH.DLL" [0102.041] FindNextFileA (in: hFindFile=0x5b5bd0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0102.041] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0102.041] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="OUTLRPC.DLL") returned -1 [0102.041] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OUTLRPC.DLL") returned -1 [0102.041] lstrcmpiA (lpString1="", lpString2="OUTLRPC.DLL") returned -1 [0102.041] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OUTLPH.DLL") returned="OUTLPH.DLL" [0102.041] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="OUTLRPC.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OUTLRPC.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\OUTLRPC.DLL" [0102.041] FindNextFileA (in: hFindFile=0x5b5bd0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0102.041] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0102.041] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="OUTLVBS.DLL") returned -1 [0102.041] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OUTLVBS.DLL") returned -1 [0102.041] lstrcmpiA (lpString1="", lpString2="OUTLVBS.DLL") returned -1 [0102.042] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OUTLRPC.DLL") returned="OUTLRPC.DLL" [0102.042] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="OUTLVBS.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\OUTLVBS.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\OUTLVBS.DLL" [0102.042] FindNextFileA (in: hFindFile=0x5b5bd0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0102.042] lstrcmpA (lpString1=".", lpString2="PAGESIZE") returned -1 [0102.042] lstrcmpA (lpString1="..", lpString2="PAGESIZE") returned -1 [0102.042] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\OUTLVBS.DLL") returned="OUTLVBS.DLL" [0102.042] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="PAGESIZE" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE" [0102.042] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be160 [0102.063] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0102.063] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0102.063] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0102.064] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0102.064] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0102.064] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0102.064] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="PGLBL001.XML") returned -1 [0102.064] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PGLBL001.XML") returned -1 [0102.064] lstrcmpiA (lpString1="", lpString2="PGLBL001.XML") returned -1 [0102.064] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\*.*") returned="*.*" [0102.064] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\", lpString2="PGLBL001.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL001.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL001.XML" [0102.064] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0102.064] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0102.064] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="PGLBL002.XML") returned -1 [0102.064] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PGLBL002.XML") returned -1 [0102.064] lstrcmpiA (lpString1="", lpString2="PGLBL002.XML") returned -1 [0102.064] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL001.XML") returned="PGLBL001.XML" [0102.064] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\", lpString2="PGLBL002.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL002.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL002.XML" [0102.064] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0102.064] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0102.064] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="PGLBL010.XML") returned -1 [0102.064] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PGLBL010.XML") returned -1 [0102.064] lstrcmpiA (lpString1="", lpString2="PGLBL010.XML") returned -1 [0102.064] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL002.XML") returned="PGLBL002.XML" [0102.064] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\", lpString2="PGLBL010.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL010.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL010.XML" [0102.064] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0102.064] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0102.064] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="PGLBL011.XML") returned -1 [0102.064] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PGLBL011.XML") returned -1 [0102.064] lstrcmpiA (lpString1="", lpString2="PGLBL011.XML") returned -1 [0102.064] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL010.XML") returned="PGLBL010.XML" [0102.064] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\", lpString2="PGLBL011.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL011.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL011.XML" [0102.064] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0102.064] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0102.064] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="PGLBL012.XML") returned -1 [0102.064] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PGLBL012.XML") returned -1 [0102.064] lstrcmpiA (lpString1="", lpString2="PGLBL012.XML") returned -1 [0102.064] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL011.XML") returned="PGLBL011.XML" [0102.064] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\", lpString2="PGLBL012.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL012.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL012.XML" [0102.064] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0102.064] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0102.065] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="PGLBL016.XML") returned -1 [0102.065] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PGLBL016.XML") returned -1 [0102.065] lstrcmpiA (lpString1="", lpString2="PGLBL016.XML") returned -1 [0102.065] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL012.XML") returned="PGLBL012.XML" [0102.065] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\", lpString2="PGLBL016.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL016.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL016.XML" [0102.065] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0102.065] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0102.065] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="PGLBL020.XML") returned -1 [0102.065] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PGLBL020.XML") returned -1 [0102.065] lstrcmpiA (lpString1="", lpString2="PGLBL020.XML") returned -1 [0102.065] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL016.XML") returned="PGLBL016.XML" [0102.065] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\", lpString2="PGLBL020.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL020.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL020.XML" [0102.065] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0102.065] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0102.065] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="PGLBL022.XML") returned -1 [0102.065] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PGLBL022.XML") returned -1 [0102.065] lstrcmpiA (lpString1="", lpString2="PGLBL022.XML") returned -1 [0102.065] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL020.XML") returned="PGLBL020.XML" [0102.065] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\", lpString2="PGLBL022.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL022.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL022.XML" [0102.065] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0102.065] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0102.065] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="PGLBL026.XML") returned -1 [0102.065] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PGLBL026.XML") returned -1 [0102.065] lstrcmpiA (lpString1="", lpString2="PGLBL026.XML") returned -1 [0102.065] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL022.XML") returned="PGLBL022.XML" [0102.065] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\", lpString2="PGLBL026.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL026.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL026.XML" [0102.065] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0102.065] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0102.065] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="PGLBL027.XML") returned -1 [0102.065] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PGLBL027.XML") returned -1 [0102.065] lstrcmpiA (lpString1="", lpString2="PGLBL027.XML") returned -1 [0102.065] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL026.XML") returned="PGLBL026.XML" [0102.065] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\", lpString2="PGLBL027.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL027.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL027.XML" [0102.065] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0102.065] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0102.065] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="PGLBL044.XML") returned -1 [0102.065] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PGLBL044.XML") returned -1 [0102.065] lstrcmpiA (lpString1="", lpString2="PGLBL044.XML") returned -1 [0102.065] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL027.XML") returned="PGLBL027.XML" [0102.066] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\", lpString2="PGLBL044.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL044.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL044.XML" [0102.066] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0102.066] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0102.066] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="PGLBL048.XML") returned -1 [0102.066] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PGLBL048.XML") returned -1 [0102.066] lstrcmpiA (lpString1="", lpString2="PGLBL048.XML") returned -1 [0102.066] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL044.XML") returned="PGLBL044.XML" [0102.066] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\", lpString2="PGLBL048.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL048.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL048.XML" [0102.066] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0102.066] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0102.066] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="PGLBL054.XML") returned -1 [0102.066] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PGLBL054.XML") returned -1 [0102.066] lstrcmpiA (lpString1="", lpString2="PGLBL054.XML") returned -1 [0102.066] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL048.XML") returned="PGLBL048.XML" [0102.066] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\", lpString2="PGLBL054.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL054.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL054.XML" [0102.066] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0102.066] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0102.066] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="PGLBL058.XML") returned -1 [0102.066] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PGLBL058.XML") returned -1 [0102.066] lstrcmpiA (lpString1="", lpString2="PGLBL058.XML") returned -1 [0102.066] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL054.XML") returned="PGLBL054.XML" [0102.066] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\", lpString2="PGLBL058.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL058.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL058.XML" [0102.066] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0102.066] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0102.066] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="PGLBL065.XML") returned -1 [0102.066] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PGLBL065.XML") returned -1 [0102.066] lstrcmpiA (lpString1="", lpString2="PGLBL065.XML") returned -1 [0102.066] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL058.XML") returned="PGLBL058.XML" [0102.066] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\", lpString2="PGLBL065.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL065.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL065.XML" [0102.066] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0102.066] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0102.066] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="PGLBL075.XML") returned -1 [0102.066] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PGLBL075.XML") returned -1 [0102.066] lstrcmpiA (lpString1="", lpString2="PGLBL075.XML") returned -1 [0102.066] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL065.XML") returned="PGLBL065.XML" [0102.066] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\", lpString2="PGLBL075.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL075.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL075.XML" [0102.067] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0102.068] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0102.068] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="PGLBL077.XML") returned -1 [0102.068] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PGLBL077.XML") returned -1 [0102.068] lstrcmpiA (lpString1="", lpString2="PGLBL077.XML") returned -1 [0102.068] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL075.XML") returned="PGLBL075.XML" [0102.068] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\", lpString2="PGLBL077.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL077.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL077.XML" [0102.068] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0102.068] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0102.068] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="PGLBL078.XML") returned -1 [0102.068] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PGLBL078.XML") returned -1 [0102.068] lstrcmpiA (lpString1="", lpString2="PGLBL078.XML") returned -1 [0102.068] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL077.XML") returned="PGLBL077.XML" [0102.068] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\", lpString2="PGLBL078.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL078.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL078.XML" [0102.068] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0102.068] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0102.068] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="PGLBL081.XML") returned -1 [0102.068] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PGLBL081.XML") returned -1 [0102.068] lstrcmpiA (lpString1="", lpString2="PGLBL081.XML") returned -1 [0102.068] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL078.XML") returned="PGLBL078.XML" [0102.068] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\", lpString2="PGLBL081.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL081.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL081.XML" [0102.068] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0102.068] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0102.068] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="PGLBL082.XML") returned -1 [0102.068] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PGLBL082.XML") returned -1 [0102.068] lstrcmpiA (lpString1="", lpString2="PGLBL082.XML") returned -1 [0102.068] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL081.XML") returned="PGLBL081.XML" [0102.068] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\", lpString2="PGLBL082.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL082.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL082.XML" [0102.068] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0102.068] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0102.068] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="PGLBL083.XML") returned -1 [0102.068] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PGLBL083.XML") returned -1 [0102.068] lstrcmpiA (lpString1="", lpString2="PGLBL083.XML") returned -1 [0102.068] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL082.XML") returned="PGLBL082.XML" [0102.068] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\", lpString2="PGLBL083.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL083.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL083.XML" [0102.068] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0102.068] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0102.068] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="PGLBL086.XML") returned -1 [0102.068] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PGLBL086.XML") returned -1 [0102.068] lstrcmpiA (lpString1="", lpString2="PGLBL086.XML") returned -1 [0102.068] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL083.XML") returned="PGLBL083.XML" [0102.069] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\", lpString2="PGLBL086.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL086.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL086.XML" [0102.069] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0102.069] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0102.069] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="PGLBL087.XML") returned -1 [0102.069] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PGLBL087.XML") returned -1 [0102.069] lstrcmpiA (lpString1="", lpString2="PGLBL087.XML") returned -1 [0102.069] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL086.XML") returned="PGLBL086.XML" [0102.069] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\", lpString2="PGLBL087.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL087.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL087.XML" [0102.069] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0102.069] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0102.069] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="PGLBL089.XML") returned -1 [0102.069] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PGLBL089.XML") returned -1 [0102.069] lstrcmpiA (lpString1="", lpString2="PGLBL089.XML") returned -1 [0102.069] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL087.XML") returned="PGLBL087.XML" [0102.069] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\", lpString2="PGLBL089.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL089.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL089.XML" [0102.069] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0102.069] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0102.069] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="PGLBL090.XML") returned -1 [0102.069] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PGLBL090.XML") returned -1 [0102.069] lstrcmpiA (lpString1="", lpString2="PGLBL090.XML") returned -1 [0102.069] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL089.XML") returned="PGLBL089.XML" [0102.069] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\", lpString2="PGLBL090.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL090.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL090.XML" [0102.069] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0102.069] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0102.069] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="PGLBL092.XML") returned -1 [0102.069] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PGLBL092.XML") returned -1 [0102.069] lstrcmpiA (lpString1="", lpString2="PGLBL092.XML") returned -1 [0102.069] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL090.XML") returned="PGLBL090.XML" [0102.069] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\", lpString2="PGLBL092.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL092.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL092.XML" [0102.069] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0102.069] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0102.069] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="PGLBL093.XML") returned -1 [0102.069] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PGLBL093.XML") returned -1 [0102.069] lstrcmpiA (lpString1="", lpString2="PGLBL093.XML") returned -1 [0102.069] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL092.XML") returned="PGLBL092.XML" [0102.069] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\", lpString2="PGLBL093.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL093.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL093.XML" [0102.069] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0102.069] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0102.070] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="PGLBL095.XML") returned -1 [0102.070] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PGLBL095.XML") returned -1 [0102.070] lstrcmpiA (lpString1="", lpString2="PGLBL095.XML") returned -1 [0102.070] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL093.XML") returned="PGLBL093.XML" [0102.070] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\", lpString2="PGLBL095.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL095.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL095.XML" [0102.070] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0102.070] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0102.070] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL095.XML") returned="PGLBL095.XML" [0102.070] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\", lpString2="PGLBL096.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL096.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL096.XML" [0102.070] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0102.070] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0102.070] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL096.XML") returned="PGLBL096.XML" [0102.070] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\", lpString2="PGLBL097.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL097.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL097.XML" [0102.070] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0102.070] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0102.070] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL097.XML") returned="PGLBL097.XML" [0102.070] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\", lpString2="PGLBL102.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL102.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL102.XML" [0102.070] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0102.070] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0102.070] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL102.XML") returned="PGLBL102.XML" [0102.070] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\", lpString2="PGLBL103.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL103.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL103.XML" [0102.070] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0102.070] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0102.070] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL103.XML") returned="PGLBL103.XML" [0102.070] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\", lpString2="PGLBL104.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL104.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL104.XML" [0102.070] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0102.075] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0102.075] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL104.XML") returned="PGLBL104.XML" [0102.075] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\", lpString2="PGLBL105.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL105.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL105.XML" [0102.075] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0102.075] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0102.075] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL105.XML") returned="PGLBL105.XML" [0102.075] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\", lpString2="PGLBL106.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL106.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL106.XML" [0102.075] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0102.075] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0102.075] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL106.XML") returned="PGLBL106.XML" [0102.075] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\", lpString2="PGLBL107.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL107.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL107.XML" [0102.075] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0102.075] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0102.075] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL107.XML") returned="PGLBL107.XML" [0102.075] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\", lpString2="PGLBL108.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL108.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL108.XML" [0102.075] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0102.075] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0102.075] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL108.XML") returned="PGLBL108.XML" [0102.076] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\", lpString2="PGLBL109.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL109.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL109.XML" [0102.076] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0102.076] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0102.076] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL109.XML") returned="PGLBL109.XML" [0102.076] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\", lpString2="PGLBL110.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL110.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL110.XML" [0102.076] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0102.076] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0102.076] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL110.XML") returned="PGLBL110.XML" [0102.076] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\", lpString2="PGLBL111.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL111.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL111.XML" [0102.077] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0102.077] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0102.077] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL111.XML") returned="PGLBL111.XML" [0102.077] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\", lpString2="PGMN001.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN001.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN001.XML" [0102.077] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0102.077] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0102.077] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN001.XML") returned="PGMN001.XML" [0102.077] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\", lpString2="PGMN002.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN002.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN002.XML" [0102.077] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0102.077] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0102.077] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN002.XML") returned="PGMN002.XML" [0102.077] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\", lpString2="PGMN010.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN010.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN010.XML" [0102.077] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0102.077] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0102.077] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN010.XML") returned="PGMN010.XML" [0102.077] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\", lpString2="PGMN011.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN011.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN011.XML" [0102.077] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0102.077] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0102.077] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN011.XML") returned="PGMN011.XML" [0102.077] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\", lpString2="PGMN020.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN020.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN020.XML" [0102.077] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0102.077] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN020.XML") returned="PGMN020.XML" [0102.077] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\", lpString2="PGMN022.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN022.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN022.XML" [0102.077] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0102.077] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN022.XML") returned="PGMN022.XML" [0102.077] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\", lpString2="PGMN026.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN026.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN026.XML" [0102.077] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0102.077] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN026.XML") returned="PGMN026.XML" [0102.078] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\", lpString2="PGMN027.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN027.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN027.XML" [0102.078] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0102.078] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN027.XML") returned="PGMN027.XML" [0102.078] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\", lpString2="PGMN044.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN044.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN044.XML" [0102.078] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0102.078] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN044.XML") returned="PGMN044.XML" [0102.078] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\", lpString2="PGMN048.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN048.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN048.XML" [0102.078] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0102.078] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN048.XML") returned="PGMN048.XML" [0102.078] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\", lpString2="PGMN054.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN054.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN054.XML" [0102.078] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0102.078] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN054.XML") returned="PGMN054.XML" [0102.078] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\", lpString2="PGMN058.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN058.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN058.XML" [0102.078] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0102.078] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN058.XML") returned="PGMN058.XML" [0102.078] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\", lpString2="PGMN065.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN065.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN065.XML" [0102.078] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0102.078] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN065.XML") returned="PGMN065.XML" [0102.078] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\", lpString2="PGMN075.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN075.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN075.XML" [0102.078] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN075.XML") returned="PGMN075.XML" [0102.078] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\", lpString2="PGMN081.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN081.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN081.XML" [0102.078] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN081.XML") returned="PGMN081.XML" [0102.078] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\", lpString2="PGMN082.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN082.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN082.XML" [0102.078] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN082.XML") returned="PGMN082.XML" [0102.078] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\", lpString2="PGMN086.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN086.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN086.XML" [0102.079] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN086.XML") returned="PGMN086.XML" [0102.079] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\", lpString2="PGMN089.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN089.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN089.XML" [0102.079] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN089.XML") returned="PGMN089.XML" [0102.079] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\", lpString2="PGMN090.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN090.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN090.XML" [0102.079] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN090.XML") returned="PGMN090.XML" [0102.079] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\", lpString2="PGMN092.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN092.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN092.XML" [0102.079] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN092.XML") returned="PGMN092.XML" [0102.079] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\", lpString2="PGMN095.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN095.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN095.XML" [0102.079] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN095.XML") returned="PGMN095.XML" [0102.079] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\", lpString2="PGMN096.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN096.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN096.XML" [0102.079] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN096.XML") returned="PGMN096.XML" [0102.079] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\", lpString2="PGMN097.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN097.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN097.XML" [0102.079] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN097.XML") returned="PGMN097.XML" [0102.079] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\", lpString2="PGMN102.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN102.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN102.XML" [0102.079] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN102.XML") returned="PGMN102.XML" [0102.079] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\", lpString2="PGMN103.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN103.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN103.XML" [0102.079] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN103.XML") returned="PGMN103.XML" [0102.079] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\", lpString2="PGMN105.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN105.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN105.XML" [0102.079] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN105.XML") returned="PGMN105.XML" [0102.079] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\", lpString2="PGMN107.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN107.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN107.XML" [0102.079] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN107.XML") returned="PGMN107.XML" [0102.079] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\", lpString2="PGMN108.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN108.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN108.XML" [0102.079] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN108.XML") returned="PGMN108.XML" [0102.079] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\", lpString2="PGMN109.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN109.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN109.XML" [0102.080] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN109.XML") returned="PGMN109.XML" [0102.080] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\", lpString2="PGMN110.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN110.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN110.XML" [0102.080] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN110.XML") returned="PGMN110.XML" [0102.080] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\", lpString2="PGMN111.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN111.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN111.XML" [0102.080] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN111.XML") returned="PGMN111.XML" [0102.080] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\", lpString2="PG_INDEX.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PG_INDEX.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PG_INDEX.XML" [0102.080] FindClose (in: hFindFile=0x5be160 | out: hFindFile=0x5be160) returned 1 [0102.081] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\*.*") returned="*.*" [0102.081] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="PDSBASE.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PDSBASE.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\PDSBASE.DLL" [0102.082] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PDSBASE.DLL") returned="PDSBASE.DLL" [0102.082] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="PE.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PE.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\PE.DLL" [0102.151] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PE.DLL") returned="PE.DLL" [0102.151] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="PEOPLEDATAHANDLER.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PEOPLEDATAHANDLER.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\PEOPLEDATAHANDLER.DLL" [0102.151] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PEOPLEDATAHANDLER.DLL") returned="PEOPLEDATAHANDLER.DLL" [0102.151] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="PJCALEND.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PJCALEND.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\PJCALEND.DLL" [0102.151] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PJCALEND.DLL") returned="PJCALEND.DLL" [0102.151] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="POWERPNT.EXE" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\POWERPNT.EXE") returned="C:\\Program Files\\Microsoft Office\\Office14\\POWERPNT.EXE" [0102.151] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\POWERPNT.EXE") returned="POWERPNT.EXE" [0102.151] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="powerpnt.exe.manifest" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\powerpnt.exe.manifest") returned="C:\\Program Files\\Microsoft Office\\Office14\\powerpnt.exe.manifest" [0102.152] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\powerpnt.exe.manifest") returned="powerpnt.exe.manifest" [0102.152] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="PPCORE.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PPCORE.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\PPCORE.DLL" [0102.152] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PPCORE.DLL") returned="PPCORE.DLL" [0102.152] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="PPSLAX.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PPSLAX.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\PPSLAX.DLL" [0102.152] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PPSLAX.DLL") returned="PPSLAX.DLL" [0102.152] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="PPTICO.EXE" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PPTICO.EXE") returned="C:\\Program Files\\Microsoft Office\\Office14\\PPTICO.EXE" [0102.152] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PPTICO.EXE") returned="PPTICO.EXE" [0102.152] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="PPTIRM.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PPTIRM.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\PPTIRM.XML" [0102.152] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PPTIRM.XML") returned="PPTIRM.XML" [0102.152] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="PPTIRMV.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PPTIRMV.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\PPTIRMV.XML" [0102.152] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PPTIRMV.XML") returned="PPTIRMV.XML" [0102.152] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="PROJIMPT.EXE" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PROJIMPT.EXE") returned="C:\\Program Files\\Microsoft Office\\Office14\\PROJIMPT.EXE" [0102.152] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PROJIMPT.EXE") returned="PROJIMPT.EXE" [0102.152] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="PROJMODL.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PROJMODL.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\PROJMODL.DLL" [0102.152] lstrcmpA (lpString1=".", lpString2="PROOF") returned -1 [0102.152] lstrcmpA (lpString1="..", lpString2="PROOF") returned -1 [0102.152] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PROJMODL.DLL") returned="PROJMODL.DLL" [0102.152] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="PROOF" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PROOF") returned="C:\\Program Files\\Microsoft Office\\Office14\\PROOF" [0102.152] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be160 [0102.182] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0102.182] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0102.182] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0102.182] lstrcmpA (lpString1=".", lpString2="1033") returned -1 [0102.182] lstrcmpA (lpString1="..", lpString2="1033") returned -1 [0102.182] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\*.*") returned="*.*" [0102.182] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\", lpString2="1033" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1033") returned="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1033" [0102.182] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1033\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be1a0 [0102.183] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0102.183] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0102.183] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0102.183] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1033\\*.*") returned="*.*" [0102.184] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1033\\", lpString2="MSGR3EN.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1033\\MSGR3EN.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1033\\MSGR3EN.DLL" [0102.184] FindClose (in: hFindFile=0x5be1a0 | out: hFindFile=0x5be1a0) returned 1 [0102.184] lstrcmpA (lpString1=".", lpString2="1036") returned -1 [0102.184] lstrcmpA (lpString1="..", lpString2="1036") returned -1 [0102.184] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\*.*") returned="*.*" [0102.184] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\", lpString2="1036" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1036") returned="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1036" [0102.184] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1036\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be1a0 [0102.184] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0102.184] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0102.184] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0102.184] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1036\\*.*") returned="*.*" [0102.184] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1036\\", lpString2="MSGR3FR.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1036\\MSGR3FR.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1036\\MSGR3FR.DLL" [0102.184] FindClose (in: hFindFile=0x5be1a0 | out: hFindFile=0x5be1a0) returned 1 [0102.184] lstrcmpA (lpString1=".", lpString2="3082") returned -1 [0102.184] lstrcmpA (lpString1="..", lpString2="3082") returned -1 [0102.184] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\*.*") returned="*.*" [0102.184] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\", lpString2="3082" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\3082") returned="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\3082" [0102.184] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\3082\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be1a0 [0102.185] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0102.185] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0102.185] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0102.185] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\3082\\*.*") returned="*.*" [0102.185] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\3082\\", lpString2="MSGR3ES.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\3082\\MSGR3ES.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\3082\\MSGR3ES.DLL" [0102.185] FindClose (in: hFindFile=0x5be1a0 | out: hFindFile=0x5be1a0) returned 1 [0102.185] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\*.*") returned="*.*" [0102.185] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\", lpString2="MSGR3EN.LEX" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3EN.LEX") returned="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3EN.LEX" [0102.185] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3EN.LEX") returned="MSGR3EN.LEX" [0102.185] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\", lpString2="MSGR3ES.LEX" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3ES.LEX") returned="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3ES.LEX" [0102.185] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3ES.LEX") returned="MSGR3ES.LEX" [0102.185] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\", lpString2="MSGR3FR.LEX" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3FR.LEX") returned="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3FR.LEX" [0102.185] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3FR.LEX") returned="MSGR3FR.LEX" [0102.185] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\", lpString2="MSHY7EN.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSHY7EN.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSHY7EN.DLL" [0102.185] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSHY7EN.DLL") returned="MSHY7EN.DLL" [0102.185] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\", lpString2="MSHY7EN.LEX" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSHY7EN.LEX") returned="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSHY7EN.LEX" [0102.185] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSHY7EN.LEX") returned="MSHY7EN.LEX" [0102.186] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\", lpString2="MSHY7ES.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSHY7ES.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSHY7ES.DLL" [0102.186] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSHY7ES.DLL") returned="MSHY7ES.DLL" [0102.186] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\", lpString2="MSHY7ES.LEX" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSHY7ES.LEX") returned="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSHY7ES.LEX" [0102.186] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSHY7ES.LEX") returned="MSHY7ES.LEX" [0102.186] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\", lpString2="MSHY7FR.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSHY7FR.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSHY7FR.DLL" [0102.186] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSHY7FR.DLL") returned="MSHY7FR.DLL" [0102.186] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\", lpString2="MSHY7FR.LEX" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSHY7FR.LEX") returned="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSHY7FR.LEX" [0102.186] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSHY7FR.LEX") returned="MSHY7FR.LEX" [0102.186] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\", lpString2="MSSP7EN.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7EN.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7EN.DLL" [0102.186] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7EN.DLL") returned="MSSP7EN.DLL" [0102.186] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\", lpString2="MSSP7EN.dub" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7EN.dub") returned="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7EN.dub" [0102.186] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7EN.dub") returned="MSSP7EN.dub" [0102.186] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\", lpString2="MSSP7EN.LEX" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7EN.LEX") returned="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7EN.LEX" [0102.186] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7EN.LEX") returned="MSSP7EN.LEX" [0102.186] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\", lpString2="MSSP7ES.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7ES.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7ES.DLL" [0102.186] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7ES.DLL") returned="MSSP7ES.DLL" [0102.186] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\", lpString2="MSSP7ES.dub" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7ES.dub") returned="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7ES.dub" [0102.187] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7ES.dub") returned="MSSP7ES.dub" [0102.187] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\", lpString2="MSSP7ES.LEX" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7ES.LEX") returned="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7ES.LEX" [0102.187] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7ES.LEX") returned="MSSP7ES.LEX" [0102.187] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\", lpString2="MSSP7FR.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7FR.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7FR.DLL" [0102.187] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7FR.DLL") returned="MSSP7FR.DLL" [0102.187] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\", lpString2="MSSP7FR.dub" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7FR.dub") returned="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7FR.dub" [0102.187] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7FR.dub") returned="MSSP7FR.dub" [0102.187] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\", lpString2="MSSP7FR.LEX" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7FR.LEX") returned="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7FR.LEX" [0102.187] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7FR.LEX") returned="MSSP7FR.LEX" [0102.187] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\", lpString2="MSTH7EN.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSTH7EN.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSTH7EN.DLL" [0102.187] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSTH7EN.DLL") returned="MSTH7EN.DLL" [0102.187] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\", lpString2="MSTH7EN.LEX" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSTH7EN.LEX") returned="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSTH7EN.LEX" [0102.187] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSTH7EN.LEX") returned="MSTH7EN.LEX" [0102.187] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\", lpString2="MSTH7ES.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSTH7ES.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSTH7ES.DLL" [0102.187] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSTH7ES.DLL") returned="MSTH7ES.DLL" [0102.187] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\", lpString2="MSTH7ES.LEX" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSTH7ES.LEX") returned="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSTH7ES.LEX" [0102.187] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSTH7ES.LEX") returned="MSTH7ES.LEX" [0102.187] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\", lpString2="MSTH7FR.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSTH7FR.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSTH7FR.DLL" [0102.188] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSTH7FR.DLL") returned="MSTH7FR.DLL" [0102.188] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\", lpString2="MSTH7FR.LEX" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSTH7FR.LEX") returned="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSTH7FR.LEX" [0102.188] FindClose (in: hFindFile=0x5be160 | out: hFindFile=0x5be160) returned 1 [0102.188] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\*.*") returned="*.*" [0102.188] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="PROPMGR.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PROPMGR.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\PROPMGR.DLL" [0102.188] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PROPMGR.DLL") returned="PROPMGR.DLL" [0102.188] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="PROPRPT.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PROPRPT.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\PROPRPT.DLL" [0102.188] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PROPRPT.DLL") returned="PROPRPT.DLL" [0102.188] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="PRTF9.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PRTF9.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\PRTF9.DLL" [0102.188] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PRTF9.DLL") returned="PRTF9.DLL" [0102.188] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="PSTPRX32.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PSTPRX32.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\PSTPRX32.DLL" [0102.188] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PSTPRX32.DLL") returned="PSTPRX32.DLL" [0102.188] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="PTXT9.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PTXT9.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\PTXT9.DLL" [0102.188] lstrcmpA (lpString1=".", lpString2="PUBBA") returned -1 [0102.188] lstrcmpA (lpString1="..", lpString2="PUBBA") returned -1 [0102.188] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PTXT9.DLL") returned="PTXT9.DLL" [0102.188] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="PUBBA" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA" [0102.188] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be160 [0102.226] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0102.226] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0102.226] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0102.226] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\*.*") returned="*.*" [0102.226] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\", lpString2="MSPUB10.BDR" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB10.BDR") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB10.BDR" [0102.226] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB10.BDR") returned="MSPUB10.BDR" [0102.226] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\", lpString2="MSPUB11.BDR" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB11.BDR") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB11.BDR" [0102.226] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB11.BDR") returned="MSPUB11.BDR" [0102.226] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\", lpString2="MSPUB1A.BDR" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB1A.BDR") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB1A.BDR" [0102.227] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB1A.BDR") returned="MSPUB1A.BDR" [0102.227] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\", lpString2="MSPUB1B.BDR" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB1B.BDR") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB1B.BDR" [0102.227] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB1B.BDR") returned="MSPUB1B.BDR" [0102.227] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\", lpString2="MSPUB2A.BDR" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB2A.BDR") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB2A.BDR" [0102.227] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB2A.BDR") returned="MSPUB2A.BDR" [0102.227] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\", lpString2="MSPUB2B.BDR" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB2B.BDR") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB2B.BDR" [0102.227] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB2B.BDR") returned="MSPUB2B.BDR" [0102.227] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\", lpString2="MSPUB3A.BDR" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB3A.BDR") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB3A.BDR" [0102.227] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB3A.BDR") returned="MSPUB3A.BDR" [0102.227] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\", lpString2="MSPUB3B.BDR" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB3B.BDR") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB3B.BDR" [0102.227] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB3B.BDR") returned="MSPUB3B.BDR" [0102.227] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\", lpString2="MSPUB4.BDR" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB4.BDR") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB4.BDR" [0102.227] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB4.BDR") returned="MSPUB4.BDR" [0102.227] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\", lpString2="MSPUB5A.BDR" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB5A.BDR") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB5A.BDR" [0102.227] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB5A.BDR") returned="MSPUB5A.BDR" [0102.227] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\", lpString2="MSPUB5B.BDR" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB5B.BDR") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB5B.BDR" [0102.227] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB5B.BDR") returned="MSPUB5B.BDR" [0102.227] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\", lpString2="MSPUB6.BDR" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB6.BDR") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB6.BDR" [0102.227] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB6.BDR") returned="MSPUB6.BDR" [0102.227] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\", lpString2="MSPUB7.BDR" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB7.BDR") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB7.BDR" [0102.227] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB7.BDR") returned="MSPUB7.BDR" [0102.228] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\", lpString2="MSPUB8.BDR" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB8.BDR") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB8.BDR" [0102.228] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB8.BDR") returned="MSPUB8.BDR" [0102.228] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\", lpString2="MSPUB9.BDR" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB9.BDR") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB9.BDR" [0102.228] FindClose (in: hFindFile=0x5be160 | out: hFindFile=0x5be160) returned 1 [0102.228] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\*.*") returned="*.*" [0102.228] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="PUBCONV.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBCONV.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBCONV.DLL" [0102.228] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBCONV.DLL") returned="PUBCONV.DLL" [0102.228] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="PUBTRAP.DLL" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBTRAP.DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBTRAP.DLL" [0102.228] lstrcmpA (lpString1=".", lpString2="PUBWIZ") returned -1 [0102.228] lstrcmpA (lpString1="..", lpString2="PUBWIZ") returned -1 [0102.228] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBTRAP.DLL") returned="PUBTRAP.DLL" [0102.228] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\", lpString2="PUBWIZ" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ" [0102.228] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be160 [0102.231] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0102.231] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0102.231] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0102.231] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\*.*") returned="*.*" [0102.231] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\", lpString2="ACCSBAR.POC" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\ACCSBAR.POC") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\ACCSBAR.POC" [0102.231] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\ACCSBAR.POC") returned="ACCSBAR.POC" [0102.231] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\", lpString2="ACCTBOX.POC" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\ACCTBOX.POC") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\ACCTBOX.POC" [0102.231] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\ACCTBOX.POC") returned="ACCTBOX.POC" [0102.231] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\", lpString2="AD.DPV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\AD.DPV") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\AD.DPV" [0102.231] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\AD.DPV") returned="AD.DPV" [0102.231] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\", lpString2="AD.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\AD.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\AD.XML" [0102.232] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\AD.XML") returned="AD.XML" [0102.232] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\", lpString2="AD98.POC" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\AD98.POC") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\AD98.POC" [0102.232] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\AD98.POC") returned="AD98.POC" [0102.232] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\", lpString2="ADRESPEL.POC" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\ADRESPEL.POC") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\ADRESPEL.POC" [0102.232] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\ADRESPEL.POC") returned="ADRESPEL.POC" [0102.232] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\", lpString2="AIR98.POC" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\AIR98.POC") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\AIR98.POC" [0102.232] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\AIR98.POC") returned="AIR98.POC" [0102.232] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\", lpString2="AWARDHM.POC" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\AWARDHM.POC") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\AWARDHM.POC" [0102.232] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\AWARDHM.POC") returned="AWARDHM.POC" [0102.232] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\", lpString2="BAN98.POC" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BAN98.POC") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BAN98.POC" [0102.232] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BAN98.POC") returned="BAN98.POC" [0102.232] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\", lpString2="BANNER.DPV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BANNER.DPV") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BANNER.DPV" [0102.232] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BANNER.DPV") returned="BANNER.DPV" [0102.232] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\", lpString2="BANNER.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BANNER.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BANNER.XML" [0102.232] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BANNER.XML") returned="BANNER.XML" [0102.232] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\", lpString2="BDRTKFUL.POC" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BDRTKFUL.POC") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BDRTKFUL.POC" [0102.232] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BDRTKFUL.POC") returned="BDRTKFUL.POC" [0102.232] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\", lpString2="BIZCARD.DPV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BIZCARD.DPV") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BIZCARD.DPV" [0102.232] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BIZCARD.DPV") returned="BIZCARD.DPV" [0102.232] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\", lpString2="BIZCARD.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BIZCARD.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BIZCARD.XML" [0102.232] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BIZCARD.XML") returned="BIZCARD.XML" [0102.232] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\", lpString2="BIZFORM.DPV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BIZFORM.DPV") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BIZFORM.DPV" [0102.232] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BIZFORM.DPV") returned="BIZFORM.DPV" [0102.232] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\", lpString2="BIZFORM.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BIZFORM.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BIZFORM.XML" [0102.235] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BIZFORM.XML") returned="BIZFORM.XML" [0102.236] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\", lpString2="BORDERBB.DPV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BORDERBB.DPV") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BORDERBB.DPV" [0102.237] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BORDERBB.DPV") returned="BORDERBB.DPV" [0102.238] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\", lpString2="BORDERBB.POC" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BORDERBB.POC") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BORDERBB.POC" [0102.239] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BORDERBB.POC") returned="BORDERBB.POC" [0102.239] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\", lpString2="BRCH98SP.POC" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BRCH98SP.POC") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BRCH98SP.POC" [0102.239] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BRCH98SP.POC") returned="BRCH98SP.POC" [0102.239] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\", lpString2="BRCHUR11.POC" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BRCHUR11.POC") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BRCHUR11.POC" [0102.239] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BRCHUR11.POC") returned="BRCHUR11.POC" [0102.239] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\", lpString2="BRCHUR98.POC" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BRCHUR98.POC") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BRCHUR98.POC" [0102.239] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BRCHUR98.POC") returned="BRCHUR98.POC" [0102.239] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\", lpString2="BROCHURE.DPV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BROCHURE.DPV") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BROCHURE.DPV" [0102.239] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BROCHURE.DPV") returned="BROCHURE.DPV" [0102.239] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\", lpString2="BROCHURE.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BROCHURE.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BROCHURE.XML" [0102.239] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BROCHURE.XML") returned="BROCHURE.XML" [0102.239] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\", lpString2="BS2BARB.POC" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BS2BARB.POC") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BS2BARB.POC" [0102.239] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BS2BARB.POC") returned="BS2BARB.POC" [0102.239] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\", lpString2="BS4BOXES.POC" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BS4BOXES.POC") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BS4BOXES.POC" [0102.239] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BS4BOXES.POC") returned="BS4BOXES.POC" [0102.239] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\", lpString2="BS53BOXS.POC" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BS53BOXS.POC") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BS53BOXS.POC" [0102.239] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BS53BOXS.POC") returned="BS53BOXS.POC" [0102.239] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\", lpString2="BZCARD11.POC" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BZCARD11.POC") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BZCARD11.POC" [0102.239] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BZCARD11.POC") returned="BZCARD11.POC" [0102.239] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\", lpString2="BZCARDHM.POC" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BZCARDHM.POC") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BZCARDHM.POC" [0102.240] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BZCARDHM.POC") returned="BZCARDHM.POC" [0102.240] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\", lpString2="BZCD98SP.POC" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BZCD98SP.POC") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BZCD98SP.POC" [0102.240] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BZCD98SP.POC") returned="BZCD98SP.POC" [0102.240] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\", lpString2="BZCRD98.POC" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BZCRD98.POC") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BZCRD98.POC" [0102.240] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BZCRD98.POC") returned="BZCRD98.POC" [0102.240] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\", lpString2="CALENDAR.DPV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CALENDAR.DPV") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CALENDAR.DPV" [0102.240] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CALENDAR.DPV") returned="CALENDAR.DPV" [0102.240] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\", lpString2="CALENDAR.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CALENDAR.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CALENDAR.XML" [0102.240] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CALENDAR.XML") returned="CALENDAR.XML" [0102.240] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\", lpString2="CALHM.POC" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CALHM.POC") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CALHM.POC" [0102.241] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CALHM.POC") returned="CALHM.POC" [0102.241] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\", lpString2="CALNDR98.POC" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CALNDR98.POC") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CALNDR98.POC" [0102.241] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CALNDR98.POC") returned="CALNDR98.POC" [0102.241] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\", lpString2="CALSO11.POC" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CALSO11.POC") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CALSO11.POC" [0102.241] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CALSO11.POC") returned="CALSO11.POC" [0102.241] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\", lpString2="CALSO98.POC" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CALSO98.POC") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CALSO98.POC" [0102.241] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CALSO98.POC") returned="CALSO98.POC" [0102.241] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\", lpString2="CATALOG.DPV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CATALOG.DPV") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CATALOG.DPV" [0102.241] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CATALOG.DPV") returned="CATALOG.DPV" [0102.241] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\", lpString2="CATALOG.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CATALOG.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CATALOG.XML" [0102.241] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CATALOG.XML") returned="CATALOG.XML" [0102.241] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\", lpString2="CATWIZ.POC" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CATWIZ.POC") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CATWIZ.POC" [0102.241] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CATWIZ.POC") returned="CATWIZ.POC" [0102.241] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\", lpString2="CATWIZ11.POC" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CATWIZ11.POC") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CATWIZ11.POC" [0102.241] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CATWIZ11.POC") returned="CATWIZ11.POC" [0102.241] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\", lpString2="CERT.DPV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CERT.DPV") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CERT.DPV" [0102.241] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CERT.DPV") returned="CERT.DPV" [0102.241] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\", lpString2="CERT.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CERT.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CERT.XML" [0102.241] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CERT.XML") returned="CERT.XML" [0102.241] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\", lpString2="CERT98.POC" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CERT98.POC") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CERT98.POC" [0102.241] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CERT98.POC") returned="CERT98.POC" [0102.241] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\", lpString2="CERT98SP.POC" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CERT98SP.POC") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CERT98SP.POC" [0102.242] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CERT98SP.POC") returned="CERT98SP.POC" [0102.242] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\", lpString2="CHECKER.POC" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CHECKER.POC") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CHECKER.POC" [0102.242] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CHECKER.POC") returned="CHECKER.POC" [0102.242] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\", lpString2="CONTACTINFOBB.DPV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CONTACTINFOBB.DPV") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CONTACTINFOBB.DPV" [0102.242] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CONTACTINFOBB.DPV") returned="CONTACTINFOBB.DPV" [0102.242] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\", lpString2="CONTACTINFOBB.POC" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CONTACTINFOBB.POC") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CONTACTINFOBB.POC" [0102.242] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CONTACTINFOBB.POC") returned="CONTACTINFOBB.POC" [0102.242] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\", lpString2="COUPON.POC" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\COUPON.POC") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\COUPON.POC" [0102.242] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\COUPON.POC") returned="COUPON.POC" [0102.242] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\", lpString2="DGACCBAR.DPV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGACCBAR.DPV") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGACCBAR.DPV" [0102.242] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGACCBAR.DPV") returned="DGACCBAR.DPV" [0102.242] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\", lpString2="DGACCBAR.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGACCBAR.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGACCBAR.XML" [0102.242] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGACCBAR.XML") returned="DGACCBAR.XML" [0102.242] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\", lpString2="DGACCBOX.DPV" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGACCBOX.DPV") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGACCBOX.DPV" [0102.242] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\", lpString2="DGACCBOX.XML" | out: lpString1="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGACCBOX.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGACCBOX.XML" [0102.252] FindClose (in: hFindFile=0x5be160 | out: hFindFile=0x5be160) returned 1 [0102.253] lstrcmpA (lpString1=".", lpString2="QUERIES") returned -1 [0102.253] lstrcmpA (lpString1="..", lpString2="QUERIES") returned -1 [0102.254] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\QUERIES\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be160 [0102.255] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0102.255] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0102.255] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0102.255] FindClose (in: hFindFile=0x5be160 | out: hFindFile=0x5be160) returned 1 [0102.496] SetFileTime (hFile=0x88, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0102.496] CloseHandle (hObject=0x88) returned 1 [0102.496] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\REMINDER.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\reminder.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\REMINDER.WAV. " (normalized: "c:\\program files\\microsoft office\\office14\\reminder.wav. ")) returned 1 [0102.498] lstrcmpA (lpString1=".", lpString2="SAMPLES") returned -1 [0102.498] lstrcmpA (lpString1="..", lpString2="SAMPLES") returned -1 [0102.498] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\SAMPLES\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be160 [0102.499] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0102.499] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0102.499] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0102.559] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0102.559] CloseHandle (hObject=0x8c) returned 1 [0102.559] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\SAMPLES\\SOLVSAMP.XLS" (normalized: "c:\\program files\\microsoft office\\office14\\samples\\solvsamp.xls"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\SAMPLES\\SOLVSAMP.XLS. " (normalized: "c:\\program files\\microsoft office\\office14\\samples\\solvsamp.xls. ")) returned 1 [0102.928] SetFileTime (hFile=0x88, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0102.928] CloseHandle (hObject=0x88) returned 1 [0102.928] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\SplashScreen.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\splashscreen.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\SplashScreen.bmp. " (normalized: "c:\\program files\\microsoft office\\office14\\splashscreen.bmp. ")) returned 1 [0102.929] lstrcmpA (lpString1=".", lpString2="STARTUP") returned -1 [0102.929] lstrcmpA (lpString1="..", lpString2="STARTUP") returned -1 [0102.929] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\STARTUP\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be160 [0102.930] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0102.930] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0102.930] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0102.931] lstrcmpA (lpString1=".", lpString2="Visio Content") returned -1 [0102.931] lstrcmpA (lpString1="..", lpString2="Visio Content") returned -1 [0102.931] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be160 [0102.931] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0102.931] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0102.931] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0102.931] lstrcmpA (lpString1=".", lpString2="1033") returned -1 [0102.931] lstrcmpA (lpString1="..", lpString2="1033") returned -1 [0102.931] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be1a0 [0103.094] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0103.095] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0103.095] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0103.123] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0103.123] CloseHandle (hObject=0x90) returned 1 [0103.123] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ASTMGT.XLS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\astmgt.xls"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ASTMGT.XLS. " (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\astmgt.xls. ")) returned 1 [0103.268] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0103.268] CloseHandle (hObject=0x90) returned 1 [0103.268] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\BLDGPLAN.DWG" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\bldgplan.dwg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\BLDGPLAN.DWG. " (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\bldgplan.dwg. ")) returned 1 [0103.388] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0103.388] CloseHandle (hObject=0x90) returned 1 [0103.388] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\BLDGPLAN.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\bldgplan.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\BLDGPLAN.JPG. " (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\bldgplan.jpg. ")) returned 1 [0103.460] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0103.460] CloseHandle (hObject=0x90) returned 1 [0103.460] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\BLOCKS.DWG" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\blocks.dwg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\BLOCKS.DWG. " (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\blocks.dwg. ")) returned 1 [0103.522] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0103.522] CloseHandle (hObject=0x90) returned 1 [0103.523] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ORGDATA.TXT" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\orgdata.txt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ORGDATA.TXT. " (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\orgdata.txt. ")) returned 1 [0103.533] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0103.533] CloseHandle (hObject=0x90) returned 1 [0103.533] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ORGDATA.XLS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\orgdata.xls"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ORGDATA.XLS. " (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\orgdata.xls. ")) returned 1 [0103.556] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0103.556] CloseHandle (hObject=0x90) returned 1 [0103.557] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\PRCIMP.XLS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\prcimp.xls"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\PRCIMP.XLS. " (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\prcimp.xls. ")) returned 1 [0103.590] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0103.590] CloseHandle (hObject=0x90) returned 1 [0103.590] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\PRJMGT.XLS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\prjmgt.xls"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\PRJMGT.XLS. " (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\prjmgt.xls. ")) returned 1 [0103.617] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0103.617] CloseHandle (hObject=0x90) returned 1 [0103.617] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\PROJTL.XLS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\projtl.xls"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\PROJTL.XLS. " (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\projtl.xls. ")) returned 1 [0103.667] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0103.667] CloseHandle (hObject=0x90) returned 1 [0103.667] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\SALSUM.XLS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\salsum.xls"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\SALSUM.XLS. " (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\salsum.xls. ")) returned 1 [0103.675] lstrcmpA (lpString1=".", lpString2="XLSTART") returned -1 [0103.675] lstrcmpA (lpString1="..", lpString2="XLSTART") returned -1 [0103.675] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\XLSTART\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be160 [0103.675] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0103.675] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0103.675] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0103.675] lstrcmpA (lpString1=".", lpString2="Stationery") returned -1 [0103.675] lstrcmpA (lpString1="..", lpString2="Stationery") returned -1 [0103.675] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Stationery\\*.*", lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 0x5be160 [0103.676] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0103.676] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0103.676] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0103.676] lstrcmpA (lpString1=".", lpString2="1033") returned -1 [0103.676] lstrcmpA (lpString1="..", lpString2="1033") returned -1 [0103.676] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be1a0 [0103.677] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0103.677] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0103.677] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0103.715] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0103.715] CloseHandle (hObject=0x8c) returned 1 [0103.715] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\CURRENCY.GIF" (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\currency.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\CURRENCY.GIF. " (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\currency.gif. ")) returned 1 [0103.718] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0103.718] CloseHandle (hObject=0x8c) returned 1 [0103.718] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\CURRENCY.HTM" (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\currency.htm"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\CURRENCY.HTM. " (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\currency.htm. ")) returned 1 [0103.719] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0103.719] CloseHandle (hObject=0x8c) returned 1 [0103.719] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\DADSHIRT.GIF" (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\dadshirt.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\DADSHIRT.GIF. " (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\dadshirt.gif. ")) returned 1 [0103.720] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0103.720] CloseHandle (hObject=0x8c) returned 1 [0103.720] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\DADSHIRT.HTM" (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\dadshirt.htm"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\DADSHIRT.HTM. " (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\dadshirt.htm. ")) returned 1 [0103.722] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0103.722] CloseHandle (hObject=0x8c) returned 1 [0103.722] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\JUDGESCH.GIF" (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\judgesch.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\JUDGESCH.GIF. " (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\judgesch.gif. ")) returned 1 [0103.723] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0103.724] CloseHandle (hObject=0x8c) returned 1 [0103.724] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\JUDGESCH.HTM" (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\judgesch.htm"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\JUDGESCH.HTM. " (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\judgesch.htm. ")) returned 1 [0103.729] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0103.729] CloseHandle (hObject=0x8c) returned 1 [0103.729] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\JUNGLE.GIF" (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\jungle.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\JUNGLE.GIF. " (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\jungle.gif. ")) returned 1 [0103.731] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0103.731] CloseHandle (hObject=0x8c) returned 1 [0103.731] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\JUNGLE.HTM" (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\jungle.htm"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\JUNGLE.HTM. " (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\jungle.htm. ")) returned 1 [0103.732] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0103.732] CloseHandle (hObject=0x8c) returned 1 [0103.733] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\NOTEBOOK.HTM" (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\notebook.htm"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\NOTEBOOK.HTM. " (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\notebook.htm. ")) returned 1 [0103.735] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0103.735] CloseHandle (hObject=0x8c) returned 1 [0103.735] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\NOTEBOOK.JPG" (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\notebook.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\NOTEBOOK.JPG. " (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\notebook.jpg. ")) returned 1 [0103.774] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0103.774] CloseHandle (hObject=0x8c) returned 1 [0103.774] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\OFFISUPP.GIF" (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\offisupp.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\OFFISUPP.GIF. " (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\offisupp.gif. ")) returned 1 [0103.776] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0103.776] CloseHandle (hObject=0x8c) returned 1 [0103.776] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\OFFISUPP.HTM" (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\offisupp.htm"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\OFFISUPP.HTM. " (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\offisupp.htm. ")) returned 1 [0103.794] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0103.794] CloseHandle (hObject=0x8c) returned 1 [0103.794] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\PAWPRINT.GIF" (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\pawprint.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\PAWPRINT.GIF. " (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\pawprint.gif. ")) returned 1 [0103.796] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0103.796] CloseHandle (hObject=0x8c) returned 1 [0103.796] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\PAWPRINT.HTM" (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\pawprint.htm"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\PAWPRINT.HTM. " (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\pawprint.htm. ")) returned 1 [0103.797] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0103.797] CloseHandle (hObject=0x8c) returned 1 [0103.797] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\PINELUMB.HTM" (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\pinelumb.htm"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\PINELUMB.HTM. " (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\pinelumb.htm. ")) returned 1 [0103.801] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0103.801] CloseHandle (hObject=0x8c) returned 1 [0103.801] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\PINELUMB.JPG" (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\pinelumb.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\PINELUMB.JPG. " (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\pinelumb.jpg. ")) returned 1 [0103.803] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0103.803] CloseHandle (hObject=0x8c) returned 1 [0103.803] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\SEAMARBL.HTM" (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\seamarbl.htm"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\SEAMARBL.HTM. " (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\seamarbl.htm. ")) returned 1 [0103.804] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0103.805] CloseHandle (hObject=0x8c) returned 1 [0103.805] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\SEAMARBL.JPG" (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\seamarbl.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\SEAMARBL.JPG. " (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\seamarbl.jpg. ")) returned 1 [0103.927] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0103.927] CloseHandle (hObject=0x8c) returned 1 [0103.927] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\TECHTOOL.GIF" (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\techtool.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\TECHTOOL.GIF. " (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\techtool.gif. ")) returned 1 [0103.929] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0103.929] CloseHandle (hObject=0x8c) returned 1 [0103.929] MoveFileA (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\TECHTOOL.HTM" (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\techtool.htm"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\TECHTOOL.HTM. " (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\techtool.htm. ")) returned 1 [0103.930] lstrcmpA (lpString1=".", lpString2="Templates") returned -1 [0103.930] lstrcmpA (lpString1="..", lpString2="Templates") returned -1 [0103.930] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\*.*", lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 0x5be160 [0103.930] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0103.931] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0103.931] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0103.931] lstrcmpA (lpString1=".", lpString2="1033") returned -1 [0103.931] lstrcmpA (lpString1="..", lpString2="1033") returned -1 [0103.931] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be1a0 [0103.972] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0103.973] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0103.973] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0103.974] lstrcmpA (lpString1=".", lpString2="Access") returned -1 [0103.974] lstrcmpA (lpString1="..", lpString2="Access") returned -1 [0103.974] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be1e0 [0103.988] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0103.988] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0103.988] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0103.988] lstrcmpA (lpString1=".", lpString2="DataType") returned -1 [0103.988] lstrcmpA (lpString1="..", lpString2="DataType") returned -1 [0103.988] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be220 [0103.989] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0103.990] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0103.990] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0103.991] lstrcmpA (lpString1=".", lpString2="Part") returned -1 [0103.991] lstrcmpA (lpString1="..", lpString2="Part") returned -1 [0103.991] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be220 [0104.009] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0104.009] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0104.009] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0104.010] lstrcmpA (lpString1=".", lpString2="WSS") returned -1 [0104.011] lstrcmpA (lpString1="..", lpString2="WSS") returned -1 [0104.011] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\WSS\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be220 [0104.011] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0104.011] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0104.011] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0104.013] lstrcmpA (lpString1=".", lpString2="FAX") returned -1 [0104.013] lstrcmpA (lpString1="..", lpString2="FAX") returned -1 [0104.013] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be1e0 [0104.026] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0104.026] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0104.026] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0104.026] lstrcmpA (lpString1=".", lpString2="ONENOTE") returned -1 [0104.026] lstrcmpA (lpString1="..", lpString2="ONENOTE") returned -1 [0104.027] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be1e0 [0104.027] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0104.027] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0104.027] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0104.027] lstrcmpA (lpString1=".", lpString2="14") returned -1 [0104.027] lstrcmpA (lpString1="..", lpString2="14") returned -1 [0104.027] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be220 [0104.027] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0104.027] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0104.027] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0104.027] lstrcmpA (lpString1=".", lpString2="Notebook Templates") returned -1 [0104.028] lstrcmpA (lpString1="..", lpString2="Notebook Templates") returned -1 [0104.028] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Notebook Templates\\*.*", lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 0x5be260 [0104.029] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0104.029] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0104.029] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0104.029] lstrcmpA (lpString1=".", lpString2="Stationery") returned -1 [0104.029] lstrcmpA (lpString1="..", lpString2="Stationery") returned -1 [0104.029] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\*.*", lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 0x5be260 [0104.029] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0104.029] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0104.029] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0104.033] lstrcmpA (lpString1=".", lpString2="Presentation Designs") returned -1 [0104.033] lstrcmpA (lpString1="..", lpString2="Presentation Designs") returned -1 [0104.033] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\Presentation Designs\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be1a0 [0104.033] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0104.033] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0104.033] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0104.033] lstrcmpA (lpString1=".", lpString2="Microsoft SQL Server Compact Edition") returned -1 [0104.033] lstrcmpA (lpString1="..", lpString2="Microsoft SQL Server Compact Edition") returned -1 [0104.033] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft SQL Server Compact Edition\\*.*", lpFindFileData=0xaf4e8 | out: lpFindFileData=0xaf4e8) returned 0x5be160 [0104.034] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0104.034] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0104.034] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0104.034] lstrcmpA (lpString1=".", lpString2="v3.5") returned -1 [0104.034] lstrcmpA (lpString1="..", lpString2="v3.5") returned -1 [0104.034] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5\\*.*", lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 0x5be1a0 [0104.036] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0104.036] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0104.036] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0104.036] lstrcmpA (lpString1=".", lpString2="Desktop") returned -1 [0104.036] lstrcmpA (lpString1="..", lpString2="Desktop") returned -1 [0104.036] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5\\Desktop\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be1e0 [0104.036] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0104.036] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0104.036] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0104.036] lstrcmpA (lpString1=".", lpString2="Microsoft Sync Framework") returned -1 [0104.036] lstrcmpA (lpString1="..", lpString2="Microsoft Sync Framework") returned -1 [0104.036] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Sync Framework\\*.*", lpFindFileData=0xaf4e8 | out: lpFindFileData=0xaf4e8) returned 0x5be160 [0104.036] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0104.037] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0104.037] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0104.037] lstrcmpA (lpString1=".", lpString2="v1.0") returned -1 [0104.037] lstrcmpA (lpString1="..", lpString2="v1.0") returned -1 [0104.037] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\*.*", lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 0x5be1a0 [0104.037] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0104.037] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0104.038] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0104.038] lstrcmpA (lpString1=".", lpString2="Documentation") returned -1 [0104.038] lstrcmpA (lpString1="..", lpString2="Documentation") returned -1 [0104.038] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be1e0 [0104.041] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0104.041] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0104.042] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0104.042] lstrcmpA (lpString1=".", lpString2="1033") returned -1 [0104.042] lstrcmpA (lpString1="..", lpString2="1033") returned -1 [0104.042] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\1033\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be220 [0104.044] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0104.044] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0104.044] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0104.044] lstrcmpA (lpString1=".", lpString2="License Agreements") returned -1 [0104.044] lstrcmpA (lpString1="..", lpString2="License Agreements") returned -1 [0104.044] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\1033\\License Agreements\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be260 [0104.044] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0104.044] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0104.044] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0104.044] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\1033\\License Agreements\\SynchronizationEula.rtf", pszSpec="*.zip") returned 0 [0104.044] lstrlenA (lpString="*.zip") returned 5 [0104.044] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\1033\\License Agreements\\SynchronizationEula.rtf", pszSpec="*.rar") returned 0 [0104.044] lstrlenA (lpString="*.rar") returned 5 [0104.044] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\1033\\License Agreements\\SynchronizationEula.rtf", pszSpec="*.7z") returned 0 [0104.044] lstrlenA (lpString="*.7z") returned 4 [0104.044] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\1033\\License Agreements\\SynchronizationEula.rtf", pszSpec="*.tar") returned 0 [0104.044] lstrlenA (lpString="*.tar") returned 5 [0104.044] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\1033\\License Agreements\\SynchronizationEula.rtf", pszSpec="*.gzip") returned 0 [0104.044] lstrlenA (lpString="*.gzip") returned 6 [0104.044] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\1033\\License Agreements\\SynchronizationEula.rtf", pszSpec="*.jpg") returned 0 [0104.044] lstrlenA (lpString="*.jpg") returned 5 [0104.044] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\1033\\License Agreements\\SynchronizationEula.rtf", pszSpec="*.jpeg") returned 0 [0104.044] lstrlenA (lpString="*.jpeg") returned 6 [0104.044] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\1033\\License Agreements\\SynchronizationEula.rtf", pszSpec="*.psd") returned 0 [0104.044] lstrlenA (lpString="*.psd") returned 5 [0104.044] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\1033\\License Agreements\\SynchronizationEula.rtf", pszSpec="*.cdr") returned 0 [0104.044] lstrlenA (lpString="*.cdr") returned 5 [0104.044] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\1033\\License Agreements\\SynchronizationEula.rtf", pszSpec="*.dwg") returned 0 [0104.044] lstrlenA (lpString="*.dwg") returned 5 [0104.044] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\1033\\License Agreements\\SynchronizationEula.rtf", pszSpec="*.max") returned 0 [0104.044] lstrlenA (lpString="*.max") returned 5 [0104.044] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\1033\\License Agreements\\SynchronizationEula.rtf", pszSpec="*.bmp") returned 0 [0104.044] lstrlenA (lpString="*.bmp") returned 5 [0104.044] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\1033\\License Agreements\\SynchronizationEula.rtf", pszSpec="*.gif") returned 0 [0104.044] lstrlenA (lpString="*.gif") returned 5 [0104.044] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\1033\\License Agreements\\SynchronizationEula.rtf", pszSpec="*.png") returned 0 [0104.044] lstrlenA (lpString="*.png") returned 5 [0104.044] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\1033\\License Agreements\\SynchronizationEula.rtf", pszSpec="*.doc") returned 0 [0104.044] lstrlenA (lpString="*.doc") returned 5 [0104.044] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\1033\\License Agreements\\SynchronizationEula.rtf", pszSpec="*.docx") returned 0 [0104.045] lstrlenA (lpString="*.docx") returned 6 [0104.045] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\1033\\License Agreements\\SynchronizationEula.rtf", pszSpec="*.xls") returned 0 [0104.045] lstrlenA (lpString="*.xls") returned 5 [0104.045] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\1033\\License Agreements\\SynchronizationEula.rtf", pszSpec="*.xlsx") returned 0 [0104.045] lstrlenA (lpString="*.xlsx") returned 6 [0104.045] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\1033\\License Agreements\\SynchronizationEula.rtf", pszSpec="*.ppt") returned 0 [0104.046] lstrlenA (lpString="*.ppt") returned 5 [0104.046] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\1033\\License Agreements\\SynchronizationEula.rtf", pszSpec="*.pptx") returned 0 [0104.046] lstrlenA (lpString="*.pptx") returned 6 [0104.046] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\1033\\License Agreements\\SynchronizationEula.rtf", pszSpec="*.txt") returned 0 [0104.046] lstrlenA (lpString="*.txt") returned 5 [0104.046] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\1033\\License Agreements\\SynchronizationEula.rtf", pszSpec="*.pdf") returned 0 [0104.046] lstrlenA (lpString="*.pdf") returned 5 [0104.046] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\1033\\License Agreements\\SynchronizationEula.rtf", pszSpec="*.djvu") returned 0 [0104.046] lstrlenA (lpString="*.djvu") returned 6 [0104.046] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\1033\\License Agreements\\SynchronizationEula.rtf", pszSpec="*.htm") returned 0 [0104.046] lstrlenA (lpString="*.htm") returned 5 [0104.046] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\1033\\License Agreements\\SynchronizationEula.rtf", pszSpec="*.html") returned 0 [0104.046] lstrlenA (lpString="*.html") returned 6 [0104.046] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\1033\\License Agreements\\SynchronizationEula.rtf", pszSpec="*.mdb") returned 0 [0104.046] lstrlenA (lpString="*.mdb") returned 5 [0104.046] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\1033\\License Agreements\\SynchronizationEula.rtf", pszSpec="*.cer") returned 0 [0104.046] lstrlenA (lpString="*.cer") returned 5 [0104.046] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\1033\\License Agreements\\SynchronizationEula.rtf", pszSpec="*.p12") returned 0 [0104.046] lstrlenA (lpString="*.p12") returned 5 [0104.046] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\1033\\License Agreements\\SynchronizationEula.rtf", pszSpec="*.pfx") returned 0 [0104.046] lstrlenA (lpString="*.pfx") returned 5 [0104.046] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\1033\\License Agreements\\SynchronizationEula.rtf", pszSpec="*.kwm") returned 0 [0104.046] lstrlenA (lpString="*.kwm") returned 5 [0104.046] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\1033\\License Agreements\\SynchronizationEula.rtf", pszSpec="*.pwm") returned 0 [0104.046] lstrlenA (lpString="*.pwm") returned 5 [0104.046] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\1033\\License Agreements\\SynchronizationEula.rtf", pszSpec="*.1cd") returned 0 [0104.046] lstrlenA (lpString="*.1cd") returned 5 [0104.046] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\1033\\License Agreements\\SynchronizationEula.rtf", pszSpec="*.md") returned 0 [0104.046] lstrlenA (lpString="*.md") returned 4 [0104.046] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\1033\\License Agreements\\SynchronizationEula.rtf", pszSpec="*.mdf") returned 0 [0104.046] lstrlenA (lpString="*.mdf") returned 5 [0104.046] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\1033\\License Agreements\\SynchronizationEula.rtf", pszSpec="*.dbf") returned 0 [0104.046] lstrlenA (lpString="*.dbf") returned 5 [0104.046] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\1033\\License Agreements\\SynchronizationEula.rtf", pszSpec="*.odt") returned 0 [0104.046] lstrlenA (lpString="*.odt") returned 5 [0104.046] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\1033\\License Agreements\\SynchronizationEula.rtf", pszSpec="*.vob") returned 0 [0104.046] lstrlenA (lpString="*.vob") returned 5 [0104.046] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\1033\\License Agreements\\SynchronizationEula.rtf", pszSpec="*.ifo") returned 0 [0104.046] lstrlenA (lpString="*.ifo") returned 5 [0104.046] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\1033\\License Agreements\\SynchronizationEula.rtf", pszSpec="*.lnk") returned 0 [0104.046] lstrlenA (lpString="*.lnk") returned 5 [0104.046] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\1033\\License Agreements\\SynchronizationEula.rtf", pszSpec="*.torrent") returned 0 [0104.046] lstrlenA (lpString="*.torrent") returned 9 [0104.046] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\1033\\License Agreements\\SynchronizationEula.rtf", pszSpec="*.mov") returned 0 [0104.046] lstrlenA (lpString="*.mov") returned 5 [0104.046] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\1033\\License Agreements\\SynchronizationEula.rtf", pszSpec="*.m2v") returned 0 [0104.046] lstrlenA (lpString="*.m2v") returned 5 [0104.046] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\1033\\License Agreements\\SynchronizationEula.rtf", pszSpec="*.3gp") returned 0 [0104.046] lstrlenA (lpString="*.3gp") returned 5 [0104.046] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\1033\\License Agreements\\SynchronizationEula.rtf", pszSpec="*.mpeg") returned 0 [0104.046] lstrlenA (lpString="*.mpeg") returned 6 [0104.046] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\1033\\License Agreements\\SynchronizationEula.rtf", pszSpec="*.mpg") returned 0 [0104.047] lstrlenA (lpString="*.mpg") returned 5 [0104.047] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\1033\\License Agreements\\SynchronizationEula.rtf", pszSpec="*.flv") returned 0 [0104.047] lstrlenA (lpString="*.flv") returned 5 [0104.047] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\1033\\License Agreements\\SynchronizationEula.rtf", pszSpec="*.avi") returned 0 [0104.047] lstrlenA (lpString="*.avi") returned 5 [0104.047] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\1033\\License Agreements\\SynchronizationEula.rtf", pszSpec="*.mp4") returned 0 [0104.047] lstrlenA (lpString="*.mp4") returned 5 [0104.047] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\1033\\License Agreements\\SynchronizationEula.rtf", pszSpec="*.wmv") returned 0 [0104.047] lstrlenA (lpString="*.wmv") returned 5 [0104.047] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\1033\\License Agreements\\SynchronizationEula.rtf", pszSpec="*.divx") returned 0 [0104.047] lstrlenA (lpString="*.divx") returned 6 [0104.047] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\1033\\License Agreements\\SynchronizationEula.rtf", pszSpec="*.mkv") returned 0 [0104.047] lstrlenA (lpString="*.mkv") returned 5 [0104.047] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\1033\\License Agreements\\SynchronizationEula.rtf", pszSpec="*.mp3") returned 0 [0104.047] lstrlenA (lpString="*.mp3") returned 5 [0104.047] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\1033\\License Agreements\\SynchronizationEula.rtf", pszSpec="*.wav") returned 0 [0104.047] lstrlenA (lpString="*.wav") returned 5 [0104.047] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\1033\\License Agreements\\SynchronizationEula.rtf", pszSpec="*.flac") returned 0 [0104.047] lstrlenA (lpString="*.flac") returned 6 [0104.047] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\1033\\License Agreements\\SynchronizationEula.rtf", pszSpec="*.ape") returned 0 [0104.047] lstrlenA (lpString="*.ape") returned 5 [0104.047] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\1033\\License Agreements\\SynchronizationEula.rtf", pszSpec="*.wma") returned 0 [0104.047] lstrlenA (lpString="*.wma") returned 5 [0104.047] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\1033\\License Agreements\\SynchronizationEula.rtf", pszSpec="*.ac3") returned 0 [0104.047] lstrlenA (lpString="*.ac3") returned 5 [0104.047] FindClose (in: hFindFile=0x5be260 | out: hFindFile=0x5be260) returned 1 [0104.047] FindClose (in: hFindFile=0x5be220 | out: hFindFile=0x5be220) returned 1 [0104.047] FindClose (in: hFindFile=0x5be1e0 | out: hFindFile=0x5be1e0) returned 1 [0104.047] lstrcmpA (lpString1=".", lpString2="Runtime") returned -1 [0104.047] lstrcmpA (lpString1="..", lpString2="Runtime") returned -1 [0104.047] lstrlenA (lpString="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime") returned 54 [0104.047] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be1e0 [0104.047] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0104.047] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0104.047] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0104.048] lstrcmpA (lpString1=".", lpString2="x64") returned -1 [0104.048] lstrcmpA (lpString1="..", lpString2="x64") returned -1 [0104.048] lstrlenA (lpString="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64") returned 58 [0104.048] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be220 [0104.063] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0104.063] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0104.063] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0104.063] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\FeedSync.dll", pszSpec="*.zip") returned 0 [0104.063] lstrlenA (lpString="*.zip") returned 5 [0104.063] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\FeedSync.dll", pszSpec="*.rar") returned 0 [0104.063] lstrlenA (lpString="*.rar") returned 5 [0104.063] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\FeedSync.dll", pszSpec="*.7z") returned 0 [0104.063] lstrlenA (lpString="*.7z") returned 4 [0104.063] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\FeedSync.dll", pszSpec="*.tar") returned 0 [0104.063] lstrlenA (lpString="*.tar") returned 5 [0104.063] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\FeedSync.dll", pszSpec="*.gzip") returned 0 [0104.063] lstrlenA (lpString="*.gzip") returned 6 [0104.063] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\FeedSync.dll", pszSpec="*.jpg") returned 0 [0104.063] lstrlenA (lpString="*.jpg") returned 5 [0104.063] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\FeedSync.dll", pszSpec="*.jpeg") returned 0 [0104.063] lstrlenA (lpString="*.jpeg") returned 6 [0104.063] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\FeedSync.dll", pszSpec="*.psd") returned 0 [0104.063] lstrlenA (lpString="*.psd") returned 5 [0104.063] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\FeedSync.dll", pszSpec="*.cdr") returned 0 [0104.063] lstrlenA (lpString="*.cdr") returned 5 [0104.063] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\FeedSync.dll", pszSpec="*.dwg") returned 0 [0104.063] lstrlenA (lpString="*.dwg") returned 5 [0104.063] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\FeedSync.dll", pszSpec="*.max") returned 0 [0104.063] lstrlenA (lpString="*.max") returned 5 [0104.063] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\FeedSync.dll", pszSpec="*.bmp") returned 0 [0104.063] lstrlenA (lpString="*.bmp") returned 5 [0104.063] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\FeedSync.dll", pszSpec="*.gif") returned 0 [0104.063] lstrlenA (lpString="*.gif") returned 5 [0104.064] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\FeedSync.dll", pszSpec="*.png") returned 0 [0104.064] lstrlenA (lpString="*.png") returned 5 [0104.064] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\FeedSync.dll", pszSpec="*.doc") returned 0 [0104.064] lstrlenA (lpString="*.doc") returned 5 [0104.064] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\FeedSync.dll", pszSpec="*.docx") returned 0 [0104.064] lstrlenA (lpString="*.docx") returned 6 [0104.064] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\FeedSync.dll", pszSpec="*.xls") returned 0 [0104.064] lstrlenA (lpString="*.xls") returned 5 [0104.064] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\FeedSync.dll", pszSpec="*.xlsx") returned 0 [0104.064] lstrlenA (lpString="*.xlsx") returned 6 [0104.064] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\FeedSync.dll", pszSpec="*.ppt") returned 0 [0104.064] lstrlenA (lpString="*.ppt") returned 5 [0104.064] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\FeedSync.dll", pszSpec="*.pptx") returned 0 [0104.064] lstrlenA (lpString="*.pptx") returned 6 [0104.064] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\FeedSync.dll", pszSpec="*.txt") returned 0 [0104.064] lstrlenA (lpString="*.txt") returned 5 [0104.064] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\FeedSync.dll", pszSpec="*.pdf") returned 0 [0104.064] lstrlenA (lpString="*.pdf") returned 5 [0104.064] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\FeedSync.dll", pszSpec="*.djvu") returned 0 [0104.064] lstrlenA (lpString="*.djvu") returned 6 [0104.064] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\FeedSync.dll", pszSpec="*.htm") returned 0 [0104.064] lstrlenA (lpString="*.htm") returned 5 [0104.064] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\FeedSync.dll", pszSpec="*.html") returned 0 [0104.064] lstrlenA (lpString="*.html") returned 6 [0104.064] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\FeedSync.dll", pszSpec="*.mdb") returned 0 [0104.064] lstrlenA (lpString="*.mdb") returned 5 [0104.064] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\FeedSync.dll", pszSpec="*.cer") returned 0 [0104.064] lstrlenA (lpString="*.cer") returned 5 [0104.064] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\FeedSync.dll", pszSpec="*.p12") returned 0 [0104.064] lstrlenA (lpString="*.p12") returned 5 [0104.064] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\FeedSync.dll", pszSpec="*.pfx") returned 0 [0104.064] lstrlenA (lpString="*.pfx") returned 5 [0104.064] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\FeedSync.dll", pszSpec="*.kwm") returned 0 [0104.064] lstrlenA (lpString="*.kwm") returned 5 [0104.064] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\FeedSync.dll", pszSpec="*.pwm") returned 0 [0104.064] lstrlenA (lpString="*.pwm") returned 5 [0104.064] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\FeedSync.dll", pszSpec="*.1cd") returned 0 [0104.064] lstrlenA (lpString="*.1cd") returned 5 [0104.064] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\FeedSync.dll", pszSpec="*.md") returned 0 [0104.064] lstrlenA (lpString="*.md") returned 4 [0104.064] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\FeedSync.dll", pszSpec="*.mdf") returned 0 [0104.064] lstrlenA (lpString="*.mdf") returned 5 [0104.064] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\FeedSync.dll", pszSpec="*.dbf") returned 0 [0104.064] lstrlenA (lpString="*.dbf") returned 5 [0104.064] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\FeedSync.dll", pszSpec="*.odt") returned 0 [0104.064] lstrlenA (lpString="*.odt") returned 5 [0104.064] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\FeedSync.dll", pszSpec="*.vob") returned 0 [0104.064] lstrlenA (lpString="*.vob") returned 5 [0104.064] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\FeedSync.dll", pszSpec="*.ifo") returned 0 [0104.064] lstrlenA (lpString="*.ifo") returned 5 [0104.064] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\FeedSync.dll", pszSpec="*.lnk") returned 0 [0104.064] lstrlenA (lpString="*.lnk") returned 5 [0104.064] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\FeedSync.dll", pszSpec="*.torrent") returned 0 [0104.065] lstrlenA (lpString="*.torrent") returned 9 [0104.065] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\FeedSync.dll", pszSpec="*.mov") returned 0 [0104.065] lstrlenA (lpString="*.mov") returned 5 [0104.065] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\FeedSync.dll", pszSpec="*.m2v") returned 0 [0104.065] lstrlenA (lpString="*.m2v") returned 5 [0104.065] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\FeedSync.dll", pszSpec="*.3gp") returned 0 [0104.065] lstrlenA (lpString="*.3gp") returned 5 [0104.065] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\FeedSync.dll", pszSpec="*.mpeg") returned 0 [0104.065] lstrlenA (lpString="*.mpeg") returned 6 [0104.065] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\FeedSync.dll", pszSpec="*.mpg") returned 0 [0104.065] lstrlenA (lpString="*.mpg") returned 5 [0104.065] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\FeedSync.dll", pszSpec="*.flv") returned 0 [0104.065] lstrlenA (lpString="*.flv") returned 5 [0104.065] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\FeedSync.dll", pszSpec="*.avi") returned 0 [0104.065] lstrlenA (lpString="*.avi") returned 5 [0104.065] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\FeedSync.dll", pszSpec="*.mp4") returned 0 [0104.065] lstrlenA (lpString="*.mp4") returned 5 [0104.065] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\FeedSync.dll", pszSpec="*.wmv") returned 0 [0104.065] lstrlenA (lpString="*.wmv") returned 5 [0104.065] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\FeedSync.dll", pszSpec="*.divx") returned 0 [0104.065] lstrlenA (lpString="*.divx") returned 6 [0104.065] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\FeedSync.dll", pszSpec="*.mkv") returned 0 [0104.065] lstrlenA (lpString="*.mkv") returned 5 [0104.065] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\FeedSync.dll", pszSpec="*.mp3") returned 0 [0104.065] lstrlenA (lpString="*.mp3") returned 5 [0104.065] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\FeedSync.dll", pszSpec="*.wav") returned 0 [0104.065] lstrlenA (lpString="*.wav") returned 5 [0104.065] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\FeedSync.dll", pszSpec="*.flac") returned 0 [0104.065] lstrlenA (lpString="*.flac") returned 6 [0104.065] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\FeedSync.dll", pszSpec="*.ape") returned 0 [0104.065] lstrlenA (lpString="*.ape") returned 5 [0104.065] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\FeedSync.dll", pszSpec="*.wma") returned 0 [0104.065] lstrlenA (lpString="*.wma") returned 5 [0104.065] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\FeedSync.dll", pszSpec="*.ac3") returned 0 [0104.065] lstrlenA (lpString="*.ac3") returned 5 [0104.065] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Microsoft.Synchronization.dll") returned -1 [0104.065] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Synchronization.dll") returned -1 [0104.065] lstrcmpiA (lpString1="", lpString2="Microsoft.Synchronization.dll") returned -1 [0104.065] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\Microsoft.Synchronization.dll", pszSpec="*.zip") returned 0 [0104.066] lstrlenA (lpString="*.zip") returned 5 [0104.066] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\Microsoft.Synchronization.dll", pszSpec="*.rar") returned 0 [0104.066] lstrlenA (lpString="*.rar") returned 5 [0104.066] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\Microsoft.Synchronization.dll", pszSpec="*.7z") returned 0 [0104.066] lstrlenA (lpString="*.7z") returned 4 [0104.066] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\Microsoft.Synchronization.dll", pszSpec="*.tar") returned 0 [0104.066] lstrlenA (lpString="*.tar") returned 5 [0104.066] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\Microsoft.Synchronization.dll", pszSpec="*.gzip") returned 0 [0104.066] lstrlenA (lpString="*.gzip") returned 6 [0104.066] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\Microsoft.Synchronization.dll", pszSpec="*.jpg") returned 0 [0104.066] lstrlenA (lpString="*.jpg") returned 5 [0104.066] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\Microsoft.Synchronization.dll", pszSpec="*.jpeg") returned 0 [0104.066] lstrlenA (lpString="*.jpeg") returned 6 [0104.066] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\Microsoft.Synchronization.dll", pszSpec="*.psd") returned 0 [0104.066] lstrlenA (lpString="*.psd") returned 5 [0104.066] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\Microsoft.Synchronization.dll", pszSpec="*.cdr") returned 0 [0104.066] lstrlenA (lpString="*.cdr") returned 5 [0104.066] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\Microsoft.Synchronization.dll", pszSpec="*.dwg") returned 0 [0104.066] lstrlenA (lpString="*.dwg") returned 5 [0104.066] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\Microsoft.Synchronization.dll", pszSpec="*.max") returned 0 [0104.066] lstrlenA (lpString="*.max") returned 5 [0104.066] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\Microsoft.Synchronization.dll", pszSpec="*.bmp") returned 0 [0104.066] lstrlenA (lpString="*.bmp") returned 5 [0104.066] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\Microsoft.Synchronization.dll", pszSpec="*.gif") returned 0 [0104.066] lstrlenA (lpString="*.gif") returned 5 [0104.066] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\Microsoft.Synchronization.dll", pszSpec="*.png") returned 0 [0104.066] lstrlenA (lpString="*.png") returned 5 [0104.066] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\Microsoft.Synchronization.dll", pszSpec="*.doc") returned 0 [0104.066] lstrlenA (lpString="*.doc") returned 5 [0104.066] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\Microsoft.Synchronization.dll", pszSpec="*.docx") returned 0 [0104.066] lstrlenA (lpString="*.docx") returned 6 [0104.066] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\Microsoft.Synchronization.dll", pszSpec="*.xls") returned 0 [0104.066] lstrlenA (lpString="*.xls") returned 5 [0104.066] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\Microsoft.Synchronization.dll", pszSpec="*.xlsx") returned 0 [0104.066] lstrlenA (lpString="*.xlsx") returned 6 [0104.066] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\Microsoft.Synchronization.dll", pszSpec="*.ppt") returned 0 [0104.066] lstrlenA (lpString="*.ppt") returned 5 [0104.066] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\Microsoft.Synchronization.dll", pszSpec="*.pptx") returned 0 [0104.066] lstrlenA (lpString="*.pptx") returned 6 [0104.066] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\Microsoft.Synchronization.dll", pszSpec="*.txt") returned 0 [0104.066] lstrlenA (lpString="*.txt") returned 5 [0104.066] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\Microsoft.Synchronization.dll", pszSpec="*.pdf") returned 0 [0104.066] lstrlenA (lpString="*.pdf") returned 5 [0104.066] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\Microsoft.Synchronization.dll", pszSpec="*.djvu") returned 0 [0104.066] lstrlenA (lpString="*.djvu") returned 6 [0104.066] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\Microsoft.Synchronization.dll", pszSpec="*.htm") returned 0 [0104.066] lstrlenA (lpString="*.htm") returned 5 [0104.066] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\Microsoft.Synchronization.dll", pszSpec="*.html") returned 0 [0104.066] lstrlenA (lpString="*.html") returned 6 [0104.066] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\Microsoft.Synchronization.dll", pszSpec="*.mdb") returned 0 [0104.066] lstrlenA (lpString="*.mdb") returned 5 [0104.066] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\Microsoft.Synchronization.dll", pszSpec="*.cer") returned 0 [0104.066] lstrlenA (lpString="*.cer") returned 5 [0104.067] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\Microsoft.Synchronization.dll", pszSpec="*.p12") returned 0 [0104.067] lstrlenA (lpString="*.p12") returned 5 [0104.067] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\Microsoft.Synchronization.dll", pszSpec="*.pfx") returned 0 [0104.067] lstrlenA (lpString="*.pfx") returned 5 [0104.067] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\Microsoft.Synchronization.dll", pszSpec="*.kwm") returned 0 [0104.067] lstrlenA (lpString="*.kwm") returned 5 [0104.067] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\Microsoft.Synchronization.dll", pszSpec="*.pwm") returned 0 [0104.067] lstrlenA (lpString="*.pwm") returned 5 [0104.067] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\Microsoft.Synchronization.dll", pszSpec="*.1cd") returned 0 [0104.067] lstrlenA (lpString="*.1cd") returned 5 [0104.067] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\Microsoft.Synchronization.dll", pszSpec="*.md") returned 0 [0104.067] lstrlenA (lpString="*.md") returned 4 [0104.067] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\Microsoft.Synchronization.dll", pszSpec="*.mdf") returned 0 [0104.067] lstrlenA (lpString="*.mdf") returned 5 [0104.067] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\Microsoft.Synchronization.dll", pszSpec="*.dbf") returned 0 [0104.067] lstrlenA (lpString="*.dbf") returned 5 [0104.067] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\Microsoft.Synchronization.dll", pszSpec="*.odt") returned 0 [0104.067] lstrlenA (lpString="*.odt") returned 5 [0104.067] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\Microsoft.Synchronization.dll", pszSpec="*.vob") returned 0 [0104.067] lstrlenA (lpString="*.vob") returned 5 [0104.067] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\Microsoft.Synchronization.dll", pszSpec="*.ifo") returned 0 [0104.067] lstrlenA (lpString="*.ifo") returned 5 [0104.067] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\Microsoft.Synchronization.dll", pszSpec="*.lnk") returned 0 [0104.067] lstrlenA (lpString="*.lnk") returned 5 [0104.067] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\Microsoft.Synchronization.dll", pszSpec="*.torrent") returned 0 [0104.067] lstrlenA (lpString="*.torrent") returned 9 [0104.067] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\Microsoft.Synchronization.dll", pszSpec="*.mov") returned 0 [0104.067] lstrlenA (lpString="*.mov") returned 5 [0104.067] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\Microsoft.Synchronization.dll", pszSpec="*.m2v") returned 0 [0104.067] lstrlenA (lpString="*.m2v") returned 5 [0104.067] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\Microsoft.Synchronization.dll", pszSpec="*.3gp") returned 0 [0104.067] lstrlenA (lpString="*.3gp") returned 5 [0104.067] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\Microsoft.Synchronization.dll", pszSpec="*.mpeg") returned 0 [0104.067] lstrlenA (lpString="*.mpeg") returned 6 [0104.067] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\Microsoft.Synchronization.dll", pszSpec="*.mpg") returned 0 [0104.067] lstrlenA (lpString="*.mpg") returned 5 [0104.067] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\Microsoft.Synchronization.dll", pszSpec="*.flv") returned 0 [0104.067] lstrlenA (lpString="*.flv") returned 5 [0104.067] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\Microsoft.Synchronization.dll", pszSpec="*.avi") returned 0 [0104.067] lstrlenA (lpString="*.avi") returned 5 [0104.067] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\Microsoft.Synchronization.dll", pszSpec="*.mp4") returned 0 [0104.067] lstrlenA (lpString="*.mp4") returned 5 [0104.067] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\Microsoft.Synchronization.dll", pszSpec="*.wmv") returned 0 [0104.067] lstrlenA (lpString="*.wmv") returned 5 [0104.067] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\Microsoft.Synchronization.dll", pszSpec="*.divx") returned 0 [0104.067] lstrlenA (lpString="*.divx") returned 6 [0104.067] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\Microsoft.Synchronization.dll", pszSpec="*.mkv") returned 0 [0104.067] lstrlenA (lpString="*.mkv") returned 5 [0104.067] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\Microsoft.Synchronization.dll", pszSpec="*.mp3") returned 0 [0104.067] lstrlenA (lpString="*.mp3") returned 5 [0104.067] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\Microsoft.Synchronization.dll", pszSpec="*.wav") returned 0 [0104.067] lstrlenA (lpString="*.wav") returned 5 [0104.068] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\Microsoft.Synchronization.dll", pszSpec="*.flac") returned 0 [0104.068] lstrlenA (lpString="*.flac") returned 6 [0104.068] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\Microsoft.Synchronization.dll", pszSpec="*.ape") returned 0 [0104.068] lstrlenA (lpString="*.ape") returned 5 [0104.068] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\Microsoft.Synchronization.dll", pszSpec="*.wma") returned 0 [0104.068] lstrlenA (lpString="*.wma") returned 5 [0104.068] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\Microsoft.Synchronization.dll", pszSpec="*.ac3") returned 0 [0104.068] lstrlenA (lpString="*.ac3") returned 5 [0104.068] FindNextFileA (in: hFindFile=0x5be220, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0104.068] lstrcmpA (lpString1=".", lpString2="resources") returned -1 [0104.068] lstrcmpA (lpString1="..", lpString2="resources") returned -1 [0104.068] lstrlenA (lpString="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\resources") returned 68 [0104.068] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\resources\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be260 [0104.069] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0104.069] FindNextFileA (in: hFindFile=0x5be260, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0104.069] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0104.069] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0104.069] FindNextFileA (in: hFindFile=0x5be260, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0104.069] lstrcmpA (lpString1=".", lpString2="1033") returned -1 [0104.069] lstrcmpA (lpString1="..", lpString2="1033") returned -1 [0104.069] lstrlenA (lpString="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\resources\\1033") returned 73 [0104.069] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\resources\\1033\\*.*", lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 0x5be2a0 [0104.069] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0104.069] FindNextFileA (in: hFindFile=0x5be2a0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0104.069] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0104.069] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0104.069] FindNextFileA (in: hFindFile=0x5be2a0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0104.069] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0104.069] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Synchronization.rll") returned -1 [0104.069] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Synchronization.rll") returned -1 [0104.069] lstrcmpiA (lpString1="", lpString2="Synchronization.rll") returned -1 [0104.069] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\resources\\1033\\Synchronization.rll", pszSpec="*.zip") returned 0 [0104.069] lstrlenA (lpString="*.zip") returned 5 [0104.069] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\resources\\1033\\Synchronization.rll", pszSpec="*.rar") returned 0 [0104.069] lstrlenA (lpString="*.rar") returned 5 [0104.069] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\resources\\1033\\Synchronization.rll", pszSpec="*.7z") returned 0 [0104.069] lstrlenA (lpString="*.7z") returned 4 [0104.069] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\resources\\1033\\Synchronization.rll", pszSpec="*.tar") returned 0 [0104.070] lstrlenA (lpString="*.tar") returned 5 [0104.070] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\resources\\1033\\Synchronization.rll", pszSpec="*.gzip") returned 0 [0104.070] lstrlenA (lpString="*.gzip") returned 6 [0104.070] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\resources\\1033\\Synchronization.rll", pszSpec="*.jpg") returned 0 [0104.070] lstrlenA (lpString="*.jpg") returned 5 [0104.070] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\resources\\1033\\Synchronization.rll", pszSpec="*.jpeg") returned 0 [0104.070] lstrlenA (lpString="*.jpeg") returned 6 [0104.070] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\resources\\1033\\Synchronization.rll", pszSpec="*.psd") returned 0 [0104.070] lstrlenA (lpString="*.psd") returned 5 [0104.070] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\resources\\1033\\Synchronization.rll", pszSpec="*.cdr") returned 0 [0104.070] lstrlenA (lpString="*.cdr") returned 5 [0104.070] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\resources\\1033\\Synchronization.rll", pszSpec="*.dwg") returned 0 [0104.070] lstrlenA (lpString="*.dwg") returned 5 [0104.070] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\resources\\1033\\Synchronization.rll", pszSpec="*.max") returned 0 [0104.070] lstrlenA (lpString="*.max") returned 5 [0104.070] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\resources\\1033\\Synchronization.rll", pszSpec="*.bmp") returned 0 [0104.070] lstrlenA (lpString="*.bmp") returned 5 [0104.070] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\resources\\1033\\Synchronization.rll", pszSpec="*.gif") returned 0 [0104.070] lstrlenA (lpString="*.gif") returned 5 [0104.070] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\resources\\1033\\Synchronization.rll", pszSpec="*.png") returned 0 [0104.070] lstrlenA (lpString="*.png") returned 5 [0104.070] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\resources\\1033\\Synchronization.rll", pszSpec="*.doc") returned 0 [0104.070] lstrlenA (lpString="*.doc") returned 5 [0104.070] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\resources\\1033\\Synchronization.rll", pszSpec="*.docx") returned 0 [0104.071] lstrlenA (lpString="*.docx") returned 6 [0104.071] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\resources\\1033\\Synchronization.rll", pszSpec="*.xls") returned 0 [0104.071] lstrlenA (lpString="*.xls") returned 5 [0104.071] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\resources\\1033\\Synchronization.rll", pszSpec="*.xlsx") returned 0 [0104.071] lstrlenA (lpString="*.xlsx") returned 6 [0104.071] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\resources\\1033\\Synchronization.rll", pszSpec="*.ppt") returned 0 [0104.071] lstrlenA (lpString="*.ppt") returned 5 [0104.071] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\resources\\1033\\Synchronization.rll", pszSpec="*.pptx") returned 0 [0104.071] lstrlenA (lpString="*.pptx") returned 6 [0104.071] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\resources\\1033\\Synchronization.rll", pszSpec="*.txt") returned 0 [0104.071] lstrlenA (lpString="*.txt") returned 5 [0104.071] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\resources\\1033\\Synchronization.rll", pszSpec="*.pdf") returned 0 [0104.071] lstrlenA (lpString="*.pdf") returned 5 [0104.071] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\resources\\1033\\Synchronization.rll", pszSpec="*.djvu") returned 0 [0104.071] lstrlenA (lpString="*.djvu") returned 6 [0104.071] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\resources\\1033\\Synchronization.rll", pszSpec="*.htm") returned 0 [0104.071] lstrlenA (lpString="*.htm") returned 5 [0104.071] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\resources\\1033\\Synchronization.rll", pszSpec="*.html") returned 0 [0104.071] lstrlenA (lpString="*.html") returned 6 [0104.071] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\resources\\1033\\Synchronization.rll", pszSpec="*.mdb") returned 0 [0104.071] lstrlenA (lpString="*.mdb") returned 5 [0104.071] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\resources\\1033\\Synchronization.rll", pszSpec="*.cer") returned 0 [0104.071] lstrlenA (lpString="*.cer") returned 5 [0104.071] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\resources\\1033\\Synchronization.rll", pszSpec="*.p12") returned 0 [0104.071] lstrlenA (lpString="*.p12") returned 5 [0104.071] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\resources\\1033\\Synchronization.rll", pszSpec="*.pfx") returned 0 [0104.071] lstrlenA (lpString="*.pfx") returned 5 [0104.071] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\resources\\1033\\Synchronization.rll", pszSpec="*.kwm") returned 0 [0104.071] lstrlenA (lpString="*.kwm") returned 5 [0104.071] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\resources\\1033\\Synchronization.rll", pszSpec="*.pwm") returned 0 [0104.071] lstrlenA (lpString="*.pwm") returned 5 [0104.071] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\resources\\1033\\Synchronization.rll", pszSpec="*.1cd") returned 0 [0104.071] lstrlenA (lpString="*.1cd") returned 5 [0104.071] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\resources\\1033\\Synchronization.rll", pszSpec="*.md") returned 0 [0104.071] lstrlenA (lpString="*.md") returned 4 [0104.071] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\resources\\1033\\Synchronization.rll", pszSpec="*.mdf") returned 0 [0104.072] lstrlenA (lpString="*.mdf") returned 5 [0104.072] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\resources\\1033\\Synchronization.rll", pszSpec="*.dbf") returned 0 [0104.072] lstrlenA (lpString="*.dbf") returned 5 [0104.072] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\resources\\1033\\Synchronization.rll", pszSpec="*.odt") returned 0 [0104.072] lstrlenA (lpString="*.odt") returned 5 [0104.072] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\resources\\1033\\Synchronization.rll", pszSpec="*.vob") returned 0 [0104.072] lstrlenA (lpString="*.vob") returned 5 [0104.072] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\resources\\1033\\Synchronization.rll", pszSpec="*.ifo") returned 0 [0104.072] lstrlenA (lpString="*.ifo") returned 5 [0104.072] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\resources\\1033\\Synchronization.rll", pszSpec="*.lnk") returned 0 [0104.072] lstrlenA (lpString="*.lnk") returned 5 [0104.072] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\resources\\1033\\Synchronization.rll", pszSpec="*.torrent") returned 0 [0104.072] lstrlenA (lpString="*.torrent") returned 9 [0104.072] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\resources\\1033\\Synchronization.rll", pszSpec="*.mov") returned 0 [0104.072] lstrlenA (lpString="*.mov") returned 5 [0104.072] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\resources\\1033\\Synchronization.rll", pszSpec="*.m2v") returned 0 [0104.072] lstrlenA (lpString="*.m2v") returned 5 [0104.072] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\resources\\1033\\Synchronization.rll", pszSpec="*.3gp") returned 0 [0104.072] lstrlenA (lpString="*.3gp") returned 5 [0104.072] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\resources\\1033\\Synchronization.rll", pszSpec="*.mpeg") returned 0 [0104.072] lstrlenA (lpString="*.mpeg") returned 6 [0104.072] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\resources\\1033\\Synchronization.rll", pszSpec="*.mpg") returned 0 [0104.072] lstrlenA (lpString="*.mpg") returned 5 [0104.072] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\resources\\1033\\Synchronization.rll", pszSpec="*.flv") returned 0 [0104.072] lstrlenA (lpString="*.flv") returned 5 [0104.072] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\resources\\1033\\Synchronization.rll", pszSpec="*.avi") returned 0 [0104.072] lstrlenA (lpString="*.avi") returned 5 [0104.072] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\resources\\1033\\Synchronization.rll", pszSpec="*.mp4") returned 0 [0104.072] lstrlenA (lpString="*.mp4") returned 5 [0104.072] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\resources\\1033\\Synchronization.rll", pszSpec="*.wmv") returned 0 [0104.072] lstrlenA (lpString="*.wmv") returned 5 [0104.072] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\resources\\1033\\Synchronization.rll", pszSpec="*.divx") returned 0 [0104.072] lstrlenA (lpString="*.divx") returned 6 [0104.072] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\resources\\1033\\Synchronization.rll", pszSpec="*.mkv") returned 0 [0104.072] lstrlenA (lpString="*.mkv") returned 5 [0104.072] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\resources\\1033\\Synchronization.rll", pszSpec="*.mp3") returned 0 [0104.072] lstrlenA (lpString="*.mp3") returned 5 [0104.072] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\resources\\1033\\Synchronization.rll", pszSpec="*.wav") returned 0 [0104.072] lstrlenA (lpString="*.wav") returned 5 [0104.072] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\resources\\1033\\Synchronization.rll", pszSpec="*.flac") returned 0 [0104.072] lstrlenA (lpString="*.flac") returned 6 [0104.072] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\resources\\1033\\Synchronization.rll", pszSpec="*.ape") returned 0 [0104.072] lstrlenA (lpString="*.ape") returned 5 [0104.072] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\resources\\1033\\Synchronization.rll", pszSpec="*.wma") returned 0 [0104.072] lstrlenA (lpString="*.wma") returned 5 [0104.072] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\resources\\1033\\Synchronization.rll", pszSpec="*.ac3") returned 0 [0104.072] lstrlenA (lpString="*.ac3") returned 5 [0104.072] FindNextFileA (in: hFindFile=0x5be2a0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 0 [0104.073] FindClose (in: hFindFile=0x5be2a0 | out: hFindFile=0x5be2a0) returned 1 [0104.073] FindNextFileA (in: hFindFile=0x5be260, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0 [0104.073] FindClose (in: hFindFile=0x5be260 | out: hFindFile=0x5be260) returned 1 [0104.073] FindNextFileA (in: hFindFile=0x5be220, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0104.073] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0104.073] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Synchronization.dll") returned -1 [0104.073] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Synchronization.dll") returned -1 [0104.073] lstrcmpiA (lpString1="", lpString2="Synchronization.dll") returned -1 [0104.073] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\*.*") returned="*.*" [0104.073] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\", lpString2="Synchronization.dll" | out: lpString1="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\Synchronization.dll") returned="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\Synchronization.dll" [0104.073] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\Synchronization.dll", pszSpec="*.zip") returned 0 [0104.073] lstrlenA (lpString="*.zip") returned 5 [0104.073] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\Synchronization.dll", pszSpec="*.rar") returned 0 [0104.073] lstrlenA (lpString="*.rar") returned 5 [0104.073] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\Synchronization.dll", pszSpec="*.7z") returned 0 [0104.073] lstrlenA (lpString="*.7z") returned 4 [0104.073] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\Synchronization.dll", pszSpec="*.tar") returned 0 [0104.073] lstrlenA (lpString="*.tar") returned 5 [0104.073] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\Synchronization.dll", pszSpec="*.gzip") returned 0 [0104.073] lstrlenA (lpString="*.gzip") returned 6 [0104.073] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\Synchronization.dll", pszSpec="*.jpg") returned 0 [0104.073] lstrlenA (lpString="*.jpg") returned 5 [0104.073] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\Synchronization.dll", pszSpec="*.jpeg") returned 0 [0104.073] lstrlenA (lpString="*.jpeg") returned 6 [0104.073] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\Synchronization.dll", pszSpec="*.psd") returned 0 [0104.073] lstrlenA (lpString="*.psd") returned 5 [0104.073] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\Synchronization.dll", pszSpec="*.cdr") returned 0 [0104.073] lstrlenA (lpString="*.cdr") returned 5 [0104.073] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\Synchronization.dll", pszSpec="*.dwg") returned 0 [0104.073] lstrlenA (lpString="*.dwg") returned 5 [0104.073] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\Synchronization.dll", pszSpec="*.max") returned 0 [0104.073] lstrlenA (lpString="*.max") returned 5 [0104.074] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\Synchronization.dll", pszSpec="*.bmp") returned 0 [0104.074] lstrlenA (lpString="*.bmp") returned 5 [0104.074] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\Synchronization.dll", pszSpec="*.gif") returned 0 [0104.074] lstrlenA (lpString="*.gif") returned 5 [0104.074] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\Synchronization.dll", pszSpec="*.png") returned 0 [0104.074] lstrlenA (lpString="*.png") returned 5 [0104.074] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\Synchronization.dll", pszSpec="*.doc") returned 0 [0104.074] lstrlenA (lpString="*.doc") returned 5 [0104.074] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\Synchronization.dll", pszSpec="*.docx") returned 0 [0104.074] lstrlenA (lpString="*.docx") returned 6 [0104.074] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\Synchronization.dll", pszSpec="*.xls") returned 0 [0104.074] lstrlenA (lpString="*.xls") returned 5 [0104.074] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\Synchronization.dll", pszSpec="*.xlsx") returned 0 [0104.074] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\Synchronization.dll", pszSpec="*.ppt") returned 0 [0104.074] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\Synchronization.dll", pszSpec="*.pptx") returned 0 [0104.074] PathMatchSpecA (pszFile="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\Synchronization.dll", pszSpec="*.txt") returned 0 [0104.075] FindNextFileA (in: hFindFile=0x5be220, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0 [0104.075] FindClose (in: hFindFile=0x5be220 | out: hFindFile=0x5be220) returned 1 [0104.075] FindNextFileA (in: hFindFile=0x5be1e0, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0 [0104.075] FindClose (in: hFindFile=0x5be1e0 | out: hFindFile=0x5be1e0) returned 1 [0104.077] FindNextFileA (in: hFindFile=0x5be1a0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 0 [0104.077] FindClose (in: hFindFile=0x5be1a0 | out: hFindFile=0x5be1a0) returned 1 [0104.077] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf4e8 | out: lpFindFileData=0xaf4e8) returned 0 [0104.077] FindClose (in: hFindFile=0x5be160 | out: hFindFile=0x5be160) returned 1 [0104.077] FindNextFileA (in: hFindFile=0x5b90e0, lpFindFileData=0xaf638 | out: lpFindFileData=0xaf638) returned 1 [0104.077] lstrcmpA (lpString1=".", lpString2="Microsoft Synchronization Services") returned -1 [0104.077] lstrcmpA (lpString1="..", lpString2="Microsoft Synchronization Services") returned -1 [0104.077] PathFindFileNameA (pszPath="C:\\Program Files\\*.*") returned="*.*" [0104.077] lstrcatA (in: lpString1="C:\\Program Files\\", lpString2="Microsoft Synchronization Services" | out: lpString1="C:\\Program Files\\Microsoft Synchronization Services") returned="C:\\Program Files\\Microsoft Synchronization Services" [0104.077] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Synchronization Services\\*.*", lpFindFileData=0xaf4e8 | out: lpFindFileData=0xaf4e8) returned 0x5be160 [0104.077] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0104.077] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf4e8 | out: lpFindFileData=0xaf4e8) returned 1 [0104.077] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0104.077] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0104.077] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf4e8 | out: lpFindFileData=0xaf4e8) returned 1 [0104.077] lstrcmpA (lpString1=".", lpString2="ADO.NET") returned -1 [0104.077] lstrcmpA (lpString1="..", lpString2="ADO.NET") returned -1 [0104.077] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Synchronization Services\\*.*") returned="*.*" [0104.077] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Synchronization Services\\", lpString2="ADO.NET" | out: lpString1="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET") returned="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET" [0104.077] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\*.*", lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 0x5be1a0 [0104.077] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0104.077] FindNextFileA (in: hFindFile=0x5be1a0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0104.077] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0104.077] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0104.077] FindNextFileA (in: hFindFile=0x5be1a0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0104.077] lstrcmpA (lpString1=".", lpString2="v1.0") returned -1 [0104.078] lstrcmpA (lpString1="..", lpString2="v1.0") returned -1 [0104.078] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\*.*") returned="*.*" [0104.078] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\", lpString2="v1.0" | out: lpString1="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\v1.0") returned="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\v1.0" [0104.078] FindFirstFileA (in: lpFileName="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\v1.0\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be1e0 [0104.141] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0104.141] FindNextFileA (in: hFindFile=0x5be1e0, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0104.141] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0104.141] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0104.141] FindNextFileA (in: hFindFile=0x5be1e0, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0104.141] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0104.141] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Microsoft.Synchronization.Data.dll") returned -1 [0104.141] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Synchronization.Data.dll") returned -1 [0104.141] lstrcmpiA (lpString1="", lpString2="Microsoft.Synchronization.Data.dll") returned -1 [0104.141] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\v1.0\\*.*") returned="*.*" [0104.141] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\v1.0\\", lpString2="Microsoft.Synchronization.Data.dll" | out: lpString1="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\v1.0\\Microsoft.Synchronization.Data.dll") returned="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\v1.0\\Microsoft.Synchronization.Data.dll" [0104.141] FindNextFileA (in: hFindFile=0x5be1e0, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0104.141] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0104.141] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Microsoft.Synchronization.Data.Server.dll") returned -1 [0104.141] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Synchronization.Data.Server.dll") returned -1 [0104.141] lstrcmpiA (lpString1="", lpString2="Microsoft.Synchronization.Data.Server.dll") returned -1 [0104.141] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\v1.0\\Microsoft.Synchronization.Data.dll") returned="Microsoft.Synchronization.Data.dll" [0104.141] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\v1.0\\", lpString2="Microsoft.Synchronization.Data.Server.dll" | out: lpString1="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\v1.0\\Microsoft.Synchronization.Data.Server.dll") returned="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\v1.0\\Microsoft.Synchronization.Data.Server.dll" [0104.141] FindNextFileA (in: hFindFile=0x5be1e0, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0104.141] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0104.141] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Microsoft.Synchronization.Data.SqlServerCe.dll") returned -1 [0104.142] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Synchronization.Data.SqlServerCe.dll") returned -1 [0104.142] lstrcmpiA (lpString1="", lpString2="Microsoft.Synchronization.Data.SqlServerCe.dll") returned -1 [0104.142] PathFindFileNameA (pszPath="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\v1.0\\Microsoft.Synchronization.Data.Server.dll") returned="Microsoft.Synchronization.Data.Server.dll" [0104.142] lstrcatA (in: lpString1="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\v1.0\\", lpString2="Microsoft.Synchronization.Data.SqlServerCe.dll" | out: lpString1="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\v1.0\\Microsoft.Synchronization.Data.SqlServerCe.dll") returned="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\v1.0\\Microsoft.Synchronization.Data.SqlServerCe.dll" [0104.142] FindNextFileA (in: hFindFile=0x5be1e0, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0 [0104.142] FindClose (in: hFindFile=0x5be1e0 | out: hFindFile=0x5be1e0) returned 1 [0104.142] FindNextFileA (in: hFindFile=0x5be1a0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 0 [0104.142] FindClose (in: hFindFile=0x5be1a0 | out: hFindFile=0x5be1a0) returned 1 [0104.142] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf4e8 | out: lpFindFileData=0xaf4e8) returned 0 [0104.142] FindClose (in: hFindFile=0x5be160 | out: hFindFile=0x5be160) returned 1 [0104.142] FindNextFileA (in: hFindFile=0x5b90e0, lpFindFileData=0xaf638 | out: lpFindFileData=0xaf638) returned 1 [0104.142] lstrcmpA (lpString1=".", lpString2="MSBuild") returned -1 [0104.142] lstrcmpA (lpString1="..", lpString2="MSBuild") returned -1 [0104.142] PathFindFileNameA (pszPath="C:\\Program Files\\*.*") returned="*.*" [0104.142] lstrcatA (in: lpString1="C:\\Program Files\\", lpString2="MSBuild" | out: lpString1="C:\\Program Files\\MSBuild") returned="C:\\Program Files\\MSBuild" [0104.142] FindFirstFileA (in: lpFileName="C:\\Program Files\\MSBuild\\*.*", lpFindFileData=0xaf4e8 | out: lpFindFileData=0xaf4e8) returned 0x5be160 [0104.143] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0104.143] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf4e8 | out: lpFindFileData=0xaf4e8) returned 1 [0104.143] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0104.143] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0104.143] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf4e8 | out: lpFindFileData=0xaf4e8) returned 1 [0104.143] lstrcmpA (lpString1=".", lpString2="Microsoft") returned -1 [0104.143] lstrcmpA (lpString1="..", lpString2="Microsoft") returned -1 [0104.143] PathFindFileNameA (pszPath="C:\\Program Files\\MSBuild\\*.*") returned="*.*" [0104.143] lstrcatA (in: lpString1="C:\\Program Files\\MSBuild\\", lpString2="Microsoft" | out: lpString1="C:\\Program Files\\MSBuild\\Microsoft") returned="C:\\Program Files\\MSBuild\\Microsoft" [0104.143] FindFirstFileA (in: lpFileName="C:\\Program Files\\MSBuild\\Microsoft\\*.*", lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 0x5be1a0 [0104.152] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0104.152] FindNextFileA (in: hFindFile=0x5be1a0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0104.152] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0104.152] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0104.152] FindNextFileA (in: hFindFile=0x5be1a0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0104.152] lstrcmpA (lpString1=".", lpString2="Windows Workflow Foundation") returned -1 [0104.152] lstrcmpA (lpString1="..", lpString2="Windows Workflow Foundation") returned -1 [0104.152] PathFindFileNameA (pszPath="C:\\Program Files\\MSBuild\\Microsoft\\*.*") returned="*.*" [0104.152] lstrcatA (in: lpString1="C:\\Program Files\\MSBuild\\Microsoft\\", lpString2="Windows Workflow Foundation" | out: lpString1="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation") returned="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation" [0104.152] FindFirstFileA (in: lpFileName="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be1e0 [0104.152] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0104.153] FindNextFileA (in: hFindFile=0x5be1e0, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0104.153] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0104.153] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0104.153] FindNextFileA (in: hFindFile=0x5be1e0, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0104.153] lstrcmpA (lpString1=".", lpString2="v3.0") returned -1 [0104.153] lstrcmpA (lpString1="..", lpString2="v3.0") returned -1 [0104.153] PathFindFileNameA (pszPath="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\*.*") returned="*.*" [0104.153] lstrcatA (in: lpString1="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\", lpString2="v3.0" | out: lpString1="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0") returned="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0" [0104.153] FindFirstFileA (in: lpFileName="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be220 [0104.153] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0104.153] FindNextFileA (in: hFindFile=0x5be220, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0104.153] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0104.153] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0104.153] FindNextFileA (in: hFindFile=0x5be220, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0104.153] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0104.153] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Workflow.Targets") returned -1 [0104.153] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Workflow.Targets") returned -1 [0104.153] lstrcmpiA (lpString1="", lpString2="Workflow.Targets") returned -1 [0104.153] PathFindFileNameA (pszPath="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\*.*") returned="*.*" [0104.153] lstrcatA (in: lpString1="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\", lpString2="Workflow.Targets" | out: lpString1="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\Workflow.Targets") returned="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\Workflow.Targets" [0104.153] FindNextFileA (in: hFindFile=0x5be220, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0104.153] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0104.153] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Workflow.VisualBasic.Targets") returned -1 [0104.153] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Workflow.VisualBasic.Targets") returned -1 [0104.153] lstrcmpiA (lpString1="", lpString2="Workflow.VisualBasic.Targets") returned -1 [0104.153] PathFindFileNameA (pszPath="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\Workflow.Targets") returned="Workflow.Targets" [0104.153] lstrcatA (in: lpString1="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\", lpString2="Workflow.VisualBasic.Targets" | out: lpString1="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\Workflow.VisualBasic.Targets") returned="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\Workflow.VisualBasic.Targets" [0104.153] FindNextFileA (in: hFindFile=0x5be220, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0 [0104.153] FindClose (in: hFindFile=0x5be220 | out: hFindFile=0x5be220) returned 1 [0104.153] FindNextFileA (in: hFindFile=0x5be1e0, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0104.153] lstrcmpA (lpString1=".", lpString2="v3.5") returned -1 [0104.153] lstrcmpA (lpString1="..", lpString2="v3.5") returned -1 [0104.153] PathFindFileNameA (pszPath="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\*.*") returned="*.*" [0104.153] lstrcatA (in: lpString1="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\", lpString2="v3.5" | out: lpString1="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5") returned="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5" [0104.154] FindFirstFileA (in: lpFileName="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be220 [0104.154] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0104.154] FindNextFileA (in: hFindFile=0x5be220, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0104.154] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0104.154] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0104.154] FindNextFileA (in: hFindFile=0x5be220, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0104.154] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0104.154] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Workflow.Targets") returned -1 [0104.154] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Workflow.Targets") returned -1 [0104.154] lstrcmpiA (lpString1="", lpString2="Workflow.Targets") returned -1 [0104.154] PathFindFileNameA (pszPath="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\*.*") returned="*.*" [0104.154] lstrcatA (in: lpString1="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\", lpString2="Workflow.Targets" | out: lpString1="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\Workflow.Targets") returned="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\Workflow.Targets" [0104.154] FindNextFileA (in: hFindFile=0x5be220, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0104.154] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0104.154] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Workflow.VisualBasic.Targets") returned -1 [0104.154] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Workflow.VisualBasic.Targets") returned -1 [0104.154] lstrcmpiA (lpString1="", lpString2="Workflow.VisualBasic.Targets") returned -1 [0104.154] PathFindFileNameA (pszPath="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\Workflow.Targets") returned="Workflow.Targets" [0104.154] lstrcatA (in: lpString1="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\", lpString2="Workflow.VisualBasic.Targets" | out: lpString1="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\Workflow.VisualBasic.Targets") returned="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\Workflow.VisualBasic.Targets" [0104.154] FindNextFileA (in: hFindFile=0x5be220, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0 [0104.154] FindClose (in: hFindFile=0x5be220 | out: hFindFile=0x5be220) returned 1 [0104.154] FindNextFileA (in: hFindFile=0x5be1e0, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0 [0104.154] FindClose (in: hFindFile=0x5be1e0 | out: hFindFile=0x5be1e0) returned 1 [0104.154] FindNextFileA (in: hFindFile=0x5be1a0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 0 [0104.154] FindClose (in: hFindFile=0x5be1a0 | out: hFindFile=0x5be1a0) returned 1 [0104.155] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf4e8 | out: lpFindFileData=0xaf4e8) returned 0 [0104.155] FindClose (in: hFindFile=0x5be160 | out: hFindFile=0x5be160) returned 1 [0104.155] FindNextFileA (in: hFindFile=0x5b90e0, lpFindFileData=0xaf638 | out: lpFindFileData=0xaf638) returned 1 [0104.155] lstrcmpA (lpString1=".", lpString2="Reference Assemblies") returned -1 [0104.155] lstrcmpA (lpString1="..", lpString2="Reference Assemblies") returned -1 [0104.155] PathFindFileNameA (pszPath="C:\\Program Files\\*.*") returned="*.*" [0104.155] lstrcatA (in: lpString1="C:\\Program Files\\", lpString2="Reference Assemblies" | out: lpString1="C:\\Program Files\\Reference Assemblies") returned="C:\\Program Files\\Reference Assemblies" [0104.155] FindFirstFileA (in: lpFileName="C:\\Program Files\\Reference Assemblies\\*.*", lpFindFileData=0xaf4e8 | out: lpFindFileData=0xaf4e8) returned 0x5be160 [0104.155] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0104.155] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf4e8 | out: lpFindFileData=0xaf4e8) returned 1 [0104.155] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0104.155] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0104.155] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf4e8 | out: lpFindFileData=0xaf4e8) returned 1 [0104.155] lstrcmpA (lpString1=".", lpString2="Microsoft") returned -1 [0104.155] lstrcmpA (lpString1="..", lpString2="Microsoft") returned -1 [0104.155] PathFindFileNameA (pszPath="C:\\Program Files\\Reference Assemblies\\*.*") returned="*.*" [0104.155] lstrcatA (in: lpString1="C:\\Program Files\\Reference Assemblies\\", lpString2="Microsoft" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft") returned="C:\\Program Files\\Reference Assemblies\\Microsoft" [0104.155] FindFirstFileA (in: lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\*.*", lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 0x5be1a0 [0104.155] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0104.155] FindNextFileA (in: hFindFile=0x5be1a0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0104.155] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0104.155] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0104.155] FindNextFileA (in: hFindFile=0x5be1a0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0104.155] lstrcmpA (lpString1=".", lpString2="Framework") returned -1 [0104.155] lstrcmpA (lpString1="..", lpString2="Framework") returned -1 [0104.155] PathFindFileNameA (pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\*.*") returned="*.*" [0104.155] lstrcatA (in: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\", lpString2="Framework" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework" [0104.155] FindFirstFileA (in: lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be1e0 [0104.156] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0104.156] FindNextFileA (in: hFindFile=0x5be1e0, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0104.156] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0104.156] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0104.156] FindNextFileA (in: hFindFile=0x5be1e0, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0104.156] lstrcmpA (lpString1=".", lpString2="v3.0") returned -1 [0104.156] lstrcmpA (lpString1="..", lpString2="v3.0") returned -1 [0104.156] PathFindFileNameA (pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\*.*") returned="*.*" [0104.156] lstrcatA (in: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\", lpString2="v3.0" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0" [0104.156] FindFirstFileA (in: lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be220 [0104.161] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0104.161] FindNextFileA (in: hFindFile=0x5be220, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0104.161] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0104.161] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0104.161] FindNextFileA (in: hFindFile=0x5be220, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0104.161] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0104.161] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="PresentationBuildTasks.dll") returned -1 [0104.161] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PresentationBuildTasks.dll") returned -1 [0104.161] lstrcmpiA (lpString1="", lpString2="PresentationBuildTasks.dll") returned -1 [0104.162] PathFindFileNameA (pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\*.*") returned="*.*" [0104.162] lstrcatA (in: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\", lpString2="PresentationBuildTasks.dll" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationBuildTasks.dll") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationBuildTasks.dll" [0104.162] FindNextFileA (in: hFindFile=0x5be220, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0104.162] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0104.162] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="PresentationCore.dll") returned -1 [0104.162] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PresentationCore.dll") returned -1 [0104.162] lstrcmpiA (lpString1="", lpString2="PresentationCore.dll") returned -1 [0104.162] PathFindFileNameA (pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationBuildTasks.dll") returned="PresentationBuildTasks.dll" [0104.162] lstrcatA (in: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\", lpString2="PresentationCore.dll" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationCore.dll") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationCore.dll" [0104.162] FindNextFileA (in: hFindFile=0x5be220, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0104.162] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0104.162] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="PresentationFramework.Aero.dll") returned -1 [0104.162] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PresentationFramework.Aero.dll") returned -1 [0104.162] lstrcmpiA (lpString1="", lpString2="PresentationFramework.Aero.dll") returned -1 [0104.162] PathFindFileNameA (pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationCore.dll") returned="PresentationCore.dll" [0104.162] lstrcatA (in: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\", lpString2="PresentationFramework.Aero.dll" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationFramework.Aero.dll") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationFramework.Aero.dll" [0104.162] FindNextFileA (in: hFindFile=0x5be220, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0104.162] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0104.162] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="PresentationFramework.Classic.dll") returned -1 [0104.162] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PresentationFramework.Classic.dll") returned -1 [0104.162] lstrcmpiA (lpString1="", lpString2="PresentationFramework.Classic.dll") returned -1 [0104.162] PathFindFileNameA (pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationFramework.Aero.dll") returned="PresentationFramework.Aero.dll" [0104.162] lstrcatA (in: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\", lpString2="PresentationFramework.Classic.dll" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationFramework.Classic.dll") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationFramework.Classic.dll" [0104.162] FindNextFileA (in: hFindFile=0x5be220, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0104.162] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0104.162] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="PresentationFramework.dll") returned -1 [0104.162] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PresentationFramework.dll") returned -1 [0104.162] lstrcmpiA (lpString1="", lpString2="PresentationFramework.dll") returned -1 [0104.162] PathFindFileNameA (pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationFramework.Classic.dll") returned="PresentationFramework.Classic.dll" [0104.162] lstrcatA (in: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\", lpString2="PresentationFramework.dll" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationFramework.dll") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationFramework.dll" [0104.162] FindNextFileA (in: hFindFile=0x5be220, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0104.162] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0104.162] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="PresentationFramework.Luna.dll") returned -1 [0104.162] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PresentationFramework.Luna.dll") returned -1 [0104.162] lstrcmpiA (lpString1="", lpString2="PresentationFramework.Luna.dll") returned -1 [0104.162] PathFindFileNameA (pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationFramework.dll") returned="PresentationFramework.dll" [0104.163] lstrcatA (in: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\", lpString2="PresentationFramework.Luna.dll" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationFramework.Luna.dll") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationFramework.Luna.dll" [0104.163] FindNextFileA (in: hFindFile=0x5be220, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0104.163] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0104.163] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="PresentationFramework.Royale.dll") returned -1 [0104.163] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="PresentationFramework.Royale.dll") returned -1 [0104.163] lstrcmpiA (lpString1="", lpString2="PresentationFramework.Royale.dll") returned -1 [0104.163] PathFindFileNameA (pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationFramework.Luna.dll") returned="PresentationFramework.Luna.dll" [0104.163] lstrcatA (in: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\", lpString2="PresentationFramework.Royale.dll" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationFramework.Royale.dll") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationFramework.Royale.dll" [0104.163] FindNextFileA (in: hFindFile=0x5be220, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0104.163] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0104.163] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="ReachFramework.dll") returned -1 [0104.163] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ReachFramework.dll") returned -1 [0104.163] lstrcmpiA (lpString1="", lpString2="ReachFramework.dll") returned -1 [0104.163] PathFindFileNameA (pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationFramework.Royale.dll") returned="PresentationFramework.Royale.dll" [0104.163] lstrcatA (in: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\", lpString2="ReachFramework.dll" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\ReachFramework.dll") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\ReachFramework.dll" [0104.163] FindNextFileA (in: hFindFile=0x5be220, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0104.163] lstrcmpA (lpString1=".", lpString2="RedistList") returned -1 [0104.163] lstrcmpA (lpString1="..", lpString2="RedistList") returned -1 [0104.163] PathFindFileNameA (pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\ReachFramework.dll") returned="ReachFramework.dll" [0104.163] lstrcatA (in: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\", lpString2="RedistList" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList" [0104.163] FindFirstFileA (in: lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be260 [0104.163] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0104.163] FindNextFileA (in: hFindFile=0x5be260, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0104.163] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0104.163] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0104.163] FindNextFileA (in: hFindFile=0x5be260, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0104.163] PeekMessageA (in: lpMsg=0xaef84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaef84) returned 0 [0104.163] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="FrameworkList.xml") returned -1 [0104.163] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FrameworkList.xml") returned 1 [0104.163] lstrcmpiA (lpString1="", lpString2="FrameworkList.xml") returned -1 [0104.163] PathFindFileNameA (pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList\\*.*") returned="*.*" [0104.163] lstrcatA (in: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList\\", lpString2="FrameworkList.xml" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList\\FrameworkList.xml") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList\\FrameworkList.xml" [0104.164] FindNextFileA (in: hFindFile=0x5be260, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0 [0104.164] FindClose (in: hFindFile=0x5be260 | out: hFindFile=0x5be260) returned 1 [0104.164] FindNextFileA (in: hFindFile=0x5be220, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0104.164] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0104.164] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="System.IdentityModel.dll") returned -1 [0104.164] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.IdentityModel.dll") returned -1 [0104.164] lstrcmpiA (lpString1="", lpString2="System.IdentityModel.dll") returned -1 [0104.164] PathFindFileNameA (pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\*.*") returned="*.*" [0104.164] lstrcatA (in: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\", lpString2="System.IdentityModel.dll" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\System.IdentityModel.dll") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\System.IdentityModel.dll" [0104.164] FindNextFileA (in: hFindFile=0x5be220, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0104.164] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0104.164] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="System.IdentityModel.Selectors.dll") returned -1 [0104.164] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.IdentityModel.Selectors.dll") returned -1 [0104.164] lstrcmpiA (lpString1="", lpString2="System.IdentityModel.Selectors.dll") returned -1 [0104.164] PathFindFileNameA (pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\System.IdentityModel.dll") returned="System.IdentityModel.dll" [0104.164] lstrcatA (in: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\", lpString2="System.IdentityModel.Selectors.dll" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\System.IdentityModel.Selectors.dll") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\System.IdentityModel.Selectors.dll" [0104.164] FindNextFileA (in: hFindFile=0x5be220, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0104.164] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0104.164] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="System.IO.Log.dll") returned -1 [0104.164] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.IO.Log.dll") returned -1 [0104.164] lstrcmpiA (lpString1="", lpString2="System.IO.Log.dll") returned -1 [0104.164] PathFindFileNameA (pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\System.IdentityModel.Selectors.dll") returned="System.IdentityModel.Selectors.dll" [0104.164] lstrcatA (in: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\", lpString2="System.IO.Log.dll" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\System.IO.Log.dll") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\System.IO.Log.dll" [0104.164] FindNextFileA (in: hFindFile=0x5be220, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0104.164] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0104.164] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="System.Printing.dll") returned -1 [0104.164] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Printing.dll") returned -1 [0104.164] lstrcmpiA (lpString1="", lpString2="System.Printing.dll") returned -1 [0104.164] PathFindFileNameA (pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\System.IO.Log.dll") returned="System.IO.Log.dll" [0104.164] lstrcatA (in: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\", lpString2="System.Printing.dll" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\System.Printing.dll") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\System.Printing.dll" [0104.164] FindNextFileA (in: hFindFile=0x5be220, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0104.164] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0104.164] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="System.Runtime.Serialization.dll") returned -1 [0104.164] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Runtime.Serialization.dll") returned -1 [0104.164] lstrcmpiA (lpString1="", lpString2="System.Runtime.Serialization.dll") returned -1 [0104.165] PathFindFileNameA (pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\System.Printing.dll") returned="System.Printing.dll" [0104.165] lstrcatA (in: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\", lpString2="System.Runtime.Serialization.dll" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\System.Runtime.Serialization.dll") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\System.Runtime.Serialization.dll" [0104.165] FindNextFileA (in: hFindFile=0x5be220, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0104.166] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0104.166] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="System.ServiceModel.dll") returned -1 [0104.166] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.ServiceModel.dll") returned -1 [0104.166] lstrcmpiA (lpString1="", lpString2="System.ServiceModel.dll") returned -1 [0104.166] PathFindFileNameA (pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\System.Runtime.Serialization.dll") returned="System.Runtime.Serialization.dll" [0104.166] lstrcatA (in: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\", lpString2="System.ServiceModel.dll" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\System.ServiceModel.dll") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\System.ServiceModel.dll" [0104.166] FindNextFileA (in: hFindFile=0x5be220, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0104.166] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0104.166] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="System.Speech.dll") returned -1 [0104.166] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Speech.dll") returned -1 [0104.166] lstrcmpiA (lpString1="", lpString2="System.Speech.dll") returned -1 [0104.166] PathFindFileNameA (pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\System.ServiceModel.dll") returned="System.ServiceModel.dll" [0104.166] lstrcatA (in: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\", lpString2="System.Speech.dll" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\System.Speech.dll") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\System.Speech.dll" [0104.166] FindNextFileA (in: hFindFile=0x5be220, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0104.166] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0104.166] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="System.Workflow.Activities.dll") returned -1 [0104.166] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Workflow.Activities.dll") returned -1 [0104.166] lstrcmpiA (lpString1="", lpString2="System.Workflow.Activities.dll") returned -1 [0104.166] PathFindFileNameA (pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\System.Speech.dll") returned="System.Speech.dll" [0104.166] lstrcatA (in: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\", lpString2="System.Workflow.Activities.dll" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\System.Workflow.Activities.dll") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\System.Workflow.Activities.dll" [0104.166] FindNextFileA (in: hFindFile=0x5be220, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0104.166] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0104.166] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="System.Workflow.ComponentModel.dll") returned -1 [0104.166] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Workflow.ComponentModel.dll") returned -1 [0104.166] lstrcmpiA (lpString1="", lpString2="System.Workflow.ComponentModel.dll") returned -1 [0104.166] PathFindFileNameA (pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\System.Workflow.Activities.dll") returned="System.Workflow.Activities.dll" [0104.166] lstrcatA (in: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\", lpString2="System.Workflow.ComponentModel.dll" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\System.Workflow.ComponentModel.dll") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\System.Workflow.ComponentModel.dll" [0104.166] FindNextFileA (in: hFindFile=0x5be220, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0104.166] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0104.166] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="System.Workflow.Runtime.dll") returned -1 [0104.166] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Workflow.Runtime.dll") returned -1 [0104.166] lstrcmpiA (lpString1="", lpString2="System.Workflow.Runtime.dll") returned -1 [0104.166] PathFindFileNameA (pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\System.Workflow.ComponentModel.dll") returned="System.Workflow.ComponentModel.dll" [0104.166] lstrcatA (in: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\", lpString2="System.Workflow.Runtime.dll" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\System.Workflow.Runtime.dll") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\System.Workflow.Runtime.dll" [0104.166] FindNextFileA (in: hFindFile=0x5be220, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0104.166] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0104.166] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="UIAutomationClient.dll") returned -1 [0104.167] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="UIAutomationClient.dll") returned -1 [0104.167] lstrcmpiA (lpString1="", lpString2="UIAutomationClient.dll") returned -1 [0104.167] PathFindFileNameA (pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\System.Workflow.Runtime.dll") returned="System.Workflow.Runtime.dll" [0104.167] lstrcatA (in: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\", lpString2="UIAutomationClient.dll" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\UIAutomationClient.dll") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\UIAutomationClient.dll" [0104.167] FindNextFileA (in: hFindFile=0x5be220, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0104.167] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0104.167] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="UIAutomationClientsideProviders.dll") returned -1 [0104.167] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="UIAutomationClientsideProviders.dll") returned -1 [0104.167] lstrcmpiA (lpString1="", lpString2="UIAutomationClientsideProviders.dll") returned -1 [0104.167] PathFindFileNameA (pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\UIAutomationClient.dll") returned="UIAutomationClient.dll" [0104.167] lstrcatA (in: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\", lpString2="UIAutomationClientsideProviders.dll" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\UIAutomationClientsideProviders.dll") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\UIAutomationClientsideProviders.dll" [0104.167] FindNextFileA (in: hFindFile=0x5be220, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0104.167] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0104.167] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="UIAutomationProvider.dll") returned -1 [0104.167] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="UIAutomationProvider.dll") returned -1 [0104.167] lstrcmpiA (lpString1="", lpString2="UIAutomationProvider.dll") returned -1 [0104.167] PathFindFileNameA (pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\UIAutomationClientsideProviders.dll") returned="UIAutomationClientsideProviders.dll" [0104.167] lstrcatA (in: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\", lpString2="UIAutomationProvider.dll" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\UIAutomationProvider.dll") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\UIAutomationProvider.dll" [0104.167] FindNextFileA (in: hFindFile=0x5be220, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0104.167] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0104.167] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="UIAutomationTypes.dll") returned -1 [0104.167] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="UIAutomationTypes.dll") returned -1 [0104.167] lstrcmpiA (lpString1="", lpString2="UIAutomationTypes.dll") returned -1 [0104.167] PathFindFileNameA (pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\UIAutomationProvider.dll") returned="UIAutomationProvider.dll" [0104.167] lstrcatA (in: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\", lpString2="UIAutomationTypes.dll" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\UIAutomationTypes.dll") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\UIAutomationTypes.dll" [0104.167] FindNextFileA (in: hFindFile=0x5be220, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0104.167] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0104.167] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="WindowsBase.dll") returned -1 [0104.167] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WindowsBase.dll") returned -1 [0104.167] lstrcmpiA (lpString1="", lpString2="WindowsBase.dll") returned -1 [0104.167] PathFindFileNameA (pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\UIAutomationTypes.dll") returned="UIAutomationTypes.dll" [0104.167] lstrcatA (in: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\", lpString2="WindowsBase.dll" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\WindowsBase.dll") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\WindowsBase.dll" [0104.167] FindNextFileA (in: hFindFile=0x5be220, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0104.167] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0104.167] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="WindowsFormsIntegration.dll") returned -1 [0104.167] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WindowsFormsIntegration.dll") returned -1 [0104.167] lstrcmpiA (lpString1="", lpString2="WindowsFormsIntegration.dll") returned -1 [0104.167] PathFindFileNameA (pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\WindowsBase.dll") returned="WindowsBase.dll" [0104.167] lstrcatA (in: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\", lpString2="WindowsFormsIntegration.dll" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\WindowsFormsIntegration.dll") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\WindowsFormsIntegration.dll" [0104.168] FindNextFileA (in: hFindFile=0x5be220, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0104.168] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0104.168] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="WinFXList.xml") returned -1 [0104.168] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WinFXList.xml") returned -1 [0104.169] lstrcmpiA (lpString1="", lpString2="WinFXList.xml") returned -1 [0104.169] PathFindFileNameA (pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\WindowsFormsIntegration.dll") returned="WindowsFormsIntegration.dll" [0104.169] lstrcatA (in: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\", lpString2="WinFXList.xml" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\WinFXList.xml") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\WinFXList.xml" [0104.170] FindNextFileA (in: hFindFile=0x5be220, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0 [0104.170] FindClose (in: hFindFile=0x5be220 | out: hFindFile=0x5be220) returned 1 [0104.170] FindNextFileA (in: hFindFile=0x5be1e0, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0104.170] lstrcmpA (lpString1=".", lpString2="v3.5") returned -1 [0104.170] lstrcmpA (lpString1="..", lpString2="v3.5") returned -1 [0104.170] PathFindFileNameA (pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\*.*") returned="*.*" [0104.170] lstrcatA (in: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\", lpString2="v3.5" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5" [0104.170] FindFirstFileA (in: lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be220 [0104.171] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0104.171] FindNextFileA (in: hFindFile=0x5be220, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0104.174] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0104.174] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0104.174] FindNextFileA (in: hFindFile=0x5be220, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0104.174] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0104.174] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Microsoft.Build.Conversion.v3.5.dll") returned -1 [0104.174] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Build.Conversion.v3.5.dll") returned -1 [0104.174] lstrcmpiA (lpString1="", lpString2="Microsoft.Build.Conversion.v3.5.dll") returned -1 [0104.174] PathFindFileNameA (pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\*.*") returned="*.*" [0104.174] lstrcatA (in: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\", lpString2="Microsoft.Build.Conversion.v3.5.dll" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\Microsoft.Build.Conversion.v3.5.dll") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\Microsoft.Build.Conversion.v3.5.dll" [0104.175] FindNextFileA (in: hFindFile=0x5be220, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0104.175] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0104.175] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Microsoft.Build.Engine.dll") returned -1 [0104.175] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Build.Engine.dll") returned -1 [0104.175] lstrcmpiA (lpString1="", lpString2="Microsoft.Build.Engine.dll") returned -1 [0104.175] PathFindFileNameA (pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\Microsoft.Build.Conversion.v3.5.dll") returned="Microsoft.Build.Conversion.v3.5.dll" [0104.175] lstrcatA (in: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\", lpString2="Microsoft.Build.Engine.dll" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\Microsoft.Build.Engine.dll") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\Microsoft.Build.Engine.dll" [0104.175] FindNextFileA (in: hFindFile=0x5be220, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0104.175] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0104.175] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Microsoft.Build.Framework.dll") returned -1 [0104.175] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Build.Framework.dll") returned -1 [0104.175] lstrcmpiA (lpString1="", lpString2="Microsoft.Build.Framework.dll") returned -1 [0104.175] PathFindFileNameA (pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\Microsoft.Build.Engine.dll") returned="Microsoft.Build.Engine.dll" [0104.175] lstrcatA (in: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\", lpString2="Microsoft.Build.Framework.dll" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\Microsoft.Build.Framework.dll") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\Microsoft.Build.Framework.dll" [0104.175] FindNextFileA (in: hFindFile=0x5be220, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0104.175] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0104.175] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Microsoft.Build.Utilities.v3.5.dll") returned -1 [0104.175] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.Build.Utilities.v3.5.dll") returned -1 [0104.175] lstrcmpiA (lpString1="", lpString2="Microsoft.Build.Utilities.v3.5.dll") returned -1 [0104.175] PathFindFileNameA (pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\Microsoft.Build.Framework.dll") returned="Microsoft.Build.Framework.dll" [0104.175] lstrcatA (in: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\", lpString2="Microsoft.Build.Utilities.v3.5.dll" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\Microsoft.Build.Utilities.v3.5.dll") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\Microsoft.Build.Utilities.v3.5.dll" [0104.175] FindNextFileA (in: hFindFile=0x5be220, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0104.175] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0104.175] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Microsoft.VisualC.STLCLR.dll") returned -1 [0104.175] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Microsoft.VisualC.STLCLR.dll") returned -1 [0104.175] lstrcmpiA (lpString1="", lpString2="Microsoft.VisualC.STLCLR.dll") returned -1 [0104.175] PathFindFileNameA (pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\Microsoft.Build.Utilities.v3.5.dll") returned="Microsoft.Build.Utilities.v3.5.dll" [0104.175] lstrcatA (in: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\", lpString2="Microsoft.VisualC.STLCLR.dll" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\Microsoft.VisualC.STLCLR.dll") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\Microsoft.VisualC.STLCLR.dll" [0104.175] FindNextFileA (in: hFindFile=0x5be220, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0104.175] lstrcmpA (lpString1=".", lpString2="RedistList") returned -1 [0104.175] lstrcmpA (lpString1="..", lpString2="RedistList") returned -1 [0104.175] PathFindFileNameA (pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\Microsoft.VisualC.STLCLR.dll") returned="Microsoft.VisualC.STLCLR.dll" [0104.175] lstrcatA (in: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\", lpString2="RedistList" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\RedistList") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\RedistList" [0104.175] FindFirstFileA (in: lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\RedistList\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be260 [0104.176] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0104.176] FindNextFileA (in: hFindFile=0x5be260, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0104.176] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0104.176] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0104.176] FindNextFileA (in: hFindFile=0x5be260, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0104.176] PeekMessageA (in: lpMsg=0xaef84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaef84) returned 0 [0104.176] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="FrameworkList.xml") returned -1 [0104.176] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FrameworkList.xml") returned 1 [0104.176] lstrcmpiA (lpString1="", lpString2="FrameworkList.xml") returned -1 [0104.176] PathFindFileNameA (pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\RedistList\\*.*") returned="*.*" [0104.176] lstrcatA (in: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\RedistList\\", lpString2="FrameworkList.xml" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\RedistList\\FrameworkList.xml") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\RedistList\\FrameworkList.xml" [0104.176] FindNextFileA (in: hFindFile=0x5be260, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0 [0104.176] FindClose (in: hFindFile=0x5be260 | out: hFindFile=0x5be260) returned 1 [0104.176] FindNextFileA (in: hFindFile=0x5be220, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0104.176] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0104.176] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="System.AddIn.Contract.dll") returned -1 [0104.176] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.AddIn.Contract.dll") returned -1 [0104.176] lstrcmpiA (lpString1="", lpString2="System.AddIn.Contract.dll") returned -1 [0104.176] PathFindFileNameA (pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\*.*") returned="*.*" [0104.176] lstrcatA (in: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\", lpString2="System.AddIn.Contract.dll" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\System.AddIn.Contract.dll") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\System.AddIn.Contract.dll" [0104.176] FindNextFileA (in: hFindFile=0x5be220, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0104.176] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0104.176] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="System.AddIn.dll") returned -1 [0104.176] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.AddIn.dll") returned -1 [0104.176] lstrcmpiA (lpString1="", lpString2="System.AddIn.dll") returned -1 [0104.176] PathFindFileNameA (pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\System.AddIn.Contract.dll") returned="System.AddIn.Contract.dll" [0104.176] lstrcatA (in: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\", lpString2="System.AddIn.dll" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\System.AddIn.dll") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\System.AddIn.dll" [0104.176] FindNextFileA (in: hFindFile=0x5be220, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0104.176] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0104.176] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="System.ComponentModel.DataAnnotations.dll") returned -1 [0104.176] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.ComponentModel.DataAnnotations.dll") returned -1 [0104.176] lstrcmpiA (lpString1="", lpString2="System.ComponentModel.DataAnnotations.dll") returned -1 [0104.176] PathFindFileNameA (pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\System.AddIn.dll") returned="System.AddIn.dll" [0104.176] lstrcatA (in: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\", lpString2="System.ComponentModel.DataAnnotations.dll" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\System.ComponentModel.DataAnnotations.dll") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\System.ComponentModel.DataAnnotations.dll" [0104.177] FindNextFileA (in: hFindFile=0x5be220, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0104.177] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0104.177] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="System.Core.dll") returned -1 [0104.177] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Core.dll") returned -1 [0104.177] lstrcmpiA (lpString1="", lpString2="System.Core.dll") returned -1 [0104.177] PathFindFileNameA (pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\System.ComponentModel.DataAnnotations.dll") returned="System.ComponentModel.DataAnnotations.dll" [0104.177] lstrcatA (in: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\", lpString2="System.Core.dll" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\System.Core.dll") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\System.Core.dll" [0104.177] FindNextFileA (in: hFindFile=0x5be220, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0104.177] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0104.177] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="System.Data.DataSetExtensions.dll") returned -1 [0104.177] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Data.DataSetExtensions.dll") returned -1 [0104.177] lstrcmpiA (lpString1="", lpString2="System.Data.DataSetExtensions.dll") returned -1 [0104.177] PathFindFileNameA (pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\System.Core.dll") returned="System.Core.dll" [0104.177] lstrcatA (in: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\", lpString2="System.Data.DataSetExtensions.dll" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\System.Data.DataSetExtensions.dll") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\System.Data.DataSetExtensions.dll" [0104.177] FindNextFileA (in: hFindFile=0x5be220, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0104.177] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0104.177] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="System.Data.Entity.Design.dll") returned -1 [0104.177] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Data.Entity.Design.dll") returned -1 [0104.177] lstrcmpiA (lpString1="", lpString2="System.Data.Entity.Design.dll") returned -1 [0104.177] PathFindFileNameA (pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\System.Data.DataSetExtensions.dll") returned="System.Data.DataSetExtensions.dll" [0104.177] lstrcatA (in: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\", lpString2="System.Data.Entity.Design.dll" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\System.Data.Entity.Design.dll") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\System.Data.Entity.Design.dll" [0104.177] FindNextFileA (in: hFindFile=0x5be220, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0104.177] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0104.177] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="System.Data.Entity.dll") returned -1 [0104.177] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Data.Entity.dll") returned -1 [0104.177] lstrcmpiA (lpString1="", lpString2="System.Data.Entity.dll") returned -1 [0104.177] PathFindFileNameA (pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\System.Data.Entity.Design.dll") returned="System.Data.Entity.Design.dll" [0104.177] lstrcatA (in: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\", lpString2="System.Data.Entity.dll" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\System.Data.Entity.dll") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\System.Data.Entity.dll" [0104.177] FindNextFileA (in: hFindFile=0x5be220, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0104.177] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0104.177] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="System.Data.Linq.dll") returned -1 [0104.177] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Data.Linq.dll") returned -1 [0104.177] lstrcmpiA (lpString1="", lpString2="System.Data.Linq.dll") returned -1 [0104.177] PathFindFileNameA (pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\System.Data.Entity.dll") returned="System.Data.Entity.dll" [0104.178] lstrcatA (in: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\", lpString2="System.Data.Linq.dll" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\System.Data.Linq.dll") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\System.Data.Linq.dll" [0104.178] FindNextFileA (in: hFindFile=0x5be220, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0104.178] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0104.178] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="System.Data.Services.Client.dll") returned -1 [0104.178] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Data.Services.Client.dll") returned -1 [0104.178] lstrcmpiA (lpString1="", lpString2="System.Data.Services.Client.dll") returned -1 [0104.178] PathFindFileNameA (pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\System.Data.Linq.dll") returned="System.Data.Linq.dll" [0104.178] lstrcatA (in: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\", lpString2="System.Data.Services.Client.dll" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\System.Data.Services.Client.dll") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\System.Data.Services.Client.dll" [0104.178] FindNextFileA (in: hFindFile=0x5be220, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0104.178] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0104.178] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="System.Data.Services.Design.dll") returned -1 [0104.178] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Data.Services.Design.dll") returned -1 [0104.178] lstrcmpiA (lpString1="", lpString2="System.Data.Services.Design.dll") returned -1 [0104.178] PathFindFileNameA (pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\System.Data.Services.Client.dll") returned="System.Data.Services.Client.dll" [0104.178] lstrcatA (in: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\", lpString2="System.Data.Services.Design.dll" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\System.Data.Services.Design.dll") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\System.Data.Services.Design.dll" [0104.178] FindNextFileA (in: hFindFile=0x5be220, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0104.178] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0104.178] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="System.Data.Services.dll") returned -1 [0104.178] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Data.Services.dll") returned -1 [0104.178] lstrcmpiA (lpString1="", lpString2="System.Data.Services.dll") returned -1 [0104.178] PathFindFileNameA (pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\System.Data.Services.Design.dll") returned="System.Data.Services.Design.dll" [0104.178] lstrcatA (in: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\", lpString2="System.Data.Services.dll" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\System.Data.Services.dll") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\System.Data.Services.dll" [0104.178] FindNextFileA (in: hFindFile=0x5be220, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0104.178] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0104.178] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="System.DirectoryServices.AccountManagement.dll") returned -1 [0104.178] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.DirectoryServices.AccountManagement.dll") returned -1 [0104.178] lstrcmpiA (lpString1="", lpString2="System.DirectoryServices.AccountManagement.dll") returned -1 [0104.178] PathFindFileNameA (pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\System.Data.Services.dll") returned="System.Data.Services.dll" [0104.178] lstrcatA (in: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\", lpString2="System.DirectoryServices.AccountManagement.dll" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\System.DirectoryServices.AccountManagement.dll") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\System.DirectoryServices.AccountManagement.dll" [0104.179] FindNextFileA (in: hFindFile=0x5be220, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0104.179] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0104.179] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="System.Management.Instrumentation.dll") returned -1 [0104.179] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Management.Instrumentation.dll") returned -1 [0104.179] lstrcmpiA (lpString1="", lpString2="System.Management.Instrumentation.dll") returned -1 [0104.179] PathFindFileNameA (pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\System.DirectoryServices.AccountManagement.dll") returned="System.DirectoryServices.AccountManagement.dll" [0104.179] lstrcatA (in: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\", lpString2="System.Management.Instrumentation.dll" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\System.Management.Instrumentation.dll") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\System.Management.Instrumentation.dll" [0104.179] FindNextFileA (in: hFindFile=0x5be220, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0104.179] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0104.179] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="System.Net.dll") returned -1 [0104.179] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Net.dll") returned -1 [0104.179] lstrcmpiA (lpString1="", lpString2="System.Net.dll") returned -1 [0104.179] PathFindFileNameA (pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\System.Management.Instrumentation.dll") returned="System.Management.Instrumentation.dll" [0104.179] lstrcatA (in: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\", lpString2="System.Net.dll" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\System.Net.dll") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\System.Net.dll" [0104.179] FindNextFileA (in: hFindFile=0x5be220, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0104.179] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0104.179] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="System.ServiceModel.Web.dll") returned -1 [0104.179] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.ServiceModel.Web.dll") returned -1 [0104.179] lstrcmpiA (lpString1="", lpString2="System.ServiceModel.Web.dll") returned -1 [0104.179] PathFindFileNameA (pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\System.Net.dll") returned="System.Net.dll" [0104.179] lstrcatA (in: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\", lpString2="System.ServiceModel.Web.dll" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\System.ServiceModel.Web.dll") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\System.ServiceModel.Web.dll" [0104.179] FindNextFileA (in: hFindFile=0x5be220, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0104.179] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0104.179] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="System.Web.Abstractions.dll") returned -1 [0104.179] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Web.Abstractions.dll") returned -1 [0104.179] lstrcmpiA (lpString1="", lpString2="System.Web.Abstractions.dll") returned -1 [0104.179] PathFindFileNameA (pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\System.ServiceModel.Web.dll") returned="System.ServiceModel.Web.dll" [0104.179] lstrcatA (in: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\", lpString2="System.Web.Abstractions.dll" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\System.Web.Abstractions.dll") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\System.Web.Abstractions.dll" [0104.179] FindNextFileA (in: hFindFile=0x5be220, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0104.179] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0104.179] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="System.Web.DynamicData.Design.dll") returned -1 [0104.179] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Web.DynamicData.Design.dll") returned -1 [0104.179] lstrcmpiA (lpString1="", lpString2="System.Web.DynamicData.Design.dll") returned -1 [0104.179] PathFindFileNameA (pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\System.Web.Abstractions.dll") returned="System.Web.Abstractions.dll" [0104.179] lstrcatA (in: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\", lpString2="System.Web.DynamicData.Design.dll" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\System.Web.DynamicData.Design.dll") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\System.Web.DynamicData.Design.dll" [0104.180] FindNextFileA (in: hFindFile=0x5be220, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0104.180] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0104.180] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="System.Web.DynamicData.dll") returned -1 [0104.180] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Web.DynamicData.dll") returned -1 [0104.180] lstrcmpiA (lpString1="", lpString2="System.Web.DynamicData.dll") returned -1 [0104.180] PathFindFileNameA (pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\System.Web.DynamicData.Design.dll") returned="System.Web.DynamicData.Design.dll" [0104.180] lstrcatA (in: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\", lpString2="System.Web.DynamicData.dll" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\System.Web.DynamicData.dll") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\System.Web.DynamicData.dll" [0104.181] FindNextFileA (in: hFindFile=0x5be220, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0104.181] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0104.181] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="System.Web.Entity.Design.dll") returned -1 [0104.181] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Web.Entity.Design.dll") returned -1 [0104.181] lstrcmpiA (lpString1="", lpString2="System.Web.Entity.Design.dll") returned -1 [0104.181] PathFindFileNameA (pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\System.Web.DynamicData.dll") returned="System.Web.DynamicData.dll" [0104.181] lstrcatA (in: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\", lpString2="System.Web.Entity.Design.dll" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\System.Web.Entity.Design.dll") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\System.Web.Entity.Design.dll" [0104.181] FindNextFileA (in: hFindFile=0x5be220, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0104.181] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0104.181] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="System.Web.Entity.dll") returned -1 [0104.181] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Web.Entity.dll") returned -1 [0104.181] lstrcmpiA (lpString1="", lpString2="System.Web.Entity.dll") returned -1 [0104.181] PathFindFileNameA (pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\System.Web.Entity.Design.dll") returned="System.Web.Entity.Design.dll" [0104.181] lstrcatA (in: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\", lpString2="System.Web.Entity.dll" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\System.Web.Entity.dll") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\System.Web.Entity.dll" [0104.182] FindNextFileA (in: hFindFile=0x5be220, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0104.182] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0104.182] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="System.Web.Extensions.Design.dll") returned -1 [0104.182] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Web.Extensions.Design.dll") returned -1 [0104.182] lstrcmpiA (lpString1="", lpString2="System.Web.Extensions.Design.dll") returned -1 [0104.182] PathFindFileNameA (pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\System.Web.Entity.dll") returned="System.Web.Entity.dll" [0104.182] lstrcatA (in: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\", lpString2="System.Web.Extensions.Design.dll" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\System.Web.Extensions.Design.dll") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\System.Web.Extensions.Design.dll" [0104.182] FindNextFileA (in: hFindFile=0x5be220, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0104.182] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0104.182] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="System.Web.Extensions.dll") returned -1 [0104.182] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Web.Extensions.dll") returned -1 [0104.182] lstrcmpiA (lpString1="", lpString2="System.Web.Extensions.dll") returned -1 [0104.182] PathFindFileNameA (pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\System.Web.Extensions.Design.dll") returned="System.Web.Extensions.Design.dll" [0104.182] lstrcatA (in: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\", lpString2="System.Web.Extensions.dll" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\System.Web.Extensions.dll") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\System.Web.Extensions.dll" [0104.182] FindNextFileA (in: hFindFile=0x5be220, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0104.182] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0104.182] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="System.Web.Routing.dll") returned -1 [0104.182] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Web.Routing.dll") returned -1 [0104.182] lstrcmpiA (lpString1="", lpString2="System.Web.Routing.dll") returned -1 [0104.182] PathFindFileNameA (pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\System.Web.Extensions.dll") returned="System.Web.Extensions.dll" [0104.182] lstrcatA (in: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\", lpString2="System.Web.Routing.dll" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\System.Web.Routing.dll") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\System.Web.Routing.dll" [0104.182] FindNextFileA (in: hFindFile=0x5be220, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0104.182] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0104.182] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="System.Windows.Presentation.dll") returned -1 [0104.182] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Windows.Presentation.dll") returned -1 [0104.182] lstrcmpiA (lpString1="", lpString2="System.Windows.Presentation.dll") returned -1 [0104.182] PathFindFileNameA (pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\System.Web.Routing.dll") returned="System.Web.Routing.dll" [0104.182] lstrcatA (in: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\", lpString2="System.Windows.Presentation.dll" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\System.Windows.Presentation.dll") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\System.Windows.Presentation.dll" [0104.182] FindNextFileA (in: hFindFile=0x5be220, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0104.182] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0104.182] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="System.WorkflowServices.dll") returned -1 [0104.182] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.WorkflowServices.dll") returned -1 [0104.182] lstrcmpiA (lpString1="", lpString2="System.WorkflowServices.dll") returned -1 [0104.182] PathFindFileNameA (pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\System.Windows.Presentation.dll") returned="System.Windows.Presentation.dll" [0104.183] lstrcatA (in: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\", lpString2="System.WorkflowServices.dll" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\System.WorkflowServices.dll") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\System.WorkflowServices.dll" [0104.183] FindNextFileA (in: hFindFile=0x5be220, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0104.183] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0104.183] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="System.Xml.Linq.dll") returned -1 [0104.183] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="System.Xml.Linq.dll") returned -1 [0104.183] lstrcmpiA (lpString1="", lpString2="System.Xml.Linq.dll") returned -1 [0104.183] PathFindFileNameA (pszPath="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\System.WorkflowServices.dll") returned="System.WorkflowServices.dll" [0104.183] lstrcatA (in: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\", lpString2="System.Xml.Linq.dll" | out: lpString1="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\System.Xml.Linq.dll") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\System.Xml.Linq.dll" [0104.184] FindNextFileA (in: hFindFile=0x5be220, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0 [0104.184] FindClose (in: hFindFile=0x5be220 | out: hFindFile=0x5be220) returned 1 [0104.184] FindNextFileA (in: hFindFile=0x5be1e0, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0 [0104.184] FindClose (in: hFindFile=0x5be1e0 | out: hFindFile=0x5be1e0) returned 1 [0104.184] FindNextFileA (in: hFindFile=0x5be1a0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 0 [0104.184] FindClose (in: hFindFile=0x5be1a0 | out: hFindFile=0x5be1a0) returned 1 [0104.184] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf4e8 | out: lpFindFileData=0xaf4e8) returned 1 [0104.184] PeekMessageA (in: lpMsg=0xaf4c4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf4c4) returned 0 [0104.184] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="records instructional obesity.exe") returned -1 [0104.184] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="records instructional obesity.exe") returned -1 [0104.184] lstrcmpiA (lpString1="", lpString2="records instructional obesity.exe") returned -1 [0104.184] PathFindFileNameA (pszPath="C:\\Program Files\\Reference Assemblies\\*.*") returned="*.*" [0104.184] lstrcatA (in: lpString1="C:\\Program Files\\Reference Assemblies\\", lpString2="records instructional obesity.exe" | out: lpString1="C:\\Program Files\\Reference Assemblies\\records instructional obesity.exe") returned="C:\\Program Files\\Reference Assemblies\\records instructional obesity.exe" [0104.184] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf4e8 | out: lpFindFileData=0xaf4e8) returned 1 [0104.184] PeekMessageA (in: lpMsg=0xaf4c4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf4c4) returned 0 [0104.184] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="stock blogging into.exe") returned -1 [0104.184] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="stock blogging into.exe") returned -1 [0104.184] lstrcmpiA (lpString1="", lpString2="stock blogging into.exe") returned -1 [0104.184] PathFindFileNameA (pszPath="C:\\Program Files\\Reference Assemblies\\records instructional obesity.exe") returned="records instructional obesity.exe" [0104.184] lstrcatA (in: lpString1="C:\\Program Files\\Reference Assemblies\\", lpString2="stock blogging into.exe" | out: lpString1="C:\\Program Files\\Reference Assemblies\\stock blogging into.exe") returned="C:\\Program Files\\Reference Assemblies\\stock blogging into.exe" [0104.184] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf4e8 | out: lpFindFileData=0xaf4e8) returned 1 [0104.184] PeekMessageA (in: lpMsg=0xaf4c4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf4c4) returned 0 [0104.184] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="talent_zero_workplace.exe") returned -1 [0104.184] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="talent_zero_workplace.exe") returned -1 [0104.184] lstrcmpiA (lpString1="", lpString2="talent_zero_workplace.exe") returned -1 [0104.184] PathFindFileNameA (pszPath="C:\\Program Files\\Reference Assemblies\\stock blogging into.exe") returned="stock blogging into.exe" [0104.184] lstrcatA (in: lpString1="C:\\Program Files\\Reference Assemblies\\", lpString2="talent_zero_workplace.exe" | out: lpString1="C:\\Program Files\\Reference Assemblies\\talent_zero_workplace.exe") returned="C:\\Program Files\\Reference Assemblies\\talent_zero_workplace.exe" [0104.184] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf4e8 | out: lpFindFileData=0xaf4e8) returned 0 [0104.184] FindClose (in: hFindFile=0x5be160 | out: hFindFile=0x5be160) returned 1 [0104.184] FindNextFileA (in: hFindFile=0x5b90e0, lpFindFileData=0xaf638 | out: lpFindFileData=0xaf638) returned 1 [0104.184] lstrcmpA (lpString1=".", lpString2="Uninstall Information") returned -1 [0104.184] lstrcmpA (lpString1="..", lpString2="Uninstall Information") returned -1 [0104.184] PathFindFileNameA (pszPath="C:\\Program Files\\*.*") returned="*.*" [0104.184] lstrcatA (in: lpString1="C:\\Program Files\\", lpString2="Uninstall Information" | out: lpString1="C:\\Program Files\\Uninstall Information") returned="C:\\Program Files\\Uninstall Information" [0104.184] FindFirstFileA (in: lpFileName="C:\\Program Files\\Uninstall Information\\*.*", lpFindFileData=0xaf4e8 | out: lpFindFileData=0xaf4e8) returned 0x5be160 [0104.185] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0104.185] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf4e8 | out: lpFindFileData=0xaf4e8) returned 1 [0104.185] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0104.185] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0104.185] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf4e8 | out: lpFindFileData=0xaf4e8) returned 0 [0104.185] FindClose (in: hFindFile=0x5be160 | out: hFindFile=0x5be160) returned 1 [0104.185] FindNextFileA (in: hFindFile=0x5b90e0, lpFindFileData=0xaf638 | out: lpFindFileData=0xaf638) returned 1 [0104.185] lstrcmpA (lpString1=".", lpString2="Windows Defender") returned -1 [0104.185] lstrcmpA (lpString1="..", lpString2="Windows Defender") returned -1 [0104.185] PathFindFileNameA (pszPath="C:\\Program Files\\*.*") returned="*.*" [0104.185] lstrcatA (in: lpString1="C:\\Program Files\\", lpString2="Windows Defender" | out: lpString1="C:\\Program Files\\Windows Defender") returned="C:\\Program Files\\Windows Defender" [0104.185] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Defender\\*.*", lpFindFileData=0xaf4e8 | out: lpFindFileData=0xaf4e8) returned 0x5be160 [0104.185] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0104.185] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf4e8 | out: lpFindFileData=0xaf4e8) returned 1 [0104.185] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0104.185] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0104.185] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf4e8 | out: lpFindFileData=0xaf4e8) returned 1 [0104.185] lstrcmpA (lpString1=".", lpString2="en-US") returned -1 [0104.185] lstrcmpA (lpString1="..", lpString2="en-US") returned -1 [0104.185] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Defender\\*.*") returned="*.*" [0104.185] lstrcatA (in: lpString1="C:\\Program Files\\Windows Defender\\", lpString2="en-US" | out: lpString1="C:\\Program Files\\Windows Defender\\en-US") returned="C:\\Program Files\\Windows Defender\\en-US" [0104.185] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Defender\\en-US\\*.*", lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 0x5be1a0 [0104.185] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0104.185] FindNextFileA (in: hFindFile=0x5be1a0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0104.185] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0104.185] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0104.186] FindNextFileA (in: hFindFile=0x5be1a0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0104.186] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0104.186] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="MpAsDesc.dll.mui") returned -1 [0104.186] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MpAsDesc.dll.mui") returned -1 [0104.186] lstrcmpiA (lpString1="", lpString2="MpAsDesc.dll.mui") returned -1 [0104.186] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Defender\\en-US\\*.*") returned="*.*" [0104.186] lstrcatA (in: lpString1="C:\\Program Files\\Windows Defender\\en-US\\", lpString2="MpAsDesc.dll.mui" | out: lpString1="C:\\Program Files\\Windows Defender\\en-US\\MpAsDesc.dll.mui") returned="C:\\Program Files\\Windows Defender\\en-US\\MpAsDesc.dll.mui" [0104.186] FindNextFileA (in: hFindFile=0x5be1a0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0104.186] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0104.186] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="MpEvMsg.dll.mui") returned -1 [0104.186] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MpEvMsg.dll.mui") returned -1 [0104.186] lstrcmpiA (lpString1="", lpString2="MpEvMsg.dll.mui") returned -1 [0104.186] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Defender\\en-US\\MpAsDesc.dll.mui") returned="MpAsDesc.dll.mui" [0104.186] lstrcatA (in: lpString1="C:\\Program Files\\Windows Defender\\en-US\\", lpString2="MpEvMsg.dll.mui" | out: lpString1="C:\\Program Files\\Windows Defender\\en-US\\MpEvMsg.dll.mui") returned="C:\\Program Files\\Windows Defender\\en-US\\MpEvMsg.dll.mui" [0104.186] FindNextFileA (in: hFindFile=0x5be1a0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0104.186] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0104.186] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="MsMpRes.dll.mui") returned -1 [0104.186] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MsMpRes.dll.mui") returned -1 [0104.186] lstrcmpiA (lpString1="", lpString2="MsMpRes.dll.mui") returned -1 [0104.186] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Defender\\en-US\\MpEvMsg.dll.mui") returned="MpEvMsg.dll.mui" [0104.186] lstrcatA (in: lpString1="C:\\Program Files\\Windows Defender\\en-US\\", lpString2="MsMpRes.dll.mui" | out: lpString1="C:\\Program Files\\Windows Defender\\en-US\\MsMpRes.dll.mui") returned="C:\\Program Files\\Windows Defender\\en-US\\MsMpRes.dll.mui" [0104.186] FindNextFileA (in: hFindFile=0x5be1a0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 0 [0104.186] FindClose (in: hFindFile=0x5be1a0 | out: hFindFile=0x5be1a0) returned 1 [0104.186] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf4e8 | out: lpFindFileData=0xaf4e8) returned 1 [0104.186] PeekMessageA (in: lpMsg=0xaf4c4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf4c4) returned 0 [0104.186] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="MpAsDesc.dll") returned -1 [0104.186] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MpAsDesc.dll") returned -1 [0104.186] lstrcmpiA (lpString1="", lpString2="MpAsDesc.dll") returned -1 [0104.186] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Defender\\*.*") returned="*.*" [0104.186] lstrcatA (in: lpString1="C:\\Program Files\\Windows Defender\\", lpString2="MpAsDesc.dll" | out: lpString1="C:\\Program Files\\Windows Defender\\MpAsDesc.dll") returned="C:\\Program Files\\Windows Defender\\MpAsDesc.dll" [0104.186] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf4e8 | out: lpFindFileData=0xaf4e8) returned 1 [0104.186] PeekMessageA (in: lpMsg=0xaf4c4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf4c4) returned 0 [0104.186] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="MpClient.dll") returned -1 [0104.186] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MpClient.dll") returned -1 [0104.186] lstrcmpiA (lpString1="", lpString2="MpClient.dll") returned -1 [0104.186] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Defender\\MpAsDesc.dll") returned="MpAsDesc.dll" [0104.186] lstrcatA (in: lpString1="C:\\Program Files\\Windows Defender\\", lpString2="MpClient.dll" | out: lpString1="C:\\Program Files\\Windows Defender\\MpClient.dll") returned="C:\\Program Files\\Windows Defender\\MpClient.dll" [0104.187] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf4e8 | out: lpFindFileData=0xaf4e8) returned 1 [0104.187] PeekMessageA (in: lpMsg=0xaf4c4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf4c4) returned 0 [0104.187] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="MpCmdRun.exe") returned -1 [0104.187] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MpCmdRun.exe") returned -1 [0104.187] lstrcmpiA (lpString1="", lpString2="MpCmdRun.exe") returned -1 [0104.187] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Defender\\MpClient.dll") returned="MpClient.dll" [0104.187] lstrcatA (in: lpString1="C:\\Program Files\\Windows Defender\\", lpString2="MpCmdRun.exe" | out: lpString1="C:\\Program Files\\Windows Defender\\MpCmdRun.exe") returned="C:\\Program Files\\Windows Defender\\MpCmdRun.exe" [0104.187] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf4e8 | out: lpFindFileData=0xaf4e8) returned 1 [0104.187] PeekMessageA (in: lpMsg=0xaf4c4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf4c4) returned 0 [0104.187] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="MpCommu.dll") returned -1 [0104.187] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MpCommu.dll") returned -1 [0104.187] lstrcmpiA (lpString1="", lpString2="MpCommu.dll") returned -1 [0104.187] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Defender\\MpCmdRun.exe") returned="MpCmdRun.exe" [0104.187] lstrcatA (in: lpString1="C:\\Program Files\\Windows Defender\\", lpString2="MpCommu.dll" | out: lpString1="C:\\Program Files\\Windows Defender\\MpCommu.dll") returned="C:\\Program Files\\Windows Defender\\MpCommu.dll" [0104.187] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf4e8 | out: lpFindFileData=0xaf4e8) returned 1 [0104.187] PeekMessageA (in: lpMsg=0xaf4c4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf4c4) returned 0 [0104.187] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="MpEvMsg.dll") returned -1 [0104.187] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MpEvMsg.dll") returned -1 [0104.187] lstrcmpiA (lpString1="", lpString2="MpEvMsg.dll") returned -1 [0104.187] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Defender\\MpCommu.dll") returned="MpCommu.dll" [0104.187] lstrcatA (in: lpString1="C:\\Program Files\\Windows Defender\\", lpString2="MpEvMsg.dll" | out: lpString1="C:\\Program Files\\Windows Defender\\MpEvMsg.dll") returned="C:\\Program Files\\Windows Defender\\MpEvMsg.dll" [0104.187] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf4e8 | out: lpFindFileData=0xaf4e8) returned 1 [0104.187] PeekMessageA (in: lpMsg=0xaf4c4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf4c4) returned 0 [0104.187] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="MpOAV.dll") returned -1 [0104.187] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MpOAV.dll") returned -1 [0104.187] lstrcmpiA (lpString1="", lpString2="MpOAV.dll") returned -1 [0104.187] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Defender\\MpEvMsg.dll") returned="MpEvMsg.dll" [0104.187] lstrcatA (in: lpString1="C:\\Program Files\\Windows Defender\\", lpString2="MpOAV.dll" | out: lpString1="C:\\Program Files\\Windows Defender\\MpOAV.dll") returned="C:\\Program Files\\Windows Defender\\MpOAV.dll" [0104.187] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf4e8 | out: lpFindFileData=0xaf4e8) returned 1 [0104.187] PeekMessageA (in: lpMsg=0xaf4c4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf4c4) returned 0 [0104.187] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="MpRTP.dll") returned -1 [0104.187] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MpRTP.dll") returned -1 [0104.187] lstrcmpiA (lpString1="", lpString2="MpRTP.dll") returned -1 [0104.187] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Defender\\MpOAV.dll") returned="MpOAV.dll" [0104.187] lstrcatA (in: lpString1="C:\\Program Files\\Windows Defender\\", lpString2="MpRTP.dll" | out: lpString1="C:\\Program Files\\Windows Defender\\MpRTP.dll") returned="C:\\Program Files\\Windows Defender\\MpRTP.dll" [0104.187] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf4e8 | out: lpFindFileData=0xaf4e8) returned 1 [0104.187] PeekMessageA (in: lpMsg=0xaf4c4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf4c4) returned 0 [0104.187] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="MpSvc.dll") returned -1 [0104.187] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MpSvc.dll") returned -1 [0104.187] lstrcmpiA (lpString1="", lpString2="MpSvc.dll") returned -1 [0104.188] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Defender\\MpRTP.dll") returned="MpRTP.dll" [0104.188] lstrcatA (in: lpString1="C:\\Program Files\\Windows Defender\\", lpString2="MpSvc.dll" | out: lpString1="C:\\Program Files\\Windows Defender\\MpSvc.dll") returned="C:\\Program Files\\Windows Defender\\MpSvc.dll" [0104.188] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf4e8 | out: lpFindFileData=0xaf4e8) returned 1 [0104.188] PeekMessageA (in: lpMsg=0xaf4c4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf4c4) returned 0 [0104.188] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="MSASCui.exe") returned -1 [0104.188] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSASCui.exe") returned -1 [0104.188] lstrcmpiA (lpString1="", lpString2="MSASCui.exe") returned -1 [0104.188] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Defender\\MpSvc.dll") returned="MpSvc.dll" [0104.188] lstrcatA (in: lpString1="C:\\Program Files\\Windows Defender\\", lpString2="MSASCui.exe" | out: lpString1="C:\\Program Files\\Windows Defender\\MSASCui.exe") returned="C:\\Program Files\\Windows Defender\\MSASCui.exe" [0104.188] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf4e8 | out: lpFindFileData=0xaf4e8) returned 1 [0104.188] PeekMessageA (in: lpMsg=0xaf4c4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf4c4) returned 0 [0104.188] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Defender\\MSASCui.exe") returned="MSASCui.exe" [0104.188] lstrcatA (in: lpString1="C:\\Program Files\\Windows Defender\\", lpString2="MsMpCom.dll" | out: lpString1="C:\\Program Files\\Windows Defender\\MsMpCom.dll") returned="C:\\Program Files\\Windows Defender\\MsMpCom.dll" [0104.188] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf4e8 | out: lpFindFileData=0xaf4e8) returned 1 [0104.188] PeekMessageA (in: lpMsg=0xaf4c4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf4c4) returned 0 [0104.188] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Defender\\MsMpCom.dll") returned="MsMpCom.dll" [0104.188] lstrcatA (in: lpString1="C:\\Program Files\\Windows Defender\\", lpString2="MsMpLics.dll" | out: lpString1="C:\\Program Files\\Windows Defender\\MsMpLics.dll") returned="C:\\Program Files\\Windows Defender\\MsMpLics.dll" [0104.188] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf4e8 | out: lpFindFileData=0xaf4e8) returned 1 [0104.188] PeekMessageA (in: lpMsg=0xaf4c4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf4c4) returned 0 [0104.188] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Defender\\MsMpLics.dll") returned="MsMpLics.dll" [0104.188] lstrcatA (in: lpString1="C:\\Program Files\\Windows Defender\\", lpString2="MsMpRes.dll" | out: lpString1="C:\\Program Files\\Windows Defender\\MsMpRes.dll") returned="C:\\Program Files\\Windows Defender\\MsMpRes.dll" [0104.188] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf4e8 | out: lpFindFileData=0xaf4e8) returned 0 [0104.188] FindClose (in: hFindFile=0x5be160 | out: hFindFile=0x5be160) returned 1 [0104.188] FindNextFileA (in: hFindFile=0x5b90e0, lpFindFileData=0xaf638 | out: lpFindFileData=0xaf638) returned 1 [0104.188] lstrcmpA (lpString1=".", lpString2="Windows Journal") returned -1 [0104.188] lstrcmpA (lpString1="..", lpString2="Windows Journal") returned -1 [0104.188] PathFindFileNameA (pszPath="C:\\Program Files\\*.*") returned="*.*" [0104.188] lstrcatA (in: lpString1="C:\\Program Files\\", lpString2="Windows Journal" | out: lpString1="C:\\Program Files\\Windows Journal") returned="C:\\Program Files\\Windows Journal" [0104.188] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Journal\\*.*", lpFindFileData=0xaf4e8 | out: lpFindFileData=0xaf4e8) returned 0x5be160 [0104.188] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0104.189] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf4e8 | out: lpFindFileData=0xaf4e8) returned 1 [0104.189] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0104.189] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0104.189] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf4e8 | out: lpFindFileData=0xaf4e8) returned 1 [0104.189] lstrcmpA (lpString1=".", lpString2="en-US") returned -1 [0104.189] lstrcmpA (lpString1="..", lpString2="en-US") returned -1 [0104.189] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Journal\\*.*") returned="*.*" [0104.189] lstrcatA (in: lpString1="C:\\Program Files\\Windows Journal\\", lpString2="en-US" | out: lpString1="C:\\Program Files\\Windows Journal\\en-US") returned="C:\\Program Files\\Windows Journal\\en-US" [0104.189] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Journal\\en-US\\*.*", lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 0x5be1a0 [0104.199] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0104.199] FindNextFileA (in: hFindFile=0x5be1a0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0104.199] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0104.199] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0104.199] FindNextFileA (in: hFindFile=0x5be1a0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0104.199] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0104.199] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Journal\\en-US\\*.*") returned="*.*" [0104.199] lstrcatA (in: lpString1="C:\\Program Files\\Windows Journal\\en-US\\", lpString2="JNTFiltr.dll.mui" | out: lpString1="C:\\Program Files\\Windows Journal\\en-US\\JNTFiltr.dll.mui") returned="C:\\Program Files\\Windows Journal\\en-US\\JNTFiltr.dll.mui" [0104.199] FindNextFileA (in: hFindFile=0x5be1a0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0104.200] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0104.200] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Journal\\en-US\\JNTFiltr.dll.mui") returned="JNTFiltr.dll.mui" [0104.200] lstrcatA (in: lpString1="C:\\Program Files\\Windows Journal\\en-US\\", lpString2="jnwdui.dll.mui" | out: lpString1="C:\\Program Files\\Windows Journal\\en-US\\jnwdui.dll.mui") returned="C:\\Program Files\\Windows Journal\\en-US\\jnwdui.dll.mui" [0104.200] FindNextFileA (in: hFindFile=0x5be1a0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0104.200] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0104.200] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Journal\\en-US\\jnwdui.dll.mui") returned="jnwdui.dll.mui" [0104.200] lstrcatA (in: lpString1="C:\\Program Files\\Windows Journal\\en-US\\", lpString2="jnwmon.dll.mui" | out: lpString1="C:\\Program Files\\Windows Journal\\en-US\\jnwmon.dll.mui") returned="C:\\Program Files\\Windows Journal\\en-US\\jnwmon.dll.mui" [0104.200] FindNextFileA (in: hFindFile=0x5be1a0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0104.200] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0104.200] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Journal\\en-US\\jnwmon.dll.mui") returned="jnwmon.dll.mui" [0104.200] lstrcatA (in: lpString1="C:\\Program Files\\Windows Journal\\en-US\\", lpString2="Journal.exe.mui" | out: lpString1="C:\\Program Files\\Windows Journal\\en-US\\Journal.exe.mui") returned="C:\\Program Files\\Windows Journal\\en-US\\Journal.exe.mui" [0104.200] FindNextFileA (in: hFindFile=0x5be1a0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0104.200] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0104.200] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Journal\\en-US\\Journal.exe.mui") returned="Journal.exe.mui" [0104.200] lstrcatA (in: lpString1="C:\\Program Files\\Windows Journal\\en-US\\", lpString2="MSPVWCTL.DLL.mui" | out: lpString1="C:\\Program Files\\Windows Journal\\en-US\\MSPVWCTL.DLL.mui") returned="C:\\Program Files\\Windows Journal\\en-US\\MSPVWCTL.DLL.mui" [0104.200] FindNextFileA (in: hFindFile=0x5be1a0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0104.200] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0104.200] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Journal\\en-US\\MSPVWCTL.DLL.mui") returned="MSPVWCTL.DLL.mui" [0104.200] lstrcatA (in: lpString1="C:\\Program Files\\Windows Journal\\en-US\\", lpString2="NBMapTIP.dll.mui" | out: lpString1="C:\\Program Files\\Windows Journal\\en-US\\NBMapTIP.dll.mui") returned="C:\\Program Files\\Windows Journal\\en-US\\NBMapTIP.dll.mui" [0104.200] FindNextFileA (in: hFindFile=0x5be1a0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0104.200] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0104.200] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Journal\\en-US\\NBMapTIP.dll.mui") returned="NBMapTIP.dll.mui" [0104.200] lstrcatA (in: lpString1="C:\\Program Files\\Windows Journal\\en-US\\", lpString2="PDIALOG.exe.mui" | out: lpString1="C:\\Program Files\\Windows Journal\\en-US\\PDIALOG.exe.mui") returned="C:\\Program Files\\Windows Journal\\en-US\\PDIALOG.exe.mui" [0104.200] FindNextFileA (in: hFindFile=0x5be1a0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 0 [0104.200] FindClose (in: hFindFile=0x5be1a0 | out: hFindFile=0x5be1a0) returned 1 [0104.201] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf4e8 | out: lpFindFileData=0xaf4e8) returned 1 [0104.201] PeekMessageA (in: lpMsg=0xaf4c4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf4c4) returned 0 [0104.201] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Journal\\*.*") returned="*.*" [0104.201] lstrcatA (in: lpString1="C:\\Program Files\\Windows Journal\\", lpString2="InkSeg.dll" | out: lpString1="C:\\Program Files\\Windows Journal\\InkSeg.dll") returned="C:\\Program Files\\Windows Journal\\InkSeg.dll" [0104.201] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf4e8 | out: lpFindFileData=0xaf4e8) returned 1 [0104.201] PeekMessageA (in: lpMsg=0xaf4c4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf4c4) returned 0 [0104.201] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Journal\\InkSeg.dll") returned="InkSeg.dll" [0104.201] lstrcatA (in: lpString1="C:\\Program Files\\Windows Journal\\", lpString2="JNTFiltr.dll" | out: lpString1="C:\\Program Files\\Windows Journal\\JNTFiltr.dll") returned="C:\\Program Files\\Windows Journal\\JNTFiltr.dll" [0104.201] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf4e8 | out: lpFindFileData=0xaf4e8) returned 1 [0104.201] PeekMessageA (in: lpMsg=0xaf4c4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf4c4) returned 0 [0104.201] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Journal\\JNTFiltr.dll") returned="JNTFiltr.dll" [0104.201] lstrcatA (in: lpString1="C:\\Program Files\\Windows Journal\\", lpString2="JNWDRV.dll" | out: lpString1="C:\\Program Files\\Windows Journal\\JNWDRV.dll") returned="C:\\Program Files\\Windows Journal\\JNWDRV.dll" [0104.201] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf4e8 | out: lpFindFileData=0xaf4e8) returned 1 [0104.201] PeekMessageA (in: lpMsg=0xaf4c4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf4c4) returned 0 [0104.201] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Journal\\JNWDRV.dll") returned="JNWDRV.dll" [0104.201] lstrcatA (in: lpString1="C:\\Program Files\\Windows Journal\\", lpString2="jnwdui.dll" | out: lpString1="C:\\Program Files\\Windows Journal\\jnwdui.dll") returned="C:\\Program Files\\Windows Journal\\jnwdui.dll" [0104.201] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf4e8 | out: lpFindFileData=0xaf4e8) returned 1 [0104.201] PeekMessageA (in: lpMsg=0xaf4c4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf4c4) returned 0 [0104.201] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Journal\\jnwdui.dll") returned="jnwdui.dll" [0104.201] lstrcatA (in: lpString1="C:\\Program Files\\Windows Journal\\", lpString2="jnwmon.dll" | out: lpString1="C:\\Program Files\\Windows Journal\\jnwmon.dll") returned="C:\\Program Files\\Windows Journal\\jnwmon.dll" [0104.202] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf4e8 | out: lpFindFileData=0xaf4e8) returned 1 [0104.202] PeekMessageA (in: lpMsg=0xaf4c4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf4c4) returned 0 [0104.202] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Journal\\jnwmon.dll") returned="jnwmon.dll" [0104.202] lstrcatA (in: lpString1="C:\\Program Files\\Windows Journal\\", lpString2="jnwppr.dll" | out: lpString1="C:\\Program Files\\Windows Journal\\jnwppr.dll") returned="C:\\Program Files\\Windows Journal\\jnwppr.dll" [0104.202] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf4e8 | out: lpFindFileData=0xaf4e8) returned 1 [0104.202] PeekMessageA (in: lpMsg=0xaf4c4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf4c4) returned 0 [0104.202] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Journal\\jnwppr.dll") returned="jnwppr.dll" [0104.202] lstrcatA (in: lpString1="C:\\Program Files\\Windows Journal\\", lpString2="Journal.exe" | out: lpString1="C:\\Program Files\\Windows Journal\\Journal.exe") returned="C:\\Program Files\\Windows Journal\\Journal.exe" [0104.202] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf4e8 | out: lpFindFileData=0xaf4e8) returned 1 [0104.202] PeekMessageA (in: lpMsg=0xaf4c4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf4c4) returned 0 [0104.202] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Journal\\Journal.exe") returned="Journal.exe" [0104.202] lstrcatA (in: lpString1="C:\\Program Files\\Windows Journal\\", lpString2="MSPVWCTL.DLL" | out: lpString1="C:\\Program Files\\Windows Journal\\MSPVWCTL.DLL") returned="C:\\Program Files\\Windows Journal\\MSPVWCTL.DLL" [0104.202] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf4e8 | out: lpFindFileData=0xaf4e8) returned 1 [0104.202] PeekMessageA (in: lpMsg=0xaf4c4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf4c4) returned 0 [0104.202] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Journal\\MSPVWCTL.DLL") returned="MSPVWCTL.DLL" [0104.202] lstrcatA (in: lpString1="C:\\Program Files\\Windows Journal\\", lpString2="NBDoc.DLL" | out: lpString1="C:\\Program Files\\Windows Journal\\NBDoc.DLL") returned="C:\\Program Files\\Windows Journal\\NBDoc.DLL" [0104.202] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf4e8 | out: lpFindFileData=0xaf4e8) returned 1 [0104.202] PeekMessageA (in: lpMsg=0xaf4c4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf4c4) returned 0 [0104.202] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Journal\\NBDoc.DLL") returned="NBDoc.DLL" [0104.202] lstrcatA (in: lpString1="C:\\Program Files\\Windows Journal\\", lpString2="NBMapTIP.dll" | out: lpString1="C:\\Program Files\\Windows Journal\\NBMapTIP.dll") returned="C:\\Program Files\\Windows Journal\\NBMapTIP.dll" [0104.202] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf4e8 | out: lpFindFileData=0xaf4e8) returned 1 [0104.202] PeekMessageA (in: lpMsg=0xaf4c4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf4c4) returned 0 [0104.202] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Journal\\NBMapTIP.dll") returned="NBMapTIP.dll" [0104.202] lstrcatA (in: lpString1="C:\\Program Files\\Windows Journal\\", lpString2="PDIALOG.exe" | out: lpString1="C:\\Program Files\\Windows Journal\\PDIALOG.exe") returned="C:\\Program Files\\Windows Journal\\PDIALOG.exe" [0104.202] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf4e8 | out: lpFindFileData=0xaf4e8) returned 1 [0104.202] lstrcmpA (lpString1=".", lpString2="Templates") returned -1 [0104.202] lstrcmpA (lpString1="..", lpString2="Templates") returned -1 [0104.202] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Journal\\PDIALOG.exe") returned="PDIALOG.exe" [0104.202] lstrcatA (in: lpString1="C:\\Program Files\\Windows Journal\\", lpString2="Templates" | out: lpString1="C:\\Program Files\\Windows Journal\\Templates") returned="C:\\Program Files\\Windows Journal\\Templates" [0104.202] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Journal\\Templates\\*.*", lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 0x5be1a0 [0104.293] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0104.293] FindNextFileA (in: hFindFile=0x5be1a0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0104.293] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0104.293] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0104.293] FindNextFileA (in: hFindFile=0x5be1a0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0104.293] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0104.293] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Journal\\Templates\\*.*") returned="*.*" [0104.293] lstrcatA (in: lpString1="C:\\Program Files\\Windows Journal\\Templates\\", lpString2="blank.jtp" | out: lpString1="C:\\Program Files\\Windows Journal\\Templates\\blank.jtp") returned="C:\\Program Files\\Windows Journal\\Templates\\blank.jtp" [0104.293] FindNextFileA (in: hFindFile=0x5be1a0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0104.293] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0104.293] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Journal\\Templates\\blank.jtp") returned="blank.jtp" [0104.293] lstrcatA (in: lpString1="C:\\Program Files\\Windows Journal\\Templates\\", lpString2="Dotted_Line.jtp" | out: lpString1="C:\\Program Files\\Windows Journal\\Templates\\Dotted_Line.jtp") returned="C:\\Program Files\\Windows Journal\\Templates\\Dotted_Line.jtp" [0104.293] FindNextFileA (in: hFindFile=0x5be1a0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0104.293] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0104.293] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Journal\\Templates\\Dotted_Line.jtp") returned="Dotted_Line.jtp" [0104.293] lstrcatA (in: lpString1="C:\\Program Files\\Windows Journal\\Templates\\", lpString2="Genko_1.jtp" | out: lpString1="C:\\Program Files\\Windows Journal\\Templates\\Genko_1.jtp") returned="C:\\Program Files\\Windows Journal\\Templates\\Genko_1.jtp" [0104.293] FindNextFileA (in: hFindFile=0x5be1a0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0104.293] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0104.293] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Journal\\Templates\\Genko_1.jtp") returned="Genko_1.jtp" [0104.293] lstrcatA (in: lpString1="C:\\Program Files\\Windows Journal\\Templates\\", lpString2="Genko_2.jtp" | out: lpString1="C:\\Program Files\\Windows Journal\\Templates\\Genko_2.jtp") returned="C:\\Program Files\\Windows Journal\\Templates\\Genko_2.jtp" [0104.293] FindNextFileA (in: hFindFile=0x5be1a0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0104.293] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0104.294] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Journal\\Templates\\Genko_2.jtp") returned="Genko_2.jtp" [0104.294] lstrcatA (in: lpString1="C:\\Program Files\\Windows Journal\\Templates\\", lpString2="Graph.jtp" | out: lpString1="C:\\Program Files\\Windows Journal\\Templates\\Graph.jtp") returned="C:\\Program Files\\Windows Journal\\Templates\\Graph.jtp" [0104.294] FindNextFileA (in: hFindFile=0x5be1a0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0104.294] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0104.294] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Journal\\Templates\\Graph.jtp") returned="Graph.jtp" [0104.294] lstrcatA (in: lpString1="C:\\Program Files\\Windows Journal\\Templates\\", lpString2="Memo.jtp" | out: lpString1="C:\\Program Files\\Windows Journal\\Templates\\Memo.jtp") returned="C:\\Program Files\\Windows Journal\\Templates\\Memo.jtp" [0104.294] FindNextFileA (in: hFindFile=0x5be1a0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0104.294] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0104.294] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Journal\\Templates\\Memo.jtp") returned="Memo.jtp" [0104.294] lstrcatA (in: lpString1="C:\\Program Files\\Windows Journal\\Templates\\", lpString2="Month_Calendar.jtp" | out: lpString1="C:\\Program Files\\Windows Journal\\Templates\\Month_Calendar.jtp") returned="C:\\Program Files\\Windows Journal\\Templates\\Month_Calendar.jtp" [0104.294] FindNextFileA (in: hFindFile=0x5be1a0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0104.294] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0104.294] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Journal\\Templates\\Month_Calendar.jtp") returned="Month_Calendar.jtp" [0104.294] lstrcatA (in: lpString1="C:\\Program Files\\Windows Journal\\Templates\\", lpString2="Music.jtp" | out: lpString1="C:\\Program Files\\Windows Journal\\Templates\\Music.jtp") returned="C:\\Program Files\\Windows Journal\\Templates\\Music.jtp" [0104.294] FindNextFileA (in: hFindFile=0x5be1a0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0104.294] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0104.294] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Journal\\Templates\\Music.jtp") returned="Music.jtp" [0104.294] lstrcatA (in: lpString1="C:\\Program Files\\Windows Journal\\Templates\\", lpString2="Seyes.jtp" | out: lpString1="C:\\Program Files\\Windows Journal\\Templates\\Seyes.jtp") returned="C:\\Program Files\\Windows Journal\\Templates\\Seyes.jtp" [0104.294] FindNextFileA (in: hFindFile=0x5be1a0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0104.294] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0104.294] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Journal\\Templates\\Seyes.jtp") returned="Seyes.jtp" [0104.294] lstrcatA (in: lpString1="C:\\Program Files\\Windows Journal\\Templates\\", lpString2="Shorthand.jtp" | out: lpString1="C:\\Program Files\\Windows Journal\\Templates\\Shorthand.jtp") returned="C:\\Program Files\\Windows Journal\\Templates\\Shorthand.jtp" [0104.294] FindNextFileA (in: hFindFile=0x5be1a0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0104.294] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0104.294] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Journal\\Templates\\Shorthand.jtp") returned="Shorthand.jtp" [0104.294] lstrcatA (in: lpString1="C:\\Program Files\\Windows Journal\\Templates\\", lpString2="To_Do_List.jtp" | out: lpString1="C:\\Program Files\\Windows Journal\\Templates\\To_Do_List.jtp") returned="C:\\Program Files\\Windows Journal\\Templates\\To_Do_List.jtp" [0104.294] FindNextFileA (in: hFindFile=0x5be1a0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 0 [0104.294] FindClose (in: hFindFile=0x5be1a0 | out: hFindFile=0x5be1a0) returned 1 [0104.295] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf4e8 | out: lpFindFileData=0xaf4e8) returned 1 [0104.295] PeekMessageA (in: lpMsg=0xaf4c4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf4c4) returned 0 [0104.295] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Journal\\*.*") returned="*.*" [0104.295] lstrcatA (in: lpString1="C:\\Program Files\\Windows Journal\\", lpString2="weapon_burning.exe" | out: lpString1="C:\\Program Files\\Windows Journal\\weapon_burning.exe") returned="C:\\Program Files\\Windows Journal\\weapon_burning.exe" [0104.295] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf4e8 | out: lpFindFileData=0xaf4e8) returned 0 [0104.295] FindClose (in: hFindFile=0x5be160 | out: hFindFile=0x5be160) returned 1 [0104.295] FindNextFileA (in: hFindFile=0x5b90e0, lpFindFileData=0xaf638 | out: lpFindFileData=0xaf638) returned 1 [0104.295] lstrcmpA (lpString1=".", lpString2="Windows Mail") returned -1 [0104.295] lstrcmpA (lpString1="..", lpString2="Windows Mail") returned -1 [0104.295] PathFindFileNameA (pszPath="C:\\Program Files\\*.*") returned="*.*" [0104.295] lstrcatA (in: lpString1="C:\\Program Files\\", lpString2="Windows Mail" | out: lpString1="C:\\Program Files\\Windows Mail") returned="C:\\Program Files\\Windows Mail" [0104.295] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Mail\\*.*", lpFindFileData=0xaf4e8 | out: lpFindFileData=0xaf4e8) returned 0x5be160 [0104.296] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0104.296] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf4e8 | out: lpFindFileData=0xaf4e8) returned 1 [0104.296] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0104.296] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0104.296] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf4e8 | out: lpFindFileData=0xaf4e8) returned 1 [0104.296] lstrcmpA (lpString1=".", lpString2="en-US") returned -1 [0104.296] lstrcmpA (lpString1="..", lpString2="en-US") returned -1 [0104.296] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Mail\\*.*") returned="*.*" [0104.296] lstrcatA (in: lpString1="C:\\Program Files\\Windows Mail\\", lpString2="en-US" | out: lpString1="C:\\Program Files\\Windows Mail\\en-US") returned="C:\\Program Files\\Windows Mail\\en-US" [0104.297] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Mail\\en-US\\*.*", lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 0x5be1a0 [0104.297] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0104.297] FindNextFileA (in: hFindFile=0x5be1a0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0104.297] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0104.297] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0104.297] FindNextFileA (in: hFindFile=0x5be1a0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0104.297] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0104.297] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Mail\\en-US\\*.*") returned="*.*" [0104.297] lstrcatA (in: lpString1="C:\\Program Files\\Windows Mail\\en-US\\", lpString2="msoeres.dll.mui" | out: lpString1="C:\\Program Files\\Windows Mail\\en-US\\msoeres.dll.mui") returned="C:\\Program Files\\Windows Mail\\en-US\\msoeres.dll.mui" [0104.297] FindNextFileA (in: hFindFile=0x5be1a0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0104.297] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0104.297] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Mail\\en-US\\msoeres.dll.mui") returned="msoeres.dll.mui" [0104.297] lstrcatA (in: lpString1="C:\\Program Files\\Windows Mail\\en-US\\", lpString2="WinMail.exe.mui" | out: lpString1="C:\\Program Files\\Windows Mail\\en-US\\WinMail.exe.mui") returned="C:\\Program Files\\Windows Mail\\en-US\\WinMail.exe.mui" [0104.297] FindNextFileA (in: hFindFile=0x5be1a0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 0 [0104.297] FindClose (in: hFindFile=0x5be1a0 | out: hFindFile=0x5be1a0) returned 1 [0104.297] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf4e8 | out: lpFindFileData=0xaf4e8) returned 1 [0104.297] PeekMessageA (in: lpMsg=0xaf4c4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf4c4) returned 0 [0104.297] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Mail\\*.*") returned="*.*" [0104.297] lstrcatA (in: lpString1="C:\\Program Files\\Windows Mail\\", lpString2="msoe.dll" | out: lpString1="C:\\Program Files\\Windows Mail\\msoe.dll") returned="C:\\Program Files\\Windows Mail\\msoe.dll" [0104.297] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf4e8 | out: lpFindFileData=0xaf4e8) returned 1 [0104.297] PeekMessageA (in: lpMsg=0xaf4c4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf4c4) returned 0 [0104.297] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Mail\\msoe.dll") returned="msoe.dll" [0104.297] lstrcatA (in: lpString1="C:\\Program Files\\Windows Mail\\", lpString2="MSOERES.dll" | out: lpString1="C:\\Program Files\\Windows Mail\\MSOERES.dll") returned="C:\\Program Files\\Windows Mail\\MSOERES.dll" [0104.297] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf4e8 | out: lpFindFileData=0xaf4e8) returned 1 [0104.297] PeekMessageA (in: lpMsg=0xaf4c4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf4c4) returned 0 [0104.297] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Mail\\MSOERES.dll") returned="MSOERES.dll" [0104.297] lstrcatA (in: lpString1="C:\\Program Files\\Windows Mail\\", lpString2="oeimport.dll" | out: lpString1="C:\\Program Files\\Windows Mail\\oeimport.dll") returned="C:\\Program Files\\Windows Mail\\oeimport.dll" [0104.298] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf4e8 | out: lpFindFileData=0xaf4e8) returned 1 [0104.298] PeekMessageA (in: lpMsg=0xaf4c4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf4c4) returned 0 [0104.298] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Mail\\oeimport.dll") returned="oeimport.dll" [0104.298] lstrcatA (in: lpString1="C:\\Program Files\\Windows Mail\\", lpString2="wab.exe" | out: lpString1="C:\\Program Files\\Windows Mail\\wab.exe") returned="C:\\Program Files\\Windows Mail\\wab.exe" [0104.298] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf4e8 | out: lpFindFileData=0xaf4e8) returned 1 [0104.298] PeekMessageA (in: lpMsg=0xaf4c4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf4c4) returned 0 [0104.298] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Mail\\wab.exe") returned="wab.exe" [0104.298] lstrcatA (in: lpString1="C:\\Program Files\\Windows Mail\\", lpString2="wabfind.dll" | out: lpString1="C:\\Program Files\\Windows Mail\\wabfind.dll") returned="C:\\Program Files\\Windows Mail\\wabfind.dll" [0104.298] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf4e8 | out: lpFindFileData=0xaf4e8) returned 1 [0104.298] PeekMessageA (in: lpMsg=0xaf4c4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf4c4) returned 0 [0104.298] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Mail\\wabfind.dll") returned="wabfind.dll" [0104.298] lstrcatA (in: lpString1="C:\\Program Files\\Windows Mail\\", lpString2="wabimp.dll" | out: lpString1="C:\\Program Files\\Windows Mail\\wabimp.dll") returned="C:\\Program Files\\Windows Mail\\wabimp.dll" [0104.298] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf4e8 | out: lpFindFileData=0xaf4e8) returned 1 [0104.298] PeekMessageA (in: lpMsg=0xaf4c4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf4c4) returned 0 [0104.298] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Mail\\wabimp.dll") returned="wabimp.dll" [0104.298] lstrcatA (in: lpString1="C:\\Program Files\\Windows Mail\\", lpString2="wabmig.exe" | out: lpString1="C:\\Program Files\\Windows Mail\\wabmig.exe") returned="C:\\Program Files\\Windows Mail\\wabmig.exe" [0104.298] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf4e8 | out: lpFindFileData=0xaf4e8) returned 1 [0104.298] PeekMessageA (in: lpMsg=0xaf4c4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf4c4) returned 0 [0104.298] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Mail\\wabmig.exe") returned="wabmig.exe" [0104.298] lstrcatA (in: lpString1="C:\\Program Files\\Windows Mail\\", lpString2="WinMail.exe" | out: lpString1="C:\\Program Files\\Windows Mail\\WinMail.exe") returned="C:\\Program Files\\Windows Mail\\WinMail.exe" [0104.298] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf4e8 | out: lpFindFileData=0xaf4e8) returned 0 [0104.298] FindClose (in: hFindFile=0x5be160 | out: hFindFile=0x5be160) returned 1 [0104.298] FindNextFileA (in: hFindFile=0x5b90e0, lpFindFileData=0xaf638 | out: lpFindFileData=0xaf638) returned 1 [0104.298] lstrcmpA (lpString1=".", lpString2="Windows Media Player") returned -1 [0104.298] lstrcmpA (lpString1="..", lpString2="Windows Media Player") returned -1 [0104.298] PathFindFileNameA (pszPath="C:\\Program Files\\*.*") returned="*.*" [0104.298] lstrcatA (in: lpString1="C:\\Program Files\\", lpString2="Windows Media Player" | out: lpString1="C:\\Program Files\\Windows Media Player") returned="C:\\Program Files\\Windows Media Player" [0104.298] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Media Player\\*.*", lpFindFileData=0xaf4e8 | out: lpFindFileData=0xaf4e8) returned 0x5be160 [0104.299] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0104.299] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf4e8 | out: lpFindFileData=0xaf4e8) returned 1 [0104.299] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0104.299] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0104.299] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf4e8 | out: lpFindFileData=0xaf4e8) returned 1 [0104.299] lstrcmpA (lpString1=".", lpString2="en-US") returned -1 [0104.299] lstrcmpA (lpString1="..", lpString2="en-US") returned -1 [0104.299] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Media Player\\*.*") returned="*.*" [0104.299] lstrcatA (in: lpString1="C:\\Program Files\\Windows Media Player\\", lpString2="en-US" | out: lpString1="C:\\Program Files\\Windows Media Player\\en-US") returned="C:\\Program Files\\Windows Media Player\\en-US" [0104.299] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Media Player\\en-US\\*.*", lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 0x5be1a0 [0104.308] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0104.308] FindNextFileA (in: hFindFile=0x5be1a0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0104.308] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0104.308] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0104.308] FindNextFileA (in: hFindFile=0x5be1a0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0104.308] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0104.308] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Media Player\\en-US\\*.*") returned="*.*" [0104.308] lstrcatA (in: lpString1="C:\\Program Files\\Windows Media Player\\en-US\\", lpString2="mpvis.dll.mui" | out: lpString1="C:\\Program Files\\Windows Media Player\\en-US\\mpvis.dll.mui") returned="C:\\Program Files\\Windows Media Player\\en-US\\mpvis.dll.mui" [0104.308] FindNextFileA (in: hFindFile=0x5be1a0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0104.308] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0104.308] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Media Player\\en-US\\mpvis.dll.mui") returned="mpvis.dll.mui" [0104.308] lstrcatA (in: lpString1="C:\\Program Files\\Windows Media Player\\en-US\\", lpString2="setup_wm.exe.mui" | out: lpString1="C:\\Program Files\\Windows Media Player\\en-US\\setup_wm.exe.mui") returned="C:\\Program Files\\Windows Media Player\\en-US\\setup_wm.exe.mui" [0104.308] FindNextFileA (in: hFindFile=0x5be1a0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0104.308] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0104.308] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Media Player\\en-US\\setup_wm.exe.mui") returned="setup_wm.exe.mui" [0104.308] lstrcatA (in: lpString1="C:\\Program Files\\Windows Media Player\\en-US\\", lpString2="wmlaunch.exe.mui" | out: lpString1="C:\\Program Files\\Windows Media Player\\en-US\\wmlaunch.exe.mui") returned="C:\\Program Files\\Windows Media Player\\en-US\\wmlaunch.exe.mui" [0104.308] FindNextFileA (in: hFindFile=0x5be1a0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0104.308] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0104.308] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Media Player\\en-US\\wmlaunch.exe.mui") returned="wmlaunch.exe.mui" [0104.308] lstrcatA (in: lpString1="C:\\Program Files\\Windows Media Player\\en-US\\", lpString2="WMPDMC.exe.mui" | out: lpString1="C:\\Program Files\\Windows Media Player\\en-US\\WMPDMC.exe.mui") returned="C:\\Program Files\\Windows Media Player\\en-US\\WMPDMC.exe.mui" [0104.308] FindNextFileA (in: hFindFile=0x5be1a0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0104.308] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0104.308] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Media Player\\en-US\\WMPDMC.exe.mui") returned="WMPDMC.exe.mui" [0104.308] lstrcatA (in: lpString1="C:\\Program Files\\Windows Media Player\\en-US\\", lpString2="WMPDMCCore.dll.mui" | out: lpString1="C:\\Program Files\\Windows Media Player\\en-US\\WMPDMCCore.dll.mui") returned="C:\\Program Files\\Windows Media Player\\en-US\\WMPDMCCore.dll.mui" [0104.309] FindNextFileA (in: hFindFile=0x5be1a0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0104.309] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0104.309] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Media Player\\en-US\\WMPDMCCore.dll.mui") returned="WMPDMCCore.dll.mui" [0104.309] lstrcatA (in: lpString1="C:\\Program Files\\Windows Media Player\\en-US\\", lpString2="wmplayer.exe.mui" | out: lpString1="C:\\Program Files\\Windows Media Player\\en-US\\wmplayer.exe.mui") returned="C:\\Program Files\\Windows Media Player\\en-US\\wmplayer.exe.mui" [0104.309] FindNextFileA (in: hFindFile=0x5be1a0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0104.309] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0104.309] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Media Player\\en-US\\wmplayer.exe.mui") returned="wmplayer.exe.mui" [0104.309] lstrcatA (in: lpString1="C:\\Program Files\\Windows Media Player\\en-US\\", lpString2="WMPMediaSharing.dll.mui" | out: lpString1="C:\\Program Files\\Windows Media Player\\en-US\\WMPMediaSharing.dll.mui") returned="C:\\Program Files\\Windows Media Player\\en-US\\WMPMediaSharing.dll.mui" [0104.309] FindNextFileA (in: hFindFile=0x5be1a0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0104.309] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0104.309] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Media Player\\en-US\\WMPMediaSharing.dll.mui") returned="WMPMediaSharing.dll.mui" [0104.309] lstrcatA (in: lpString1="C:\\Program Files\\Windows Media Player\\en-US\\", lpString2="wmpnetwk.exe.mui" | out: lpString1="C:\\Program Files\\Windows Media Player\\en-US\\wmpnetwk.exe.mui") returned="C:\\Program Files\\Windows Media Player\\en-US\\wmpnetwk.exe.mui" [0104.309] FindNextFileA (in: hFindFile=0x5be1a0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0104.309] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0104.309] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Media Player\\en-US\\wmpnetwk.exe.mui") returned="wmpnetwk.exe.mui" [0104.309] lstrcatA (in: lpString1="C:\\Program Files\\Windows Media Player\\en-US\\", lpString2="wmpnscfg.exe.mui" | out: lpString1="C:\\Program Files\\Windows Media Player\\en-US\\wmpnscfg.exe.mui") returned="C:\\Program Files\\Windows Media Player\\en-US\\wmpnscfg.exe.mui" [0104.309] FindNextFileA (in: hFindFile=0x5be1a0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0104.309] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0104.309] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Media Player\\en-US\\wmpnscfg.exe.mui") returned="wmpnscfg.exe.mui" [0104.309] lstrcatA (in: lpString1="C:\\Program Files\\Windows Media Player\\en-US\\", lpString2="wmpnssci.dll.mui" | out: lpString1="C:\\Program Files\\Windows Media Player\\en-US\\wmpnssci.dll.mui") returned="C:\\Program Files\\Windows Media Player\\en-US\\wmpnssci.dll.mui" [0104.309] FindNextFileA (in: hFindFile=0x5be1a0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0104.309] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0104.309] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Media Player\\en-US\\wmpnssci.dll.mui") returned="wmpnssci.dll.mui" [0104.309] lstrcatA (in: lpString1="C:\\Program Files\\Windows Media Player\\en-US\\", lpString2="wmpnssui.dll.mui" | out: lpString1="C:\\Program Files\\Windows Media Player\\en-US\\wmpnssui.dll.mui") returned="C:\\Program Files\\Windows Media Player\\en-US\\wmpnssui.dll.mui" [0104.309] FindNextFileA (in: hFindFile=0x5be1a0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0104.309] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0104.309] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Media Player\\en-US\\wmpnssui.dll.mui") returned="wmpnssui.dll.mui" [0104.309] lstrcatA (in: lpString1="C:\\Program Files\\Windows Media Player\\en-US\\", lpString2="WMPSideShowGadget.exe.mui" | out: lpString1="C:\\Program Files\\Windows Media Player\\en-US\\WMPSideShowGadget.exe.mui") returned="C:\\Program Files\\Windows Media Player\\en-US\\WMPSideShowGadget.exe.mui" [0104.310] FindNextFileA (in: hFindFile=0x5be1a0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 0 [0104.310] FindClose (in: hFindFile=0x5be1a0 | out: hFindFile=0x5be1a0) returned 1 [0104.310] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf4e8 | out: lpFindFileData=0xaf4e8) returned 1 [0104.310] lstrcmpA (lpString1=".", lpString2="Icons") returned -1 [0104.310] lstrcmpA (lpString1="..", lpString2="Icons") returned -1 [0104.310] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Media Player\\*.*") returned="*.*" [0104.310] lstrcatA (in: lpString1="C:\\Program Files\\Windows Media Player\\", lpString2="Icons" | out: lpString1="C:\\Program Files\\Windows Media Player\\Icons") returned="C:\\Program Files\\Windows Media Player\\Icons" [0104.310] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Media Player\\Icons\\*.*", lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 0x5be1a0 [0104.310] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0104.310] FindNextFileA (in: hFindFile=0x5be1a0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0104.310] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0104.310] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0104.310] FindNextFileA (in: hFindFile=0x5be1a0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 0 [0104.311] FindClose (in: hFindFile=0x5be1a0 | out: hFindFile=0x5be1a0) returned 1 [0104.311] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf4e8 | out: lpFindFileData=0xaf4e8) returned 1 [0104.311] lstrcmpA (lpString1=".", lpString2="Media Renderer") returned -1 [0104.311] lstrcmpA (lpString1="..", lpString2="Media Renderer") returned -1 [0104.311] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Media Player\\*.*") returned="*.*" [0104.311] lstrcatA (in: lpString1="C:\\Program Files\\Windows Media Player\\", lpString2="Media Renderer" | out: lpString1="C:\\Program Files\\Windows Media Player\\Media Renderer") returned="C:\\Program Files\\Windows Media Player\\Media Renderer" [0104.311] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Media Player\\Media Renderer\\*.*", lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 0x5be1a0 [0104.320] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0104.320] FindNextFileA (in: hFindFile=0x5be1a0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0104.320] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0104.320] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0104.320] FindNextFileA (in: hFindFile=0x5be1a0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0104.320] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0104.320] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Media Player\\Media Renderer\\*.*") returned="*.*" [0104.320] lstrcatA (in: lpString1="C:\\Program Files\\Windows Media Player\\Media Renderer\\", lpString2="avtransport.xml" | out: lpString1="C:\\Program Files\\Windows Media Player\\Media Renderer\\avtransport.xml") returned="C:\\Program Files\\Windows Media Player\\Media Renderer\\avtransport.xml" [0104.320] FindNextFileA (in: hFindFile=0x5be1a0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0104.320] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0104.320] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Media Player\\Media Renderer\\avtransport.xml") returned="avtransport.xml" [0104.320] lstrcatA (in: lpString1="C:\\Program Files\\Windows Media Player\\Media Renderer\\", lpString2="connectionmanager_dmr.xml" | out: lpString1="C:\\Program Files\\Windows Media Player\\Media Renderer\\connectionmanager_dmr.xml") returned="C:\\Program Files\\Windows Media Player\\Media Renderer\\connectionmanager_dmr.xml" [0104.320] FindNextFileA (in: hFindFile=0x5be1a0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0104.320] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0104.320] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Media Player\\Media Renderer\\connectionmanager_dmr.xml") returned="connectionmanager_dmr.xml" [0104.320] lstrcatA (in: lpString1="C:\\Program Files\\Windows Media Player\\Media Renderer\\", lpString2="DMR_120.jpg" | out: lpString1="C:\\Program Files\\Windows Media Player\\Media Renderer\\DMR_120.jpg") returned="C:\\Program Files\\Windows Media Player\\Media Renderer\\DMR_120.jpg" [0104.320] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Windows Media Player\\Media Renderer\\DMR_120.jpg" | out: lpString1="C:\\Program Files\\Windows Media Player\\Media Renderer\\DMR_120.jpg") returned="C:\\Program Files\\Windows Media Player\\Media Renderer\\DMR_120.jpg" [0104.320] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Windows Media Player\\Media Renderer\\DMR_120.jpg" | out: lpString1="C:\\Program Files\\Windows Media Player\\Media Renderer\\DMR_120.jpg") returned="C:\\Program Files\\Windows Media Player\\Media Renderer\\DMR_120.jpg" [0104.320] lstrcatA (in: lpString1="C:\\Program Files\\Windows Media Player\\Media Renderer\\DMR_120.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Windows Media Player\\Media Renderer\\DMR_120.jpg.") returned="C:\\Program Files\\Windows Media Player\\Media Renderer\\DMR_120.jpg." [0104.320] lstrcatA (in: lpString1="C:\\Program Files\\Windows Media Player\\Media Renderer\\DMR_120.jpg.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Windows Media Player\\Media Renderer\\DMR_120.jpg. ") returned="C:\\Program Files\\Windows Media Player\\Media Renderer\\DMR_120.jpg. " [0104.320] CreateFileA (lpFileName="C:\\Program Files\\Windows Media Player\\Media Renderer\\DMR_120.jpg" (normalized: "c:\\program files\\windows media player\\media renderer\\dmr_120.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0104.331] FindNextFileA (in: hFindFile=0x5be1a0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0104.331] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0104.331] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Media Player\\Media Renderer\\DMR_120.jpg") returned="DMR_120.jpg" [0104.331] lstrcatA (in: lpString1="C:\\Program Files\\Windows Media Player\\Media Renderer\\", lpString2="DMR_120.png" | out: lpString1="C:\\Program Files\\Windows Media Player\\Media Renderer\\DMR_120.png") returned="C:\\Program Files\\Windows Media Player\\Media Renderer\\DMR_120.png" [0104.332] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Windows Media Player\\Media Renderer\\DMR_120.png" | out: lpString1="C:\\Program Files\\Windows Media Player\\Media Renderer\\DMR_120.png") returned="C:\\Program Files\\Windows Media Player\\Media Renderer\\DMR_120.png" [0104.332] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Windows Media Player\\Media Renderer\\DMR_120.png" | out: lpString1="C:\\Program Files\\Windows Media Player\\Media Renderer\\DMR_120.png") returned="C:\\Program Files\\Windows Media Player\\Media Renderer\\DMR_120.png" [0104.332] lstrcatA (in: lpString1="C:\\Program Files\\Windows Media Player\\Media Renderer\\DMR_120.png", lpString2="." | out: lpString1="C:\\Program Files\\Windows Media Player\\Media Renderer\\DMR_120.png.") returned="C:\\Program Files\\Windows Media Player\\Media Renderer\\DMR_120.png." [0104.332] lstrcatA (in: lpString1="C:\\Program Files\\Windows Media Player\\Media Renderer\\DMR_120.png.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Windows Media Player\\Media Renderer\\DMR_120.png. ") returned="C:\\Program Files\\Windows Media Player\\Media Renderer\\DMR_120.png. " [0104.332] CreateFileA (lpFileName="C:\\Program Files\\Windows Media Player\\Media Renderer\\DMR_120.png" (normalized: "c:\\program files\\windows media player\\media renderer\\dmr_120.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0104.357] FindNextFileA (in: hFindFile=0x5be1a0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0104.357] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0104.357] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Media Player\\Media Renderer\\DMR_120.png") returned="DMR_120.png" [0104.357] lstrcatA (in: lpString1="C:\\Program Files\\Windows Media Player\\Media Renderer\\", lpString2="DMR_48.jpg" | out: lpString1="C:\\Program Files\\Windows Media Player\\Media Renderer\\DMR_48.jpg") returned="C:\\Program Files\\Windows Media Player\\Media Renderer\\DMR_48.jpg" [0104.357] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Windows Media Player\\Media Renderer\\DMR_48.jpg" | out: lpString1="C:\\Program Files\\Windows Media Player\\Media Renderer\\DMR_48.jpg") returned="C:\\Program Files\\Windows Media Player\\Media Renderer\\DMR_48.jpg" [0104.357] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Windows Media Player\\Media Renderer\\DMR_48.jpg" | out: lpString1="C:\\Program Files\\Windows Media Player\\Media Renderer\\DMR_48.jpg") returned="C:\\Program Files\\Windows Media Player\\Media Renderer\\DMR_48.jpg" [0104.357] lstrcatA (in: lpString1="C:\\Program Files\\Windows Media Player\\Media Renderer\\DMR_48.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Windows Media Player\\Media Renderer\\DMR_48.jpg.") returned="C:\\Program Files\\Windows Media Player\\Media Renderer\\DMR_48.jpg." [0104.357] lstrcatA (in: lpString1="C:\\Program Files\\Windows Media Player\\Media Renderer\\DMR_48.jpg.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Windows Media Player\\Media Renderer\\DMR_48.jpg. ") returned="C:\\Program Files\\Windows Media Player\\Media Renderer\\DMR_48.jpg. " [0104.357] CreateFileA (lpFileName="C:\\Program Files\\Windows Media Player\\Media Renderer\\DMR_48.jpg" (normalized: "c:\\program files\\windows media player\\media renderer\\dmr_48.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0104.357] FindNextFileA (in: hFindFile=0x5be1a0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0104.357] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0104.357] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Media Player\\Media Renderer\\DMR_48.jpg") returned="DMR_48.jpg" [0104.357] lstrcatA (in: lpString1="C:\\Program Files\\Windows Media Player\\Media Renderer\\", lpString2="DMR_48.png" | out: lpString1="C:\\Program Files\\Windows Media Player\\Media Renderer\\DMR_48.png") returned="C:\\Program Files\\Windows Media Player\\Media Renderer\\DMR_48.png" [0104.357] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Windows Media Player\\Media Renderer\\DMR_48.png" | out: lpString1="C:\\Program Files\\Windows Media Player\\Media Renderer\\DMR_48.png") returned="C:\\Program Files\\Windows Media Player\\Media Renderer\\DMR_48.png" [0104.357] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Windows Media Player\\Media Renderer\\DMR_48.png" | out: lpString1="C:\\Program Files\\Windows Media Player\\Media Renderer\\DMR_48.png") returned="C:\\Program Files\\Windows Media Player\\Media Renderer\\DMR_48.png" [0104.357] lstrcatA (in: lpString1="C:\\Program Files\\Windows Media Player\\Media Renderer\\DMR_48.png", lpString2="." | out: lpString1="C:\\Program Files\\Windows Media Player\\Media Renderer\\DMR_48.png.") returned="C:\\Program Files\\Windows Media Player\\Media Renderer\\DMR_48.png." [0104.357] lstrcatA (in: lpString1="C:\\Program Files\\Windows Media Player\\Media Renderer\\DMR_48.png.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Windows Media Player\\Media Renderer\\DMR_48.png. ") returned="C:\\Program Files\\Windows Media Player\\Media Renderer\\DMR_48.png. " [0104.357] CreateFileA (lpFileName="C:\\Program Files\\Windows Media Player\\Media Renderer\\DMR_48.png" (normalized: "c:\\program files\\windows media player\\media renderer\\dmr_48.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0104.358] FindNextFileA (in: hFindFile=0x5be1a0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0104.358] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0104.358] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Media Player\\Media Renderer\\DMR_48.png") returned="DMR_48.png" [0104.358] lstrcatA (in: lpString1="C:\\Program Files\\Windows Media Player\\Media Renderer\\", lpString2="RenderingControl.xml" | out: lpString1="C:\\Program Files\\Windows Media Player\\Media Renderer\\RenderingControl.xml") returned="C:\\Program Files\\Windows Media Player\\Media Renderer\\RenderingControl.xml" [0104.358] FindNextFileA (in: hFindFile=0x5be1a0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 0 [0104.358] FindClose (in: hFindFile=0x5be1a0 | out: hFindFile=0x5be1a0) returned 1 [0104.359] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf4e8 | out: lpFindFileData=0xaf4e8) returned 1 [0104.359] PeekMessageA (in: lpMsg=0xaf4c4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf4c4) returned 0 [0104.359] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Media Player\\*.*") returned="*.*" [0104.359] lstrcatA (in: lpString1="C:\\Program Files\\Windows Media Player\\", lpString2="mpvis.DLL" | out: lpString1="C:\\Program Files\\Windows Media Player\\mpvis.DLL") returned="C:\\Program Files\\Windows Media Player\\mpvis.DLL" [0104.359] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf4e8 | out: lpFindFileData=0xaf4e8) returned 1 [0104.359] lstrcmpA (lpString1=".", lpString2="Network Sharing") returned -1 [0104.359] lstrcmpA (lpString1="..", lpString2="Network Sharing") returned -1 [0104.359] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Media Player\\mpvis.DLL") returned="mpvis.DLL" [0104.359] lstrcatA (in: lpString1="C:\\Program Files\\Windows Media Player\\", lpString2="Network Sharing" | out: lpString1="C:\\Program Files\\Windows Media Player\\Network Sharing") returned="C:\\Program Files\\Windows Media Player\\Network Sharing" [0104.359] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Media Player\\Network Sharing\\*.*", lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 0x5be1a0 [0104.375] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0104.375] FindNextFileA (in: hFindFile=0x5be1a0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0104.375] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0104.375] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0104.375] FindNextFileA (in: hFindFile=0x5be1a0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0104.375] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0104.375] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Media Player\\Network Sharing\\*.*") returned="*.*" [0104.375] lstrcatA (in: lpString1="C:\\Program Files\\Windows Media Player\\Network Sharing\\", lpString2="ConnectionManager.xml" | out: lpString1="C:\\Program Files\\Windows Media Player\\Network Sharing\\ConnectionManager.xml") returned="C:\\Program Files\\Windows Media Player\\Network Sharing\\ConnectionManager.xml" [0104.375] FindNextFileA (in: hFindFile=0x5be1a0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0104.375] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0104.375] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Media Player\\Network Sharing\\ConnectionManager.xml") returned="ConnectionManager.xml" [0104.375] lstrcatA (in: lpString1="C:\\Program Files\\Windows Media Player\\Network Sharing\\", lpString2="ContentDirectory.xml" | out: lpString1="C:\\Program Files\\Windows Media Player\\Network Sharing\\ContentDirectory.xml") returned="C:\\Program Files\\Windows Media Player\\Network Sharing\\ContentDirectory.xml" [0104.375] FindNextFileA (in: hFindFile=0x5be1a0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0104.375] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0104.375] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Media Player\\Network Sharing\\ContentDirectory.xml") returned="ContentDirectory.xml" [0104.375] lstrcatA (in: lpString1="C:\\Program Files\\Windows Media Player\\Network Sharing\\", lpString2="MediaReceiverRegistrar.xml" | out: lpString1="C:\\Program Files\\Windows Media Player\\Network Sharing\\MediaReceiverRegistrar.xml") returned="C:\\Program Files\\Windows Media Player\\Network Sharing\\MediaReceiverRegistrar.xml" [0104.375] FindNextFileA (in: hFindFile=0x5be1a0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0104.375] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0104.375] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Media Player\\Network Sharing\\MediaReceiverRegistrar.xml") returned="MediaReceiverRegistrar.xml" [0104.375] lstrcatA (in: lpString1="C:\\Program Files\\Windows Media Player\\Network Sharing\\", lpString2="wmpnss_bw120.jpg" | out: lpString1="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_bw120.jpg") returned="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_bw120.jpg" [0104.376] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_bw120.jpg" | out: lpString1="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_bw120.jpg") returned="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_bw120.jpg" [0104.376] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_bw120.jpg" | out: lpString1="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_bw120.jpg") returned="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_bw120.jpg" [0104.376] lstrcatA (in: lpString1="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_bw120.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_bw120.jpg.") returned="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_bw120.jpg." [0104.376] lstrcatA (in: lpString1="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_bw120.jpg.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_bw120.jpg. ") returned="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_bw120.jpg. " [0104.376] CreateFileA (lpFileName="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_bw120.jpg" (normalized: "c:\\program files\\windows media player\\network sharing\\wmpnss_bw120.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0104.376] FindNextFileA (in: hFindFile=0x5be1a0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0104.376] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0104.376] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_bw120.jpg") returned="wmpnss_bw120.jpg" [0104.376] lstrcatA (in: lpString1="C:\\Program Files\\Windows Media Player\\Network Sharing\\", lpString2="wmpnss_bw120.png" | out: lpString1="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_bw120.png") returned="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_bw120.png" [0104.376] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_bw120.png" | out: lpString1="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_bw120.png") returned="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_bw120.png" [0104.376] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_bw120.png" | out: lpString1="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_bw120.png") returned="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_bw120.png" [0104.376] lstrcatA (in: lpString1="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_bw120.png", lpString2="." | out: lpString1="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_bw120.png.") returned="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_bw120.png." [0104.376] lstrcatA (in: lpString1="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_bw120.png.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_bw120.png. ") returned="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_bw120.png. " [0104.376] CreateFileA (lpFileName="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_bw120.png" (normalized: "c:\\program files\\windows media player\\network sharing\\wmpnss_bw120.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0104.376] FindNextFileA (in: hFindFile=0x5be1a0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0104.376] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0104.376] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_bw120.png") returned="wmpnss_bw120.png" [0104.376] lstrcatA (in: lpString1="C:\\Program Files\\Windows Media Player\\Network Sharing\\", lpString2="wmpnss_bw32.bmp" | out: lpString1="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_bw32.bmp") returned="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_bw32.bmp" [0104.376] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_bw32.bmp" | out: lpString1="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_bw32.bmp") returned="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_bw32.bmp" [0104.377] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_bw32.bmp" | out: lpString1="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_bw32.bmp") returned="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_bw32.bmp" [0104.377] lstrcatA (in: lpString1="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_bw32.bmp", lpString2="." | out: lpString1="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_bw32.bmp.") returned="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_bw32.bmp." [0104.377] lstrcatA (in: lpString1="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_bw32.bmp.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_bw32.bmp. ") returned="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_bw32.bmp. " [0104.377] CreateFileA (lpFileName="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_bw32.bmp" (normalized: "c:\\program files\\windows media player\\network sharing\\wmpnss_bw32.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0104.377] FindNextFileA (in: hFindFile=0x5be1a0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0104.377] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0104.377] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_bw32.bmp") returned="wmpnss_bw32.bmp" [0104.377] lstrcatA (in: lpString1="C:\\Program Files\\Windows Media Player\\Network Sharing\\", lpString2="wmpnss_bw32.jpg" | out: lpString1="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_bw32.jpg") returned="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_bw32.jpg" [0104.377] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_bw32.jpg" | out: lpString1="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_bw32.jpg") returned="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_bw32.jpg" [0104.377] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_bw32.jpg" | out: lpString1="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_bw32.jpg") returned="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_bw32.jpg" [0104.377] lstrcatA (in: lpString1="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_bw32.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_bw32.jpg.") returned="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_bw32.jpg." [0104.377] lstrcatA (in: lpString1="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_bw32.jpg.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_bw32.jpg. ") returned="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_bw32.jpg. " [0104.377] CreateFileA (lpFileName="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_bw32.jpg" (normalized: "c:\\program files\\windows media player\\network sharing\\wmpnss_bw32.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0104.377] FindNextFileA (in: hFindFile=0x5be1a0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0104.377] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0104.377] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_bw32.jpg") returned="wmpnss_bw32.jpg" [0104.377] lstrcatA (in: lpString1="C:\\Program Files\\Windows Media Player\\Network Sharing\\", lpString2="wmpnss_bw48.bmp" | out: lpString1="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_bw48.bmp") returned="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_bw48.bmp" [0104.377] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_bw48.bmp" | out: lpString1="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_bw48.bmp") returned="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_bw48.bmp" [0104.377] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_bw48.bmp" | out: lpString1="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_bw48.bmp") returned="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_bw48.bmp" [0104.377] lstrcatA (in: lpString1="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_bw48.bmp", lpString2="." | out: lpString1="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_bw48.bmp.") returned="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_bw48.bmp." [0104.378] lstrcatA (in: lpString1="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_bw48.bmp.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_bw48.bmp. ") returned="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_bw48.bmp. " [0104.378] CreateFileA (lpFileName="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_bw48.bmp" (normalized: "c:\\program files\\windows media player\\network sharing\\wmpnss_bw48.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0104.378] FindNextFileA (in: hFindFile=0x5be1a0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0104.378] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0104.378] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_bw48.bmp") returned="wmpnss_bw48.bmp" [0104.378] lstrcatA (in: lpString1="C:\\Program Files\\Windows Media Player\\Network Sharing\\", lpString2="wmpnss_bw48.jpg" | out: lpString1="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_bw48.jpg") returned="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_bw48.jpg" [0104.378] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_bw48.jpg" | out: lpString1="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_bw48.jpg") returned="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_bw48.jpg" [0104.378] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_bw48.jpg" | out: lpString1="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_bw48.jpg") returned="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_bw48.jpg" [0104.378] lstrcatA (in: lpString1="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_bw48.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_bw48.jpg.") returned="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_bw48.jpg." [0104.378] lstrcatA (in: lpString1="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_bw48.jpg.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_bw48.jpg. ") returned="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_bw48.jpg. " [0104.378] CreateFileA (lpFileName="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_bw48.jpg" (normalized: "c:\\program files\\windows media player\\network sharing\\wmpnss_bw48.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0104.378] FindNextFileA (in: hFindFile=0x5be1a0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0104.378] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0104.378] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_bw48.jpg") returned="wmpnss_bw48.jpg" [0104.378] lstrcatA (in: lpString1="C:\\Program Files\\Windows Media Player\\Network Sharing\\", lpString2="wmpnss_bw48.png" | out: lpString1="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_bw48.png") returned="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_bw48.png" [0104.378] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_bw48.png" | out: lpString1="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_bw48.png") returned="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_bw48.png" [0104.378] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_bw48.png" | out: lpString1="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_bw48.png") returned="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_bw48.png" [0104.378] lstrcatA (in: lpString1="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_bw48.png", lpString2="." | out: lpString1="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_bw48.png.") returned="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_bw48.png." [0104.378] lstrcatA (in: lpString1="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_bw48.png.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_bw48.png. ") returned="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_bw48.png. " [0104.378] CreateFileA (lpFileName="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_bw48.png" (normalized: "c:\\program files\\windows media player\\network sharing\\wmpnss_bw48.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0104.381] FindNextFileA (in: hFindFile=0x5be1a0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0104.381] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0104.381] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_bw48.png") returned="wmpnss_bw48.png" [0104.381] lstrcatA (in: lpString1="C:\\Program Files\\Windows Media Player\\Network Sharing\\", lpString2="wmpnss_color120.jpg" | out: lpString1="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_color120.jpg") returned="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_color120.jpg" [0104.381] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_color120.jpg" | out: lpString1="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_color120.jpg") returned="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_color120.jpg" [0104.381] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_color120.jpg" | out: lpString1="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_color120.jpg") returned="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_color120.jpg" [0104.381] lstrcatA (in: lpString1="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_color120.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_color120.jpg.") returned="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_color120.jpg." [0104.381] lstrcatA (in: lpString1="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_color120.jpg.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_color120.jpg. ") returned="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_color120.jpg. " [0104.381] CreateFileA (lpFileName="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_color120.jpg" (normalized: "c:\\program files\\windows media player\\network sharing\\wmpnss_color120.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0104.381] FindNextFileA (in: hFindFile=0x5be1a0, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0104.381] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0104.381] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_color120.jpg") returned="wmpnss_color120.jpg" [0104.381] lstrcatA (in: lpString1="C:\\Program Files\\Windows Media Player\\Network Sharing\\", lpString2="wmpnss_color120.png" | out: lpString1="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_color120.png") returned="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_color120.png" [0104.381] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_color120.png" | out: lpString1="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_color120.png") returned="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_color120.png" [0104.381] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_color120.png" | out: lpString1="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_color120.png") returned="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_color120.png" [0104.381] lstrcatA (in: lpString1="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_color120.png", lpString2="." | out: lpString1="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_color120.png.") returned="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_color120.png." [0104.381] lstrcatA (in: lpString1="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_color120.png.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_color120.png. ") returned="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_color120.png. " [0104.381] CreateFileA (lpFileName="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_color120.png" (normalized: "c:\\program files\\windows media player\\network sharing\\wmpnss_color120.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0104.381] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0104.381] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_color120.png") returned="wmpnss_color120.png" [0104.381] lstrcatA (in: lpString1="C:\\Program Files\\Windows Media Player\\Network Sharing\\", lpString2="wmpnss_color32.bmp" | out: lpString1="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_color32.bmp") returned="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_color32.bmp" [0104.381] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_color32.bmp" | out: lpString1="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_color32.bmp") returned="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_color32.bmp" [0104.381] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_color32.bmp" | out: lpString1="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_color32.bmp") returned="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_color32.bmp" [0104.381] lstrcatA (in: lpString1="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_color32.bmp", lpString2="." | out: lpString1="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_color32.bmp.") returned="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_color32.bmp." [0104.381] lstrcatA (in: lpString1="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_color32.bmp.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_color32.bmp. ") returned="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_color32.bmp. " [0104.382] CreateFileA (lpFileName="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_color32.bmp" (normalized: "c:\\program files\\windows media player\\network sharing\\wmpnss_color32.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0104.382] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0104.382] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_color32.bmp") returned="wmpnss_color32.bmp" [0104.382] lstrcatA (in: lpString1="C:\\Program Files\\Windows Media Player\\Network Sharing\\", lpString2="wmpnss_color32.jpg" | out: lpString1="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_color32.jpg") returned="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_color32.jpg" [0104.382] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_color32.jpg" | out: lpString1="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_color32.jpg") returned="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_color32.jpg" [0104.382] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_color32.jpg" | out: lpString1="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_color32.jpg") returned="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_color32.jpg" [0104.382] lstrcatA (in: lpString1="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_color32.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_color32.jpg.") returned="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_color32.jpg." [0104.382] lstrcatA (in: lpString1="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_color32.jpg.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_color32.jpg. ") returned="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_color32.jpg. " [0104.382] CreateFileA (lpFileName="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_color32.jpg" (normalized: "c:\\program files\\windows media player\\network sharing\\wmpnss_color32.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0104.382] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0104.382] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_color32.jpg") returned="wmpnss_color32.jpg" [0104.382] lstrcatA (in: lpString1="C:\\Program Files\\Windows Media Player\\Network Sharing\\", lpString2="wmpnss_color48.bmp" | out: lpString1="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_color48.bmp") returned="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_color48.bmp" [0104.382] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_color48.bmp" | out: lpString1="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_color48.bmp") returned="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_color48.bmp" [0104.382] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_color48.bmp" | out: lpString1="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_color48.bmp") returned="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_color48.bmp" [0104.382] lstrcatA (in: lpString1="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_color48.bmp", lpString2="." | out: lpString1="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_color48.bmp.") returned="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_color48.bmp." [0104.382] lstrcatA (in: lpString1="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_color48.bmp.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_color48.bmp. ") returned="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_color48.bmp. " [0104.382] CreateFileA (lpFileName="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_color48.bmp" (normalized: "c:\\program files\\windows media player\\network sharing\\wmpnss_color48.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0104.383] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0104.383] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_color48.bmp") returned="wmpnss_color48.bmp" [0104.383] lstrcatA (in: lpString1="C:\\Program Files\\Windows Media Player\\Network Sharing\\", lpString2="wmpnss_color48.jpg" | out: lpString1="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_color48.jpg") returned="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_color48.jpg" [0104.383] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_color48.jpg" | out: lpString1="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_color48.jpg") returned="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_color48.jpg" [0104.383] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_color48.jpg" | out: lpString1="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_color48.jpg") returned="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_color48.jpg" [0104.383] lstrcatA (in: lpString1="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_color48.jpg", lpString2="." | out: lpString1="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_color48.jpg.") returned="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_color48.jpg." [0104.383] lstrcatA (in: lpString1="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_color48.jpg.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_color48.jpg. ") returned="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_color48.jpg. " [0104.383] CreateFileA (lpFileName="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_color48.jpg" (normalized: "c:\\program files\\windows media player\\network sharing\\wmpnss_color48.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0104.383] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0104.383] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_color48.jpg") returned="wmpnss_color48.jpg" [0104.383] lstrcatA (in: lpString1="C:\\Program Files\\Windows Media Player\\Network Sharing\\", lpString2="wmpnss_color48.png" | out: lpString1="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_color48.png") returned="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_color48.png" [0104.383] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_color48.png" | out: lpString1="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_color48.png") returned="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_color48.png" [0104.383] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_color48.png" | out: lpString1="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_color48.png") returned="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_color48.png" [0104.383] lstrcatA (in: lpString1="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_color48.png", lpString2="." | out: lpString1="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_color48.png.") returned="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_color48.png." [0104.383] lstrcatA (in: lpString1="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_color48.png.", lpString2="\xa0" | out: lpString1="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_color48.png. ") returned="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_color48.png. " [0104.383] CreateFileA (lpFileName="C:\\Program Files\\Windows Media Player\\Network Sharing\\wmpnss_color48.png" (normalized: "c:\\program files\\windows media player\\network sharing\\wmpnss_color48.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0104.383] FindClose (in: hFindFile=0x5be1a0 | out: hFindFile=0x5be1a0) returned 1 [0104.384] PeekMessageA (in: lpMsg=0xaf4c4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf4c4) returned 0 [0104.384] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Media Player\\*.*") returned="*.*" [0104.384] lstrcatA (in: lpString1="C:\\Program Files\\Windows Media Player\\", lpString2="setup_wm.exe" | out: lpString1="C:\\Program Files\\Windows Media Player\\setup_wm.exe") returned="C:\\Program Files\\Windows Media Player\\setup_wm.exe" [0104.384] lstrcmpA (lpString1=".", lpString2="Skins") returned -1 [0104.384] lstrcmpA (lpString1="..", lpString2="Skins") returned -1 [0104.384] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Media Player\\setup_wm.exe") returned="setup_wm.exe" [0104.384] lstrcatA (in: lpString1="C:\\Program Files\\Windows Media Player\\", lpString2="Skins" | out: lpString1="C:\\Program Files\\Windows Media Player\\Skins") returned="C:\\Program Files\\Windows Media Player\\Skins" [0104.384] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Media Player\\Skins\\*.*", lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 0x5be1a0 [0104.384] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0104.384] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0104.384] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0104.384] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0104.384] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Media Player\\Skins\\*.*") returned="*.*" [0104.384] lstrcatA (in: lpString1="C:\\Program Files\\Windows Media Player\\Skins\\", lpString2="Revert.wmz" | out: lpString1="C:\\Program Files\\Windows Media Player\\Skins\\Revert.wmz") returned="C:\\Program Files\\Windows Media Player\\Skins\\Revert.wmz" [0104.384] FindClose (in: hFindFile=0x5be1a0 | out: hFindFile=0x5be1a0) returned 1 [0104.384] lstrcmpA (lpString1=".", lpString2="Visualizations") returned -1 [0104.384] lstrcmpA (lpString1="..", lpString2="Visualizations") returned -1 [0104.384] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Media Player\\*.*") returned="*.*" [0104.384] lstrcatA (in: lpString1="C:\\Program Files\\Windows Media Player\\", lpString2="Visualizations" | out: lpString1="C:\\Program Files\\Windows Media Player\\Visualizations") returned="C:\\Program Files\\Windows Media Player\\Visualizations" [0104.384] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Media Player\\Visualizations\\*.*", lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 0x5be1a0 [0104.385] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0104.385] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0104.385] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0104.385] FindClose (in: hFindFile=0x5be1a0 | out: hFindFile=0x5be1a0) returned 1 [0104.385] PeekMessageA (in: lpMsg=0xaf4c4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf4c4) returned 0 [0104.385] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Media Player\\*.*") returned="*.*" [0104.385] lstrcatA (in: lpString1="C:\\Program Files\\Windows Media Player\\", lpString2="wmlaunch.exe" | out: lpString1="C:\\Program Files\\Windows Media Player\\wmlaunch.exe") returned="C:\\Program Files\\Windows Media Player\\wmlaunch.exe" [0104.385] PeekMessageA (in: lpMsg=0xaf4c4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf4c4) returned 0 [0104.385] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Media Player\\wmlaunch.exe") returned="wmlaunch.exe" [0104.385] lstrcatA (in: lpString1="C:\\Program Files\\Windows Media Player\\", lpString2="wmpconfig.exe" | out: lpString1="C:\\Program Files\\Windows Media Player\\wmpconfig.exe") returned="C:\\Program Files\\Windows Media Player\\wmpconfig.exe" [0104.385] PeekMessageA (in: lpMsg=0xaf4c4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf4c4) returned 0 [0104.385] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Media Player\\wmpconfig.exe") returned="wmpconfig.exe" [0104.385] lstrcatA (in: lpString1="C:\\Program Files\\Windows Media Player\\", lpString2="WMPDMC.exe" | out: lpString1="C:\\Program Files\\Windows Media Player\\WMPDMC.exe") returned="C:\\Program Files\\Windows Media Player\\WMPDMC.exe" [0104.385] PeekMessageA (in: lpMsg=0xaf4c4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf4c4) returned 0 [0104.385] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Media Player\\WMPDMC.exe") returned="WMPDMC.exe" [0104.385] lstrcatA (in: lpString1="C:\\Program Files\\Windows Media Player\\", lpString2="WMPDMCCore.dll" | out: lpString1="C:\\Program Files\\Windows Media Player\\WMPDMCCore.dll") returned="C:\\Program Files\\Windows Media Player\\WMPDMCCore.dll" [0104.385] PeekMessageA (in: lpMsg=0xaf4c4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf4c4) returned 0 [0104.385] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Media Player\\WMPDMCCore.dll") returned="WMPDMCCore.dll" [0104.385] lstrcatA (in: lpString1="C:\\Program Files\\Windows Media Player\\", lpString2="wmpenc.exe" | out: lpString1="C:\\Program Files\\Windows Media Player\\wmpenc.exe") returned="C:\\Program Files\\Windows Media Player\\wmpenc.exe" [0104.385] PeekMessageA (in: lpMsg=0xaf4c4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf4c4) returned 0 [0104.385] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Media Player\\wmpenc.exe") returned="wmpenc.exe" [0104.385] lstrcatA (in: lpString1="C:\\Program Files\\Windows Media Player\\", lpString2="wmplayer.exe" | out: lpString1="C:\\Program Files\\Windows Media Player\\wmplayer.exe") returned="C:\\Program Files\\Windows Media Player\\wmplayer.exe" [0104.385] PeekMessageA (in: lpMsg=0xaf4c4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf4c4) returned 0 [0104.385] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Media Player\\wmplayer.exe") returned="wmplayer.exe" [0104.385] lstrcatA (in: lpString1="C:\\Program Files\\Windows Media Player\\", lpString2="WMPMediaSharing.dll" | out: lpString1="C:\\Program Files\\Windows Media Player\\WMPMediaSharing.dll") returned="C:\\Program Files\\Windows Media Player\\WMPMediaSharing.dll" [0104.385] PeekMessageA (in: lpMsg=0xaf4c4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf4c4) returned 0 [0104.386] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Media Player\\WMPMediaSharing.dll") returned="WMPMediaSharing.dll" [0104.386] lstrcatA (in: lpString1="C:\\Program Files\\Windows Media Player\\", lpString2="wmpnetwk.exe" | out: lpString1="C:\\Program Files\\Windows Media Player\\wmpnetwk.exe") returned="C:\\Program Files\\Windows Media Player\\wmpnetwk.exe" [0104.386] PeekMessageA (in: lpMsg=0xaf4c4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf4c4) returned 0 [0104.386] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Media Player\\wmpnetwk.exe") returned="wmpnetwk.exe" [0104.386] lstrcatA (in: lpString1="C:\\Program Files\\Windows Media Player\\", lpString2="wmpnscfg.exe" | out: lpString1="C:\\Program Files\\Windows Media Player\\wmpnscfg.exe") returned="C:\\Program Files\\Windows Media Player\\wmpnscfg.exe" [0104.386] PeekMessageA (in: lpMsg=0xaf4c4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf4c4) returned 0 [0104.386] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Media Player\\wmpnscfg.exe") returned="wmpnscfg.exe" [0104.386] lstrcatA (in: lpString1="C:\\Program Files\\Windows Media Player\\", lpString2="wmpnssci.dll" | out: lpString1="C:\\Program Files\\Windows Media Player\\wmpnssci.dll") returned="C:\\Program Files\\Windows Media Player\\wmpnssci.dll" [0104.386] PeekMessageA (in: lpMsg=0xaf4c4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf4c4) returned 0 [0104.386] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Media Player\\wmpnssci.dll") returned="wmpnssci.dll" [0104.386] lstrcatA (in: lpString1="C:\\Program Files\\Windows Media Player\\", lpString2="WMPNSSUI.dll" | out: lpString1="C:\\Program Files\\Windows Media Player\\WMPNSSUI.dll") returned="C:\\Program Files\\Windows Media Player\\WMPNSSUI.dll" [0104.386] PeekMessageA (in: lpMsg=0xaf4c4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf4c4) returned 0 [0104.386] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Media Player\\WMPNSSUI.dll") returned="WMPNSSUI.dll" [0104.386] lstrcatA (in: lpString1="C:\\Program Files\\Windows Media Player\\", lpString2="wmprph.exe" | out: lpString1="C:\\Program Files\\Windows Media Player\\wmprph.exe") returned="C:\\Program Files\\Windows Media Player\\wmprph.exe" [0104.386] PeekMessageA (in: lpMsg=0xaf4c4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf4c4) returned 0 [0104.386] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Media Player\\wmprph.exe") returned="wmprph.exe" [0104.386] lstrcatA (in: lpString1="C:\\Program Files\\Windows Media Player\\", lpString2="wmpshare.exe" | out: lpString1="C:\\Program Files\\Windows Media Player\\wmpshare.exe") returned="C:\\Program Files\\Windows Media Player\\wmpshare.exe" [0104.386] PeekMessageA (in: lpMsg=0xaf4c4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf4c4) returned 0 [0104.386] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Media Player\\wmpshare.exe") returned="wmpshare.exe" [0104.386] lstrcatA (in: lpString1="C:\\Program Files\\Windows Media Player\\", lpString2="WMPSideShowGadget.exe" | out: lpString1="C:\\Program Files\\Windows Media Player\\WMPSideShowGadget.exe") returned="C:\\Program Files\\Windows Media Player\\WMPSideShowGadget.exe" [0104.386] FindClose (in: hFindFile=0x5be160 | out: hFindFile=0x5be160) returned 1 [0104.386] lstrcmpA (lpString1=".", lpString2="Windows NT") returned -1 [0104.386] lstrcmpA (lpString1="..", lpString2="Windows NT") returned -1 [0104.386] PathFindFileNameA (pszPath="C:\\Program Files\\*.*") returned="*.*" [0104.386] lstrcatA (in: lpString1="C:\\Program Files\\", lpString2="Windows NT" | out: lpString1="C:\\Program Files\\Windows NT") returned="C:\\Program Files\\Windows NT" [0104.386] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows NT\\*.*", lpFindFileData=0xaf4e8 | out: lpFindFileData=0xaf4e8) returned 0x5be160 [0104.387] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0104.387] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0104.387] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0104.387] lstrcmpA (lpString1=".", lpString2="Accessories") returned -1 [0104.387] lstrcmpA (lpString1="..", lpString2="Accessories") returned -1 [0104.387] PathFindFileNameA (pszPath="C:\\Program Files\\Windows NT\\*.*") returned="*.*" [0104.387] lstrcatA (in: lpString1="C:\\Program Files\\Windows NT\\", lpString2="Accessories" | out: lpString1="C:\\Program Files\\Windows NT\\Accessories") returned="C:\\Program Files\\Windows NT\\Accessories" [0104.387] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows NT\\Accessories\\*.*", lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 0x5be1a0 [0104.387] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0104.387] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0104.387] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0104.387] lstrcmpA (lpString1=".", lpString2="en-US") returned -1 [0104.387] lstrcmpA (lpString1="..", lpString2="en-US") returned -1 [0104.387] PathFindFileNameA (pszPath="C:\\Program Files\\Windows NT\\Accessories\\*.*") returned="*.*" [0104.387] lstrcatA (in: lpString1="C:\\Program Files\\Windows NT\\Accessories\\", lpString2="en-US" | out: lpString1="C:\\Program Files\\Windows NT\\Accessories\\en-US") returned="C:\\Program Files\\Windows NT\\Accessories\\en-US" [0104.387] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows NT\\Accessories\\en-US\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be1e0 [0104.387] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0104.387] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0104.387] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0104.387] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0104.387] PathFindFileNameA (pszPath="C:\\Program Files\\Windows NT\\Accessories\\en-US\\*.*") returned="*.*" [0104.387] lstrcatA (in: lpString1="C:\\Program Files\\Windows NT\\Accessories\\en-US\\", lpString2="wordpad.exe.mui" | out: lpString1="C:\\Program Files\\Windows NT\\Accessories\\en-US\\wordpad.exe.mui") returned="C:\\Program Files\\Windows NT\\Accessories\\en-US\\wordpad.exe.mui" [0104.387] FindClose (in: hFindFile=0x5be1e0 | out: hFindFile=0x5be1e0) returned 1 [0104.387] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0104.388] PathFindFileNameA (pszPath="C:\\Program Files\\Windows NT\\Accessories\\*.*") returned="*.*" [0104.388] lstrcatA (in: lpString1="C:\\Program Files\\Windows NT\\Accessories\\", lpString2="wordpad.exe" | out: lpString1="C:\\Program Files\\Windows NT\\Accessories\\wordpad.exe") returned="C:\\Program Files\\Windows NT\\Accessories\\wordpad.exe" [0104.388] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0104.388] PathFindFileNameA (pszPath="C:\\Program Files\\Windows NT\\Accessories\\wordpad.exe") returned="wordpad.exe" [0104.388] lstrcatA (in: lpString1="C:\\Program Files\\Windows NT\\Accessories\\", lpString2="WordpadFilter.dll" | out: lpString1="C:\\Program Files\\Windows NT\\Accessories\\WordpadFilter.dll") returned="C:\\Program Files\\Windows NT\\Accessories\\WordpadFilter.dll" [0104.388] FindClose (in: hFindFile=0x5be1a0 | out: hFindFile=0x5be1a0) returned 1 [0104.388] lstrcmpA (lpString1=".", lpString2="TableTextService") returned -1 [0104.388] lstrcmpA (lpString1="..", lpString2="TableTextService") returned -1 [0104.388] PathFindFileNameA (pszPath="C:\\Program Files\\Windows NT\\*.*") returned="*.*" [0104.388] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows NT\\TableTextService\\*.*", lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 0x5be1a0 [0104.388] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0104.388] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0104.388] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0104.388] lstrcmpA (lpString1=".", lpString2="en-US") returned -1 [0104.388] lstrcmpA (lpString1="..", lpString2="en-US") returned -1 [0104.388] PathFindFileNameA (pszPath="C:\\Program Files\\Windows NT\\TableTextService\\*.*") returned="*.*" [0104.388] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows NT\\TableTextService\\en-US\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be1e0 [0104.388] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0104.388] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0104.388] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0104.388] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0104.388] PathFindFileNameA (pszPath="C:\\Program Files\\Windows NT\\TableTextService\\en-US\\*.*") returned="*.*" [0104.388] FindClose (in: hFindFile=0x5be1e0 | out: hFindFile=0x5be1e0) returned 1 [0104.389] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0104.389] PathFindFileNameA (pszPath="C:\\Program Files\\Windows NT\\TableTextService\\*.*") returned="*.*" [0104.389] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0104.389] PathFindFileNameA (pszPath="C:\\Program Files\\Windows NT\\TableTextService\\TableTextService.dll") returned="TableTextService.dll" [0104.389] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0104.389] PathFindFileNameA (pszPath="C:\\Program Files\\Windows NT\\TableTextService\\TableTextServiceAmharic.txt") returned="TableTextServiceAmharic.txt" [0104.389] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0104.389] PathFindFileNameA (pszPath="C:\\Program Files\\Windows NT\\TableTextService\\TableTextServiceArray.txt") returned="TableTextServiceArray.txt" [0104.389] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0104.389] PathFindFileNameA (pszPath="C:\\Program Files\\Windows NT\\TableTextService\\TableTextServiceDaYi.txt") returned="TableTextServiceDaYi.txt" [0104.390] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0104.390] PathFindFileNameA (pszPath="C:\\Program Files\\Windows NT\\TableTextService\\TableTextServiceSimplifiedQuanPin.txt") returned="TableTextServiceSimplifiedQuanPin.txt" [0104.390] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0104.390] PathFindFileNameA (pszPath="C:\\Program Files\\Windows NT\\TableTextService\\TableTextServiceSimplifiedShuangPin.txt") returned="TableTextServiceSimplifiedShuangPin.txt" [0104.391] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0104.391] PathFindFileNameA (pszPath="C:\\Program Files\\Windows NT\\TableTextService\\TableTextServiceSimplifiedZhengMa.txt") returned="TableTextServiceSimplifiedZhengMa.txt" [0104.391] lstrcmpA (lpString1=".", lpString2="Windows Photo Viewer") returned -1 [0104.391] lstrcmpA (lpString1="..", lpString2="Windows Photo Viewer") returned -1 [0104.391] PathFindFileNameA (pszPath="C:\\Program Files\\*.*") returned="*.*" [0104.391] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Photo Viewer\\*.*", lpFindFileData=0xaf4e8 | out: lpFindFileData=0xaf4e8) returned 0x5be160 [0104.392] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0104.392] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0104.392] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0104.392] lstrcmpA (lpString1=".", lpString2="en-US") returned -1 [0104.392] lstrcmpA (lpString1="..", lpString2="en-US") returned -1 [0104.392] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Photo Viewer\\*.*") returned="*.*" [0104.392] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Photo Viewer\\en-US\\*.*", lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 0x5be1a0 [0104.392] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0104.392] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0104.392] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0104.392] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0104.392] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Photo Viewer\\en-US\\*.*") returned="*.*" [0104.392] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0104.392] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Photo Viewer\\en-US\\ImagingDevices.exe.mui") returned="ImagingDevices.exe.mui" [0104.392] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0104.392] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Photo Viewer\\en-US\\PhotoAcq.dll.mui") returned="PhotoAcq.dll.mui" [0104.393] PeekMessageA (in: lpMsg=0xaf4c4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf4c4) returned 0 [0104.393] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Photo Viewer\\*.*") returned="*.*" [0104.393] PeekMessageA (in: lpMsg=0xaf4c4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf4c4) returned 0 [0104.393] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Photo Viewer\\ImagingDevices.exe") returned="ImagingDevices.exe" [0104.393] PeekMessageA (in: lpMsg=0xaf4c4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf4c4) returned 0 [0104.393] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Photo Viewer\\ImagingEngine.dll") returned="ImagingEngine.dll" [0104.393] PeekMessageA (in: lpMsg=0xaf4c4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf4c4) returned 0 [0104.393] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Photo Viewer\\PhotoAcq.dll") returned="PhotoAcq.dll" [0104.393] PeekMessageA (in: lpMsg=0xaf4c4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf4c4) returned 0 [0104.393] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Photo Viewer\\PhotoBase.dll") returned="PhotoBase.dll" [0104.393] lstrcmpA (lpString1=".", lpString2="Windows Portable Devices") returned -1 [0104.393] lstrcmpA (lpString1="..", lpString2="Windows Portable Devices") returned -1 [0104.393] PathFindFileNameA (pszPath="C:\\Program Files\\*.*") returned="*.*" [0104.393] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Portable Devices\\*.*", lpFindFileData=0xaf4e8 | out: lpFindFileData=0xaf4e8) returned 0x5be160 [0104.393] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0104.393] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0104.393] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0104.393] PeekMessageA (in: lpMsg=0xaf4c4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf4c4) returned 0 [0104.393] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Portable Devices\\*.*") returned="*.*" [0104.393] PeekMessageA (in: lpMsg=0xaf4c4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf4c4) returned 0 [0104.393] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Portable Devices\\build-disease.exe") returned="build-disease.exe" [0104.394] lstrcmpA (lpString1=".", lpString2="Windows Sidebar") returned -1 [0104.394] lstrcmpA (lpString1="..", lpString2="Windows Sidebar") returned -1 [0104.394] PathFindFileNameA (pszPath="C:\\Program Files\\*.*") returned="*.*" [0104.394] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Sidebar\\*.*", lpFindFileData=0xaf4e8 | out: lpFindFileData=0xaf4e8) returned 0x5be160 [0104.394] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0104.394] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0104.394] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0104.394] lstrcmpA (lpString1=".", lpString2="en-US") returned -1 [0104.394] lstrcmpA (lpString1="..", lpString2="en-US") returned -1 [0104.394] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Sidebar\\*.*") returned="*.*" [0104.394] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Sidebar\\en-US\\*.*", lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 0x5be1a0 [0104.394] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0104.395] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0104.395] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0104.395] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0104.395] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Sidebar\\en-US\\*.*") returned="*.*" [0104.395] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0104.395] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Sidebar\\en-US\\sbdrop.dll.mui") returned="sbdrop.dll.mui" [0104.395] lstrcmpA (lpString1=".", lpString2="Gadgets") returned -1 [0104.395] lstrcmpA (lpString1="..", lpString2="Gadgets") returned -1 [0104.395] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Sidebar\\*.*") returned="*.*" [0104.395] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\*.*", lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 0x5be1a0 [0104.396] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0104.396] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0104.396] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0104.396] lstrcmpA (lpString1=".", lpString2="Calendar.Gadget") returned -1 [0104.396] lstrcmpA (lpString1="..", lpString2="Calendar.Gadget") returned -1 [0104.396] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Sidebar\\Gadgets\\*.*") returned="*.*" [0104.396] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be1e0 [0104.397] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0104.397] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0104.397] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0104.397] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0104.397] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\*.*") returned="*.*" [0104.397] lstrcmpA (lpString1=".", lpString2="en-US") returned -1 [0104.397] lstrcmpA (lpString1="..", lpString2="en-US") returned -1 [0104.397] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\drag.png") returned="drag.png" [0104.397] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\en-US\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be220 [0104.397] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0104.398] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0104.398] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0104.398] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0104.398] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\en-US\\*.*") returned="*.*" [0104.398] lstrcmpA (lpString1=".", lpString2="css") returned -1 [0104.398] lstrcmpA (lpString1="..", lpString2="css") returned -1 [0104.398] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\en-US\\calendar.html") returned="calendar.html" [0104.398] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\en-US\\css\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be260 [0104.398] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0104.398] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0104.398] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0104.398] PeekMessageA (in: lpMsg=0xaef84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaef84) returned 0 [0104.398] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\en-US\\css\\*.*") returned="*.*" [0104.399] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0104.399] PathFindFileNameA (pszPath="C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\en-US\\*.*") returned="*.*" [0104.399] lstrcmpA (lpString1=".", lpString2="js") returned -1 [0104.399] lstrcmpA (lpString1="..", lpString2="js") returned -1 [0104.399] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\en-US\\js\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be260 [0104.399] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0104.399] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0104.399] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0104.399] PeekMessageA (in: lpMsg=0xaef84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaef84) returned 0 [0104.399] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0104.400] lstrcmpA (lpString1=".", lpString2="images") returned -1 [0104.400] lstrcmpA (lpString1="..", lpString2="images") returned -1 [0104.400] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\images\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be220 [0104.468] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0104.468] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0104.468] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0104.468] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0104.469] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0104.469] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0104.469] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0104.470] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0104.470] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0104.470] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0104.470] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0104.471] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0104.471] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0104.471] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0104.471] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0104.485] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0104.486] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0104.511] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0104.511] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0104.512] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0104.512] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0104.512] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0104.512] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0104.513] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0104.513] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0104.514] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0104.514] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0104.514] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0104.515] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0104.516] lstrcmpA (lpString1=".", lpString2="Clock.Gadget") returned -1 [0104.517] lstrcmpA (lpString1="..", lpString2="Clock.Gadget") returned -1 [0104.517] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be1e0 [0104.517] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0104.517] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0104.517] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0104.517] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0104.518] lstrcmpA (lpString1=".", lpString2="en-US") returned -1 [0104.518] lstrcmpA (lpString1="..", lpString2="en-US") returned -1 [0104.518] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\en-US\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be220 [0104.518] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0104.518] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0104.518] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0104.518] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0104.519] lstrcmpA (lpString1=".", lpString2="css") returned -1 [0104.519] lstrcmpA (lpString1="..", lpString2="css") returned -1 [0104.519] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\en-US\\css\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be260 [0104.519] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0104.519] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0104.519] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0104.519] PeekMessageA (in: lpMsg=0xaef84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaef84) returned 0 [0104.520] PeekMessageA (in: lpMsg=0xaef84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaef84) returned 0 [0104.520] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0104.520] lstrcmpA (lpString1=".", lpString2="js") returned -1 [0104.520] lstrcmpA (lpString1="..", lpString2="js") returned -1 [0104.520] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\en-US\\js\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be260 [0104.520] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0104.520] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0104.520] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0104.520] PeekMessageA (in: lpMsg=0xaef84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaef84) returned 0 [0104.520] PeekMessageA (in: lpMsg=0xaef84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaef84) returned 0 [0104.520] PeekMessageA (in: lpMsg=0xaef84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaef84) returned 0 [0104.520] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0104.521] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0104.521] lstrcmpA (lpString1=".", lpString2="images") returned -1 [0104.521] lstrcmpA (lpString1="..", lpString2="images") returned -1 [0104.521] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be220 [0104.644] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0104.645] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0104.645] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0104.645] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0104.645] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0104.646] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0104.646] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0104.646] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0104.674] lstrcmpA (lpString1=".", lpString2="CPU.Gadget") returned -1 [0104.674] lstrcmpA (lpString1="..", lpString2="CPU.Gadget") returned -1 [0104.674] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\CPU.Gadget\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be1e0 [0104.675] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0104.675] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0104.675] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0104.675] lstrcmpA (lpString1=".", lpString2="en-US") returned -1 [0104.675] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\CPU.Gadget\\en-US\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be220 [0104.676] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\CPU.Gadget\\en-US\\css\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be260 [0104.677] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\CPU.Gadget\\en-US\\js\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be260 [0104.677] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\CPU.Gadget\\images\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be220 [0104.709] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be1e0 [0104.710] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\en-US\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be220 [0104.710] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\en-US\\css\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be260 [0104.711] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\en-US\\js\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be260 [0104.712] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\images\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be220 [0104.756] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be1e0 [0104.757] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\css\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be220 [0104.758] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\en-US\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be220 [0104.758] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\images\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be220 [0104.808] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\MediaCenter.Gadget\\js\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be220 [0104.808] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be1e0 [0104.809] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\en-US\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be220 [0104.809] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\en-US\\css\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be260 [0104.810] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\en-US\\js\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be260 [0104.812] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be220 [0104.826] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be1e0 [0104.826] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\en-US\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be220 [0104.827] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\en-US\\css\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be260 [0104.828] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\en-US\\js\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be260 [0104.830] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\images\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be220 [0104.873] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be1e0 [0104.874] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\en-US\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be220 [0104.875] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\en-US\\css\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be260 [0104.875] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\en-US\\js\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be260 [0104.877] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\images\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be220 [0104.879] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\images\\in_sidebar\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be260 [0104.881] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\images\\on_desktop\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be260 [0104.886] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be1e0 [0104.887] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\en-US\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be220 [0104.888] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\en-US\\css\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be260 [0104.889] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\en-US\\js\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be260 [0104.894] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be220 [0104.897] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\120DPI\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be260 [0105.015] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\144DPI\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be260 [0105.054] FindFirstFileA (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Shared Gadgets\\*.*", lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 0x5be1a0 [0105.054] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\*.*", lpFindFileData=0xaf638 | out: lpFindFileData=0xaf638) returned 0x5be1a0 [0105.054] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\*.*", lpFindFileData=0xaf4e8 | out: lpFindFileData=0xaf4e8) returned 0x5be160 [0105.054] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\*.*", lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 0x5be1e0 [0105.259] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Benioku.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\benioku.htm"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Benioku.htm. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\benioku.htm. ")) returned 1 [0105.267] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Berime.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\berime.htm"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Berime.htm. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\berime.htm. ")) returned 1 [0105.268] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Esl\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be220 [0105.388] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\IrakHau.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\irakhau.htm"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\IrakHau.htm. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\irakhau.htm. ")) returned 1 [0105.489] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Leame.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\leame.htm"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Leame.htm. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\leame.htm. ")) returned 1 [0105.544] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\LeesMij.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\leesmij.htm"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\LeesMij.htm. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\leesmij.htm. ")) returned 1 [0105.576] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Leggimi.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\leggimi.htm"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Leggimi.htm. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\leggimi.htm. ")) returned 1 [0105.579] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\LeiaMe.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\leiame.htm"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\LeiaMe.htm. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\leiame.htm. ")) returned 1 [0105.624] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Liesmich.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\liesmich.htm"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Liesmich.htm. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\liesmich.htm. ")) returned 1 [0105.723] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Lisezmoi.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\lisezmoi.htm"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Lisezmoi.htm. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\lisezmoi.htm. ")) returned 1 [0105.771] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Llegiu-me.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\llegiu-me.htm"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Llegiu-me.htm. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\llegiu-me.htm. ")) returned 1 [0105.879] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\LueMinut.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\lueminut.htm"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\LueMinut.htm. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\lueminut.htm. ")) returned 1 [0105.880] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be220 [0105.881] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0105.925] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0105.976] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0106.073] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CAT\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0106.124] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CAT\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\cat\\adobeid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CAT\\AdobeID.pdf. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\cat\\adobeid.pdf. ")) returned 1 [0106.140] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CAT\\DefaultID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\cat\\defaultid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CAT\\DefaultID.pdf. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\cat\\defaultid.pdf. ")) returned 1 [0106.141] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHS\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0106.196] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHS\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\chs\\adobeid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHS\\AdobeID.pdf. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\chs\\adobeid.pdf. ")) returned 1 [0106.238] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHS\\DefaultID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\chs\\defaultid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHS\\DefaultID.pdf. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\chs\\defaultid.pdf. ")) returned 1 [0106.239] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHT\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0106.252] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHT\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\cht\\adobeid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHT\\AdobeID.pdf. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\cht\\adobeid.pdf. ")) returned 1 [0106.261] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHT\\DefaultID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\cht\\defaultid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHT\\DefaultID.pdf. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\cht\\defaultid.pdf. ")) returned 1 [0106.262] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CZE\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0106.363] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CZE\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\cze\\adobeid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CZE\\AdobeID.pdf. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\cze\\adobeid.pdf. ")) returned 1 [0106.454] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CZE\\DefaultID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\cze\\defaultid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CZE\\DefaultID.pdf. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\cze\\defaultid.pdf. ")) returned 1 [0106.455] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DAN\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0106.540] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DAN\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\dan\\adobeid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DAN\\AdobeID.pdf. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\dan\\adobeid.pdf. ")) returned 1 [0106.543] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DAN\\DefaultID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\dan\\defaultid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DAN\\DefaultID.pdf. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\dan\\defaultid.pdf. ")) returned 1 [0106.544] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DEU\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0106.629] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DEU\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\deu\\adobeid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DEU\\AdobeID.pdf. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\deu\\adobeid.pdf. ")) returned 1 [0106.632] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DEU\\DefaultID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\deu\\defaultid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DEU\\DefaultID.pdf. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\deu\\defaultid.pdf. ")) returned 1 [0106.634] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ENU\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0106.700] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ENU\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\enu\\adobeid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ENU\\AdobeID.pdf. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\enu\\adobeid.pdf. ")) returned 1 [0106.704] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ENU\\DefaultID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\enu\\defaultid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ENU\\DefaultID.pdf. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\enu\\defaultid.pdf. ")) returned 1 [0106.705] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0106.708] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\esp\\adobeid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\AdobeID.pdf. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\esp\\adobeid.pdf. ")) returned 1 [0106.711] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\DefaultID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\esp\\defaultid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\DefaultID.pdf. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\esp\\defaultid.pdf. ")) returned 1 [0106.712] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\EUQ\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0106.712] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0106.715] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\fra\\adobeid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\AdobeID.pdf. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\fra\\adobeid.pdf. ")) returned 1 [0106.758] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\DefaultID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\fra\\defaultid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\DefaultID.pdf. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\fra\\defaultid.pdf. ")) returned 1 [0106.759] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0106.794] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\hrv\\adobeid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\AdobeID.pdf. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\hrv\\adobeid.pdf. ")) returned 1 [0106.797] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\DefaultID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\hrv\\defaultid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\DefaultID.pdf. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\hrv\\defaultid.pdf. ")) returned 1 [0106.797] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0106.801] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\hun\\adobeid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\AdobeID.pdf. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\hun\\adobeid.pdf. ")) returned 1 [0106.836] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\DefaultID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\hun\\defaultid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\DefaultID.pdf. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\hun\\defaultid.pdf. ")) returned 1 [0106.837] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0106.893] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\ita\\adobeid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\AdobeID.pdf. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\ita\\adobeid.pdf. ")) returned 1 [0106.896] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\DefaultID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\ita\\defaultid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\DefaultID.pdf. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\ita\\defaultid.pdf. ")) returned 1 [0106.898] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0106.949] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\jpn\\adobeid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\AdobeID.pdf. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\jpn\\adobeid.pdf. ")) returned 1 [0106.953] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\DefaultID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\jpn\\defaultid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\DefaultID.pdf. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\jpn\\defaultid.pdf. ")) returned 1 [0106.954] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0106.956] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\kor\\adobeid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\AdobeID.pdf. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\kor\\adobeid.pdf. ")) returned 1 [0106.958] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\DefaultID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\kor\\defaultid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\DefaultID.pdf. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\kor\\defaultid.pdf. ")) returned 1 [0106.959] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0107.003] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\nld\\adobeid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\AdobeID.pdf. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\nld\\adobeid.pdf. ")) returned 1 [0107.006] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\DefaultID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\nld\\defaultid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\DefaultID.pdf. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\nld\\defaultid.pdf. ")) returned 1 [0107.007] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0107.009] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\nor\\adobeid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\AdobeID.pdf. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\nor\\adobeid.pdf. ")) returned 1 [0107.012] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\DefaultID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\nor\\defaultid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\DefaultID.pdf. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\nor\\defaultid.pdf. ")) returned 1 [0107.012] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0107.035] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\pol\\adobeid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\AdobeID.pdf. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\pol\\adobeid.pdf. ")) returned 1 [0107.085] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\DefaultID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\pol\\defaultid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\DefaultID.pdf. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\pol\\defaultid.pdf. ")) returned 1 [0107.086] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0107.088] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\ptb\\adobeid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\AdobeID.pdf. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\ptb\\adobeid.pdf. ")) returned 1 [0107.091] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\DefaultID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\ptb\\defaultid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\DefaultID.pdf. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\ptb\\defaultid.pdf. ")) returned 1 [0107.091] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0107.115] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\rum\\adobeid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\AdobeID.pdf. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\rum\\adobeid.pdf. ")) returned 1 [0107.118] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\DefaultID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\rum\\defaultid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\DefaultID.pdf. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\rum\\defaultid.pdf. ")) returned 1 [0107.119] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0107.158] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\rus\\adobeid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\AdobeID.pdf. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\rus\\adobeid.pdf. ")) returned 1 [0107.198] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\DefaultID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\rus\\defaultid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\DefaultID.pdf. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\rus\\defaultid.pdf. ")) returned 1 [0107.199] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0107.406] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\sky\\adobeid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\AdobeID.pdf. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\sky\\adobeid.pdf. ")) returned 1 [0107.413] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\DefaultID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\sky\\defaultid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\DefaultID.pdf. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\sky\\defaultid.pdf. ")) returned 1 [0107.414] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0107.437] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\slv\\adobeid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\AdobeID.pdf. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\slv\\adobeid.pdf. ")) returned 1 [0107.440] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\DefaultID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\slv\\defaultid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\DefaultID.pdf. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\slv\\defaultid.pdf. ")) returned 1 [0107.441] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0107.444] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\suo\\adobeid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\AdobeID.pdf. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\suo\\adobeid.pdf. ")) returned 1 [0107.446] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\DefaultID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\suo\\defaultid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\DefaultID.pdf. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\suo\\defaultid.pdf. ")) returned 1 [0107.447] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0107.449] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\sve\\adobeid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\AdobeID.pdf. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\sve\\adobeid.pdf. ")) returned 1 [0107.453] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\DefaultID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\sve\\defaultid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\DefaultID.pdf. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\sve\\defaultid.pdf. ")) returned 1 [0107.454] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0107.473] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\tur\\adobeid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\AdobeID.pdf. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\tur\\adobeid.pdf. ")) returned 1 [0107.496] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\DefaultID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\tur\\defaultid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\DefaultID.pdf. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\tur\\defaultid.pdf. ")) returned 1 [0107.497] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0107.508] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\ukr\\adobeid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\AdobeID.pdf. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\ukr\\adobeid.pdf. ")) returned 1 [0107.513] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\DefaultID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\ukr\\defaultid.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\DefaultID.pdf. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\ukr\\defaultid.pdf. ")) returned 1 [0107.517] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Javascripts\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0107.517] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0107.526] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CAT\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0107.534] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CAT\\license.html" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\cat\\license.html"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CAT\\license.html. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\cat\\license.html. ")) returned 1 [0107.535] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0107.553] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\license.html" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\chs\\license.html"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\license.html. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\chs\\license.html. ")) returned 1 [0107.555] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0107.722] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\license.html" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\cht\\license.html"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\license.html. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\cht\\license.html. ")) returned 1 [0107.723] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0107.736] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\license.html" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\cze\\license.html"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\license.html. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\cze\\license.html. ")) returned 1 [0107.738] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0107.745] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\license.html" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\dan\\license.html"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\license.html. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\dan\\license.html. ")) returned 1 [0107.747] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0107.750] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\license.html" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\deu\\license.html"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\license.html. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\deu\\license.html. ")) returned 1 [0107.751] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0107.764] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\license.html" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\enu\\license.html"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\license.html. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\enu\\license.html. ")) returned 1 [0107.766] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0107.775] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\license.html" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\esp\\license.html"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\license.html. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\esp\\license.html. ")) returned 1 [0107.777] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0107.792] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\license.html" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\euq\\license.html"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\license.html. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\euq\\license.html. ")) returned 1 [0107.793] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0107.796] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\license.html" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\fra\\license.html"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\license.html. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\fra\\license.html. ")) returned 1 [0107.798] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0107.801] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\license.html" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\hrv\\license.html"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\license.html. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\hrv\\license.html. ")) returned 1 [0107.803] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0107.806] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\license.html" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\hun\\license.html"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\license.html. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\hun\\license.html. ")) returned 1 [0107.807] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0107.810] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\license.html" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\ita\\license.html"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\license.html. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\ita\\license.html. ")) returned 1 [0107.812] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0107.821] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\license.html" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\jpn\\license.html"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\license.html. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\jpn\\license.html. ")) returned 1 [0107.822] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0107.859] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\license.html" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\kor\\license.html"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\license.html. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\kor\\license.html. ")) returned 1 [0107.861] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0107.864] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\license.html" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\nld\\license.html"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\license.html. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\nld\\license.html. ")) returned 1 [0107.865] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0107.868] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\license.html" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\nor\\license.html"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\license.html. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\nor\\license.html. ")) returned 1 [0107.870] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0107.891] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\license.html" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\pol\\license.html"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\license.html. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\pol\\license.html. ")) returned 1 [0107.894] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0107.925] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\license.html" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\ptb\\license.html"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\license.html. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\ptb\\license.html. ")) returned 1 [0107.926] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0107.953] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\license.html" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\rum\\license.html"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\license.html. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\rum\\license.html. ")) returned 1 [0107.956] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0108.019] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\license.html" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\rus\\license.html"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\license.html. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\rus\\license.html. ")) returned 1 [0108.020] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0108.040] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\license.html" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\sky\\license.html"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\license.html. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\sky\\license.html. ")) returned 1 [0108.041] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0108.056] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\license.html" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\slv\\license.html"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\license.html. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\slv\\license.html. ")) returned 1 [0108.057] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0108.062] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\license.html" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\suo\\license.html"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\license.html. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\suo\\license.html. ")) returned 1 [0108.063] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0108.074] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\license.html" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\sve\\license.html"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\license.html. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\sve\\license.html. ")) returned 1 [0108.075] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0108.083] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\license.html" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\tur\\license.html"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\license.html. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\tur\\license.html. ")) returned 1 [0108.084] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0108.132] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\license.html" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\ukr\\license.html"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\license.html. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\ukr\\license.html. ")) returned 1 [0108.134] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0108.143] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0108.155] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Services\\*.*", lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 0x5be2e0 [0108.160] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0108.164] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\Services\\*.*", lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 0x5be2e0 [0108.167] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0108.187] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\Services\\*.*", lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 0x5be2e0 [0108.188] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0108.227] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\Services\\*.*", lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 0x5be2e0 [0108.228] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0108.240] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\Services\\*.*", lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 0x5be2e0 [0108.241] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0108.254] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\Services\\*.*", lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 0x5be2e0 [0108.255] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0108.264] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\Services\\*.*", lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 0x5be2e0 [0108.265] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0108.312] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\Services\\*.*", lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 0x5be2e0 [0108.313] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0108.435] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\Services\\*.*", lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 0x5be2e0 [0108.436] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hu_HU\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0108.438] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hu_HU\\Services\\*.*", lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 0x5be2e0 [0108.438] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\it_IT\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0108.448] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\it_IT\\Services\\*.*", lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 0x5be2e0 [0108.449] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ja_JP\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0108.452] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ja_JP\\Services\\*.*", lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 0x5be2e0 [0108.453] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ko_KR\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0108.459] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ko_KR\\Services\\*.*", lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 0x5be2e0 [0108.461] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nb_NO\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0108.463] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nb_NO\\Services\\*.*", lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 0x5be2e0 [0108.464] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nl_NL\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0108.467] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nl_NL\\Services\\*.*", lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 0x5be2e0 [0108.468] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pl_PL\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0108.471] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pl_PL\\Services\\*.*", lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 0x5be2e0 [0108.472] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pt_BR\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0108.478] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pt_BR\\Services\\*.*", lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 0x5be2e0 [0108.479] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ro_RO\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0108.481] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ro_RO\\Services\\*.*", lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 0x5be2e0 [0108.482] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ru_RU\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0108.485] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ru_RU\\Services\\*.*", lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 0x5be2e0 [0108.487] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sk_SK\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0108.489] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sk_SK\\Services\\*.*", lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 0x5be2e0 [0108.490] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sl_SI\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0108.492] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sl_SI\\Services\\*.*", lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 0x5be2e0 [0108.493] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0108.496] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\Services\\*.*", lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 0x5be2e0 [0108.496] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\tr_TR\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0108.499] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\tr_TR\\Services\\*.*", lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 0x5be2e0 [0108.500] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\uk_UA\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0108.503] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\uk_UA\\Services\\*.*", lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 0x5be2e0 [0108.504] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_CN\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0108.541] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_CN\\Services\\*.*", lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 0x5be2e0 [0108.542] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_TW\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0108.544] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_TW\\Services\\*.*", lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 0x5be2e0 [0108.667] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\PDFSigQFormalRep.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\pdfsigqformalrep.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\PDFSigQFormalRep.pdf. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\pdfsigqformalrep.pdf. ")) returned 1 [0108.669] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0108.669] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\AcroForm\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0108.670] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\AcroForm\\PMP\\*.*", lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 0x5be2e0 [0108.694] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0108.696] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\*.*", lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 0x5be2e0 [0108.705] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CAT\\*.*", lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 0x5be320 [0108.725] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CAT\\Dynamic.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cat\\dynamic.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CAT\\Dynamic.pdf. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cat\\dynamic.pdf. ")) returned 1 [0108.730] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CAT\\Faces.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cat\\faces.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CAT\\Faces.pdf. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cat\\faces.pdf. ")) returned 1 [0108.746] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CAT\\Pointers.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cat\\pointers.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CAT\\Pointers.pdf. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cat\\pointers.pdf. ")) returned 1 [0108.750] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CAT\\SignHere.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cat\\signhere.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CAT\\SignHere.pdf. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cat\\signhere.pdf. ")) returned 1 [0108.755] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CAT\\Standard.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cat\\standard.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CAT\\Standard.pdf. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cat\\standard.pdf. ")) returned 1 [0108.769] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CAT\\StandardBusiness.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cat\\standardbusiness.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CAT\\StandardBusiness.pdf. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cat\\standardbusiness.pdf. ")) returned 1 [0108.771] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHS\\*.*", lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 0x5be320 [0108.785] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHS\\Dynamic.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\chs\\dynamic.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHS\\Dynamic.pdf. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\chs\\dynamic.pdf. ")) returned 1 [0108.799] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHS\\Hanko.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\chs\\hanko.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHS\\Hanko.pdf. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\chs\\hanko.pdf. ")) returned 1 [0108.807] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHS\\SignHere.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\chs\\signhere.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHS\\SignHere.pdf. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\chs\\signhere.pdf. ")) returned 1 [0108.813] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHS\\StandardBusiness.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\chs\\standardbusiness.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHS\\StandardBusiness.pdf. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\chs\\standardbusiness.pdf. ")) returned 1 [0108.814] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHT\\*.*", lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 0x5be320 [0108.829] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHT\\Dynamic.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cht\\dynamic.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHT\\Dynamic.pdf. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cht\\dynamic.pdf. ")) returned 1 [0108.835] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHT\\Hanko.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cht\\hanko.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHT\\Hanko.pdf. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cht\\hanko.pdf. ")) returned 1 [0108.843] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHT\\SignHere.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cht\\signhere.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHT\\SignHere.pdf. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cht\\signhere.pdf. ")) returned 1 [0108.850] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHT\\StandardBusiness.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cht\\standardbusiness.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHT\\StandardBusiness.pdf. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cht\\standardbusiness.pdf. ")) returned 1 [0108.852] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CZE\\*.*", lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 0x5be320 [0108.910] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CZE\\Dynamic.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cze\\dynamic.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CZE\\Dynamic.pdf. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cze\\dynamic.pdf. ")) returned 1 [0108.914] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CZE\\Faces.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cze\\faces.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CZE\\Faces.pdf. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cze\\faces.pdf. ")) returned 1 [0108.928] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CZE\\Pointers.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cze\\pointers.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CZE\\Pointers.pdf. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cze\\pointers.pdf. ")) returned 1 [0108.944] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CZE\\SignHere.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cze\\signhere.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CZE\\SignHere.pdf. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cze\\signhere.pdf. ")) returned 1 [0108.949] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CZE\\Standard.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cze\\standard.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CZE\\Standard.pdf. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cze\\standard.pdf. ")) returned 1 [0108.953] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CZE\\StandardBusiness.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cze\\standardbusiness.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CZE\\StandardBusiness.pdf. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cze\\standardbusiness.pdf. ")) returned 1 [0108.954] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\DAN\\*.*", lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 0x5be320 [0108.957] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\DAN\\Dynamic.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\dan\\dynamic.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\DAN\\Dynamic.pdf. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\dan\\dynamic.pdf. ")) returned 1 [0108.960] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\DAN\\SignHere.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\dan\\signhere.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\DAN\\SignHere.pdf. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\dan\\signhere.pdf. ")) returned 1 [0108.963] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\DAN\\StandardBusiness.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\dan\\standardbusiness.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\DAN\\StandardBusiness.pdf. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\dan\\standardbusiness.pdf. ")) returned 1 [0108.964] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\DEU\\*.*", lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 0x5be320 [0108.967] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\DEU\\Dynamic.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\deu\\dynamic.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\DEU\\Dynamic.pdf. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\deu\\dynamic.pdf. ")) returned 1 [0108.969] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\DEU\\SignHere.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\deu\\signhere.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\DEU\\SignHere.pdf. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\deu\\signhere.pdf. ")) returned 1 [0108.983] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\DEU\\StandardBusiness.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\deu\\standardbusiness.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\DEU\\StandardBusiness.pdf. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\deu\\standardbusiness.pdf. ")) returned 1 [0108.985] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ENU\\*.*", lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 0x5be320 [0109.011] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ENU\\Dynamic.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\enu\\dynamic.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ENU\\Dynamic.pdf. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\enu\\dynamic.pdf. ")) returned 1 [0109.014] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ENU\\SignHere.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\enu\\signhere.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ENU\\SignHere.pdf. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\enu\\signhere.pdf. ")) returned 1 [0109.027] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ENU\\StandardBusiness.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\enu\\standardbusiness.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ENU\\StandardBusiness.pdf. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\enu\\standardbusiness.pdf. ")) returned 1 [0109.028] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ESP\\*.*", lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 0x5be320 [0109.030] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ESP\\Dynamic.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\esp\\dynamic.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ESP\\Dynamic.pdf. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\esp\\dynamic.pdf. ")) returned 1 [0109.033] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ESP\\SignHere.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\esp\\signhere.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ESP\\SignHere.pdf. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\esp\\signhere.pdf. ")) returned 1 [0109.045] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ESP\\StandardBusiness.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\esp\\standardbusiness.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ESP\\StandardBusiness.pdf. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\esp\\standardbusiness.pdf. ")) returned 1 [0109.046] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\EUQ\\*.*", lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 0x5be320 [0109.092] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\EUQ\\Dynamic.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\euq\\dynamic.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\EUQ\\Dynamic.pdf. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\euq\\dynamic.pdf. ")) returned 1 [0109.096] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\EUQ\\Faces.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\euq\\faces.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\EUQ\\Faces.pdf. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\euq\\faces.pdf. ")) returned 1 [0109.100] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\EUQ\\Pointers.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\euq\\pointers.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\EUQ\\Pointers.pdf. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\euq\\pointers.pdf. ")) returned 1 [0109.104] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\EUQ\\SignHere.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\euq\\signhere.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\EUQ\\SignHere.pdf. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\euq\\signhere.pdf. ")) returned 1 [0109.126] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\EUQ\\Standard.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\euq\\standard.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\EUQ\\Standard.pdf. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\euq\\standard.pdf. ")) returned 1 [0109.160] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\EUQ\\StandardBusiness.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\euq\\standardbusiness.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\EUQ\\StandardBusiness.pdf. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\euq\\standardbusiness.pdf. ")) returned 1 [0109.162] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\FRA\\*.*", lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 0x5be320 [0109.167] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\FRA\\Dynamic.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\fra\\dynamic.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\FRA\\Dynamic.pdf. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\fra\\dynamic.pdf. ")) returned 1 [0109.193] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\FRA\\SignHere.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\fra\\signhere.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\FRA\\SignHere.pdf. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\fra\\signhere.pdf. ")) returned 1 [0109.221] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\FRA\\StandardBusiness.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\fra\\standardbusiness.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\FRA\\StandardBusiness.pdf. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\fra\\standardbusiness.pdf. ")) returned 1 [0109.223] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HRV\\*.*", lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 0x5be320 [0109.245] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HRV\\Dynamic.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\hrv\\dynamic.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HRV\\Dynamic.pdf. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\hrv\\dynamic.pdf. ")) returned 1 [0109.249] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HRV\\Faces.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\hrv\\faces.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HRV\\Faces.pdf. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\hrv\\faces.pdf. ")) returned 1 [0109.267] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HRV\\Pointers.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\hrv\\pointers.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HRV\\Pointers.pdf. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\hrv\\pointers.pdf. ")) returned 1 [0109.272] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HRV\\SignHere.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\hrv\\signhere.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HRV\\SignHere.pdf. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\hrv\\signhere.pdf. ")) returned 1 [0109.275] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HRV\\Standard.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\hrv\\standard.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HRV\\Standard.pdf. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\hrv\\standard.pdf. ")) returned 1 [0109.301] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HRV\\StandardBusiness.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\hrv\\standardbusiness.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HRV\\StandardBusiness.pdf. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\hrv\\standardbusiness.pdf. ")) returned 1 [0109.303] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HUN\\*.*", lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 0x5be320 [0109.352] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HUN\\Dynamic.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\hun\\dynamic.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HUN\\Dynamic.pdf. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\hun\\dynamic.pdf. ")) returned 1 [0109.357] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HUN\\Faces.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\hun\\faces.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HUN\\Faces.pdf. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\hun\\faces.pdf. ")) returned 1 [0109.361] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HUN\\Pointers.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\hun\\pointers.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HUN\\Pointers.pdf. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\hun\\pointers.pdf. ")) returned 1 [0109.381] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HUN\\SignHere.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\hun\\signhere.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HUN\\SignHere.pdf. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\hun\\signhere.pdf. ")) returned 1 [0109.432] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HUN\\Standard.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\hun\\standard.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HUN\\Standard.pdf. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\hun\\standard.pdf. ")) returned 1 [0109.436] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HUN\\StandardBusiness.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\hun\\standardbusiness.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HUN\\StandardBusiness.pdf. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\hun\\standardbusiness.pdf. ")) returned 1 [0109.438] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ITA\\*.*", lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 0x5be320 [0109.440] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ITA\\Dynamic.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\ita\\dynamic.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ITA\\Dynamic.pdf. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\ita\\dynamic.pdf. ")) returned 1 [0109.455] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ITA\\SignHere.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\ita\\signhere.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ITA\\SignHere.pdf. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\ita\\signhere.pdf. ")) returned 1 [0109.467] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ITA\\StandardBusiness.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\ita\\standardbusiness.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ITA\\StandardBusiness.pdf. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\ita\\standardbusiness.pdf. ")) returned 1 [0109.468] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\JPN\\*.*", lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 0x5be320 [0109.470] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\JPN\\Dynamic.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\jpn\\dynamic.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\JPN\\Dynamic.pdf. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\jpn\\dynamic.pdf. ")) returned 1 [0109.481] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\JPN\\Hanko.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\jpn\\hanko.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\JPN\\Hanko.pdf. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\jpn\\hanko.pdf. ")) returned 1 [0109.485] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\JPN\\SignHere.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\jpn\\signhere.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\JPN\\SignHere.pdf. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\jpn\\signhere.pdf. ")) returned 1 [0109.489] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\JPN\\StandardBusiness.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\jpn\\standardbusiness.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\JPN\\StandardBusiness.pdf. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\jpn\\standardbusiness.pdf. ")) returned 1 [0109.491] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\KOR\\*.*", lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 0x5be320 [0109.494] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\KOR\\Dynamic.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\kor\\dynamic.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\KOR\\Dynamic.pdf. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\kor\\dynamic.pdf. ")) returned 1 [0109.498] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\KOR\\Hanko.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\kor\\hanko.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\KOR\\Hanko.pdf. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\kor\\hanko.pdf. ")) returned 1 [0109.512] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\KOR\\SignHere.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\kor\\signhere.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\KOR\\SignHere.pdf. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\kor\\signhere.pdf. ")) returned 1 [0109.515] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\KOR\\StandardBusiness.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\kor\\standardbusiness.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\KOR\\StandardBusiness.pdf. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\kor\\standardbusiness.pdf. ")) returned 1 [0109.516] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NLD\\*.*", lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 0x5be320 [0109.518] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NLD\\Dynamic.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\nld\\dynamic.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NLD\\Dynamic.pdf. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\nld\\dynamic.pdf. ")) returned 1 [0109.521] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NLD\\SignHere.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\nld\\signhere.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NLD\\SignHere.pdf. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\nld\\signhere.pdf. ")) returned 1 [0109.524] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NLD\\StandardBusiness.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\nld\\standardbusiness.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NLD\\StandardBusiness.pdf. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\nld\\standardbusiness.pdf. ")) returned 1 [0109.525] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NOR\\*.*", lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 0x5be320 [0109.527] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NOR\\Dynamic.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\nor\\dynamic.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NOR\\Dynamic.pdf. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\nor\\dynamic.pdf. ")) returned 1 [0109.530] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NOR\\SignHere.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\nor\\signhere.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NOR\\SignHere.pdf. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\nor\\signhere.pdf. ")) returned 1 [0109.587] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NOR\\StandardBusiness.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\nor\\standardbusiness.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NOR\\StandardBusiness.pdf. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\nor\\standardbusiness.pdf. ")) returned 1 [0109.588] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\*.*", lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 0x5be320 [0109.592] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\Dynamic.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\pol\\dynamic.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\Dynamic.pdf. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\pol\\dynamic.pdf. ")) returned 1 [0109.617] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\Faces.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\pol\\faces.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\Faces.pdf. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\pol\\faces.pdf. ")) returned 1 [0109.649] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\Pointers.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\pol\\pointers.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\Pointers.pdf. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\pol\\pointers.pdf. ")) returned 1 [0109.726] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\SignHere.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\pol\\signhere.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\SignHere.pdf. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\pol\\signhere.pdf. ")) returned 1 [0109.734] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\Standard.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\pol\\standard.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\Standard.pdf. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\pol\\standard.pdf. ")) returned 1 [0109.741] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\StandardBusiness.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\pol\\standardbusiness.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\StandardBusiness.pdf. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\pol\\standardbusiness.pdf. ")) returned 1 [0109.743] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\PTB\\*.*", lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 0x5be320 [0109.763] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\PTB\\Dynamic.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\ptb\\dynamic.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\PTB\\Dynamic.pdf. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\ptb\\dynamic.pdf. ")) returned 1 [0109.766] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\PTB\\SignHere.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\ptb\\signhere.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\PTB\\SignHere.pdf. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\ptb\\signhere.pdf. ")) returned 1 [0109.786] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\PTB\\StandardBusiness.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\ptb\\standardbusiness.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\PTB\\StandardBusiness.pdf. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\ptb\\standardbusiness.pdf. ")) returned 1 [0109.787] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\*.*", lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 0x5be320 [0109.809] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\Dynamic.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\rum\\dynamic.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\Dynamic.pdf. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\rum\\dynamic.pdf. ")) returned 1 [0109.814] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\Faces.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\rum\\faces.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\Faces.pdf. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\rum\\faces.pdf. ")) returned 1 [0109.824] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\Pointers.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\rum\\pointers.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\Pointers.pdf. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\rum\\pointers.pdf. ")) returned 1 [0109.829] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\SignHere.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\rum\\signhere.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\SignHere.pdf. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\rum\\signhere.pdf. ")) returned 1 [0109.834] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\Standard.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\rum\\standard.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\Standard.pdf. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\rum\\standard.pdf. ")) returned 1 [0109.849] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\StandardBusiness.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\rum\\standardbusiness.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\StandardBusiness.pdf. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\rum\\standardbusiness.pdf. ")) returned 1 [0109.851] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\*.*", lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 0x5be320 [0109.889] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\Dynamic.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\rus\\dynamic.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\Dynamic.pdf. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\rus\\dynamic.pdf. ")) returned 1 [0109.892] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\Faces.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\rus\\faces.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\Faces.pdf. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\rus\\faces.pdf. ")) returned 1 [0109.897] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\Pointers.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\rus\\pointers.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\Pointers.pdf. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\rus\\pointers.pdf. ")) returned 1 [0109.903] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\SignHere.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\rus\\signhere.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\SignHere.pdf. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\rus\\signhere.pdf. ")) returned 1 [0109.907] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\Standard.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\rus\\standard.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\Standard.pdf. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\rus\\standard.pdf. ")) returned 1 [0109.929] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\StandardBusiness.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\rus\\standardbusiness.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\StandardBusiness.pdf. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\rus\\standardbusiness.pdf. ")) returned 1 [0109.930] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\*.*", lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 0x5be320 [0110.494] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\Dynamic.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\sky\\dynamic.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\Dynamic.pdf. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\sky\\dynamic.pdf. ")) returned 1 [0110.503] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\Faces.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\sky\\faces.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\Faces.pdf. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\sky\\faces.pdf. ")) returned 1 [0110.516] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\Pointers.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\sky\\pointers.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\Pointers.pdf. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\sky\\pointers.pdf. ")) returned 1 [0110.535] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\SignHere.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\sky\\signhere.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\SignHere.pdf. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\sky\\signhere.pdf. ")) returned 1 [0110.554] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\Standard.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\sky\\standard.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\Standard.pdf. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\sky\\standard.pdf. ")) returned 1 [0110.563] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\StandardBusiness.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\sky\\standardbusiness.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\StandardBusiness.pdf. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\sky\\standardbusiness.pdf. ")) returned 1 [0110.564] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\*.*", lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 0x5be320 [0110.601] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\Dynamic.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\slv\\dynamic.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\Dynamic.pdf. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\slv\\dynamic.pdf. ")) returned 1 [0110.610] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\Faces.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\slv\\faces.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\Faces.pdf. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\slv\\faces.pdf. ")) returned 1 [0110.624] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\Pointers.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\slv\\pointers.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\Pointers.pdf. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\slv\\pointers.pdf. ")) returned 1 [0110.627] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\SignHere.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\slv\\signhere.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\SignHere.pdf. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\slv\\signhere.pdf. ")) returned 1 [0110.643] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\Standard.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\slv\\standard.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\Standard.pdf. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\slv\\standard.pdf. ")) returned 1 [0110.674] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\StandardBusiness.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\slv\\standardbusiness.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\StandardBusiness.pdf. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\slv\\standardbusiness.pdf. ")) returned 1 [0110.675] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO\\*.*", lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 0x5be320 [0110.696] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO\\Dynamic.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\suo\\dynamic.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO\\Dynamic.pdf. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\suo\\dynamic.pdf. ")) returned 1 [0110.699] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO\\SignHere.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\suo\\signhere.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO\\SignHere.pdf. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\suo\\signhere.pdf. ")) returned 1 [0110.727] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO\\StandardBusiness.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\suo\\standardbusiness.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO\\StandardBusiness.pdf. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\suo\\standardbusiness.pdf. ")) returned 1 [0110.729] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SVE\\*.*", lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 0x5be320 [0110.737] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SVE\\Dynamic.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\sve\\dynamic.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SVE\\Dynamic.pdf. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\sve\\dynamic.pdf. ")) returned 1 [0110.740] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SVE\\SignHere.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\sve\\signhere.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SVE\\SignHere.pdf. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\sve\\signhere.pdf. ")) returned 1 [0110.755] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SVE\\StandardBusiness.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\sve\\standardbusiness.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SVE\\StandardBusiness.pdf. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\sve\\standardbusiness.pdf. ")) returned 1 [0110.756] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\*.*", lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 0x5be320 [0110.789] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\Dynamic.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\tur\\dynamic.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\Dynamic.pdf. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\tur\\dynamic.pdf. ")) returned 1 [0110.793] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\Faces.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\tur\\faces.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\Faces.pdf. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\tur\\faces.pdf. ")) returned 1 [0110.811] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\Pointers.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\tur\\pointers.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\Pointers.pdf. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\tur\\pointers.pdf. ")) returned 1 [0110.814] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\SignHere.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\tur\\signhere.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\SignHere.pdf. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\tur\\signhere.pdf. ")) returned 1 [0110.817] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\Standard.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\tur\\standard.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\Standard.pdf. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\tur\\standard.pdf. ")) returned 1 [0110.828] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\StandardBusiness.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\tur\\standardbusiness.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\StandardBusiness.pdf. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\tur\\standardbusiness.pdf. ")) returned 1 [0110.829] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\*.*", lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 0x5be320 [0110.835] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\Dynamic.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\ukr\\dynamic.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\Dynamic.pdf. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\ukr\\dynamic.pdf. ")) returned 1 [0110.838] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\Faces.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\ukr\\faces.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\Faces.pdf. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\ukr\\faces.pdf. ")) returned 1 [0110.847] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\Pointers.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\ukr\\pointers.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\Pointers.pdf. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\ukr\\pointers.pdf. ")) returned 1 [0110.849] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\SignHere.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\ukr\\signhere.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\SignHere.pdf. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\ukr\\signhere.pdf. ")) returned 1 [0110.852] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\Standard.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\ukr\\standard.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\Standard.pdf. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\ukr\\standard.pdf. ")) returned 1 [0110.883] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\StandardBusiness.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\ukr\\standardbusiness.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\StandardBusiness.pdf. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\ukr\\standardbusiness.pdf. ")) returned 1 [0110.918] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\Words.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\words.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\Words.pdf. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\words.pdf. ")) returned 1 [0110.920] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0110.921] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\*.*", lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 0x5be2e0 [0110.930] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_CZE\\*.*", lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 0x5be2e0 [0110.931] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_HRV\\*.*", lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 0x5be2e0 [0110.932] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_HUN\\*.*", lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 0x5be2e0 [0110.932] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_POL\\*.*", lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 0x5be2e0 [0110.933] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUM\\*.*", lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 0x5be2e0 [0110.934] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUS\\*.*", lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 0x5be2e0 [0110.934] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SKY\\*.*", lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 0x5be2e0 [0110.935] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SLV\\*.*", lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 0x5be2e0 [0110.937] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_TUR\\*.*", lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 0x5be2e0 [0110.938] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_UKR\\*.*", lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 0x5be2e0 [0110.939] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0111.054] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d\\prc\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0111.056] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\pmd.cer" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\pmd.cer"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\pmd.cer. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\pmd.cer. ")) returned 1 [0111.057] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Services\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0111.058] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\SPPlugins\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0111.059] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0111.063] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\add_reviewer.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\add_reviewer.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\add_reviewer.gif. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\add_reviewer.gif. ")) returned 1 [0111.065] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\bl.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\bl.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\bl.gif. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\bl.gif. ")) returned 1 [0111.066] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\br.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\br.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\br.gif. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\br.gif. ")) returned 1 [0111.068] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\create_form.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\create_form.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\create_form.gif. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\create_form.gif. ")) returned 1 [0111.071] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\distribute_form.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\distribute_form.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\distribute_form.gif. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\distribute_form.gif. ")) returned 1 [0111.073] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\email_all.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\email_all.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\email_all.gif. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\email_all.gif. ")) returned 1 [0111.075] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\email_initiator.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\email_initiator.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\email_initiator.gif. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\email_initiator.gif. ")) returned 1 [0111.077] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\ended_review_or_form.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\ended_review_or_form.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\ended_review_or_form.gif. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\ended_review_or_form.gif. ")) returned 1 [0111.080] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\end_review.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\end_review.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\end_review.gif. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\end_review.gif. ")) returned 1 [0111.083] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\forms_distributed.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\forms_distributed.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\forms_distributed.gif. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\forms_distributed.gif. ")) returned 1 [0111.085] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\forms_received.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\forms_received.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\forms_received.gif. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\forms_received.gif. ")) returned 1 [0111.086] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\forms_super.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\forms_super.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\forms_super.gif. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\forms_super.gif. ")) returned 1 [0111.088] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\form_responses.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\form_responses.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\form_responses.gif. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\form_responses.gif. ")) returned 1 [0111.089] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\info.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\info.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\info.gif. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\info.gif. ")) returned 1 [0111.092] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\open_original_form.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\open_original_form.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\open_original_form.gif. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\open_original_form.gif. ")) returned 1 [0111.094] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\pdf.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\pdf.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\pdf.gif. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\pdf.gif. ")) returned 1 [0111.096] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\reviewers.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\reviewers.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\reviewers.gif. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\reviewers.gif. ")) returned 1 [0111.098] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\reviews_joined.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\reviews_joined.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\reviews_joined.gif. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\reviews_joined.gif. ")) returned 1 [0111.099] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\reviews_sent.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\reviews_sent.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\reviews_sent.gif. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\reviews_sent.gif. ")) returned 1 [0111.101] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\reviews_super.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\reviews_super.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\reviews_super.gif. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\reviews_super.gif. ")) returned 1 [0111.106] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\review_browser.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\review_browser.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\review_browser.gif. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\review_browser.gif. ")) returned 1 [0111.108] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\review_email.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\review_email.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\review_email.gif. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\review_email.gif. ")) returned 1 [0111.111] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\review_same_reviewers.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\review_same_reviewers.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\review_same_reviewers.gif. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\review_same_reviewers.gif. ")) returned 1 [0111.123] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\review_shared.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\review_shared.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\review_shared.gif. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\review_shared.gif. ")) returned 1 [0111.125] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\rss.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\rss.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\rss.gif. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\rss.gif. ")) returned 1 [0111.127] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\server_issue.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\server_issue.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\server_issue.gif. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\server_issue.gif. ")) returned 1 [0111.129] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\server_lg.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\server_lg.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\server_lg.gif. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\server_lg.gif. ")) returned 1 [0111.131] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\server_ok.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\server_ok.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\server_ok.gif. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\server_ok.gif. ")) returned 1 [0111.133] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\stop_collection_data.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\stop_collection_data.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\stop_collection_data.gif. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\stop_collection_data.gif. ")) returned 1 [0111.135] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\submission_history.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\submission_history.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\submission_history.gif. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\submission_history.gif. ")) returned 1 [0111.137] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\tl.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\tl.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\tl.gif. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\tl.gif. ")) returned 1 [0111.139] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\tr.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\tr.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\tr.gif. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\tr.gif. ")) returned 1 [0111.142] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\trash.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\trash.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\trash.gif. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\trash.gif. ")) returned 1 [0111.145] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\turnOffNotificationInAcrobat.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\turnoffnotificationinacrobat.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\turnOffNotificationInAcrobat.gif. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\turnoffnotificationinacrobat.gif. ")) returned 1 [0111.149] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\turnOffNotificationInTray.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\turnoffnotificationintray.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\turnOffNotificationInTray.gif. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\turnoffnotificationintray.gif. ")) returned 1 [0111.154] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\turnOnNotificationInAcrobat.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\turnonnotificationinacrobat.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\turnOnNotificationInAcrobat.gif. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\turnonnotificationinacrobat.gif. ")) returned 1 [0111.158] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\turnOnNotificationInTray.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\turnonnotificationintray.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\turnOnNotificationInTray.gif. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\turnonnotificationintray.gif. ")) returned 1 [0111.162] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\warning.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\warning.gif"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\warning.gif. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\warning.gif. ")) returned 1 [0111.175] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMe.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\readme.htm"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMe.htm. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\readme.htm. ")) returned 1 [0111.186] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeCS.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\readmecs.htm"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeCS.htm. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\readmecs.htm. ")) returned 1 [0111.196] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeCT.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\readmect.htm"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeCT.htm. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\readmect.htm. ")) returned 1 [0111.211] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeCZE.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\readmecze.htm"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeCZE.htm. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\readmecze.htm. ")) returned 1 [0111.238] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeHRV.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\readmehrv.htm"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeHRV.htm. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\readmehrv.htm. ")) returned 1 [0111.243] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeHUN.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\readmehun.htm"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeHUN.htm. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\readmehun.htm. ")) returned 1 [0111.250] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeJ.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\readmej.htm"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeJ.htm. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\readmej.htm. ")) returned 1 [0111.261] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeK.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\readmek.htm"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeK.htm. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\readmek.htm. ")) returned 1 [0111.270] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMePOL.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\readmepol.htm"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMePOL.htm. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\readmepol.htm. ")) returned 1 [0111.273] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeRUM.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\readmerum.htm"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeRUM.htm. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\readmerum.htm. ")) returned 1 [0111.276] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeRUS.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\readmerus.htm"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeRUS.htm. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\readmerus.htm. ")) returned 1 [0111.279] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeSKY.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\readmesky.htm"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeSKY.htm. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\readmesky.htm. ")) returned 1 [0111.282] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeUKR.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\readmeukr.htm"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeUKR.htm. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\readmeukr.htm. ")) returned 1 [0111.283] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be220 [0111.289] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0111.305] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0111.401] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\ENUtxt.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\enutxt.pdf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\ENUtxt.pdf. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\enutxt.pdf. ")) returned 1 [0111.402] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0111.499] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\PFM\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0111.499] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0111.500] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0111.663] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar.txt. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar.txt. ")) returned 1 [0111.683] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_AE.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_ae.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_AE.txt. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_ae.txt. ")) returned 1 [0111.686] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_BH.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_bh.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_BH.txt. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_bh.txt. ")) returned 1 [0111.733] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_DZ.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_dz.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_DZ.txt. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_dz.txt. ")) returned 1 [0111.759] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_EG.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_eg.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_EG.txt. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_eg.txt. ")) returned 1 [0111.763] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_IN.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_in.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_IN.txt. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_in.txt. ")) returned 1 [0111.815] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_IQ.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_iq.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_IQ.txt. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_iq.txt. ")) returned 1 [0111.818] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_JO.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_jo.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_JO.txt. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_jo.txt. ")) returned 1 [0111.840] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_KW.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_kw.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_KW.txt. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_kw.txt. ")) returned 1 [0111.865] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_LB.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_lb.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_LB.txt. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_lb.txt. ")) returned 1 [0111.868] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_LY.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_ly.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_LY.txt. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_ly.txt. ")) returned 1 [0111.889] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_MA.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_ma.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_MA.txt. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_ma.txt. ")) returned 1 [0111.922] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_OM.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_om.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_OM.txt. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_om.txt. ")) returned 1 [0111.938] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_QA.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_qa.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_QA.txt. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_qa.txt. ")) returned 1 [0111.946] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_SA.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_sa.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_SA.txt. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_sa.txt. ")) returned 1 [0111.950] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_SD.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_sd.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_SD.txt. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_sd.txt. ")) returned 1 [0111.962] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_SY.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_sy.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_SY.txt. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_sy.txt. ")) returned 1 [0112.012] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_TN.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_tn.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_TN.txt. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_tn.txt. ")) returned 1 [0112.034] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_YE.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_ye.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_YE.txt. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_ye.txt. ")) returned 1 [0112.054] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.bg.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.bg.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.bg.txt. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.bg.txt. ")) returned 1 [0112.058] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.bg_BG.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.bg_bg.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.bg_BG.txt. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.bg_bg.txt. ")) returned 1 [0112.068] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ca.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ca.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ca.txt. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ca.txt. ")) returned 1 [0112.079] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ca_ES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ca_es.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ca_ES.txt. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ca_es.txt. ")) returned 1 [0112.094] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ca_ES_PREEURO.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ca_es_preeuro.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ca_ES_PREEURO.txt. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ca_es_preeuro.txt. ")) returned 1 [0112.127] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.cs.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.cs.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.cs.txt. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.cs.txt. ")) returned 1 [0112.143] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.cs_CZ.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.cs_cz.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.cs_CZ.txt. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.cs_cz.txt. ")) returned 1 [0112.337] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.da.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.da.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.da.txt. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.da.txt. ")) returned 1 [0112.362] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.da_DK.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.da_dk.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.da_DK.txt. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.da_dk.txt. ")) returned 1 [0112.365] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.de_CH.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.de_ch.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.de_CH.txt. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.de_ch.txt. ")) returned 1 [0112.413] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.de_DE.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.de_de.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.de_DE.txt. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.de_de.txt. ")) returned 1 [0112.423] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.de_DE_PREEURO.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.de_de_preeuro.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.de_DE_PREEURO.txt. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.de_de_preeuro.txt. ")) returned 1 [0112.449] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.el.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.el.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.el.txt. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.el.txt. ")) returned 1 [0112.466] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.el_GR.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.el_gr.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.el_GR.txt. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.el_gr.txt. ")) returned 1 [0112.475] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.el_GR_PREEURO.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.el_gr_preeuro.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.el_GR_PREEURO.txt. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.el_gr_preeuro.txt. ")) returned 1 [0112.528] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.en_CA.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.en_ca.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.en_CA.txt. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.en_ca.txt. ")) returned 1 [0112.545] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.en_GB.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.en_gb.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.en_GB.txt. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.en_gb.txt. ")) returned 1 [0112.594] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.en_GB_EURO.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.en_gb_euro.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.en_GB_EURO.txt. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.en_gb_euro.txt. ")) returned 1 [0112.644] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.en_US.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.en_us.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.en_US.txt. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.en_us.txt. ")) returned 1 [0112.648] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.en_US_POSIX.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.en_us_posix.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.en_US_POSIX.txt. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.en_us_posix.txt. ")) returned 1 [0112.677] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es.txt. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es.txt. ")) returned 1 [0112.685] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_AR.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_ar.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_AR.txt. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_ar.txt. ")) returned 1 [0112.704] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_BO.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_bo.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_BO.txt. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_bo.txt. ")) returned 1 [0112.717] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_CL.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_cl.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_CL.txt. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_cl.txt. ")) returned 1 [0112.722] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_CO.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_co.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_CO.txt. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_co.txt. ")) returned 1 [0112.832] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_CR.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_cr.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_CR.txt. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_cr.txt. ")) returned 1 [0112.866] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_DO.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_do.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_DO.txt. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_do.txt. ")) returned 1 [0112.872] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_EC.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_ec.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_EC.txt. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_ec.txt. ")) returned 1 [0112.928] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_ES.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_es.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_ES.txt. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_es.txt. ")) returned 1 [0112.957] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_ES_PREEURO.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_es_preeuro.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_ES_PREEURO.txt. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_es_preeuro.txt. ")) returned 1 [0113.045] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_GT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_gt.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_GT.txt. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_gt.txt. ")) returned 1 [0113.159] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_HN.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_hn.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_HN.txt. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_hn.txt. ")) returned 1 [0113.166] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_MX.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_mx.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_MX.txt. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_mx.txt. ")) returned 1 [0113.181] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_NI.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_ni.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_NI.txt. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_ni.txt. ")) returned 1 [0113.186] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_PA.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_pa.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_PA.txt. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_pa.txt. ")) returned 1 [0113.189] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_PE.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_pe.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_PE.txt. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_pe.txt. ")) returned 1 [0113.248] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_PR.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_pr.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_PR.txt. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_pr.txt. ")) returned 1 [0113.279] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_PY.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_py.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_PY.txt. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_py.txt. ")) returned 1 [0113.303] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_SV.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_sv.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_SV.txt. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_sv.txt. ")) returned 1 [0113.308] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_US.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_us.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_US.txt. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_us.txt. ")) returned 1 [0113.344] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_UY.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_uy.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_UY.txt. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_uy.txt. ")) returned 1 [0113.351] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_VE.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_ve.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_VE.txt. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_ve.txt. ")) returned 1 [0113.358] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es__TRADITIONAL.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es__traditional.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es__TRADITIONAL.txt. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es__traditional.txt. ")) returned 1 [0113.386] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.et.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.et.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.et.txt. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.et.txt. ")) returned 1 [0113.459] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.et_EE.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.et_ee.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.et_EE.txt. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.et_ee.txt. ")) returned 1 [0113.494] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.fi.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.fi.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.fi.txt. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.fi.txt. ")) returned 1 [0113.500] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.fi_FI.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.fi_fi.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.fi_FI.txt. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.fi_fi.txt. ")) returned 1 [0113.504] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.fi_FI_PREEURO.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.fi_fi_preeuro.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.fi_FI_PREEURO.txt. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.fi_fi_preeuro.txt. ")) returned 1 [0113.536] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.fr_CA.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.fr_ca.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.fr_CA.txt. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.fr_ca.txt. ")) returned 1 [0113.547] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.fr_FR.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.fr_fr.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.fr_FR.txt. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.fr_fr.txt. ")) returned 1 [0113.551] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.fr_FR_PREEURO.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.fr_fr_preeuro.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.fr_FR_PREEURO.txt. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.fr_fr_preeuro.txt. ")) returned 1 [0113.583] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.he.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.he.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.he.txt. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.he.txt. ")) returned 1 [0113.593] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.he_IL.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.he_il.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.he_IL.txt. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.he_il.txt. ")) returned 1 [0113.597] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.hr.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.hr.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.hr.txt. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.hr.txt. ")) returned 1 [0113.604] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.hr_HR.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.hr_hr.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.hr_HR.txt. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.hr_hr.txt. ")) returned 1 [0113.640] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.hu.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.hu.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.hu.txt. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.hu.txt. ")) returned 1 [0113.644] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.hu_HU.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.hu_hu.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.hu_HU.txt. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.hu_hu.txt. ")) returned 1 [0113.684] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.it.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.it.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.it.txt. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.it.txt. ")) returned 1 [0113.689] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.it_CH.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.it_ch.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.it_CH.txt. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.it_ch.txt. ")) returned 1 [0113.693] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.it_IT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.it_it.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.it_IT.txt. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.it_it.txt. ")) returned 1 [0113.697] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.it_IT_PREEURO.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.it_it_preeuro.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.it_IT_PREEURO.txt. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.it_it_preeuro.txt. ")) returned 1 [0113.725] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ja.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ja.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ja.txt. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ja.txt. ")) returned 1 [0113.750] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ja_JP.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ja_jp.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ja_JP.txt. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ja_jp.txt. ")) returned 1 [0113.766] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ja_JP_TRADITIONAL.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ja_jp_traditional.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ja_JP_TRADITIONAL.txt. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ja_jp_traditional.txt. ")) returned 1 [0113.771] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ko.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ko.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ko.txt. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ko.txt. ")) returned 1 [0113.799] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ko_KR.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ko_kr.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ko_KR.txt. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ko_kr.txt. ")) returned 1 [0113.838] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.lt.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.lt.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.lt.txt. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.lt.txt. ")) returned 1 [0113.844] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.lt_LT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.lt_lt.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.lt_LT.txt. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.lt_lt.txt. ")) returned 1 [0113.852] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.lv.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.lv.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.lv.txt. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.lv.txt. ")) returned 1 [0113.857] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.lv_LV.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.lv_lv.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.lv_LV.txt. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.lv_lv.txt. ")) returned 1 [0113.863] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.nb.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.nb.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.nb.txt. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.nb.txt. ")) returned 1 [0113.870] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.nb_NO.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.nb_no.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.nb_NO.txt. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.nb_no.txt. ")) returned 1 [0113.930] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.nl.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.nl.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.nl.txt. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.nl.txt. ")) returned 1 [0113.933] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.nl_BE.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.nl_be.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.nl_BE.txt. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.nl_be.txt. ")) returned 1 [0113.948] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.nl_BE_PREEURO.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.nl_be_preeuro.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.nl_BE_PREEURO.txt. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.nl_be_preeuro.txt. ")) returned 1 [0114.015] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.nl_NL.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.nl_nl.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.nl_NL.txt. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.nl_nl.txt. ")) returned 1 [0114.017] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.nl_NL_PREEURO.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.nl_nl_preeuro.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.nl_NL_PREEURO.txt. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.nl_nl_preeuro.txt. ")) returned 1 [0114.023] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.nn_NO.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.nn_no.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.nn_NO.txt. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.nn_no.txt. ")) returned 1 [0114.046] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.pl.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.pl.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.pl.txt. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.pl.txt. ")) returned 1 [0114.053] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.pl_PL.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.pl_pl.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.pl_PL.txt. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.pl_pl.txt. ")) returned 1 [0114.081] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.pt_BR.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.pt_br.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.pt_BR.txt. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.pt_br.txt. ")) returned 1 [0114.086] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.pt_PT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.pt_pt.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.pt_PT.txt. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.pt_pt.txt. ")) returned 1 [0114.094] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.pt_PT_PREEURO.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.pt_pt_preeuro.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.pt_PT_PREEURO.txt. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.pt_pt_preeuro.txt. ")) returned 1 [0114.105] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ro.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ro.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ro.txt. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ro.txt. ")) returned 1 [0114.110] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ro_RO.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ro_ro.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ro_RO.txt. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ro_ro.txt. ")) returned 1 [0114.132] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ru.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ru.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ru.txt. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ru.txt. ")) returned 1 [0114.150] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ru_RU.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ru_ru.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ru_RU.txt. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ru_ru.txt. ")) returned 1 [0114.186] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ru_UA.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ru_ua.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ru_UA.txt. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ru_ua.txt. ")) returned 1 [0114.219] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.sk.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.sk.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.sk.txt. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.sk.txt. ")) returned 1 [0114.223] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.sk_SK.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.sk_sk.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.sk_SK.txt. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.sk_sk.txt. ")) returned 1 [0114.227] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.sl.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.sl.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.sl.txt. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.sl.txt. ")) returned 1 [0114.232] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.sl_SI.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.sl_si.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.sl_SI.txt. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.sl_si.txt. ")) returned 1 [0114.240] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.sv.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.sv.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.sv.txt. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.sv.txt. ")) returned 1 [0114.247] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.sv_FI.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.sv_fi.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.sv_FI.txt. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.sv_fi.txt. ")) returned 1 [0114.286] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.sv_SE.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.sv_se.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.sv_SE.txt. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.sv_se.txt. ")) returned 1 [0114.293] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.tr.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.tr.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.tr.txt. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.tr.txt. ")) returned 1 [0114.357] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.tr_TR.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.tr_tr.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.tr_TR.txt. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.tr_tr.txt. ")) returned 1 [0114.422] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.uk.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.uk.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.uk.txt. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.uk.txt. ")) returned 1 [0114.426] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.uk_UA.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.uk_ua.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.uk_UA.txt. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.uk_ua.txt. ")) returned 1 [0114.487] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.zh_CN.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.zh_cn.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.zh_CN.txt. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.zh_cn.txt. ")) returned 1 [0114.526] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.zh_TW.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.zh_tw.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.zh_TW.txt. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.zh_tw.txt. ")) returned 1 [0114.559] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.zh_TW_STROKE.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.zh_tw_stroke.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.zh_TW_STROKE.txt. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.zh_tw_stroke.txt. ")) returned 1 [0114.562] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0114.562] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\*.*", lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 0x5be2e0 [0114.563] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\*.*", lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 0x5be320 [0114.584] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\SaslPrep\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0114.585] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0114.592] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0114.592] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\ICU\\*.*", lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 0x5be2e0 [0114.593] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\*.*", lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 0x5be2e0 [0114.593] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Adobe\\*.*", lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 0x5be320 [0114.663] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Adobe\\HKSCS.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\adobe\\hkscs.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Adobe\\HKSCS.txt. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\adobe\\hkscs.txt. ")) returned 1 [0114.674] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Adobe\\Japanese83pv.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\adobe\\japanese83pv.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Adobe\\Japanese83pv.txt. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\adobe\\japanese83pv.txt. ")) returned 1 [0114.678] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Adobe\\JISX0208.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\adobe\\jisx0208.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Adobe\\JISX0208.txt. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\adobe\\jisx0208.txt. ")) returned 1 [0114.682] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Adobe\\JISX0213.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\adobe\\jisx0213.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Adobe\\JISX0213.txt. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\adobe\\jisx0213.txt. ")) returned 1 [0114.702] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Adobe\\symbol.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\adobe\\symbol.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Adobe\\symbol.txt. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\adobe\\symbol.txt. ")) returned 1 [0114.737] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Adobe\\zdingbat.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\adobe\\zdingbat.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Adobe\\zdingbat.txt. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\adobe\\zdingbat.txt. ")) returned 1 [0114.739] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Mac\\*.*", lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 0x5be320 [0114.758] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Mac\\ARABIC.TXT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\mac\\arabic.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Mac\\ARABIC.TXT. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\mac\\arabic.txt. ")) returned 1 [0114.789] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Mac\\CENTEURO.TXT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\mac\\centeuro.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Mac\\CENTEURO.TXT. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\mac\\centeuro.txt. ")) returned 1 [0114.823] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Mac\\CHINSIMP.TXT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\mac\\chinsimp.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Mac\\CHINSIMP.TXT. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\mac\\chinsimp.txt. ")) returned 1 [0114.873] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Mac\\CHINTRAD.TXT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\mac\\chintrad.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Mac\\CHINTRAD.TXT. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\mac\\chintrad.txt. ")) returned 1 [0114.877] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Mac\\CORPCHAR.TXT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\mac\\corpchar.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Mac\\CORPCHAR.TXT. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\mac\\corpchar.txt. ")) returned 1 [0114.963] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Mac\\CROATIAN.TXT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\mac\\croatian.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Mac\\CROATIAN.TXT. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\mac\\croatian.txt. ")) returned 1 [0114.975] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Mac\\CYRILLIC.TXT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\mac\\cyrillic.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Mac\\CYRILLIC.TXT. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\mac\\cyrillic.txt. ")) returned 1 [0114.979] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Mac\\FARSI.TXT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\mac\\farsi.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Mac\\FARSI.TXT. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\mac\\farsi.txt. ")) returned 1 [0114.983] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Mac\\GREEK.TXT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\mac\\greek.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Mac\\GREEK.TXT. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\mac\\greek.txt. ")) returned 1 [0114.987] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Mac\\HEBREW.TXT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\mac\\hebrew.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Mac\\HEBREW.TXT. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\mac\\hebrew.txt. ")) returned 1 [0114.991] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Mac\\ICELAND.TXT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\mac\\iceland.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Mac\\ICELAND.TXT. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\mac\\iceland.txt. ")) returned 1 [0115.010] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Mac\\JAPANESE.TXT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\mac\\japanese.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Mac\\JAPANESE.TXT. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\mac\\japanese.txt. ")) returned 1 [0115.142] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Mac\\KOREAN.TXT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\mac\\korean.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Mac\\KOREAN.TXT. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\mac\\korean.txt. ")) returned 1 [0115.147] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Mac\\ROMAN.TXT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\mac\\roman.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Mac\\ROMAN.TXT. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\mac\\roman.txt. ")) returned 1 [0115.219] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Mac\\ROMANIAN.TXT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\mac\\romanian.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Mac\\ROMANIAN.TXT. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\mac\\romanian.txt. ")) returned 1 [0115.222] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Mac\\SYMBOL.TXT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\mac\\symbol.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Mac\\SYMBOL.TXT. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\mac\\symbol.txt. ")) returned 1 [0115.227] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Mac\\THAI.TXT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\mac\\thai.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Mac\\THAI.TXT. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\mac\\thai.txt. ")) returned 1 [0115.266] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Mac\\TURKISH.TXT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\mac\\turkish.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Mac\\TURKISH.TXT. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\mac\\turkish.txt. ")) returned 1 [0115.321] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Mac\\UKRAINE.TXT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\mac\\ukraine.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Mac\\UKRAINE.TXT. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\mac\\ukraine.txt. ")) returned 1 [0115.323] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\win\\*.*", lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 0x5be320 [0115.368] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\win\\CP1250.TXT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\win\\cp1250.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\win\\CP1250.TXT. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\win\\cp1250.txt. ")) returned 1 [0115.433] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\win\\CP1251.TXT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\win\\cp1251.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\win\\CP1251.TXT. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\win\\cp1251.txt. ")) returned 1 [0115.483] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\win\\CP1252.TXT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\win\\cp1252.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\win\\CP1252.TXT. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\win\\cp1252.txt. ")) returned 1 [0115.515] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\win\\CP1253.TXT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\win\\cp1253.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\win\\CP1253.TXT. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\win\\cp1253.txt. ")) returned 1 [0115.545] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\win\\CP1254.TXT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\win\\cp1254.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\win\\CP1254.TXT. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\win\\cp1254.txt. ")) returned 1 [0115.591] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\win\\CP1255.TXT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\win\\cp1255.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\win\\CP1255.TXT. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\win\\cp1255.txt. ")) returned 1 [0115.603] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\win\\CP1256.TXT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\win\\cp1256.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\win\\CP1256.TXT. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\win\\cp1256.txt. ")) returned 1 [0115.647] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\win\\CP1257.TXT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\win\\cp1257.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\win\\CP1257.TXT. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\win\\cp1257.txt. ")) returned 1 [0115.682] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\win\\CP1258.TXT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\win\\cp1258.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\win\\CP1258.TXT. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\win\\cp1258.txt. ")) returned 1 [0115.714] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\win\\CP874.TXT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\win\\cp874.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\win\\CP874.TXT. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\win\\cp874.txt. ")) returned 1 [0115.783] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\win\\CP932.TXT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\win\\cp932.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\win\\CP932.TXT. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\win\\cp932.txt. ")) returned 1 [0115.845] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\win\\CP936.TXT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\win\\cp936.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\win\\CP936.TXT. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\win\\cp936.txt. ")) returned 1 [0115.880] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\win\\CP949.TXT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\win\\cp949.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\win\\CP949.TXT. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\win\\cp949.txt. ")) returned 1 [0115.898] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\win\\CP950.TXT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\win\\cp950.txt"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\win\\CP950.TXT. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\typesupport\\unicode\\mappings\\win\\cp950.txt. ")) returned 1 [0115.900] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be220 [0115.900] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0115.908] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Vigtigt.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\vigtigt.htm"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Vigtigt.htm. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\vigtigt.htm. ")) returned 1 [0115.931] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Viktig.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\viktig.htm"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Viktig.htm. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\viktig.htm. ")) returned 1 [0115.950] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Viktigt.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\viktigt.htm"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Viktigt.htm. " (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\viktigt.htm. ")) returned 1 [0115.953] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\*.*", lpFindFileData=0xaf4e8 | out: lpFindFileData=0xaf4e8) returned 0x5be160 [0115.953] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\*.*", lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 0x5be1e0 [0115.953] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be220 [0115.954] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0115.969] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\ARM\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be220 [0115.969] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\ARM\\1.0\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0115.969] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be220 [0115.975] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ca_ES\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0115.976] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\cs_CZ\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0115.977] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\da_DK\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0115.978] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\de_DE\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0115.979] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\en_US\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0115.979] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\es_ES\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0115.980] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\eu_ES\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0115.980] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\fi_FI\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0115.981] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\fr_FR\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0115.985] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\hr_HR\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0115.985] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\hu_HU\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0116.042] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\it_IT\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0116.066] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ja_JP\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0116.066] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ko_KR\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0116.099] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\nb_NO\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0116.099] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\nl_NL\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0116.099] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\pl_PL\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0116.100] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\pt_BR\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0116.100] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ro_RO\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0116.110] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ru_RU\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0116.110] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\sk_SK\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0116.112] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\sl_SI\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0116.112] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\sv_SE\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0116.113] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\tr_TR\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0116.114] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\uk_UA\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0116.114] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\zh_CN\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0116.114] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\zh_TW\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0116.115] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Java\\*.*", lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 0x5be1e0 [0116.115] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be220 [0116.115] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\*.*", lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 0x5be1e0 [0116.115] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\DAO\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be220 [0116.116] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be220 [0116.144] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\1028\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0116.150] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\1031\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0116.151] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\1033\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0116.152] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\1036\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0116.153] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\1040\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0116.153] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\1041\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0116.154] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\1042\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0116.155] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\1046\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0116.156] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\1049\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0116.156] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\2052\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0116.157] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Help\\3082\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0116.157] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be220 [0116.167] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\1.0\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0116.168] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\1.7\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0116.169] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\en-US\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0116.177] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\HWRCustomization\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0116.178] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSEnv\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be220 [0116.180] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSEnv\\PublicAssemblies\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0116.181] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSInfo\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be220 [0116.182] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\MSInfo\\en-US\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0116.182] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\OFFICE14\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be220 [0116.182] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\OFFICE14\\1033\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0116.184] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\OFFICE14\\Cultures\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0116.184] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\OFFICE14\\Office Setup Controller\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0116.185] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Portal\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be220 [0116.186] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Portal\\1033\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0116.186] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Stationery\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be220 [0116.201] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\TextConv\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be220 [0116.203] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\TextConv\\en-US\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0116.204] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\TextConv\\WksConv\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0116.205] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Triedit\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be220 [0116.205] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Triedit\\en-US\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0116.206] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VBA\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be220 [0116.207] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VBA\\VBA6\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0116.207] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VC\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be220 [0116.208] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VC\\amd64\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0116.209] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VGX\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be220 [0116.210] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTA\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be220 [0116.210] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTA\\8.0\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0116.213] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTA\\8.0\\x86\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0116.222] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTA\\AppInfoDocument\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0116.223] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTA\\AppInfoDocument\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0116.223] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTA\\Pipeline.v10.0\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0116.224] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTA\\Pipeline.v10.0\\AddInSideAdapters\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0116.226] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTA\\Pipeline.v10.0\\AddInViews\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0116.228] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTA\\Pipeline.v10.0\\Contracts\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0116.230] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTA\\Pipeline.v10.0\\HostSideAdapters\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0116.232] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTO\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be220 [0116.234] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTO\\10.0\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0116.235] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0116.237] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Web Server Extensions\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be220 [0116.237] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Web Server Extensions\\14\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0116.237] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Web Server Extensions\\14\\BIN\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0116.238] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Services\\*.*", lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 0x5be1e0 [0116.239] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\*.*", lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 0x5be1e0 [0116.240] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be220 [0116.240] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0116.240] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0116.250] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\*.*", lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 0x5be2e0 [0116.268] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\System\\*.*", lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 0x5be1e0 [0116.270] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\System\\ado\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be220 [0116.272] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\System\\ado\\en-US\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0116.273] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\System\\en-US\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be220 [0116.274] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\System\\msadc\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be220 [0116.276] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\System\\msadc\\en-US\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0116.303] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\System\\Ole DB\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be220 [0116.305] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Common Files\\System\\Ole DB\\en-US\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0116.307] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Google\\*.*", lpFindFileData=0xaf4e8 | out: lpFindFileData=0xaf4e8) returned 0x5be160 [0116.307] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\*.*", lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 0x5be1e0 [0116.308] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be220 [0116.308] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0116.320] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\default_apps\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0116.323] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Extensions\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0116.327] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Installer\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0116.392] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Installer\\chrome.7z" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\installer\\chrome.7z"), lpNewFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Installer\\chrome.7z. " (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\installer\\chrome.7z. ")) returned 1 [0116.394] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0116.413] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\VisualElements\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0116.471] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\VisualElements\\logo.png" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\visualelements\\logo.png"), lpNewFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\VisualElements\\logo.png. " (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\visualelements\\logo.png. ")) returned 1 [0116.486] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\VisualElements\\logocanary.png" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\visualelements\\logocanary.png"), lpNewFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\VisualElements\\logocanary.png. " (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\visualelements\\logocanary.png. ")) returned 1 [0116.496] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\VisualElements\\smalllogo.png" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\visualelements\\smalllogo.png"), lpNewFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\VisualElements\\smalllogo.png. " (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\visualelements\\smalllogo.png. ")) returned 1 [0116.505] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\VisualElements\\smalllogocanary.png" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\visualelements\\smalllogocanary.png"), lpNewFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\VisualElements\\smalllogocanary.png. " (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\visualelements\\smalllogocanary.png. ")) returned 1 [0116.506] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\WidevineCdm\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0116.507] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\WidevineCdm\\_platform_specific\\*.*", lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 0x5be2e0 [0116.507] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\WidevineCdm\\_platform_specific\\win_x64\\*.*", lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 0x5be320 [0116.511] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\SetupMetrics\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0116.512] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Google\\CrashReports\\*.*", lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 0x5be1e0 [0116.514] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Internet Explorer\\*.*", lpFindFileData=0xaf4e8 | out: lpFindFileData=0xaf4e8) returned 0x5be160 [0116.514] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Internet Explorer\\en-US\\*.*", lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 0x5be1e0 [0116.515] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Internet Explorer\\SIGNUP\\*.*", lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 0x5be1e0 [0116.515] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Java\\*.*", lpFindFileData=0xaf4e8 | out: lpFindFileData=0xaf4e8) returned 0x5be160 [0116.515] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Java\\jre7\\*.*", lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 0x5be1e0 [0116.516] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Java\\jre7\\bin\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be220 [0116.536] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Java\\jre7\\bin\\client\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0116.547] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\bin\\client\\Xusage.txt" (normalized: "c:\\program files (x86)\\java\\jre7\\bin\\client\\xusage.txt"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\bin\\client\\Xusage.txt. " (normalized: "c:\\program files (x86)\\java\\jre7\\bin\\client\\xusage.txt. ")) returned 1 [0116.548] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Java\\jre7\\bin\\dtplugin\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0116.560] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Java\\jre7\\bin\\plugin2\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0116.562] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be220 [0116.576] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\applet\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0116.576] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\cmm\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0116.577] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0116.610] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy\\ffjcext.zip" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\deploy\\ffjcext.zip"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy\\ffjcext.zip. " (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\deploy\\ffjcext.zip. ")) returned 1 [0116.612] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy\\jqs\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0116.627] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy\\splash.gif" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\deploy\\splash.gif"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy\\splash.gif. " (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\deploy\\splash.gif. ")) returned 1 [0116.629] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0116.634] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\fonts\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0116.640] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\i386\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0116.641] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0116.642] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\cursors\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0116.653] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\cursors\\invalid32x32.gif" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\images\\cursors\\invalid32x32.gif"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\cursors\\invalid32x32.gif. " (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\images\\cursors\\invalid32x32.gif. ")) returned 1 [0116.658] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\cursors\\win32_CopyDrop32x32.gif" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\images\\cursors\\win32_copydrop32x32.gif"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\cursors\\win32_CopyDrop32x32.gif. " (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\images\\cursors\\win32_copydrop32x32.gif. ")) returned 1 [0116.662] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\images\\cursors\\win32_copynodrop32x32.gif"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif. " (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\images\\cursors\\win32_copynodrop32x32.gif. ")) returned 1 [0116.665] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\cursors\\win32_LinkDrop32x32.gif" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\images\\cursors\\win32_linkdrop32x32.gif"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\cursors\\win32_LinkDrop32x32.gif. " (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\images\\cursors\\win32_linkdrop32x32.gif. ")) returned 1 [0116.669] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\images\\cursors\\win32_linknodrop32x32.gif"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif. " (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\images\\cursors\\win32_linknodrop32x32.gif. ")) returned 1 [0116.672] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\cursors\\win32_MoveDrop32x32.gif" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\images\\cursors\\win32_movedrop32x32.gif"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\cursors\\win32_MoveDrop32x32.gif. " (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\images\\cursors\\win32_movedrop32x32.gif. ")) returned 1 [0116.675] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\images\\cursors\\win32_movenodrop32x32.gif"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif. " (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\images\\cursors\\win32_movenodrop32x32.gif. ")) returned 1 [0116.677] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\jfr\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0116.696] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\jvm.hprof.txt" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\jvm.hprof.txt"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\jvm.hprof.txt. " (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\jvm.hprof.txt. ")) returned 1 [0116.698] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\management\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0116.702] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\security\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0116.713] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0116.717] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0116.729] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0116.766] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Argentina\\*.*", lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 0x5be2e0 [0116.772] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Indiana\\*.*", lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 0x5be2e0 [0116.783] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Kentucky\\*.*", lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 0x5be2e0 [0116.795] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\North_Dakota\\*.*", lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 0x5be2e0 [0116.796] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Antarctica\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0116.808] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0116.813] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Atlantic\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0116.836] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Australia\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0116.848] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0116.860] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0116.872] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Indian\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0116.893] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Pacific\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0116.913] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\SystemV\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0116.941] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\README.txt" (normalized: "c:\\program files (x86)\\java\\jre7\\readme.txt"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\README.txt. " (normalized: "c:\\program files (x86)\\java\\jre7\\readme.txt. ")) returned 1 [0116.965] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\THIRDPARTYLICENSEREADME-JAVAFX.txt" (normalized: "c:\\program files (x86)\\java\\jre7\\thirdpartylicensereadme-javafx.txt"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\THIRDPARTYLICENSEREADME-JAVAFX.txt. " (normalized: "c:\\program files (x86)\\java\\jre7\\thirdpartylicensereadme-javafx.txt. ")) returned 1 [0116.981] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\THIRDPARTYLICENSEREADME.txt" (normalized: "c:\\program files (x86)\\java\\jre7\\thirdpartylicensereadme.txt"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\THIRDPARTYLICENSEREADME.txt. " (normalized: "c:\\program files (x86)\\java\\jre7\\thirdpartylicensereadme.txt. ")) returned 1 [0116.996] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\Welcome.html" (normalized: "c:\\program files (x86)\\java\\jre7\\welcome.html"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\Welcome.html. " (normalized: "c:\\program files (x86)\\java\\jre7\\welcome.html. ")) returned 1 [0116.997] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Microsoft Analysis Services\\*.*", lpFindFileData=0xaf4e8 | out: lpFindFileData=0xaf4e8) returned 0x5be160 [0116.998] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\*.*", lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 0x5be1e0 [0116.998] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be220 [0117.000] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0117.014] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0117.014] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0117.015] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Microsoft Office\\*.*", lpFindFileData=0xaf4e8 | out: lpFindFileData=0xaf4e8) returned 0x5be160 [0117.015] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Office14\\*.*", lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 0x5be1e0 [0117.015] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Office14\\1033\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be220 [0117.019] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\*.*", lpFindFileData=0xaf4e8 | out: lpFindFileData=0xaf4e8) returned 0x5be160 [0117.019] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\*.*", lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 0x5be1e0 [0117.020] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be220 [0117.020] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\PrivateAssemblies\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0117.021] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\PublicAssemblies\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0117.075] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0117.075] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0117.076] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\*.*", lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 0x5be2e0 [0117.076] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\*.*", lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 0x5be320 [0117.112] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\AboutBox.zip" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\aboutbox.zip"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\AboutBox.zip. " (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\aboutbox.zip. ")) returned 1 [0117.124] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\AppConfig.zip" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\appconfig.zip"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\AppConfig.zip. " (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\appconfig.zip. ")) returned 1 [0117.131] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\AppConfigInternal.zip" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\appconfiginternal.zip"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\AppConfigInternal.zip. " (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\appconfiginternal.zip. ")) returned 1 [0117.155] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\AssemblyInfo.zip" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\assemblyinfo.zip"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\AssemblyInfo.zip. " (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\assemblyinfo.zip. ")) returned 1 [0117.158] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\AssemblyInfoInternal.zip" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\assemblyinfointernal.zip"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\AssemblyInfoInternal.zip. " (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\assemblyinfointernal.zip. ")) returned 1 [0117.160] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\Class.zip" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\class.zip"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\Class.zip. " (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\class.zip. ")) returned 1 [0117.169] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\CodeFile.zip" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\codefile.zip"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\CodeFile.zip. " (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\codefile.zip. ")) returned 1 [0117.176] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\DataSet.zip" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\dataset.zip"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\DataSet.zip. " (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\dataset.zip. ")) returned 1 [0117.181] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\EmptyDatabase.zip" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\emptydatabase.zip"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\EmptyDatabase.zip. " (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\emptydatabase.zip. ")) returned 1 [0117.185] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\Form.zip" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\form.zip"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\Form.zip. " (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\form.zip. ")) returned 1 [0117.197] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\Interface.zip" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\interface.zip"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\Interface.zip. " (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\interface.zip. ")) returned 1 [0117.202] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\MDIParent.zip" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\mdiparent.zip"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\MDIParent.zip. " (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\mdiparent.zip. ")) returned 1 [0117.212] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\Resource.zip" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\resource.zip"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\Resource.zip. " (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\resource.zip. ")) returned 1 [0117.220] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\ResourceInternal.zip" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\resourceinternal.zip"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\ResourceInternal.zip. " (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\resourceinternal.zip. ")) returned 1 [0117.223] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\Settings.zip" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\settings.zip"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\Settings.zip. " (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\settings.zip. ")) returned 1 [0117.227] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\SettingsInternal.zip" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\settingsinternal.zip"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\SettingsInternal.zip. " (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\settingsinternal.zip. ")) returned 1 [0117.230] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\TextFile.zip" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\textfile.zip"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\TextFile.zip. " (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\textfile.zip. ")) returned 1 [0117.265] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\UserControl.zip" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\usercontrol.zip"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\UserControl.zip. " (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\usercontrol.zip. ")) returned 1 [0117.283] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\Visualizer.zip" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\visualizer.zip"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\Visualizer.zip. " (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\visualizer.zip. ")) returned 1 [0117.287] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\XmlFile.zip" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\xmlfile.zip"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\XmlFile.zip. " (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\csharp\\1033\\xmlfile.zip. ")) returned 1 [0117.288] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\*.*", lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 0x5be2e0 [0117.289] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\*.*", lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 0x5be320 [0117.292] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\AppConfigurationInternal.zip" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\visualbasic\\1033\\appconfigurationinternal.zip"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\AppConfigurationInternal.zip. " (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\visualbasic\\1033\\appconfigurationinternal.zip. ")) returned 1 [0117.295] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\AssemblyInfoInternal.zip" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\visualbasic\\1033\\assemblyinfointernal.zip"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\AssemblyInfoInternal.zip. " (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\visualbasic\\1033\\assemblyinfointernal.zip. ")) returned 1 [0117.296] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\Class.zip" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\visualbasic\\1033\\class.zip"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\Class.zip. " (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\visualbasic\\1033\\class.zip. ")) returned 1 [0117.305] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\Dataset.zip" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\visualbasic\\1033\\dataset.zip"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\Dataset.zip. " (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\visualbasic\\1033\\dataset.zip. ")) returned 1 [0117.309] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\Dialog.zip" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\visualbasic\\1033\\dialog.zip"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\Dialog.zip. " (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\visualbasic\\1033\\dialog.zip. ")) returned 1 [0117.311] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\EmptyDatabase.zip" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\visualbasic\\1033\\emptydatabase.zip"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\EmptyDatabase.zip. " (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\visualbasic\\1033\\emptydatabase.zip. ")) returned 1 [0117.379] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\Explorer.zip" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\visualbasic\\1033\\explorer.zip"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\Explorer.zip. " (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\visualbasic\\1033\\explorer.zip. ")) returned 1 [0117.389] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\Form.zip" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\visualbasic\\1033\\form.zip"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\Form.zip. " (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\visualbasic\\1033\\form.zip. ")) returned 1 [0117.393] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\LoginForm.zip" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\visualbasic\\1033\\loginform.zip"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\LoginForm.zip. " (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\visualbasic\\1033\\loginform.zip. ")) returned 1 [0117.409] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\MDIParent.zip" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\visualbasic\\1033\\mdiparent.zip"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\MDIParent.zip. " (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\visualbasic\\1033\\mdiparent.zip. ")) returned 1 [0117.412] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\Module.zip" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\visualbasic\\1033\\module.zip"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\Module.zip. " (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\visualbasic\\1033\\module.zip. ")) returned 1 [0117.425] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\ResourceInternal.zip" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\visualbasic\\1033\\resourceinternal.zip"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\ResourceInternal.zip. " (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\visualbasic\\1033\\resourceinternal.zip. ")) returned 1 [0117.428] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\SettingsInternal.zip" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\visualbasic\\1033\\settingsinternal.zip"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\SettingsInternal.zip. " (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\visualbasic\\1033\\settingsinternal.zip. ")) returned 1 [0117.466] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\SplashScreen.zip" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\visualbasic\\1033\\splashscreen.zip"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\SplashScreen.zip. " (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\visualbasic\\1033\\splashscreen.zip. ")) returned 1 [0117.469] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\Text.zip" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\visualbasic\\1033\\text.zip"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\Text.zip. " (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\visualbasic\\1033\\text.zip. ")) returned 1 [0117.472] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\UserControl.zip" (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\visualbasic\\1033\\usercontrol.zip"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic\\1033\\UserControl.zip. " (normalized: "c:\\program files (x86)\\microsoft visual studio 8\\common7\\ide\\vsta\\itemtemplates\\visualbasic\\1033\\usercontrol.zip. ")) returned 1 [0117.474] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\Packages\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be220 [0117.474] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\Packages\\Debugger\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0117.474] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\SDK\\*.*", lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 0x5be1e0 [0117.474] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\VSTA\\*.*", lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 0x5be1e0 [0117.475] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\VSTA\\Bin\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be220 [0117.475] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\VSTA\\Bin\\1033\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0117.475] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Microsoft.NET\\*.*", lpFindFileData=0xaf4e8 | out: lpFindFileData=0xaf4e8) returned 0x5be160 [0117.475] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Microsoft.NET\\Primary Interop Assemblies\\*.*", lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 0x5be1e0 [0117.489] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Microsoft.NET\\RedistList\\*.*", lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 0x5be1e0 [0117.490] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Mozilla Firefox\\*.*", lpFindFileData=0xaf4e8 | out: lpFindFileData=0xaf4e8) returned 0x5be160 [0117.491] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Mozilla Firefox\\browser\\*.*", lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 0x5be1e0 [0117.509] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Mozilla Firefox\\browser\\components\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be220 [0117.510] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Mozilla Firefox\\browser\\extensions\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be220 [0117.511] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Mozilla Firefox\\browser\\extensions\\{972ce4c6-7e08-4474-a285-3208198ce6fd}\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0117.520] MoveFileA (lpExistingFileName="C:\\Program Files (x86)\\Mozilla Firefox\\browser\\extensions\\{972ce4c6-7e08-4474-a285-3208198ce6fd}\\icon.png" (normalized: "c:\\program files (x86)\\mozilla firefox\\browser\\extensions\\{972ce4c6-7e08-4474-a285-3208198ce6fd}\\icon.png"), lpNewFileName="C:\\Program Files (x86)\\Mozilla Firefox\\browser\\extensions\\{972ce4c6-7e08-4474-a285-3208198ce6fd}\\icon.png. " (normalized: "c:\\program files (x86)\\mozilla firefox\\browser\\extensions\\{972ce4c6-7e08-4474-a285-3208198ce6fd}\\icon.png. ")) returned 1 [0117.522] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Mozilla Firefox\\browser\\searchplugins\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be220 [0117.561] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Mozilla Firefox\\defaults\\*.*", lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 0x5be1e0 [0117.561] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Mozilla Firefox\\defaults\\pref\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be220 [0117.562] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Mozilla Firefox\\dictionaries\\*.*", lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 0x5be1e0 [0117.563] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Mozilla Firefox\\uninstall\\*.*", lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 0x5be1e0 [0117.564] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Mozilla Firefox\\webapprt\\*.*", lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 0x5be1e0 [0117.564] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Mozilla Maintenance Service\\*.*", lpFindFileData=0xaf4e8 | out: lpFindFileData=0xaf4e8) returned 0x5be160 [0117.566] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\MSBuild\\*.*", lpFindFileData=0xaf4e8 | out: lpFindFileData=0xaf4e8) returned 0x5be160 [0117.566] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\MSBuild\\Microsoft\\*.*", lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 0x5be1e0 [0117.566] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be220 [0117.566] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0117.567] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0117.567] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Reference Assemblies\\*.*", lpFindFileData=0xaf4e8 | out: lpFindFileData=0xaf4e8) returned 0x5be160 [0117.567] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\*.*", lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 0x5be1e0 [0117.567] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be220 [0117.568] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0117.569] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0117.570] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\SubsetList\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0117.570] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0117.572] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\RedistList\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0117.573] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\SubsetList\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0117.574] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Uninstall Information\\*.*", lpFindFileData=0xaf4e8 | out: lpFindFileData=0xaf4e8) returned 0x5be160 [0117.574] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Windows Defender\\*.*", lpFindFileData=0xaf4e8 | out: lpFindFileData=0xaf4e8) returned 0x5be160 [0117.574] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Windows Defender\\en-US\\*.*", lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 0x5be1e0 [0117.576] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Windows Mail\\*.*", lpFindFileData=0xaf4e8 | out: lpFindFileData=0xaf4e8) returned 0x5be160 [0117.587] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Windows Mail\\en-US\\*.*", lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 0x5be1e0 [0117.588] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Windows Media Player\\*.*", lpFindFileData=0xaf4e8 | out: lpFindFileData=0xaf4e8) returned 0x5be160 [0117.588] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Windows Media Player\\en-US\\*.*", lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 0x5be1e0 [0117.588] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Windows Media Player\\Icons\\*.*", lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 0x5be1e0 [0117.589] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Windows Media Player\\Media Renderer\\*.*", lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 0x5be1e0 [0117.606] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Windows Media Player\\Network Sharing\\*.*", lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 0x5be1e0 [0117.606] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Windows Media Player\\Skins\\*.*", lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 0x5be1e0 [0117.606] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Windows Media Player\\Visualizations\\*.*", lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 0x5be1e0 [0117.607] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Windows NT\\*.*", lpFindFileData=0xaf4e8 | out: lpFindFileData=0xaf4e8) returned 0x5be160 [0117.607] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Windows NT\\Accessories\\*.*", lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 0x5be1e0 [0117.608] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Windows NT\\Accessories\\en-US\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be220 [0117.608] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Windows NT\\TableTextService\\*.*", lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 0x5be1e0 [0117.609] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Windows NT\\TableTextService\\en-US\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be220 [0117.610] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Windows Photo Viewer\\*.*", lpFindFileData=0xaf4e8 | out: lpFindFileData=0xaf4e8) returned 0x5be160 [0117.610] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Windows Photo Viewer\\en-US\\*.*", lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 0x5be1e0 [0117.610] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Windows Portable Devices\\*.*", lpFindFileData=0xaf4e8 | out: lpFindFileData=0xaf4e8) returned 0x5be160 [0117.610] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Windows Sidebar\\*.*", lpFindFileData=0xaf4e8 | out: lpFindFileData=0xaf4e8) returned 0x5be160 [0117.610] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Windows Sidebar\\en-US\\*.*", lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 0x5be1e0 [0117.611] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\*.*", lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 0x5be1e0 [0117.613] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be220 [0117.613] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\en-US\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0117.613] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\en-US\\css\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0117.614] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\en-US\\js\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0117.614] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\images\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0117.640] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\Clock.Gadget\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be220 [0117.641] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\Clock.Gadget\\en-US\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0117.641] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\Clock.Gadget\\en-US\\css\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0117.642] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\Clock.Gadget\\en-US\\js\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0117.642] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0117.647] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\CPU.Gadget\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be220 [0117.648] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\CPU.Gadget\\en-US\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0117.648] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\CPU.Gadget\\en-US\\css\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0117.648] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\CPU.Gadget\\en-US\\js\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0117.649] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\CPU.Gadget\\images\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0117.651] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\Currency.Gadget\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be220 [0117.651] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\Currency.Gadget\\en-US\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0117.651] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\Currency.Gadget\\en-US\\css\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0117.651] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\Currency.Gadget\\en-US\\js\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0117.652] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\Currency.Gadget\\images\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0117.655] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be220 [0117.655] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\en-US\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0117.655] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\en-US\\css\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0117.656] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\en-US\\js\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0117.656] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\PicturePuzzle.Gadget\\Images\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0117.660] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be220 [0117.660] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\en-US\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0117.662] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\en-US\\css\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0117.662] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\en-US\\js\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0117.662] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\RSSFeeds.Gadget\\images\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0117.665] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be220 [0117.666] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\en-US\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0117.667] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\en-US\\css\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0117.667] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\en-US\\js\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0117.667] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\images\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0117.670] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\images\\in_sidebar\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0117.670] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\SlideShow.Gadget\\images\\on_desktop\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0117.671] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\Weather.Gadget\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be220 [0117.671] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\Weather.Gadget\\en-US\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0117.672] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\Weather.Gadget\\en-US\\css\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0117.673] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\Weather.Gadget\\en-US\\js\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0117.673] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0117.676] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\120DPI\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0117.682] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\Weather.Gadget\\images\\144DPI\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0117.694] FindFirstFileA (in: lpFileName="C:\\Program Files (x86)\\Windows Sidebar\\Shared Gadgets\\*.*", lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 0x5be1e0 [0117.694] FindFirstFileA (in: lpFileName="C:\\ProgramData\\*.*", lpFindFileData=0xaf638 | out: lpFindFileData=0xaf638) returned 0x5be1a0 [0117.694] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Adobe\\*.*", lpFindFileData=0xaf4e8 | out: lpFindFileData=0xaf4e8) returned 0x5be1e0 [0117.695] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Adobe\\Acrobat\\*.*", lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 0x5be160 [0117.695] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be220 [0117.695] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\Replicate\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0117.695] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0117.695] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Adobe\\ARM\\*.*", lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 0x5be160 [0117.696] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Adobe\\ARM\\Reader_10.0.0\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be220 [0117.706] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Application Data\\*.*", lpFindFileData=0xaf4e8 | out: lpFindFileData=0xaf4e8) returned 0xffffffff [0117.706] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Desktop\\*.*", lpFindFileData=0xaf4e8 | out: lpFindFileData=0xaf4e8) returned 0xffffffff [0117.706] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Documents\\*.*", lpFindFileData=0xaf4e8 | out: lpFindFileData=0xaf4e8) returned 0xffffffff [0117.706] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Favorites\\*.*", lpFindFileData=0xaf4e8 | out: lpFindFileData=0xaf4e8) returned 0xffffffff [0117.706] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\*.*", lpFindFileData=0xaf4e8 | out: lpFindFileData=0xaf4e8) returned 0x5be1e0 [0117.707] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Assistance\\*.*", lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 0x5be160 [0117.707] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Assistance\\Client\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be220 [0117.707] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0117.707] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0117.726] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\*.*", lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 0x5be160 [0117.727] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\DSS\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be220 [0117.727] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\DSS\\MachineKeys\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0117.727] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\Keys\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be220 [0117.728] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be220 [0117.728] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\MachineKeys\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0117.728] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0117.729] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\*.*", lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 0x5be160 [0117.729] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be220 [0117.730] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0117.734] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0117.735] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be220 [0117.735] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0117.738] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0117.738] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0117.741] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0117.742] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\DeviceSync\\*.*", lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 0x5be160 [0117.747] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\DRM\\*.*", lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 0x5be160 [0117.747] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\DRM\\Server\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be220 [0117.748] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\eHome\\*.*", lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 0x5be160 [0117.748] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\eHome\\logs\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be220 [0117.748] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Event Viewer\\*.*", lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 0x5be160 [0117.809] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Event Viewer\\Views\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be220 [0117.809] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0117.810] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\IdentityCRL\\*.*", lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 0x5be160 [0117.810] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Media Player\\*.*", lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 0x5be160 [0117.811] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\MF\\*.*", lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 0x5be160 [0117.811] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\MSDN\\*.*", lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 0x5be160 [0117.812] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\MSDN\\8.0\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be220 [0117.813] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\NetFramework\\*.*", lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 0x5be160 [0117.819] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\NetFramework\\BreadcrumbStore\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be220 [0117.819] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Network\\*.*", lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 0x5be160 [0117.820] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Network\\Connections\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be220 [0117.820] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Network\\Downloader\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be220 [0117.821] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\*.*", lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 0x5be160 [0117.825] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be220 [0117.827] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0117.902] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0118.105] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\*.*", lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 0x5be160 [0118.105] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be220 [0118.105] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\RAC\\*.*", lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 0x5be160 [0118.106] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\RAC\\Outbound\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be220 [0118.106] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\RAC\\PublishedData\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be220 [0118.106] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\RAC\\StateData\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be220 [0118.106] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\RAC\\Temp\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be220 [0118.106] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Search\\*.*", lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 0x5be160 [0118.107] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be220 [0118.108] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0118.108] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0118.110] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\Config\\*.*", lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 0x5be2e0 [0118.110] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\GatherLogs\\*.*", lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 0x5be2e0 [0118.111] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\GatherLogs\\SystemIndex\\*.*", lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 0x5be320 [0118.115] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\*.*", lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 0x5be2e0 [0118.115] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\*.*", lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 0x5be320 [0118.117] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\*.*", lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 0x5be360 [0118.120] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\CiFiles\\*.*", lpFindFileData=0xaea68 | out: lpFindFileData=0xaea68) returned 0x5be3a0 [0118.134] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\PropMap\\*.*", lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 0x5be360 [0118.135] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\SecStore\\*.*", lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 0x5be360 [0118.135] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\Temp\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0118.135] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\*.*", lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 0x5be160 [0118.135] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be220 [0118.156] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\guest.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\guest.bmp"), lpNewFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\guest.bmp. " (normalized: "c:\\programdata\\microsoft\\user account pictures\\guest.bmp. ")) returned 1 [0118.158] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\user.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\user.bmp"), lpNewFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\user.bmp. " (normalized: "c:\\programdata\\microsoft\\user account pictures\\user.bmp. ")) returned 1 [0118.159] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Vault\\*.*", lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 0x5be160 [0118.160] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\VISIO\\*.*", lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 0x5be160 [0118.161] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\*.*", lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 0x5be160 [0118.161] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\AIT\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be220 [0118.161] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Caches\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be220 [0118.162] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataStore\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be220 [0118.162] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataStore\\en-US\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0118.162] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\DRM\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be220 [0118.163] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\DRM\\Cache\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0118.163] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\GameExplorer\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be220 [0118.163] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be220 [0118.219] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\energy-report.html" (normalized: "c:\\programdata\\microsoft\\windows\\power efficiency diagnostics\\energy-report.html"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\energy-report.html. " (normalized: "c:\\programdata\\microsoft\\windows\\power efficiency diagnostics\\energy-report.html. ")) returned 1 [0118.220] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be220 [0118.231] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 01.wma" (normalized: "c:\\programdata\\microsoft\\windows\\ringtones\\ringtone 01.wma"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 01.wma. " (normalized: "c:\\programdata\\microsoft\\windows\\ringtones\\ringtone 01.wma. ")) returned 1 [0118.287] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 02.wma" (normalized: "c:\\programdata\\microsoft\\windows\\ringtones\\ringtone 02.wma"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 02.wma. " (normalized: "c:\\programdata\\microsoft\\windows\\ringtones\\ringtone 02.wma. ")) returned 1 [0118.297] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 03.wma" (normalized: "c:\\programdata\\microsoft\\windows\\ringtones\\ringtone 03.wma"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 03.wma. " (normalized: "c:\\programdata\\microsoft\\windows\\ringtones\\ringtone 03.wma. ")) returned 1 [0118.324] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 04.wma" (normalized: "c:\\programdata\\microsoft\\windows\\ringtones\\ringtone 04.wma"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 04.wma. " (normalized: "c:\\programdata\\microsoft\\windows\\ringtones\\ringtone 04.wma. ")) returned 1 [0118.366] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 05.wma" (normalized: "c:\\programdata\\microsoft\\windows\\ringtones\\ringtone 05.wma"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 05.wma. " (normalized: "c:\\programdata\\microsoft\\windows\\ringtones\\ringtone 05.wma. ")) returned 1 [0118.438] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 06.wma" (normalized: "c:\\programdata\\microsoft\\windows\\ringtones\\ringtone 06.wma"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 06.wma. " (normalized: "c:\\programdata\\microsoft\\windows\\ringtones\\ringtone 06.wma. ")) returned 1 [0118.452] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 07.wma" (normalized: "c:\\programdata\\microsoft\\windows\\ringtones\\ringtone 07.wma"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 07.wma. " (normalized: "c:\\programdata\\microsoft\\windows\\ringtones\\ringtone 07.wma. ")) returned 1 [0118.457] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 08.wma" (normalized: "c:\\programdata\\microsoft\\windows\\ringtones\\ringtone 08.wma"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 08.wma. " (normalized: "c:\\programdata\\microsoft\\windows\\ringtones\\ringtone 08.wma. ")) returned 1 [0118.484] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 09.wma" (normalized: "c:\\programdata\\microsoft\\windows\\ringtones\\ringtone 09.wma"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 09.wma. " (normalized: "c:\\programdata\\microsoft\\windows\\ringtones\\ringtone 09.wma. ")) returned 1 [0118.530] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 10.wma" (normalized: "c:\\programdata\\microsoft\\windows\\ringtones\\ringtone 10.wma"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 10.wma. " (normalized: "c:\\programdata\\microsoft\\windows\\ringtones\\ringtone 10.wma. ")) returned 1 [0118.532] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Sqm\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be220 [0118.533] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Sqm\\Manifest\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0118.533] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Sqm\\Sessions\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0118.534] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Sqm\\Upload\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0118.534] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be220 [0118.565] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Default Programs.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\default programs.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Default Programs.lnk. " (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\default programs.lnk. ")) returned 1 [0118.567] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0118.567] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0118.568] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\*.*", lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 0x5be2e0 [0118.626] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Speech Recognition.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\speech recognition.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Speech Recognition.lnk. " (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\speech recognition.lnk. ")) returned 1 [0118.630] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Calculator.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\calculator.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Calculator.lnk. " (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\calculator.lnk. ")) returned 1 [0118.634] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\displayswitch.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\displayswitch.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\displayswitch.lnk. " (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\displayswitch.lnk. ")) returned 1 [0118.657] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Math Input Panel.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\math input panel.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Math Input Panel.lnk. " (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\math input panel.lnk. ")) returned 1 [0118.723] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Mobility Center.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\mobility center.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Mobility Center.lnk. " (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\mobility center.lnk. ")) returned 1 [0118.794] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\NetworkProjection.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\networkprojection.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\NetworkProjection.lnk. " (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\networkprojection.lnk. ")) returned 1 [0118.797] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Paint.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\paint.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Paint.lnk. " (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\paint.lnk. ")) returned 1 [0118.848] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Remote Desktop Connection.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\remote desktop connection.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Remote Desktop Connection.lnk. " (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\remote desktop connection.lnk. ")) returned 1 [0118.857] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Snipping Tool.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\snipping tool.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Snipping Tool.lnk. " (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\snipping tool.lnk. ")) returned 1 [0118.859] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Sound Recorder.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\sound recorder.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Sound Recorder.lnk. " (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\sound recorder.lnk. ")) returned 1 [0118.862] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Sticky Notes.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\sticky notes.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Sticky Notes.lnk. " (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\sticky notes.lnk. ")) returned 1 [0118.883] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Sync Center.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\sync center.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Sync Center.lnk. " (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\sync center.lnk. ")) returned 1 [0118.884] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\*.*", lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 0x5be2e0 [0118.913] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Character Map.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\character map.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Character Map.lnk. " (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\character map.lnk. ")) returned 1 [0118.939] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\dfrgui.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\dfrgui.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\dfrgui.lnk. " (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\dfrgui.lnk. ")) returned 1 [0118.942] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Disk Cleanup.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\disk cleanup.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Disk Cleanup.lnk. " (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\disk cleanup.lnk. ")) returned 1 [0118.979] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Resource Monitor.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\resource monitor.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Resource Monitor.lnk. " (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\resource monitor.lnk. ")) returned 1 [0118.984] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\System Information.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\system information.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\System Information.lnk. " (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\system information.lnk. ")) returned 1 [0118.987] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\System Restore.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\system restore.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\System Restore.lnk. " (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\system restore.lnk. ")) returned 1 [0118.991] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Task Scheduler.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\task scheduler.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Task Scheduler.lnk. " (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\task scheduler.lnk. ")) returned 1 [0119.011] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Windows Easy Transfer Reports.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\windows easy transfer reports.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Windows Easy Transfer Reports.lnk. " (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\windows easy transfer reports.lnk. ")) returned 1 [0119.022] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Windows Easy Transfer.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\windows easy transfer.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Windows Easy Transfer.lnk. " (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\windows easy transfer.lnk. ")) returned 1 [0119.024] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Tablet PC\\*.*", lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 0x5be2e0 [0119.037] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Tablet PC\\ShapeCollector.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\tablet pc\\shapecollector.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Tablet PC\\ShapeCollector.lnk. " (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\tablet pc\\shapecollector.lnk. ")) returned 1 [0119.054] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Tablet PC\\TabTip.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\tablet pc\\tabtip.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Tablet PC\\TabTip.lnk. " (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\tablet pc\\tabtip.lnk. ")) returned 1 [0119.057] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Tablet PC\\Windows Journal.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\tablet pc\\windows journal.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Tablet PC\\Windows Journal.lnk. " (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\tablet pc\\windows journal.lnk. ")) returned 1 [0119.059] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Welcome Center.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\welcome center.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Welcome Center.lnk. " (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\welcome center.lnk. ")) returned 1 [0119.060] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\*.*", lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 0x5be2e0 [0119.074] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\Windows PowerShell (x86).lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\windows powershell\\windows powershell (x86).lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\Windows PowerShell (x86).lnk. " (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\windows powershell\\windows powershell (x86).lnk. ")) returned 1 [0119.091] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\Windows PowerShell ISE (x86).lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\windows powershell\\windows powershell ise (x86).lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\Windows PowerShell ISE (x86).lnk. " (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\windows powershell\\windows powershell ise (x86).lnk. ")) returned 1 [0119.100] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\Windows PowerShell ISE.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\windows powershell\\windows powershell ise.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\Windows PowerShell ISE.lnk. " (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\windows powershell\\windows powershell ise.lnk. ")) returned 1 [0119.140] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\Windows PowerShell.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\windows powershell\\windows powershell.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\Windows PowerShell.lnk. " (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\windows powershell\\windows powershell.lnk. ")) returned 1 [0119.150] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Wordpad.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\wordpad.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Wordpad.lnk. " (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\wordpad.lnk. ")) returned 1 [0119.151] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0119.160] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Component Services.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\component services.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Component Services.lnk. " (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\component services.lnk. ")) returned 1 [0119.163] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Computer Management.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\computer management.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Computer Management.lnk. " (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\computer management.lnk. ")) returned 1 [0119.182] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Data Sources (ODBC).lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\data sources (odbc).lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Data Sources (ODBC).lnk. " (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\data sources (odbc).lnk. ")) returned 1 [0119.195] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Event Viewer.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\event viewer.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Event Viewer.lnk. " (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\event viewer.lnk. ")) returned 1 [0119.212] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\iSCSI Initiator.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\iscsi initiator.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\iSCSI Initiator.lnk. " (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\iscsi initiator.lnk. ")) returned 1 [0119.220] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Memory Diagnostics Tool.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\memory diagnostics tool.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Memory Diagnostics Tool.lnk. " (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\memory diagnostics tool.lnk. ")) returned 1 [0119.240] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Performance Monitor.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\performance monitor.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Performance Monitor.lnk. " (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\performance monitor.lnk. ")) returned 1 [0119.255] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Print Management.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\print management.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Print Management.lnk. " (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\print management.lnk. ")) returned 1 [0119.274] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Security Configuration Management.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\security configuration management.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Security Configuration Management.lnk. " (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\security configuration management.lnk. ")) returned 1 [0119.292] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\services.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\services.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\services.lnk. " (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\services.lnk. ")) returned 1 [0119.302] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\System Configuration.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\system configuration.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\System Configuration.lnk. " (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\system configuration.lnk. ")) returned 1 [0119.309] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Task Scheduler.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\task scheduler.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Task Scheduler.lnk. " (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\task scheduler.lnk. ")) returned 1 [0119.322] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Windows Firewall with Advanced Security.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\windows firewall with advanced security.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Windows Firewall with Advanced Security.lnk. " (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\windows firewall with advanced security.lnk. ")) returned 1 [0119.366] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Windows PowerShell Modules.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\windows powershell modules.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Windows PowerShell Modules.lnk. " (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\windows powershell modules.lnk. ")) returned 1 [0119.404] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Adobe Reader X.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\adobe reader x.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Adobe Reader X.lnk. " (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\adobe reader x.lnk. ")) returned 1 [0119.405] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Games\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0119.407] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Games\\GameExplorer.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\games\\gameexplorer.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Games\\GameExplorer.lnk. " (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\games\\gameexplorer.lnk. ")) returned 1 [0119.432] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Google Chrome.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\google chrome.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Google Chrome.lnk. " (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\google chrome.lnk. ")) returned 1 [0119.436] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0119.439] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\About Java.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\java\\about java.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\About Java.lnk. " (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\java\\about java.lnk. ")) returned 1 [0119.464] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\Check For Updates.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\java\\check for updates.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\Check For Updates.lnk. " (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\java\\check for updates.lnk. ")) returned 1 [0119.492] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\Configure Java.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\java\\configure java.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\Configure Java.lnk. " (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\java\\configure java.lnk. ")) returned 1 [0119.509] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\Get Help.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\java\\get help.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\Get Help.lnk. " (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\java\\get help.lnk. ")) returned 1 [0119.512] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\Visit Java.com.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\java\\visit java.com.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\Visit Java.com.lnk. " (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\java\\visit java.com.lnk. ")) returned 1 [0119.514] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0119.520] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Backup and Restore Center.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\maintenance\\backup and restore center.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Backup and Restore Center.lnk. " (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\maintenance\\backup and restore center.lnk. ")) returned 1 [0119.533] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Create Recovery Disc.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\maintenance\\create recovery disc.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Create Recovery Disc.lnk. " (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\maintenance\\create recovery disc.lnk. ")) returned 1 [0119.549] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Remote Assistance.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\maintenance\\remote assistance.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Remote Assistance.lnk. " (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\maintenance\\remote assistance.lnk. ")) returned 1 [0119.582] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Media Center.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\media center.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Media Center.lnk. " (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\media center.lnk. ")) returned 1 [0119.584] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0119.595] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Access 2010.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft access 2010.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Access 2010.lnk. " (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft access 2010.lnk. ")) returned 1 [0119.618] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Excel 2010.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft excel 2010.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Excel 2010.lnk. " (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft excel 2010.lnk. ")) returned 1 [0119.665] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft InfoPath Designer 2010.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft infopath designer 2010.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft InfoPath Designer 2010.lnk. " (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft infopath designer 2010.lnk. ")) returned 1 [0119.723] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft InfoPath Filler 2010.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft infopath filler 2010.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft InfoPath Filler 2010.lnk. " (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft infopath filler 2010.lnk. ")) returned 1 [0119.724] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools\\*.*", lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 0x5be2e0 [0119.778] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools\\Digital Certificate for VBA Projects.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft office 2010 tools\\digital certificate for vba projects.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools\\Digital Certificate for VBA Projects.lnk. " (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft office 2010 tools\\digital certificate for vba projects.lnk. ")) returned 1 [0119.892] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools\\Microsoft Clip Organizer.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft office 2010 tools\\microsoft clip organizer.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools\\Microsoft Clip Organizer.lnk. " (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft office 2010 tools\\microsoft clip organizer.lnk. ")) returned 1 [0119.908] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools\\Microsoft Office 2010 Language Preferences.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft office 2010 tools\\microsoft office 2010 language preferences.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools\\Microsoft Office 2010 Language Preferences.lnk. " (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft office 2010 tools\\microsoft office 2010 language preferences.lnk. ")) returned 1 [0119.941] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools\\Microsoft Office 2010 Upload Center.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft office 2010 tools\\microsoft office 2010 upload center.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools\\Microsoft Office 2010 Upload Center.lnk. " (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft office 2010 tools\\microsoft office 2010 upload center.lnk. ")) returned 1 [0120.014] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools\\Microsoft Office Picture Manager.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft office 2010 tools\\microsoft office picture manager.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools\\Microsoft Office Picture Manager.lnk. " (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft office 2010 tools\\microsoft office picture manager.lnk. ")) returned 1 [0120.074] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools\\Microsoft Project Server 2010 Accounts.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft office 2010 tools\\microsoft project server 2010 accounts.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools\\Microsoft Project Server 2010 Accounts.lnk. " (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft office 2010 tools\\microsoft project server 2010 accounts.lnk. ")) returned 1 [0120.102] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft OneNote 2010.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft onenote 2010.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft OneNote 2010.lnk. " (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft onenote 2010.lnk. ")) returned 1 [0120.117] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Outlook 2010.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft outlook 2010.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Outlook 2010.lnk. " (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft outlook 2010.lnk. ")) returned 1 [0120.134] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft PowerPoint 2010.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft powerpoint 2010.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft PowerPoint 2010.lnk. " (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft powerpoint 2010.lnk. ")) returned 1 [0120.170] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Project 2010.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft project 2010.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Project 2010.lnk. " (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft project 2010.lnk. ")) returned 1 [0120.216] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Publisher 2010.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft publisher 2010.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Publisher 2010.lnk. " (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft publisher 2010.lnk. ")) returned 1 [0120.425] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft SharePoint Workspace 2010.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft sharepoint workspace 2010.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft SharePoint Workspace 2010.lnk. " (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft sharepoint workspace 2010.lnk. ")) returned 1 [0120.427] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Visio 2010.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft visio 2010.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Visio 2010.lnk. " (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft visio 2010.lnk. ")) returned 1 [0120.474] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Word 2010.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft word 2010.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Word 2010.lnk. " (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft word 2010.lnk. ")) returned 1 [0120.476] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Mozilla Firefox.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\mozilla firefox.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Mozilla Firefox.lnk. " (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\mozilla firefox.lnk. ")) returned 1 [0120.477] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\SharePoint\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0120.557] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\SharePoint\\Microsoft SharePoint Workspace 2010.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\sharepoint\\microsoft sharepoint workspace 2010.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\SharePoint\\Microsoft SharePoint Workspace 2010.lnk. " (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\sharepoint\\microsoft sharepoint workspace 2010.lnk. ")) returned 1 [0120.560] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Sidebar.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\sidebar.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Sidebar.lnk. " (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\sidebar.lnk. ")) returned 1 [0120.561] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0120.561] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Tablet PC\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0120.562] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Windows Anytime Upgrade.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\windows anytime upgrade.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Windows Anytime Upgrade.lnk. " (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\windows anytime upgrade.lnk. ")) returned 1 [0120.637] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Windows DVD Maker.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\windows dvd maker.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Windows DVD Maker.lnk. " (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\windows dvd maker.lnk. ")) returned 1 [0120.640] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Windows Fax and Scan.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\windows fax and scan.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Windows Fax and Scan.lnk. " (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\windows fax and scan.lnk. ")) returned 1 [0120.643] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Windows Media Player.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\windows media player.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Windows Media Player.lnk. " (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\windows media player.lnk. ")) returned 1 [0120.645] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\XPS Viewer.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\xps viewer.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\XPS Viewer.lnk. " (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\xps viewer.lnk. ")) returned 1 [0120.648] MoveFileA (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Windows Update.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\windows update.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Windows Update.lnk. " (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\windows update.lnk. ")) returned 1 [0120.650] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Templates\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be220 [0120.650] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\WER\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be220 [0120.650] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\WER\\ReportArchive\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0120.650] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\WER\\ReportQueue\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0120.651] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\*.*", lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 0x5be160 [0120.653] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Definition Updates\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be220 [0120.653] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Definition Updates\\Backup\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0120.653] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Definition Updates\\Updates\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0120.654] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Definition Updates\\{D2B0B133-42ED-44D3-809A-46EBB62BA863}\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0120.654] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\LocalCopy\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be220 [0120.655] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Quarantine\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be220 [0120.655] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be220 [0120.656] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0120.656] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\CacheManager\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0120.656] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Results\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0120.656] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Results\\Resource\\*.*", lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 0x5be2e0 [0120.657] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Service\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0120.657] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Scans\\History\\Store\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0120.658] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows Defender\\Support\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be220 [0120.658] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows NT\\*.*", lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 0x5be160 [0120.658] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be220 [0120.660] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\ActivityLog\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0120.660] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0120.661] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\en-US\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0120.661] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\Inbox\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0120.662] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\Queue\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0120.662] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\SentItems\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0120.662] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\VirtualInbox\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0120.662] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\VirtualInbox\\en-US\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0120.663] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows NT\\MSScan\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be220 [0120.664] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\WwanSvc\\*.*", lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 0x5be160 [0120.664] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft\\WwanSvc\\Profiles\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be220 [0120.664] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Microsoft Help\\*.*", lpFindFileData=0xaf4e8 | out: lpFindFileData=0xaf4e8) returned 0x5be1e0 [0120.768] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Mozilla\\*.*", lpFindFileData=0xaf4e8 | out: lpFindFileData=0xaf4e8) returned 0x5be160 [0120.768] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Mozilla\\logs\\*.*", lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 0x5be1e0 [0120.769] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Oracle\\*.*", lpFindFileData=0xaf4e8 | out: lpFindFileData=0xaf4e8) returned 0x5be1e0 [0120.769] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Package Cache\\*.*", lpFindFileData=0xaf4e8 | out: lpFindFileData=0xaf4e8) returned 0x5be1e0 [0120.945] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\*.*", lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 0x5be160 [0120.946] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be220 [0120.946] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0120.946] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\x64\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0120.950] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\*.*", lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 0x5be160 [0120.951] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be220 [0120.951] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0120.952] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\x64\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0120.952] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\*.*", lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 0x5be160 [0120.952] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be220 [0120.953] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0120.953] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\*.*", lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 0x5be160 [0120.954] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\*.*", lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 0x5be160 [0120.980] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be220 [0120.980] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0120.981] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\*.*", lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 0x5be160 [0120.988] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\*.*", lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 0x5be160 [0120.988] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be220 [0120.989] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0120.989] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\*.*", lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 0x5be160 [0120.990] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be220 [0120.990] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0120.990] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\*.*", lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 0x5be160 [0120.991] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be220 [0120.991] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0120.991] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\*.*", lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 0x5be160 [0120.991] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be220 [0120.992] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0120.992] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\*.*", lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 0x5be160 [0120.992] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be220 [0120.992] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0120.993] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\*.*", lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 0x5be160 [0121.050] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be220 [0121.051] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0121.052] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\*.*", lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 0x5be160 [0121.052] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be220 [0121.107] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0121.172] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\*.*", lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 0x5be160 [0121.173] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\*.*", lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 0x5be160 [0121.299] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be220 [0121.299] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0121.300] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\*.*", lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 0x5be160 [0121.300] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be220 [0121.300] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0121.301] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\*.*", lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 0x5be160 [0121.301] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\*.*", lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 0x5be160 [0121.304] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\*.*", lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 0x5be160 [0121.305] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\*.*", lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 0x5be160 [0121.305] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be220 [0121.305] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0121.305] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Start Menu\\*.*", lpFindFileData=0xaf4e8 | out: lpFindFileData=0xaf4e8) returned 0xffffffff [0121.305] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Sun\\*.*", lpFindFileData=0xaf4e8 | out: lpFindFileData=0xaf4e8) returned 0x5be1e0 [0121.306] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Sun\\Java\\*.*", lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 0x5be220 [0121.306] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Sun\\Java\\Java Update\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be160 [0121.306] FindFirstFileA (in: lpFileName="C:\\ProgramData\\Templates\\*.*", lpFindFileData=0xaf4e8 | out: lpFindFileData=0xaf4e8) returned 0xffffffff [0121.307] FindFirstFileA (in: lpFileName="C:\\Recovery\\*.*", lpFindFileData=0xaf638 | out: lpFindFileData=0xaf638) returned 0x5be1a0 [0121.307] FindFirstFileA (in: lpFileName="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\*.*", lpFindFileData=0xaf4e8 | out: lpFindFileData=0xaf4e8) returned 0x5be1e0 [0121.308] FindFirstFileA (in: lpFileName="C:\\System Volume Information\\*.*", lpFindFileData=0xaf638 | out: lpFindFileData=0xaf638) returned 0xffffffff [0121.308] FindFirstFileA (in: lpFileName="C:\\Users\\*.*", lpFindFileData=0xaf638 | out: lpFindFileData=0xaf638) returned 0x5be1a0 [0121.308] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\*.*", lpFindFileData=0xaf4e8 | out: lpFindFileData=0xaf4e8) returned 0x5be1e0 [0121.308] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\*.*", lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 0x5be220 [0121.308] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be160 [0121.308] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0121.308] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0121.309] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\*.*", lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 0x5be2e0 [0121.309] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\Cache\\*.*", lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 0x5be320 [0121.310] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0121.311] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\*.*", lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 0x5be2e0 [0121.312] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0xffffffff [0121.312] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0121.312] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0121.312] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\*.*", lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 0x5be2e0 [0121.313] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\*.*", lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 0x5be320 [0121.313] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\*.*", lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 0x5be360 [0121.314] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\*.*", lpFindFileData=0xaea68 | out: lpFindFileData=0xaea68) returned 0x5be3a0 [0121.314] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\Data\\*.*", lpFindFileData=0xae918 | out: lpFindFileData=0xae918) returned 0x5be3e0 [0121.315] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\*.*", lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 0x5be2e0 [0121.315] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\*.*", lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 0x5be320 [0121.317] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715\\*.*", lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 0x5be360 [0121.318] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\*.*", lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 0x5be360 [0121.321] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\*.*", lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 0x5be360 [0121.348] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Deployment\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0121.349] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0121.349] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0121.349] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\*.*", lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 0x5be2e0 [0121.352] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\CertificateTransparency\\*.*", lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 0x5be320 [0121.353] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\*.*", lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 0x5be320 [0121.354] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\reports\\*.*", lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 0x5be360 [0121.354] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\*.*", lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 0x5be320 [0121.523] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\*.*", lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 0x5be360 [0121.527] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\*.*", lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 0x5be360 [0121.603] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\*.*", lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 0x5be360 [0121.616] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\*.*", lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 0x5be360 [0121.685] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\*.*", lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 0x5be360 [0121.813] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\*.*", lpFindFileData=0xaea68 | out: lpFindFileData=0xaea68) returned 0x5be3a0 [0121.871] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\*.*", lpFindFileData=0xae918 | out: lpFindFileData=0xae918) returned 0x5be3e0 [0122.144] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_128.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_128.png. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_128.png. ")) returned 1 [0122.146] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_16.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_16.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_16.png. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_16.png. ")) returned 1 [0122.175] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.html"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.html. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.html. ")) returned 1 [0122.177] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\*.*", lpFindFileData=0xae7c8 | out: lpFindFileData=0xae7c8) returned 0x5be420 [0122.245] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ar\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0122.245] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\bg\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0122.245] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ca\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0122.255] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\cs\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0122.255] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\da\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0122.256] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\de\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0122.256] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\el\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0122.257] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_GB\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0122.273] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_US\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0122.273] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0122.274] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es_419\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0122.274] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\et\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0122.275] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fi\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0122.275] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fil\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0122.276] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fr\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0122.276] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\he\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0122.277] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hi\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0122.277] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hu\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0122.277] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\id\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0122.278] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\it\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0122.278] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ja\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0122.279] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ko\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0122.279] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lt\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0122.279] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lv\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0122.280] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ms\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0122.281] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\nl\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0122.282] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\no\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0122.282] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pl\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0122.282] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_BR\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0122.283] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_PT\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0122.283] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ro\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0122.283] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ru\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0122.284] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sk\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0122.284] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sl\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0122.285] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sr\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0122.285] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sv\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0122.286] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\th\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0122.286] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\tr\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0122.287] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\uk\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0122.287] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\vi\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0122.287] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_CN\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0122.288] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_TW\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0122.288] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\*.*", lpFindFileData=0xae7c8 | out: lpFindFileData=0xae7c8) returned 0x5be420 [0122.288] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\*.*", lpFindFileData=0xaea68 | out: lpFindFileData=0xaea68) returned 0x5be3a0 [0122.288] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\*.*", lpFindFileData=0xae918 | out: lpFindFileData=0xae918) returned 0x5be3e0 [0122.374] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_128.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_128.png. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_128.png. ")) returned 1 [0122.474] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_16.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_16.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_16.png. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_16.png. ")) returned 1 [0122.477] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.html"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.html. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.html. ")) returned 1 [0122.478] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\*.*", lpFindFileData=0xae7c8 | out: lpFindFileData=0xae7c8) returned 0x5be420 [0122.566] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ar\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0122.566] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\bg\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0122.566] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ca\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0122.590] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\cs\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0122.591] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\da\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0122.591] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\de\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0122.592] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\el\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0122.592] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_GB\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0122.593] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_US\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0122.593] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0122.681] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es_419\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0122.682] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\et\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0122.682] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fi\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0122.683] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fil\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0122.683] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fr\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0122.684] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\he\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0122.684] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hi\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0122.685] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hu\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0122.686] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\id\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0122.686] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\it\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0122.687] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ja\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0122.687] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ko\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0122.688] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lt\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0122.688] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lv\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0122.689] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ms\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0122.689] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\nl\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0122.690] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\no\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0122.691] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pl\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0122.691] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_BR\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0122.692] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_PT\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0122.693] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ro\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0122.693] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ru\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0122.694] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sk\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0122.694] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sl\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0122.696] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sr\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0122.697] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sv\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0122.700] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\th\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0122.700] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\tr\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0122.700] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\uk\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0122.701] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\vi\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0122.701] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_CN\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0122.702] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_TW\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0122.702] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\*.*", lpFindFileData=0xae7c8 | out: lpFindFileData=0xae7c8) returned 0x5be420 [0122.702] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\*.*", lpFindFileData=0xaea68 | out: lpFindFileData=0xaea68) returned 0x5be3a0 [0122.702] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\*.*", lpFindFileData=0xae918 | out: lpFindFileData=0xae918) returned 0x5be3e0 [0122.913] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\128.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\128.png. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\128.png. ")) returned 1 [0122.914] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\*.*", lpFindFileData=0xae7c8 | out: lpFindFileData=0xae7c8) returned 0x5be420 [0122.984] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ar\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0122.985] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\bg\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0122.987] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ca\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0122.988] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\cs\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0122.990] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\da\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0122.991] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\de\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0122.993] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\el\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0122.993] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_GB\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0122.995] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_US\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0122.996] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0122.998] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es_419\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0122.998] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\et\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0123.001] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\eu\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0123.001] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fi\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0123.126] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fil\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0123.126] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fr\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0123.178] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\he\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0123.179] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hi\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0123.181] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hr\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0123.181] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hu\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0123.183] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\id\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0123.183] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\it\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0123.185] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ja\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0123.186] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ko\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0123.262] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lt\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0123.262] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lv\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0123.263] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ms\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0123.263] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\nl\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0123.264] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\no\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0123.264] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pl\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0123.264] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_BR\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0123.265] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_PT\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0123.265] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ro\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0123.266] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ru\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0123.266] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sk\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0123.266] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sl\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0123.267] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sr\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0123.267] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sv\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0123.268] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\th\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0123.268] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\tr\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0123.269] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\uk\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0123.269] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\vi\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0123.270] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_CN\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0123.271] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_TW\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0123.272] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_metadata\\*.*", lpFindFileData=0xae7c8 | out: lpFindFileData=0xae7c8) returned 0x5be420 [0123.272] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\*.*", lpFindFileData=0xaea68 | out: lpFindFileData=0xaea68) returned 0x5be3a0 [0123.273] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\*.*", lpFindFileData=0xae918 | out: lpFindFileData=0xae918) returned 0x5be3e0 [0123.403] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\128.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\128.png. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\128.png. ")) returned 1 [0123.404] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\*.*", lpFindFileData=0xae7c8 | out: lpFindFileData=0xae7c8) returned 0x5be420 [0123.406] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ar\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0123.406] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\bg\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0123.407] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ca\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0123.407] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\cs\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0123.408] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\da\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0123.408] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\de\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0123.409] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\el\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0123.410] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\en\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0123.411] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\es\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0123.411] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fi\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0123.412] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fil\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0123.412] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fr\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0123.413] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\he\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0123.413] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hi\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0123.417] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hr\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0123.418] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hu\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0123.419] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\id\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0123.419] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\it\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0123.420] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ja\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0123.420] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ko\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0123.461] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lt\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0123.461] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lv\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0123.578] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\nl\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0123.578] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\no\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0123.579] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pl\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0123.579] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_BR\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0123.580] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_PT\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0123.580] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ro\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0123.580] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ru\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0123.581] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sk\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0123.581] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sl\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0123.582] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sr\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0123.582] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sv\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0123.583] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\th\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0123.583] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\tr\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0123.583] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\uk\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0123.584] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\vi\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0123.584] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_CN\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0123.585] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_TW\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0123.585] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_metadata\\*.*", lpFindFileData=0xae7c8 | out: lpFindFileData=0xae7c8) returned 0x5be420 [0123.586] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\*.*", lpFindFileData=0xaea68 | out: lpFindFileData=0xaea68) returned 0x5be3a0 [0123.586] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\*.*", lpFindFileData=0xae918 | out: lpFindFileData=0xae918) returned 0x5be3e0 [0123.617] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_128.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_128.png. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_128.png. ")) returned 1 [0123.619] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_16.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_16.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_16.png. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_16.png. ")) returned 1 [0123.620] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.html"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.html. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.html. ")) returned 1 [0123.620] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\*.*", lpFindFileData=0xae7c8 | out: lpFindFileData=0xae7c8) returned 0x5be420 [0123.622] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ar\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0123.622] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\bg\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0123.623] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ca\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0123.623] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\cs\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0123.623] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\da\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0123.624] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\de\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0123.624] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\el\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0123.625] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_GB\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0123.625] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_US\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0123.626] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0123.627] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es_419\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0123.627] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\et\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0123.628] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fi\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0123.628] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fil\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0123.629] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fr\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0123.629] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\he\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0123.630] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hi\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0123.630] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hu\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0123.630] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\id\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0123.631] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\it\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0123.631] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ja\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0123.631] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ko\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0123.632] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lt\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0123.632] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lv\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0123.633] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ms\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0123.633] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\nl\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0123.634] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\no\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0123.634] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pl\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0123.635] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_BR\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0123.635] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_PT\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0123.636] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ro\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0123.636] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ru\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0123.637] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sk\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0123.637] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sl\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0123.638] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sr\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0123.638] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sv\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0123.639] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\th\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0123.639] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\tr\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0123.639] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\uk\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0123.640] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\vi\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0123.640] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_CN\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0123.641] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_TW\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0123.641] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\*.*", lpFindFileData=0xae7c8 | out: lpFindFileData=0xae7c8) returned 0x5be420 [0123.641] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\*.*", lpFindFileData=0xaea68 | out: lpFindFileData=0xaea68) returned 0x5be3a0 [0123.662] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\*.*", lpFindFileData=0xae918 | out: lpFindFileData=0xae918) returned 0x5be3e0 [0123.664] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\128.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\128.png. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\128.png. ")) returned 1 [0123.665] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\*.*", lpFindFileData=0xae7c8 | out: lpFindFileData=0xae7c8) returned 0x5be420 [0123.699] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\af\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0123.700] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\am\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0123.700] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ar\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0123.701] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\az\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0123.701] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bg\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0123.701] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bn\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0123.702] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ca\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0123.702] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\cs\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0123.703] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\da\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0123.703] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\de\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0123.703] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\el\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0123.704] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_GB\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0123.704] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_US\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0123.705] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0123.705] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es_419\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0123.706] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\et\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0123.706] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\eu\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0123.707] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fa\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0123.707] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fi\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0123.708] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fil\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0123.708] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0123.709] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr_CA\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0123.710] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gl\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0123.710] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gu\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0123.710] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hi\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0123.711] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hr\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0123.711] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hu\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0123.711] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hy\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0123.712] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\id\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0123.712] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\is\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0123.713] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\it\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0123.713] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\iw\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0123.714] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ja\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0123.714] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ka\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0123.715] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\km\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0123.715] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\kn\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0123.716] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ko\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0123.716] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lo\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0123.717] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lt\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0123.717] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lv\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0123.718] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ml\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0123.718] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mn\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0123.729] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mr\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0123.730] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ms\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0123.730] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ne\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0123.731] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\nl\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0123.731] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\no\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0123.732] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pl\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0123.732] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_BR\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0123.732] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_PT\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0123.733] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ro\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0123.733] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ru\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0123.734] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\si\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0123.734] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sk\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0123.735] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sl\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0123.735] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sr\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0123.736] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sv\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0123.736] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sw\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0123.736] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ta\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0123.737] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\te\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0123.737] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\th\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0123.737] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\tr\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0123.738] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\uk\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0123.738] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ur\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0123.739] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\vi\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0123.739] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_CN\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0123.742] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_HK\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0123.742] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_TW\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0123.743] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zu\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0123.743] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\*.*", lpFindFileData=0xae7c8 | out: lpFindFileData=0xae7c8) returned 0x5be420 [0123.745] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\*.*", lpFindFileData=0xaea68 | out: lpFindFileData=0xaea68) returned 0x5be3a0 [0123.746] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\*.*", lpFindFileData=0xae918 | out: lpFindFileData=0xae918) returned 0x5be3e0 [0123.762] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\css\\*.*", lpFindFileData=0xae7c8 | out: lpFindFileData=0xae7c8) returned 0x5be420 [0123.763] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\html\\*.*", lpFindFileData=0xae7c8 | out: lpFindFileData=0xae7c8) returned 0x5be420 [0123.782] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\html\\craw_window.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\html\\craw_window.html"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\html\\craw_window.html. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\html\\craw_window.html. ")) returned 1 [0123.783] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\*.*", lpFindFileData=0xae7c8 | out: lpFindFileData=0xae7c8) returned 0x5be420 [0123.787] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\flapper.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\flapper.gif"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\flapper.gif. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\flapper.gif. ")) returned 1 [0123.791] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_128.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_128.png. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_128.png. ")) returned 1 [0123.794] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_16.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_16.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_16.png. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_16.png. ")) returned 1 [0123.796] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button.png. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button.png. ")) returned 1 [0123.798] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_close.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_close.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_close.png. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_close.png. ")) returned 1 [0123.800] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_hover.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_hover.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_hover.png. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_hover.png. ")) returned 1 [0123.803] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_maximize.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_maximize.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_maximize.png. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_maximize.png. ")) returned 1 [0123.805] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_pressed.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_pressed.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_pressed.png. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_pressed.png. ")) returned 1 [0123.806] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\*.*", lpFindFileData=0xae7c8 | out: lpFindFileData=0xae7c8) returned 0x5be420 [0123.835] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\bg\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0123.836] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ca\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0123.837] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\cs\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0123.837] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\da\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0123.838] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\de\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0123.838] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\el\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0123.839] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0123.839] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en_GB\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0123.840] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0123.841] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es_419\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0123.842] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\et\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0123.842] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fi\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0123.843] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fil\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0123.843] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fr\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0123.844] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hi\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0123.845] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hr\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0123.845] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hu\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0123.846] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\id\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0123.847] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\it\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0123.847] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ja\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0123.848] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ko\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0123.848] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lt\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0123.849] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lv\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0123.850] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nb\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0123.850] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nl\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0123.851] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pl\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0123.852] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_BR\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0123.852] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_PT\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0123.853] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ro\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0123.853] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ru\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0123.854] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sk\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0123.854] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sl\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0123.855] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sr\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0123.856] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sv\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0123.858] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\th\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0123.858] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\tr\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0123.859] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\uk\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0123.860] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\vi\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0123.861] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_CN\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0123.861] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_TW\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0123.862] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_metadata\\*.*", lpFindFileData=0xae7c8 | out: lpFindFileData=0xae7c8) returned 0x5be420 [0123.862] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\*.*", lpFindFileData=0xaea68 | out: lpFindFileData=0xaea68) returned 0x5be3a0 [0123.863] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\*.*", lpFindFileData=0xae918 | out: lpFindFileData=0xae918) returned 0x5be3e0 [0123.938] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\128.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\128.png. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\128.png. ")) returned 1 [0123.941] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\*.*", lpFindFileData=0xae7c8 | out: lpFindFileData=0xae7c8) returned 0x5be420 [0123.942] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ar\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0123.944] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\bg\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0123.944] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ca\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0123.945] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\cs\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0123.946] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\da\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0123.947] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\de\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0123.948] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\el\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0123.950] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\en\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0123.950] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\es\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0123.952] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fi\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0123.953] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fil\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0123.954] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fr\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0123.954] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hi\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0123.954] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hr\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0123.955] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hu\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0123.991] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\id\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0123.991] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\it\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0124.064] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ja\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0124.065] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ko\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0124.065] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lt\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0124.065] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lv\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0124.065] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\nl\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0124.066] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\no\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0124.066] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pl\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0124.066] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_BR\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0124.125] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_PT\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0124.126] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ro\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0124.126] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ru\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0124.126] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\se\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0124.126] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sk\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0124.127] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sl\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0124.127] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sr\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0124.127] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\th\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0124.128] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\tr\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0124.128] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\uk\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0124.128] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\vi\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0124.129] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_CN\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0124.129] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_TW\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0124.129] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_metadata\\*.*", lpFindFileData=0xae7c8 | out: lpFindFileData=0xae7c8) returned 0x5be420 [0124.135] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\*.*", lpFindFileData=0xaea68 | out: lpFindFileData=0xaea68) returned 0x5be3a0 [0124.136] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\*.*", lpFindFileData=0xae918 | out: lpFindFileData=0xae918) returned 0x5be3e0 [0124.143] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.html"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.html. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.html. ")) returned 1 [0124.145] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\*.*", lpFindFileData=0xae7c8 | out: lpFindFileData=0xae7c8) returned 0x5be420 [0124.219] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\chromecast_logo_grey.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\chromecast_logo_grey.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\chromecast_logo_grey.png. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\chromecast_logo_grey.png. ")) returned 1 [0124.221] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\devices.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\devices.html"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\devices.html. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\devices.html. ")) returned 1 [0124.242] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\index.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\index.html"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\index.html. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\index.html. ")) returned 1 [0124.244] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\offers.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\offers.html"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\offers.html. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\offers.html. ")) returned 1 [0124.245] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\setup.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\setup.html"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\setup.html. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\setup.html. ")) returned 1 [0124.246] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\*.*", lpFindFileData=0xae7c8 | out: lpFindFileData=0xae7c8) returned 0x5be420 [0124.256] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.html"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.html. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.html. ")) returned 1 [0124.278] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.html"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.html. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.html. ")) returned 1 [0124.280] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\*.*", lpFindFileData=0xae7c8 | out: lpFindFileData=0xae7c8) returned 0x5be420 [0124.282] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\am\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0124.282] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ar\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0124.283] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bg\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0124.283] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bn\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0124.284] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ca\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0124.284] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\cs\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0124.285] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\da\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0124.285] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\de\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0124.286] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\el\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0124.286] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\en\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0124.287] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\es\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0124.287] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\et\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0124.288] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fa\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0124.288] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fi\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0124.289] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fil\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0124.289] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fr\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0124.290] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\gu\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0124.290] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hi\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0124.470] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\brndlog.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\brndlog.txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\brndlog.txt. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\brndlog.txt. ")) returned 1 [0124.734] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA3e3XC[2].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\aa3e3xc[2].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA3e3XC[2].png. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\aa3e3xc[2].png. ")) returned 1 [0124.746] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA3vOVA[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\aa3vova[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA3vOVA[1].png. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\aa3vova[1].png. ")) returned 1 [0124.751] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA42EP9[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\aa42ep9[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA42EP9[1].png. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\aa42ep9[1].png. ")) returned 1 [0124.754] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA54rQj[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\aa54rqj[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA54rQj[1].png. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\aa54rqj[1].png. ")) returned 1 [0124.764] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA61yi9[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\aa61yi9[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA61yi9[1].png. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\aa61yi9[1].png. ")) returned 1 [0124.776] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA8uCo4[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\aa8uco4[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA8uCo4[1].png. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\aa8uco4[1].png. ")) returned 1 [0124.779] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AAdAVrM[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\aadavrm[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AAdAVrM[1].png. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\aadavrm[1].png. ")) returned 1 [0124.784] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\adServer[1].htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\adserver[1].htm"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\adServer[1].htm. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\adserver[1].htm. ")) returned 1 [0124.793] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB1CcOi[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bb1ccoi[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB1CcOi[1].png. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bb1ccoi[1].png. ")) returned 1 [0124.807] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB46JmN[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bb46jmn[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB46JmN[1].png. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bb46jmn[1].png. ")) returned 1 [0124.833] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB5kJAC[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bb5kjac[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB5kJAC[1].png. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bb5kjac[1].png. ")) returned 1 [0124.836] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB5kTiV[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bb5ktiv[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB5kTiV[1].png. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bb5ktiv[1].png. ")) returned 1 [0124.852] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB6Ma4a[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bb6ma4a[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB6Ma4a[1].png. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bb6ma4a[1].png. ")) returned 1 [0124.859] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB74fLs[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bb74fls[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB74fLs[1].png. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bb74fls[1].png. ")) returned 1 [0124.899] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBIqq8[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbiqq8[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBIqq8[1].jpg. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbiqq8[1].jpg. ")) returned 1 [0124.902] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBL0ij[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbl0ij[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBL0ij[1].jpg. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbl0ij[1].jpg. ")) returned 1 [0124.905] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBLhZX[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbblhzx[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBLhZX[1].jpg. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbblhzx[1].jpg. ")) returned 1 [0124.915] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBNiEo[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbnieo[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBNiEo[1].jpg. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbnieo[1].jpg. ")) returned 1 [0124.924] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBO1mQ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbo1mq[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBO1mQ[1].jpg. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbo1mq[1].jpg. ")) returned 1 [0124.969] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBO3tl[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbo3tl[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBO3tl[1].jpg. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbo3tl[1].jpg. ")) returned 1 [0124.972] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBO8dQ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbo8dq[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBO8dQ[1].jpg. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbo8dq[1].jpg. ")) returned 1 [0124.974] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBOe7C[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbboe7c[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBOe7C[1].jpg. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbboe7c[1].jpg. ")) returned 1 [0125.002] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBPThN[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbpthn[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBPThN[1].jpg. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbpthn[1].jpg. ")) returned 1 [0125.027] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBPUFJ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbpufj[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBPUFJ[1].jpg. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbpufj[1].jpg. ")) returned 1 [0125.030] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBQxzx[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbqxzx[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBQxzx[1].jpg. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbqxzx[1].jpg. ")) returned 1 [0125.048] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBseMP[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbsemp[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBseMP[1].jpg. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbsemp[1].jpg. ")) returned 1 [0125.051] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBsqNL[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbsqnl[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBsqNL[1].jpg. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbsqnl[1].jpg. ")) returned 1 [0125.053] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBTpvW[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbtpvw[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBTpvW[1].jpg. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbtpvw[1].jpg. ")) returned 1 [0125.058] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVEOW[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbveow[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVEOW[1].jpg. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbveow[1].jpg. ")) returned 1 [0125.060] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVGsM[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbvgsm[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVGsM[1].jpg. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbvgsm[1].jpg. ")) returned 1 [0125.079] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVIzI[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbvizi[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVIzI[1].jpg. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbvizi[1].jpg. ")) returned 1 [0125.089] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVJ4r[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbvj4r[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVJ4r[1].jpg. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbvj4r[1].jpg. ")) returned 1 [0125.092] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVxM8[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbvxm8[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVxM8[1].jpg. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbvxm8[1].jpg. ")) returned 1 [0125.101] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBz9wz[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbz9wz[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBz9wz[1].jpg. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbz9wz[1].jpg. ")) returned 1 [0125.111] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBzxW1[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbzxw1[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBzxW1[1].jpg. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbzxw1[1].jpg. ")) returned 1 [0125.119] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC06Ub[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc06ub[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC06Ub[1].jpg. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc06ub[1].jpg. ")) returned 1 [0125.122] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC095c[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc095c[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC095c[1].jpg. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc095c[1].jpg. ")) returned 1 [0125.125] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0ALC[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc0alc[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0ALC[1].jpg. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc0alc[1].jpg. ")) returned 1 [0125.167] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0lYn[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc0lyn[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0lYn[1].jpg. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc0lyn[1].jpg. ")) returned 1 [0125.201] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0mlu[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc0mlu[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0mlu[1].jpg. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc0mlu[1].jpg. ")) returned 1 [0125.246] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0rDa[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc0rda[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0rDa[1].jpg. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc0rda[1].jpg. ")) returned 1 [0125.252] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0rDa[2].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc0rda[2].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0rDa[2].jpg. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc0rda[2].jpg. ")) returned 1 [0125.273] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0tCi[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc0tci[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0tCi[1].jpg. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc0tci[1].jpg. ")) returned 1 [0125.286] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBDK7Yy[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbdk7yy[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBDK7Yy[1].jpg. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbdk7yy[1].jpg. ")) returned 1 [0125.299] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBDRbsH[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbdrbsh[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBDRbsH[1].jpg. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbdrbsh[1].jpg. ")) returned 1 [0125.315] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBDZoZR[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbdzozr[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBDZoZR[1].jpg. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbdzozr[1].jpg. ")) returned 1 [0125.326] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBE97O8[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbe97o8[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBE97O8[1].jpg. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbe97o8[1].jpg. ")) returned 1 [0125.334] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBE9wSt[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbe9wst[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBE9wSt[1].jpg. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbe9wst[1].jpg. ")) returned 1 [0125.353] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEcHle[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbechle[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEcHle[1].jpg. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbechle[1].jpg. ")) returned 1 [0125.357] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdE0f[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbede0f[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdE0f[1].jpg. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbede0f[1].jpg. ")) returned 1 [0125.381] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdoQv[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbedoqv[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdoQv[1].jpg. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbedoqv[1].jpg. ")) returned 1 [0125.403] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdqEy[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbedqey[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdqEy[1].jpg. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbedqey[1].jpg. ")) returned 1 [0125.421] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdtWw[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbedtww[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdtWw[1].jpg. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbedtww[1].jpg. ")) returned 1 [0125.537] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdXJj[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbedxjj[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdXJj[1].jpg. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbedxjj[1].jpg. ")) returned 1 [0125.548] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEeP0k[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbeep0k[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEeP0k[1].jpg. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbeep0k[1].jpg. ")) returned 1 [0125.557] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEeTuf[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbeetuf[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEeTuf[1].jpg. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbeetuf[1].jpg. ")) returned 1 [0125.605] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEfE6e[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbefe6e[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEfE6e[1].jpg. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbefe6e[1].jpg. ")) returned 1 [0125.639] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEfjuT[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbefjut[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEfjuT[1].jpg. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbefjut[1].jpg. ")) returned 1 [0125.682] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEg9QV[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbeg9qv[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEg9QV[1].jpg. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbeg9qv[1].jpg. ")) returned 1 [0125.695] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgGSl[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbeggsl[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgGSl[1].jpg. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbeggsl[1].jpg. ")) returned 1 [0125.704] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgiYw[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegiyw[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgiYw[1].jpg. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegiyw[1].jpg. ")) returned 1 [0125.709] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgJfz[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegjfz[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgJfz[1].jpg. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegjfz[1].jpg. ")) returned 1 [0125.741] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgqtY[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegqty[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgqtY[1].jpg. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegqty[1].jpg. ")) returned 1 [0125.747] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgsz3[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegsz3[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgsz3[1].jpg. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegsz3[1].jpg. ")) returned 1 [0125.749] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgtcS[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegtcs[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgtcS[1].jpg. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegtcs[1].jpg. ")) returned 1 [0125.775] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgtcS[2].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegtcs[2].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgtcS[2].jpg. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegtcs[2].jpg. ")) returned 1 [0125.793] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgx5f[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegx5f[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgx5f[1].jpg. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegx5f[1].jpg. ")) returned 1 [0125.843] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgx5f[2].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegx5f[2].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgx5f[2].jpg. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegx5f[2].jpg. ")) returned 1 [0126.164] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgyIm[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegyim[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgyIm[1].jpg. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegyim[1].jpg. ")) returned 1 [0126.203] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBg3ODX[2].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbg3odx[2].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBg3ODX[2].png. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbg3odx[2].png. ")) returned 1 [0126.229] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBiyCq[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbiycq[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBiyCq[1].png. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbiycq[1].png. ")) returned 1 [0126.240] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBn4lUU[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbn4luu[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBn4lUU[1].png. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbn4luu[1].png. ")) returned 1 [0126.246] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBnMKeN[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbnmken[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBnMKeN[1].png. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbnmken[1].png. ")) returned 1 [0126.248] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBwGan9[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbwgan9[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBwGan9[1].jpg. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbwgan9[1].jpg. ")) returned 1 [0126.260] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBz3ebk[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbz3ebk[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBz3ebk[1].png. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbz3ebk[1].png. ")) returned 1 [0126.283] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\benefits-5-mobile[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\benefits-5-mobile[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\benefits-5-mobile[1].png. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\benefits-5-mobile[1].png. ")) returned 1 [0126.291] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\chrome-new[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\chrome-new[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\chrome-new[1].jpg. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\chrome-new[1].jpg. ")) returned 1 [0126.294] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\css[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\css[2].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\css[2].txt. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\css[2].txt. ")) returned 1 [0126.304] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\fallback_728x90[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\fallback_728x90[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\fallback_728x90[1].jpg. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\fallback_728x90[1].jpg. ")) returned 1 [0126.315] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\ie8[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\ie8[1].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\ie8[1].txt. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\ie8[1].txt. ")) returned 1 [0126.325] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\Passport[1].htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\passport[1].htm"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\Passport[1].htm. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\passport[1].htm. ")) returned 1 [0126.329] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\postmessageRelay[1].htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\postmessagerelay[1].htm"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\postmessageRelay[1].htm. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\postmessagerelay[1].htm. ")) returned 1 [0126.341] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\search[1].htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\search[1].htm"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\search[1].htm. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\search[1].htm. ")) returned 1 [0126.359] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\000000929096[1].gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\000000929096[1].gif"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\000000929096[1].gif. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\000000929096[1].gif. ")) returned 1 [0126.362] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA3e1oO[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aa3e1oo[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA3e1oO[1].png. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aa3e1oo[1].png. ")) returned 1 [0126.371] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA429NP[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aa429np[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA429NP[1].png. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aa429np[1].png. ")) returned 1 [0126.383] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA42pjY[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aa42pjy[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA42pjY[1].png. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aa42pjy[1].png. ")) returned 1 [0126.394] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA61AKN[2].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aa61akn[2].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA61AKN[2].png. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aa61akn[2].png. ")) returned 1 [0126.399] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA6KizP[2].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aa6kizp[2].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA6KizP[2].png. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aa6kizp[2].png. ")) returned 1 [0126.413] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA7XCQ3[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aa7xcq3[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA7XCQ3[1].png. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aa7xcq3[1].png. ")) returned 1 [0126.546] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA8Tave[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aa8tave[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA8Tave[1].png. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aa8tave[1].png. ")) returned 1 [0126.557] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AAfOIDq[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aafoidq[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AAfOIDq[1].png. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aafoidq[1].png. ")) returned 1 [0126.564] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AAkhMz9[2].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aakhmz9[2].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AAkhMz9[2].png. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aakhmz9[2].png. ")) returned 1 [0126.567] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AAmRY2Q[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aamry2q[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AAmRY2Q[1].png. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aamry2q[1].png. ")) returned 1 [0126.576] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AAni8qk[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aani8qk[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AAni8qk[1].png. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aani8qk[1].png. ")) returned 1 [0126.585] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\async_usersync[1].htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\async_usersync[1].htm"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\async_usersync[1].htm. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\async_usersync[1].htm. ")) returned 1 [0126.591] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\b367c075-d98a-457d-b37d-3d9e8ab53e8b[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\b367c075-d98a-457d-b37d-3d9e8ab53e8b[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\b367c075-d98a-457d-b37d-3d9e8ab53e8b[1].jpg. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\b367c075-d98a-457d-b37d-3d9e8ab53e8b[1].jpg. ")) returned 1 [0126.594] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BB8jcOr[2].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bb8jcor[2].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BB8jcOr[2].png. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bb8jcor[2].png. ")) returned 1 [0126.608] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBB8ZbM[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbb8zbm[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBB8ZbM[1].jpg. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbb8zbm[1].jpg. ")) returned 1 [0126.620] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBB9wH0[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbb9wh0[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBB9wH0[1].png. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbb9wh0[1].png. ")) returned 1 [0126.623] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBCFjo[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbcfjo[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBCFjo[1].jpg. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbcfjo[1].jpg. ")) returned 1 [0126.625] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBDtcM[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbdtcm[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBDtcM[1].jpg. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbdtcm[1].jpg. ")) returned 1 [0126.628] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBIeNJ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbienj[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBIeNJ[1].jpg. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbienj[1].jpg. ")) returned 1 [0126.631] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBImKX[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbimkx[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBImKX[1].jpg. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbimkx[1].jpg. ")) returned 1 [0126.643] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBL4R9[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbl4r9[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBL4R9[1].jpg. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbl4r9[1].jpg. ")) returned 1 [0126.651] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBLhTZ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbblhtz[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBLhTZ[1].jpg. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbblhtz[1].jpg. ")) returned 1 [0126.657] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBnhZY[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbnhzy[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBnhZY[1].jpg. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbnhzy[1].jpg. ")) returned 1 [0126.660] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBPhAr[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbphar[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBPhAr[1].jpg. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbphar[1].jpg. ")) returned 1 [0126.673] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBPiby[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbpiby[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBPiby[1].jpg. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbpiby[1].jpg. ")) returned 1 [0126.683] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBPmXJ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbpmxj[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBPmXJ[1].jpg. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbpmxj[1].jpg. ")) returned 1 [0126.697] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBPS37[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbps37[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBPS37[1].png. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbps37[1].png. ")) returned 1 [0126.718] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBQiBF[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbqibf[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBQiBF[1].jpg. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbqibf[1].jpg. ")) returned 1 [0126.722] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBty8h[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbty8h[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBty8h[1].jpg. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbty8h[1].jpg. ")) returned 1 [0126.727] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBVACL[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbvacl[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBVACL[1].jpg. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbvacl[1].jpg. ")) returned 1 [0126.740] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBVGyR[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbvgyr[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBVGyR[1].jpg. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbvgyr[1].jpg. ")) returned 1 [0126.743] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBVMtX[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbvmtx[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBVMtX[1].jpg. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbvmtx[1].jpg. ")) returned 1 [0126.756] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBVYsu[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbvysu[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBVYsu[1].jpg. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbvysu[1].jpg. ")) returned 1 [0126.759] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBWLtW[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbwltw[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBWLtW[1].jpg. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbwltw[1].jpg. ")) returned 1 [0126.768] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBX3xB[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbx3xb[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBX3xB[1].jpg. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbx3xb[1].jpg. ")) returned 1 [0126.771] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBY98e[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbby98e[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBY98e[1].jpg. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbby98e[1].jpg. ")) returned 1 [0126.774] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBZYVP[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbzyvp[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBZYVP[1].jpg. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbzyvp[1].jpg. ")) returned 1 [0127.568] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC04o2[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc04o2[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC04o2[1].jpg. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc04o2[1].jpg. ")) returned 1 [0127.626] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC04ok[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc04ok[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC04ok[1].jpg. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc04ok[1].jpg. ")) returned 1 [0128.073] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC04we[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc04we[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC04we[1].jpg. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc04we[1].jpg. ")) returned 1 [0128.130] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC05rl[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc05rl[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC05rl[1].jpg. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc05rl[1].jpg. ")) returned 1 [0128.133] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC05rl[2].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc05rl[2].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC05rl[2].jpg. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc05rl[2].jpg. ")) returned 1 [0128.136] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC0ATj[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc0atj[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC0ATj[1].jpg. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc0atj[1].jpg. ")) returned 1 [0128.191] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC0D8i[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc0d8i[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC0D8i[1].jpg. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc0d8i[1].jpg. ")) returned 1 [0128.257] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC0g7a[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc0g7a[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC0g7a[1].jpg. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc0g7a[1].jpg. ")) returned 1 [0128.728] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC0w1b[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc0w1b[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC0w1b[1].jpg. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc0w1b[1].jpg. ")) returned 1 [0129.641] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC0xLt[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc0xlt[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC0xLt[1].jpg. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc0xlt[1].jpg. ")) returned 1 [0129.654] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBDWA22[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbdwa22[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBDWA22[1].jpg. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbdwa22[1].jpg. ")) returned 1 [0129.665] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBE7d3b[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbe7d3b[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBE7d3b[1].jpg. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbe7d3b[1].jpg. ")) returned 1 [0129.694] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBE85ld[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbe85ld[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBE85ld[1].jpg. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbe85ld[1].jpg. ")) returned 1 [0129.700] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEdckp[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbedckp[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEdckp[1].jpg. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbedckp[1].jpg. ")) returned 1 [0129.722] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEdMci[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbedmci[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEdMci[1].jpg. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbedmci[1].jpg. ")) returned 1 [0129.727] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEdSLV[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbedslv[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEdSLV[1].jpg. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbedslv[1].jpg. ")) returned 1 [0129.923] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEe2Pd[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbee2pd[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEe2Pd[1].jpg. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbee2pd[1].jpg. ")) returned 1 [0129.926] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEe4Oo[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbee4oo[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEe4Oo[1].png. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbee4oo[1].png. ")) returned 1 [0129.945] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEe6Ew[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbee6ew[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEe6Ew[1].jpg. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbee6ew[1].jpg. ")) returned 1 [0129.966] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEeFp3[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbeefp3[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEeFp3[1].jpg. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbeefp3[1].jpg. ")) returned 1 [0129.978] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEeGwU[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbeegwu[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEeGwU[1].jpg. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbeegwu[1].jpg. ")) returned 1 [0130.006] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEeUg0[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbeeug0[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEeUg0[1].jpg. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbeeug0[1].jpg. ")) returned 1 [0130.021] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEeZnr[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbeeznr[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEeZnr[1].jpg. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbeeznr[1].jpg. ")) returned 1 [0130.031] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEf5Lq[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbef5lq[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEf5Lq[1].jpg. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbef5lq[1].jpg. ")) returned 1 [0130.044] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEfwtU[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbefwtu[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEfwtU[1].jpg. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbefwtu[1].jpg. ")) returned 1 [0130.054] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEfzSd[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbefzsd[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEfzSd[1].jpg. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbefzsd[1].jpg. ")) returned 1 [0130.057] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgCuQ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbegcuq[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgCuQ[1].jpg. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbegcuq[1].jpg. ")) returned 1 [0130.059] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgHzB[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbeghzb[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgHzB[1].jpg. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbeghzb[1].jpg. ")) returned 1 [0130.088] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgIl2[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbegil2[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgIl2[1].jpg. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbegil2[1].jpg. ")) returned 1 [0130.102] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgIl2[2].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbegil2[2].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgIl2[2].jpg. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbegil2[2].jpg. ")) returned 1 [0130.104] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgIyL[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbegiyl[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgIyL[1].jpg. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbegiyl[1].jpg. ")) returned 1 [0130.121] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgkY6[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbegky6[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgkY6[1].jpg. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbegky6[1].jpg. ")) returned 1 [0130.124] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgLzV[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbeglzv[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgLzV[1].jpg. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbeglzv[1].jpg. ")) returned 1 [0130.132] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgUri[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbeguri[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgUri[1].jpg. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbeguri[1].jpg. ")) returned 1 [0130.141] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgXBv[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbegxbv[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgXBv[1].jpg. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbegxbv[1].jpg. ")) returned 1 [0130.151] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgZME[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbegzme[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgZME[1].jpg. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbegzme[1].jpg. ")) returned 1 [0130.159] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBghfVy[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbghfvy[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBghfVy[1].png. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbghfvy[1].png. ")) returned 1 [0130.166] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBkwUr[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbkwur[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBkwUr[1].png. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbkwur[1].png. ")) returned 1 [0130.173] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBlBV0U[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bblbv0u[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBlBV0U[1].png. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bblbv0u[1].png. ")) returned 1 [0130.192] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBzhWWE[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbzhwwe[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBzhWWE[1].jpg. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbzhwwe[1].jpg. ")) returned 1 [0130.210] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\benefits-2[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\benefits-2[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\benefits-2[1].jpg. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\benefits-2[1].jpg. ")) returned 1 [0130.219] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\benefits-4[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\benefits-4[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\benefits-4[1].jpg. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\benefits-4[1].jpg. ")) returned 1 [0130.241] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\browser[1].htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\browser[1].htm"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\browser[1].htm. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\browser[1].htm. ")) returned 1 [0130.243] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\collect[1].gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\collect[1].gif"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\collect[1].gif. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\collect[1].gif. ")) returned 1 [0130.244] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\e151e5[1].gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\e151e5[1].gif"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\e151e5[1].gif. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\e151e5[1].gif. ")) returned 1 [0130.269] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\e4-190963-91cdfbc1[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\e4-190963-91cdfbc1[1].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\e4-190963-91cdfbc1[1].txt. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\e4-190963-91cdfbc1[1].txt. ")) returned 1 [0130.272] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\eula_text[1].htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\eula_text[1].htm"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\eula_text[1].htm. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\eula_text[1].htm. ")) returned 1 [0130.299] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\f[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\f[1].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\f[1].txt. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\f[1].txt. ")) returned 1 [0130.527] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\google_plus_16dp[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\google_plus_16dp[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\google_plus_16dp[1].png. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\google_plus_16dp[1].png. ")) returned 1 [0130.534] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\index[1].htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\index[1].htm"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\index[1].htm. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\index[1].htm. ")) returned 1 [0130.539] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\print[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\print[1].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\print[1].txt. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\print[1].txt. ")) returned 1 [0130.892] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\tecjslog[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\tecjslog[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\tecjslog[1].png. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\tecjslog[1].png. ")) returned 1 [0131.274] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\19619569[1].gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\19619569[1].gif"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\19619569[1].gif. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\19619569[1].gif. ")) returned 1 [0131.277] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA3DGHW[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aa3dghw[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA3DGHW[1].png. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aa3dghw[1].png. ")) returned 1 [0131.281] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA3e1pt[2].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aa3e1pt[2].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA3e1pt[2].png. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aa3e1pt[2].png. ")) returned 1 [0131.282] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA42ckd[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aa42ckd[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA42ckd[1].png. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aa42ckd[1].png. ")) returned 1 [0131.378] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA42eYr[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aa42eyr[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA42eYr[1].png. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aa42eyr[1].png. ")) returned 1 [0131.562] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA61ILp[2].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aa61ilp[2].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA61ILp[2].png. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aa61ilp[2].png. ")) returned 1 [0131.564] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA6SNZ6[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aa6snz6[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA6SNZ6[1].png. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aa6snz6[1].png. ")) returned 1 [0131.788] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAbyinC[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aabyinc[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAbyinC[1].png. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aabyinc[1].png. ")) returned 1 [0131.875] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAicW5W[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aaicw5w[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAicW5W[1].jpg. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aaicw5w[1].jpg. ")) returned 1 [0132.193] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAj0doQ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aaj0doq[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAj0doQ[1].jpg. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aaj0doq[1].jpg. ")) returned 1 [0132.195] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAkqhIf[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aakqhif[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAkqhIf[1].png. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aakqhif[1].png. ")) returned 1 [0132.282] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAmo09p[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aamo09p[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAmo09p[1].jpg. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aamo09p[1].jpg. ")) returned 1 [0132.288] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAmUyV2[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aamuyv2[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAmUyV2[1].png. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aamuyv2[1].png. ")) returned 1 [0132.302] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAn7gKR[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aan7gkr[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAn7gKR[1].png. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aan7gkr[1].png. ")) returned 1 [0132.318] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\activityi;src=2542116;type=clien612;cat=chrom0;ord=1;num=7814394060213[1].htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\activityi;src=2542116;type=clien612;cat=chrom0;ord=1;num=7814394060213[1].htm"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\activityi;src=2542116;type=clien612;cat=chrom0;ord=1;num=7814394060213[1].htm. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\activityi;src=2542116;type=clien612;cat=chrom0;ord=1;num=7814394060213[1].htm. ")) returned 1 [0132.330] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BB5zDwX[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bb5zdwx[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BB5zDwX[1].png. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bb5zdwx[1].png. ")) returned 1 [0132.386] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBaK3Nm[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbak3nm[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBaK3Nm[1].png. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbak3nm[1].png. ")) returned 1 [0132.389] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBLcCz[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbblccz[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBLcCz[1].jpg. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbblccz[1].jpg. ")) returned 1 [0132.421] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBLdzQ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbldzq[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBLdzQ[1].jpg. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbldzq[1].jpg. ")) returned 1 [0132.424] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBO1mQ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbo1mq[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBO1mQ[1].jpg. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbo1mq[1].jpg. ")) returned 1 [0132.535] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBO1qB[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbo1qb[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBO1qB[1].jpg. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbo1qb[1].jpg. ")) returned 1 [0132.558] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBOIAt[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbboiat[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBOIAt[1].jpg. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbboiat[1].jpg. ")) returned 1 [0132.593] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBOmuh[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbomuh[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBOmuh[1].jpg. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbomuh[1].jpg. ")) returned 1 [0132.630] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBPK5J[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbpk5j[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBPK5J[1].jpg. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbpk5j[1].jpg. ")) returned 1 [0132.641] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBPMvJ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbpmvj[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBPMvJ[1].jpg. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbpmvj[1].jpg. ")) returned 1 [0132.647] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBUL3E[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbul3e[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBUL3E[1].jpg. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbul3e[1].jpg. ")) returned 1 [0132.657] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBUqkT[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbuqkt[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBUqkT[1].jpg. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbuqkt[1].jpg. ")) returned 1 [0132.665] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBUqkT[2].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbuqkt[2].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBUqkT[2].jpg. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbuqkt[2].jpg. ")) returned 1 [0132.671] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBX3z0[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbx3z0[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBX3z0[1].jpg. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbx3z0[1].jpg. ")) returned 1 [0132.674] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBYEW1[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbyew1[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBYEW1[1].jpg. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbyew1[1].jpg. ")) returned 1 [0132.676] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBYfEH[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbyfeh[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBYfEH[1].jpg. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbyfeh[1].jpg. ")) returned 1 [0132.689] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBZ20W[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbz20w[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBZ20W[1].jpg. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbz20w[1].jpg. ")) returned 1 [0132.693] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBzaxY[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbzaxy[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBzaxY[1].jpg. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbzaxy[1].jpg. ")) returned 1 [0132.700] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBZzuz[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbzzuz[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBZzuz[1].jpg. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbzzuz[1].jpg. ")) returned 1 [0132.707] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC03B1[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc03b1[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC03B1[1].jpg. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc03b1[1].jpg. ")) returned 1 [0132.720] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC04o2[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc04o2[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC04o2[1].jpg. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc04o2[1].jpg. ")) returned 1 [0132.723] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC06ZQ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc06zq[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC06ZQ[1].jpg. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc06zq[1].jpg. ")) returned 1 [0132.725] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0ALC[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc0alc[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0ALC[1].jpg. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc0alc[1].jpg. ")) returned 1 [0132.910] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0BiZ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc0biz[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0BiZ[1].jpg. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc0biz[1].jpg. ")) returned 1 [0132.921] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0FXU[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc0fxu[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0FXU[1].jpg. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc0fxu[1].jpg. ")) returned 1 [0132.931] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0FXU[2].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc0fxu[2].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0FXU[2].jpg. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc0fxu[2].jpg. ")) returned 1 [0132.938] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0mkg[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc0mkg[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0mkg[1].jpg. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc0mkg[1].jpg. ")) returned 1 [0132.942] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0mkg[2].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc0mkg[2].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0mkg[2].jpg. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc0mkg[2].jpg. ")) returned 1 [0132.961] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0oQi[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc0oqi[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0oQi[1].jpg. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc0oqi[1].jpg. ")) returned 1 [0133.039] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0tCi[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc0tci[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0tCi[1].jpg. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc0tci[1].jpg. ")) returned 1 [0133.094] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBCM2U2[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbcm2u2[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBCM2U2[1].jpg. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbcm2u2[1].jpg. ")) returned 1 [0133.122] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBDGTbx[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbdgtbx[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBDGTbx[1].jpg. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbdgtbx[1].jpg. ")) returned 1 [0133.128] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBDk44m[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbdk44m[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBDk44m[1].png. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbdk44m[1].png. ")) returned 1 [0133.147] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBDWXoC[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbdwxoc[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBDWXoC[1].jpg. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbdwxoc[1].jpg. ")) returned 1 [0133.150] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBE3NcH[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbe3nch[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBE3NcH[1].jpg. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbe3nch[1].jpg. ")) returned 1 [0133.153] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBE7GLE[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbe7gle[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBE7GLE[1].png. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbe7gle[1].png. ")) returned 1 [0133.180] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBE8aLO[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbe8alo[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBE8aLO[1].jpg. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbe8alo[1].jpg. ")) returned 1 [0133.204] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEd5bF[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbed5bf[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEd5bF[1].jpg. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbed5bf[1].jpg. ")) returned 1 [0133.207] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEdDNm[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbeddnm[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEdDNm[1].jpg. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbeddnm[1].jpg. ")) returned 1 [0133.247] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEdpyr[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbedpyr[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEdpyr[1].jpg. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbedpyr[1].jpg. ")) returned 1 [0133.250] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEdQdv[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbedqdv[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEdQdv[1].jpg. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbedqdv[1].jpg. ")) returned 1 [0133.266] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEe62t[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbee62t[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEe62t[1].jpg. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbee62t[1].jpg. ")) returned 1 [0133.560] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEedPR[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbeedpr[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEedPR[1].jpg. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbeedpr[1].jpg. ")) returned 1 [0133.624] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEeTpB[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbeetpb[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEeTpB[1].jpg. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbeetpb[1].jpg. ")) returned 1 [0133.706] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEeTuf[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbeetuf[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEeTuf[1].jpg. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbeetuf[1].jpg. ")) returned 1 [0134.009] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEeU5U[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbeeu5u[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEeU5U[1].jpg. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbeeu5u[1].jpg. ")) returned 1 [0134.054] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEf306[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbef306[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEf306[1].jpg. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbef306[1].jpg. ")) returned 1 [0134.067] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEf54R[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbef54r[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEf54R[1].jpg. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbef54r[1].jpg. ")) returned 1 [0134.070] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfBbH[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbefbbh[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfBbH[1].jpg. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbefbbh[1].jpg. ")) returned 1 [0134.088] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfBq0[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbefbq0[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfBq0[1].jpg. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbefbq0[1].jpg. ")) returned 1 [0134.109] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfBrz[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbefbrz[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfBrz[1].jpg. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbefbrz[1].jpg. ")) returned 1 [0134.158] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfXl6[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbefxl6[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfXl6[1].jpg. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbefxl6[1].jpg. ")) returned 1 [0134.161] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEgEH3[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbegeh3[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEgEH3[1].jpg. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbegeh3[1].jpg. ")) returned 1 [0134.233] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEgsz3[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbegsz3[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEgsz3[1].jpg. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbegsz3[1].jpg. ")) returned 1 [0134.740] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEgTxB[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbegtxb[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEgTxB[1].jpg. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbegtxb[1].jpg. ")) returned 1 [0134.924] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBo1lFJ[2].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbo1lfj[2].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBo1lFJ[2].png. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbo1lfj[2].png. ")) returned 1 [0134.937] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBs47TE[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbs47te[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBs47TE[1].png. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbs47te[1].png. ")) returned 1 [0134.945] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBu9sWQ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbu9swq[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBu9sWQ[1].jpg. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbu9swq[1].jpg. ")) returned 1 [0134.953] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BByazif[2].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbyazif[2].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BByazif[2].jpg. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbyazif[2].jpg. ")) returned 1 [0135.035] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\c7-bdbd0d-91cdfbc1[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\c7-bdbd0d-91cdfbc1[1].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\c7-bdbd0d-91cdfbc1[1].txt. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\c7-bdbd0d-91cdfbc1[1].txt. ")) returned 1 [0135.038] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\chrome_throbber_fast_16[1].gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\chrome_throbber_fast_16[1].gif"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\chrome_throbber_fast_16[1].gif. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\chrome_throbber_fast_16[1].gif. ")) returned 1 [0135.039] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\collect[1].gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\collect[1].gif"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\collect[1].gif. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\collect[1].gif. ")) returned 1 [0135.126] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\eula-mac[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\eula-mac[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\eula-mac[1].jpg. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\eula-mac[1].jpg. ")) returned 1 [0135.131] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\tecjslog[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\tecjslog[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\tecjslog[1].png. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\tecjslog[1].png. ")) returned 1 [0135.168] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\thankyou[1].htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\thankyou[1].htm"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\thankyou[1].htm. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\thankyou[1].htm. ")) returned 1 [0135.207] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\th[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\th[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\th[1].jpg. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\th[1].jpg. ")) returned 1 [0135.385] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\0ff92924-f857-491e-a2ee-c0fe20f0d064[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\0ff92924-f857-491e-a2ee-c0fe20f0d064[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\0ff92924-f857-491e-a2ee-c0fe20f0d064[1].jpg. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\0ff92924-f857-491e-a2ee-c0fe20f0d064[1].jpg. ")) returned 1 [0135.547] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\26158[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\26158[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\26158[1].png. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\26158[1].png. ")) returned 1 [0135.629] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA42x3V[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aa42x3v[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA42x3V[1].png. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aa42x3v[1].png. ")) returned 1 [0135.638] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA58NQj[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aa58nqj[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA58NQj[1].png. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aa58nqj[1].png. ")) returned 1 [0135.641] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA61Ofl[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aa61ofl[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA61Ofl[1].png. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aa61ofl[1].png. ")) returned 1 [0135.655] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA6SFRQ[2].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aa6sfrq[2].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA6SFRQ[2].png. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aa6sfrq[2].png. ")) returned 1 [0135.687] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAa1vhm[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aaa1vhm[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAa1vhm[1].png. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aaa1vhm[1].png. ")) returned 1 [0135.690] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAa1xJF[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aaa1xjf[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAa1xJF[1].png. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aaa1xjf[1].png. ")) returned 1 [0135.752] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAlG41q[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aalg41q[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAlG41q[1].jpg. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aalg41q[1].jpg. ")) returned 1 [0135.894] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAmin0Z[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aamin0z[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAmin0Z[1].png. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aamin0z[1].png. ")) returned 1 [0135.897] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAnhRyj[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aanhryj[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAnhRyj[1].jpg. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aanhryj[1].jpg. ")) returned 1 [0135.943] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\activityi;src=2542116;cat=Chrom00;type=clien612;ord=2366422437621[1].htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\activityi;src=2542116;cat=chrom00;type=clien612;ord=2366422437621[1].htm"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\activityi;src=2542116;cat=Chrom00;type=clien612;ord=2366422437621[1].htm. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\activityi;src=2542116;cat=chrom00;type=clien612;ord=2366422437621[1].htm. ")) returned 1 [0136.100] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ae8e984b-1820-4a8d-93dc-392ed6563fb6[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\ae8e984b-1820-4a8d-93dc-392ed6563fb6[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ae8e984b-1820-4a8d-93dc-392ed6563fb6[1].jpg. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\ae8e984b-1820-4a8d-93dc-392ed6563fb6[1].jpg. ")) returned 1 [0136.266] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BB56XTo[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bb56xto[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BB56XTo[1].png. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bb56xto[1].png. ")) returned 1 [0136.388] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BB5vO0g[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bb5vo0g[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BB5vO0g[1].png. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bb5vo0g[1].png. ")) returned 1 [0136.492] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BB8AdqN[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bb8adqn[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BB8AdqN[1].png. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bb8adqn[1].png. ")) returned 1 [0136.540] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBALZyp[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbalzyp[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBALZyp[1].jpg. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbalzyp[1].jpg. ")) returned 1 [0136.672] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBImKp[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbimkp[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBImKp[1].jpg. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbimkp[1].jpg. ")) returned 1 [0136.759] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMGJo[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbmgjo[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMGJo[1].jpg. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbmgjo[1].jpg. ")) returned 1 [0136.843] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMKDF[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbmkdf[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMKDF[1].jpg. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbmkdf[1].jpg. ")) returned 1 [0136.969] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMQch[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbmqch[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMQch[1].jpg. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbmqch[1].jpg. ")) returned 1 [0137.243] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMyVh[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbmyvh[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMyVh[1].jpg. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbmyvh[1].jpg. ")) returned 1 [0137.246] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBNAf7[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbnaf7[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBNAf7[1].jpg. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbnaf7[1].jpg. ")) returned 1 [0137.283] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBNnTF[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbnntf[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBNnTF[1].jpg. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbnntf[1].jpg. ")) returned 1 [0137.569] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBO4dZ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbo4dz[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBO4dZ[1].jpg. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbo4dz[1].jpg. ")) returned 1 [0137.585] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBO8ow[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbo8ow[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBO8ow[1].jpg. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbo8ow[1].jpg. ")) returned 1 [0137.588] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOaeS[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbboaes[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOaeS[1].jpg. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbboaes[1].jpg. ")) returned 1 [0137.590] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOcIb[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbocib[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOcIb[1].jpg. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbocib[1].jpg. ")) returned 1 [0137.683] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOddp[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbboddp[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOddp[1].jpg. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbboddp[1].jpg. ")) returned 1 [0137.687] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOmar[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbomar[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOmar[1].jpg. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbomar[1].jpg. ")) returned 1 [0137.702] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBR4yQ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbr4yq[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBR4yQ[1].jpg. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbr4yq[1].jpg. ")) returned 1 [0137.791] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBUPaj[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbupaj[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBUPaj[1].jpg. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbupaj[1].jpg. ")) returned 1 [0137.794] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBVEOW[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbveow[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBVEOW[1].jpg. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbveow[1].jpg. ")) returned 1 [0137.820] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBVLcG[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbvlcg[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBVLcG[1].jpg. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbvlcg[1].jpg. ")) returned 1 [0138.296] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBVSkP[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbvskp[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBVSkP[1].jpg. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbvskp[1].jpg. ")) returned 1 [0138.470] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBYfEH[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbyfeh[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBYfEH[1].jpg. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbyfeh[1].jpg. ")) returned 1 [0138.475] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBZ5vT[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbz5vt[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBZ5vT[1].jpg. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbz5vt[1].jpg. ")) returned 1 [0138.481] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC02Gr[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc02gr[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC02Gr[1].jpg. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc02gr[1].jpg. ")) returned 1 [0138.518] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC02Gr[2].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc02gr[2].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC02Gr[2].jpg. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc02gr[2].jpg. ")) returned 1 [0138.619] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC03B1[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc03b1[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC03B1[1].jpg. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc03b1[1].jpg. ")) returned 1 [0138.876] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC06Ub[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc06ub[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC06Ub[1].jpg. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc06ub[1].jpg. ")) returned 1 [0138.884] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0Djg[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc0djg[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0Djg[1].jpg. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc0djg[1].jpg. ")) returned 1 [0138.888] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0g7a[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc0g7a[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0g7a[1].jpg. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc0g7a[1].jpg. ")) returned 1 [0138.893] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0lf2[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc0lf2[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0lf2[1].jpg. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc0lf2[1].jpg. ")) returned 1 [0138.895] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0mK1[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc0mk1[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0mK1[1].jpg. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc0mk1[1].jpg. ")) returned 1 [0139.034] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0qlB[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc0qlb[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0qlB[1].jpg. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc0qlb[1].jpg. ")) returned 1 [0139.071] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE7KPZ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbe7kpz[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE7KPZ[1].jpg. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbe7kpz[1].jpg. ")) returned 1 [0139.124] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE8IlA[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbe8ila[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE8IlA[1].jpg. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbe8ila[1].jpg. ")) returned 1 [0139.157] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE972F[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbe972f[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE972F[1].jpg. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbe972f[1].jpg. ")) returned 1 [0139.191] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE9tdx[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbe9tdx[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE9tdx[1].jpg. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbe9tdx[1].jpg. ")) returned 1 [0139.194] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEdrqt[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbedrqt[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEdrqt[1].jpg. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbedrqt[1].jpg. ")) returned 1 [0139.248] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeEwt[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbeeewt[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeEwt[1].jpg. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbeeewt[1].jpg. ")) returned 1 [0139.328] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeis3[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbeeis3[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeis3[1].jpg. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbeeis3[1].jpg. ")) returned 1 [0139.335] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeKvV[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbeekvv[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeKvV[1].jpg. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbeekvv[1].jpg. ")) returned 1 [0139.347] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeNd8[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbeend8[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeNd8[1].png. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbeend8[1].png. ")) returned 1 [0139.361] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEewZB[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbeewzb[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEewZB[1].jpg. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbeewzb[1].jpg. ")) returned 1 [0139.747] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeZ0k[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbeez0k[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeZ0k[1].jpg. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbeez0k[1].jpg. ")) returned 1 [0139.765] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEf6s4[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbef6s4[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEf6s4[1].jpg. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbef6s4[1].jpg. ")) returned 1 [0139.778] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfAc5[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbefac5[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfAc5[1].jpg. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbefac5[1].jpg. ")) returned 1 [0139.794] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfgDi[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbefgdi[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfgDi[1].jpg. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbefgdi[1].jpg. ")) returned 1 [0139.809] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfjuT[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbefjut[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfjuT[1].jpg. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbefjut[1].jpg. ")) returned 1 [0140.068] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfkgi[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbefkgi[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfkgi[1].jpg. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbefkgi[1].jpg. ")) returned 1 [0140.304] SetFileTime (hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0140.305] CloseHandle (hObject=0xa4) returned 1 [0140.305] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfRKA[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbefrka[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfRKA[1].jpg. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbefrka[1].jpg. ")) returned 1 [0140.309] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfRwv[1].jpg", pszSpec="*.zip") returned 0 [0140.309] lstrlenA (lpString="*.zip") returned 5 [0140.309] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfRwv[1].jpg", pszSpec="*.rar") returned 0 [0140.309] lstrlenA (lpString="*.rar") returned 5 [0140.309] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfRwv[1].jpg", pszSpec="*.7z") returned 0 [0140.309] lstrlenA (lpString="*.7z") returned 4 [0140.309] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfRwv[1].jpg", pszSpec="*.tar") returned 0 [0140.309] lstrlenA (lpString="*.tar") returned 5 [0140.309] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfRwv[1].jpg", pszSpec="*.gzip") returned 0 [0140.310] lstrlenA (lpString="*.gzip") returned 6 [0140.310] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfRwv[1].jpg", pszSpec="*.jpg") returned 1 [0140.310] lstrlenA (lpString="*.jpg") returned 5 [0140.310] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfRwv[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfRwv[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfRwv[1].jpg" [0140.310] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfRwv[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfRwv[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfRwv[1].jpg" [0140.310] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfRwv[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbefrwv[1].jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa4 [0140.311] GetFileSize (in: hFile=0xa4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2b6c [0140.312] GetFileTime (in: hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x4574c090, dwHighDateTime=0x1d2faf3), lpLastAccessTime=0x407536*(dwLowDateTime=0x4574c090, dwHighDateTime=0x1d2faf3), lpLastWriteTime=0x40753e*(dwLowDateTime=0x457721f0, dwHighDateTime=0x1d2faf3)) returned 1 [0140.312] SetFilePointer (in: hFile=0xa4, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0140.312] ReadFile (in: hFile=0xa4, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x2b12, lpOverlapped=0x0) returned 1 [0140.320] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfRwv[1].jpg") returned="BBEfRwv[1].jpg" [0140.320] SetFilePointer (in: hFile=0xa4, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0140.320] WriteFile (in: hFile=0xa4, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x2b12, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x2b12, lpOverlapped=0x0) returned 1 [0140.320] SetFileTime (hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0140.321] CloseHandle (hObject=0xa4) returned 1 [0140.321] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfRwv[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbefrwv[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfRwv[1].jpg. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbefrwv[1].jpg. ")) returned 1 [0140.322] FindNextFileA (in: hFindFile=0x5be3a0, lpFindFileData=0xaea68 | out: lpFindFileData=0xaea68) returned 1 [0140.323] PeekMessageA (in: lpMsg=0xaea44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaea44) returned 0 [0140.323] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BBEfwtU[1].jpg") returned 1 [0140.323] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BBEfwtU[1].jpg") returned 1 [0140.323] lstrcmpiA (lpString1="", lpString2="BBEfwtU[1].jpg") returned -1 [0140.323] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfRwv[1].jpg") returned="BBEfRwv[1].jpg" [0140.323] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\", lpString2="BBEfwtU[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfwtU[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfwtU[1].jpg" [0140.323] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfwtU[1].jpg", pszSpec="*.zip") returned 0 [0140.323] lstrlenA (lpString="*.zip") returned 5 [0140.323] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfwtU[1].jpg", pszSpec="*.rar") returned 0 [0140.323] lstrlenA (lpString="*.rar") returned 5 [0140.323] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfwtU[1].jpg", pszSpec="*.7z") returned 0 [0140.323] lstrlenA (lpString="*.7z") returned 4 [0140.323] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfwtU[1].jpg", pszSpec="*.tar") returned 0 [0140.323] lstrlenA (lpString="*.tar") returned 5 [0140.323] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfwtU[1].jpg", pszSpec="*.gzip") returned 0 [0140.323] lstrlenA (lpString="*.gzip") returned 6 [0140.323] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfwtU[1].jpg", pszSpec="*.jpg") returned 1 [0140.323] lstrlenA (lpString="*.jpg") returned 5 [0140.323] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfwtU[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfwtU[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfwtU[1].jpg" [0140.323] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfwtU[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfwtU[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfwtU[1].jpg" [0140.323] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfwtU[1].jpg", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfwtU[1].jpg.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfwtU[1].jpg." [0140.323] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfwtU[1].jpg.", lpString2="\xa0" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfwtU[1].jpg. ") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfwtU[1].jpg. " [0140.323] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfwtU[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbefwtu[1].jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa4 [0140.326] GetFileSize (in: hFile=0xa4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2676 [0140.326] GetFileTime (in: hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x45478670, dwHighDateTime=0x1d2faf3), lpLastAccessTime=0x407536*(dwLowDateTime=0x45478670, dwHighDateTime=0x1d2faf3), lpLastWriteTime=0x40753e*(dwLowDateTime=0x45478670, dwHighDateTime=0x1d2faf3)) returned 1 [0140.326] SetFilePointer (in: hFile=0xa4, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0140.326] ReadFile (in: hFile=0xa4, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x261c, lpOverlapped=0x0) returned 1 [0140.330] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfwtU[1].jpg") returned="BBEfwtU[1].jpg" [0140.330] SetFilePointer (in: hFile=0xa4, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0140.330] WriteFile (in: hFile=0xa4, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x261c, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x261c, lpOverlapped=0x0) returned 1 [0140.330] SetFileTime (hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0140.331] CloseHandle (hObject=0xa4) returned 1 [0140.331] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfwtU[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbefwtu[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfwtU[1].jpg. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbefwtu[1].jpg. ")) returned 1 [0140.332] FindNextFileA (in: hFindFile=0x5be3a0, lpFindFileData=0xaea68 | out: lpFindFileData=0xaea68) returned 1 [0140.332] PeekMessageA (in: lpMsg=0xaea44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaea44) returned 0 [0140.332] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BBEfY4X[1].jpg") returned 1 [0140.332] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BBEfY4X[1].jpg") returned 1 [0140.332] lstrcmpiA (lpString1="", lpString2="BBEfY4X[1].jpg") returned -1 [0140.332] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfwtU[1].jpg") returned="BBEfwtU[1].jpg" [0140.332] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\", lpString2="BBEfY4X[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfY4X[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfY4X[1].jpg" [0140.332] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfY4X[1].jpg", pszSpec="*.zip") returned 0 [0140.332] lstrlenA (lpString="*.zip") returned 5 [0140.332] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfY4X[1].jpg", pszSpec="*.rar") returned 0 [0140.332] lstrlenA (lpString="*.rar") returned 5 [0140.332] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfY4X[1].jpg", pszSpec="*.7z") returned 0 [0140.333] lstrlenA (lpString="*.7z") returned 4 [0140.333] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfY4X[1].jpg", pszSpec="*.tar") returned 0 [0140.333] lstrlenA (lpString="*.tar") returned 5 [0140.333] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfY4X[1].jpg", pszSpec="*.gzip") returned 0 [0140.333] lstrlenA (lpString="*.gzip") returned 6 [0140.333] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfY4X[1].jpg", pszSpec="*.jpg") returned 1 [0140.333] lstrlenA (lpString="*.jpg") returned 5 [0140.333] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfY4X[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfY4X[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfY4X[1].jpg" [0140.333] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfY4X[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfY4X[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfY4X[1].jpg" [0140.333] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfY4X[1].jpg", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfY4X[1].jpg.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfY4X[1].jpg." [0140.333] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfY4X[1].jpg.", lpString2="\xa0" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfY4X[1].jpg. ") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfY4X[1].jpg. " [0140.333] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfY4X[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbefy4x[1].jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa4 [0140.334] GetFileSize (in: hFile=0xa4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb41 [0140.334] GetFileTime (in: hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x45856a30, dwHighDateTime=0x1d2faf3), lpLastAccessTime=0x407536*(dwLowDateTime=0x45856a30, dwHighDateTime=0x1d2faf3), lpLastWriteTime=0x40753e*(dwLowDateTime=0x45856a30, dwHighDateTime=0x1d2faf3)) returned 1 [0140.334] SetFilePointer (in: hFile=0xa4, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0140.334] ReadFile (in: hFile=0xa4, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0xae7, lpOverlapped=0x0) returned 1 [0140.342] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfY4X[1].jpg") returned="BBEfY4X[1].jpg" [0140.342] SetFilePointer (in: hFile=0xa4, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0140.342] WriteFile (in: hFile=0xa4, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0xae7, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0xae7, lpOverlapped=0x0) returned 1 [0140.342] SetFileTime (hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0140.342] CloseHandle (hObject=0xa4) returned 1 [0140.342] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfY4X[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbefy4x[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfY4X[1].jpg. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbefy4x[1].jpg. ")) returned 1 [0140.344] FindNextFileA (in: hFindFile=0x5be3a0, lpFindFileData=0xaea68 | out: lpFindFileData=0xaea68) returned 1 [0140.344] PeekMessageA (in: lpMsg=0xaea44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaea44) returned 0 [0140.344] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BBEgD9f[1].jpg") returned 1 [0140.344] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BBEgD9f[1].jpg") returned 1 [0140.344] lstrcmpiA (lpString1="", lpString2="BBEgD9f[1].jpg") returned -1 [0140.344] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfY4X[1].jpg") returned="BBEfY4X[1].jpg" [0140.344] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\", lpString2="BBEgD9f[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgD9f[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgD9f[1].jpg" [0140.344] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgD9f[1].jpg", pszSpec="*.zip") returned 0 [0140.344] lstrlenA (lpString="*.zip") returned 5 [0140.344] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgD9f[1].jpg", pszSpec="*.rar") returned 0 [0140.344] lstrlenA (lpString="*.rar") returned 5 [0140.344] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgD9f[1].jpg", pszSpec="*.7z") returned 0 [0140.344] lstrlenA (lpString="*.7z") returned 4 [0140.344] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgD9f[1].jpg", pszSpec="*.tar") returned 0 [0140.344] lstrlenA (lpString="*.tar") returned 5 [0140.344] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgD9f[1].jpg", pszSpec="*.gzip") returned 0 [0140.344] lstrlenA (lpString="*.gzip") returned 6 [0140.344] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgD9f[1].jpg", pszSpec="*.jpg") returned 1 [0140.345] lstrlenA (lpString="*.jpg") returned 5 [0140.345] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgD9f[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgD9f[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgD9f[1].jpg" [0140.345] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgD9f[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgD9f[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgD9f[1].jpg" [0140.345] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgD9f[1].jpg", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgD9f[1].jpg.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgD9f[1].jpg." [0140.345] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgD9f[1].jpg.", lpString2="\xa0" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgD9f[1].jpg. ") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgD9f[1].jpg. " [0140.345] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgD9f[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbegd9f[1].jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa4 [0140.346] GetFileSize (in: hFile=0xa4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x25f6 [0140.346] GetFileTime (in: hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x45725f30, dwHighDateTime=0x1d2faf3), lpLastAccessTime=0x407536*(dwLowDateTime=0x45725f30, dwHighDateTime=0x1d2faf3), lpLastWriteTime=0x40753e*(dwLowDateTime=0x45725f30, dwHighDateTime=0x1d2faf3)) returned 1 [0140.346] SetFilePointer (in: hFile=0xa4, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0140.346] ReadFile (in: hFile=0xa4, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x259c, lpOverlapped=0x0) returned 1 [0140.347] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgD9f[1].jpg") returned="BBEgD9f[1].jpg" [0140.347] SetFilePointer (in: hFile=0xa4, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0140.348] WriteFile (in: hFile=0xa4, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x259c, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x259c, lpOverlapped=0x0) returned 1 [0140.348] SetFileTime (hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0140.348] CloseHandle (hObject=0xa4) returned 1 [0140.348] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgD9f[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbegd9f[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgD9f[1].jpg. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbegd9f[1].jpg. ")) returned 1 [0140.349] FindNextFileA (in: hFindFile=0x5be3a0, lpFindFileData=0xaea68 | out: lpFindFileData=0xaea68) returned 1 [0140.349] PeekMessageA (in: lpMsg=0xaea44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaea44) returned 0 [0140.349] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BBEgJfz[1].jpg") returned 1 [0140.349] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BBEgJfz[1].jpg") returned 1 [0140.349] lstrcmpiA (lpString1="", lpString2="BBEgJfz[1].jpg") returned -1 [0140.350] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgD9f[1].jpg") returned="BBEgD9f[1].jpg" [0140.350] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\", lpString2="BBEgJfz[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgJfz[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgJfz[1].jpg" [0140.350] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgJfz[1].jpg", pszSpec="*.zip") returned 0 [0140.350] lstrlenA (lpString="*.zip") returned 5 [0140.350] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgJfz[1].jpg", pszSpec="*.rar") returned 0 [0140.350] lstrlenA (lpString="*.rar") returned 5 [0140.350] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgJfz[1].jpg", pszSpec="*.7z") returned 0 [0140.350] lstrlenA (lpString="*.7z") returned 4 [0140.350] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgJfz[1].jpg", pszSpec="*.tar") returned 0 [0140.350] lstrlenA (lpString="*.tar") returned 5 [0140.350] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgJfz[1].jpg", pszSpec="*.gzip") returned 0 [0140.350] lstrlenA (lpString="*.gzip") returned 6 [0140.350] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgJfz[1].jpg", pszSpec="*.jpg") returned 1 [0140.350] lstrlenA (lpString="*.jpg") returned 5 [0140.350] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgJfz[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgJfz[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgJfz[1].jpg" [0140.350] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgJfz[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgJfz[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgJfz[1].jpg" [0140.350] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgJfz[1].jpg", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgJfz[1].jpg.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgJfz[1].jpg." [0140.351] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgJfz[1].jpg.", lpString2="\xa0" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgJfz[1].jpg. ") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgJfz[1].jpg. " [0140.351] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgJfz[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbegjfz[1].jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa4 [0140.351] GetFileSize (in: hFile=0xa4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x819 [0140.352] GetFileTime (in: hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x45ab8030, dwHighDateTime=0x1d2faf3), lpLastAccessTime=0x407536*(dwLowDateTime=0x45ab8030, dwHighDateTime=0x1d2faf3), lpLastWriteTime=0x40753e*(dwLowDateTime=0x45ab8030, dwHighDateTime=0x1d2faf3)) returned 1 [0140.352] SetFilePointer (in: hFile=0xa4, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0140.352] ReadFile (in: hFile=0xa4, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x7bf, lpOverlapped=0x0) returned 1 [0140.353] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgJfz[1].jpg") returned="BBEgJfz[1].jpg" [0140.353] SetFilePointer (in: hFile=0xa4, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0140.353] WriteFile (in: hFile=0xa4, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x7bf, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x7bf, lpOverlapped=0x0) returned 1 [0140.353] SetFileTime (hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0140.353] CloseHandle (hObject=0xa4) returned 1 [0140.353] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgJfz[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbegjfz[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgJfz[1].jpg. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbegjfz[1].jpg. ")) returned 1 [0140.354] FindNextFileA (in: hFindFile=0x5be3a0, lpFindFileData=0xaea68 | out: lpFindFileData=0xaea68) returned 1 [0140.354] PeekMessageA (in: lpMsg=0xaea44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaea44) returned 0 [0140.354] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BBEgsWA[1].jpg") returned 1 [0140.354] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BBEgsWA[1].jpg") returned 1 [0140.354] lstrcmpiA (lpString1="", lpString2="BBEgsWA[1].jpg") returned -1 [0140.354] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgJfz[1].jpg") returned="BBEgJfz[1].jpg" [0140.354] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\", lpString2="BBEgsWA[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgsWA[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgsWA[1].jpg" [0140.354] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgsWA[1].jpg", pszSpec="*.zip") returned 0 [0140.354] lstrlenA (lpString="*.zip") returned 5 [0140.354] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgsWA[1].jpg", pszSpec="*.rar") returned 0 [0140.354] lstrlenA (lpString="*.rar") returned 5 [0140.354] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgsWA[1].jpg", pszSpec="*.7z") returned 0 [0140.354] lstrlenA (lpString="*.7z") returned 4 [0140.354] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgsWA[1].jpg", pszSpec="*.tar") returned 0 [0140.354] lstrlenA (lpString="*.tar") returned 5 [0140.354] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgsWA[1].jpg", pszSpec="*.gzip") returned 0 [0140.354] lstrlenA (lpString="*.gzip") returned 6 [0140.354] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgsWA[1].jpg", pszSpec="*.jpg") returned 1 [0140.354] lstrlenA (lpString="*.jpg") returned 5 [0140.354] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgsWA[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgsWA[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgsWA[1].jpg" [0140.354] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgsWA[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgsWA[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgsWA[1].jpg" [0140.354] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgsWA[1].jpg", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgsWA[1].jpg.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgsWA[1].jpg." [0140.354] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgsWA[1].jpg.", lpString2="\xa0" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgsWA[1].jpg. ") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgsWA[1].jpg. " [0140.354] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgsWA[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbegswa[1].jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa4 [0140.355] GetFileSize (in: hFile=0xa4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x916 [0140.355] GetFileTime (in: hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x45b2a450, dwHighDateTime=0x1d2faf3), lpLastAccessTime=0x407536*(dwLowDateTime=0x45b2a450, dwHighDateTime=0x1d2faf3), lpLastWriteTime=0x40753e*(dwLowDateTime=0x45b2a450, dwHighDateTime=0x1d2faf3)) returned 1 [0140.355] SetFilePointer (in: hFile=0xa4, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0140.355] ReadFile (in: hFile=0xa4, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x8bc, lpOverlapped=0x0) returned 1 [0140.535] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgsWA[1].jpg") returned="BBEgsWA[1].jpg" [0140.535] SetFilePointer (in: hFile=0xa4, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0140.535] WriteFile (in: hFile=0xa4, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x8bc, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x8bc, lpOverlapped=0x0) returned 1 [0140.536] SetFileTime (hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0140.536] CloseHandle (hObject=0xa4) returned 1 [0140.536] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgsWA[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbegswa[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgsWA[1].jpg. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbegswa[1].jpg. ")) returned 1 [0140.568] FindNextFileA (in: hFindFile=0x5be3a0, lpFindFileData=0xaea68 | out: lpFindFileData=0xaea68) returned 1 [0140.568] PeekMessageA (in: lpMsg=0xaea44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaea44) returned 0 [0140.568] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BBEgX5G[1].jpg") returned 1 [0140.568] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BBEgX5G[1].jpg") returned 1 [0140.568] lstrcmpiA (lpString1="", lpString2="BBEgX5G[1].jpg") returned -1 [0140.569] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgsWA[1].jpg") returned="BBEgsWA[1].jpg" [0140.569] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\", lpString2="BBEgX5G[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgX5G[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgX5G[1].jpg" [0140.569] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgX5G[1].jpg", pszSpec="*.zip") returned 0 [0140.569] lstrlenA (lpString="*.zip") returned 5 [0140.569] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgX5G[1].jpg", pszSpec="*.rar") returned 0 [0140.569] lstrlenA (lpString="*.rar") returned 5 [0140.569] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgX5G[1].jpg", pszSpec="*.7z") returned 0 [0140.569] lstrlenA (lpString="*.7z") returned 4 [0140.569] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgX5G[1].jpg", pszSpec="*.tar") returned 0 [0140.569] lstrlenA (lpString="*.tar") returned 5 [0140.569] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgX5G[1].jpg", pszSpec="*.gzip") returned 0 [0140.569] lstrlenA (lpString="*.gzip") returned 6 [0140.569] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgX5G[1].jpg", pszSpec="*.jpg") returned 1 [0140.569] lstrlenA (lpString="*.jpg") returned 5 [0140.569] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgX5G[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgX5G[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgX5G[1].jpg" [0140.569] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgX5G[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgX5G[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgX5G[1].jpg" [0140.569] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgX5G[1].jpg", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgX5G[1].jpg.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgX5G[1].jpg." [0140.569] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgX5G[1].jpg.", lpString2="\xa0" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgX5G[1].jpg. ") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgX5G[1].jpg. " [0140.569] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgX5G[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbegx5g[1].jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa4 [0140.571] GetFileSize (in: hFile=0xa4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x918 [0140.571] GetFileTime (in: hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x45725f30, dwHighDateTime=0x1d2faf3), lpLastAccessTime=0x407536*(dwLowDateTime=0x45725f30, dwHighDateTime=0x1d2faf3), lpLastWriteTime=0x40753e*(dwLowDateTime=0x45725f30, dwHighDateTime=0x1d2faf3)) returned 1 [0140.571] SetFilePointer (in: hFile=0xa4, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0140.571] ReadFile (in: hFile=0xa4, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x8be, lpOverlapped=0x0) returned 1 [0140.736] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgX5G[1].jpg") returned="BBEgX5G[1].jpg" [0140.736] SetFilePointer (in: hFile=0xa4, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0140.736] WriteFile (in: hFile=0xa4, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x8be, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x8be, lpOverlapped=0x0) returned 1 [0140.736] SetFileTime (hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0140.737] CloseHandle (hObject=0xa4) returned 1 [0140.737] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgX5G[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbegx5g[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgX5G[1].jpg. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbegx5g[1].jpg. ")) returned 1 [0140.739] FindNextFileA (in: hFindFile=0x5be3a0, lpFindFileData=0xaea68 | out: lpFindFileData=0xaea68) returned 1 [0140.739] PeekMessageA (in: lpMsg=0xaea44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaea44) returned 0 [0140.739] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BBih5H[1].png") returned 1 [0140.739] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BBih5H[1].png") returned 1 [0140.740] lstrcmpiA (lpString1="", lpString2="BBih5H[1].png") returned -1 [0140.740] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgX5G[1].jpg") returned="BBEgX5G[1].jpg" [0140.740] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\", lpString2="BBih5H[1].png" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBih5H[1].png") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBih5H[1].png" [0140.740] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBih5H[1].png", pszSpec="*.zip") returned 0 [0140.740] lstrlenA (lpString="*.zip") returned 5 [0140.740] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBih5H[1].png", pszSpec="*.rar") returned 0 [0140.740] lstrlenA (lpString="*.rar") returned 5 [0140.740] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBih5H[1].png", pszSpec="*.7z") returned 0 [0140.740] lstrlenA (lpString="*.7z") returned 4 [0140.740] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBih5H[1].png", pszSpec="*.tar") returned 0 [0140.740] lstrlenA (lpString="*.tar") returned 5 [0140.740] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBih5H[1].png", pszSpec="*.gzip") returned 0 [0140.740] lstrlenA (lpString="*.gzip") returned 6 [0140.740] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBih5H[1].png", pszSpec="*.jpg") returned 0 [0140.740] lstrlenA (lpString="*.jpg") returned 5 [0140.740] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBih5H[1].png", pszSpec="*.jpeg") returned 0 [0140.740] lstrlenA (lpString="*.jpeg") returned 6 [0140.740] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBih5H[1].png", pszSpec="*.psd") returned 0 [0140.740] lstrlenA (lpString="*.psd") returned 5 [0140.741] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBih5H[1].png", pszSpec="*.cdr") returned 0 [0140.741] lstrlenA (lpString="*.cdr") returned 5 [0140.741] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBih5H[1].png", pszSpec="*.dwg") returned 0 [0140.741] lstrlenA (lpString="*.dwg") returned 5 [0140.741] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBih5H[1].png", pszSpec="*.max") returned 0 [0140.741] lstrlenA (lpString="*.max") returned 5 [0140.741] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBih5H[1].png", pszSpec="*.bmp") returned 0 [0140.741] lstrlenA (lpString="*.bmp") returned 5 [0140.741] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBih5H[1].png", pszSpec="*.gif") returned 0 [0140.741] lstrlenA (lpString="*.gif") returned 5 [0140.741] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBih5H[1].png", pszSpec="*.png") returned 1 [0140.741] lstrlenA (lpString="*.png") returned 5 [0140.741] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBih5H[1].png" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBih5H[1].png") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBih5H[1].png" [0140.741] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBih5H[1].png" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBih5H[1].png") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBih5H[1].png" [0140.741] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBih5H[1].png", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBih5H[1].png.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBih5H[1].png." [0140.741] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBih5H[1].png.", lpString2="\xa0" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBih5H[1].png. ") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBih5H[1].png. " [0140.741] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBih5H[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbih5h[1].png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa4 [0140.743] GetFileSize (in: hFile=0xa4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3a2 [0140.743] GetFileTime (in: hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x51256470, dwHighDateTime=0x1d2dd9e), lpLastAccessTime=0x407536*(dwLowDateTime=0x51256470, dwHighDateTime=0x1d2dd9e), lpLastWriteTime=0x40753e*(dwLowDateTime=0x51256470, dwHighDateTime=0x1d2dd9e)) returned 1 [0140.743] SetFilePointer (in: hFile=0xa4, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0140.743] ReadFile (in: hFile=0xa4, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x348, lpOverlapped=0x0) returned 1 [0140.861] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBih5H[1].png") returned="BBih5H[1].png" [0140.861] SetFilePointer (in: hFile=0xa4, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0140.861] WriteFile (in: hFile=0xa4, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x348, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x348, lpOverlapped=0x0) returned 1 [0140.862] SetFileTime (hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0140.863] CloseHandle (hObject=0xa4) returned 1 [0140.863] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBih5H[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbih5h[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBih5H[1].png. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbih5h[1].png. ")) returned 1 [0140.865] FindNextFileA (in: hFindFile=0x5be3a0, lpFindFileData=0xaea68 | out: lpFindFileData=0xaea68) returned 1 [0140.865] PeekMessageA (in: lpMsg=0xaea44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaea44) returned 0 [0140.865] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BBmUxRK[1].png") returned 1 [0140.865] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BBmUxRK[1].png") returned 1 [0140.866] lstrcmpiA (lpString1="", lpString2="BBmUxRK[1].png") returned -1 [0140.866] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBih5H[1].png") returned="BBih5H[1].png" [0140.866] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\", lpString2="BBmUxRK[1].png" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBmUxRK[1].png") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBmUxRK[1].png" [0140.866] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBmUxRK[1].png", pszSpec="*.zip") returned 0 [0140.866] lstrlenA (lpString="*.zip") returned 5 [0140.866] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBmUxRK[1].png", pszSpec="*.rar") returned 0 [0140.866] lstrlenA (lpString="*.rar") returned 5 [0140.866] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBmUxRK[1].png", pszSpec="*.7z") returned 0 [0140.866] lstrlenA (lpString="*.7z") returned 4 [0140.866] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBmUxRK[1].png", pszSpec="*.tar") returned 0 [0140.866] lstrlenA (lpString="*.tar") returned 5 [0140.866] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBmUxRK[1].png", pszSpec="*.gzip") returned 0 [0140.866] lstrlenA (lpString="*.gzip") returned 6 [0140.866] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBmUxRK[1].png", pszSpec="*.jpg") returned 0 [0140.866] lstrlenA (lpString="*.jpg") returned 5 [0140.866] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBmUxRK[1].png", pszSpec="*.jpeg") returned 0 [0140.866] lstrlenA (lpString="*.jpeg") returned 6 [0140.866] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBmUxRK[1].png", pszSpec="*.psd") returned 0 [0140.866] lstrlenA (lpString="*.psd") returned 5 [0140.866] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBmUxRK[1].png", pszSpec="*.cdr") returned 0 [0140.867] lstrlenA (lpString="*.cdr") returned 5 [0140.867] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBmUxRK[1].png", pszSpec="*.dwg") returned 0 [0140.867] lstrlenA (lpString="*.dwg") returned 5 [0140.867] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBmUxRK[1].png", pszSpec="*.max") returned 0 [0140.867] lstrlenA (lpString="*.max") returned 5 [0140.867] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBmUxRK[1].png", pszSpec="*.bmp") returned 0 [0140.867] lstrlenA (lpString="*.bmp") returned 5 [0140.867] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBmUxRK[1].png", pszSpec="*.gif") returned 0 [0140.867] lstrlenA (lpString="*.gif") returned 5 [0140.867] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBmUxRK[1].png", pszSpec="*.png") returned 1 [0140.867] lstrlenA (lpString="*.png") returned 5 [0140.867] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBmUxRK[1].png" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBmUxRK[1].png") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBmUxRK[1].png" [0140.867] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBmUxRK[1].png" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBmUxRK[1].png") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBmUxRK[1].png" [0140.867] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBmUxRK[1].png", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBmUxRK[1].png.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBmUxRK[1].png." [0140.867] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBmUxRK[1].png.", lpString2="\xa0" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBmUxRK[1].png. ") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBmUxRK[1].png. " [0140.867] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBmUxRK[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbmuxrk[1].png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa4 [0140.871] GetFileSize (in: hFile=0xa4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x24c [0140.871] GetFileTime (in: hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xbe4ca790, dwHighDateTime=0x1d2faf2), lpLastAccessTime=0x407536*(dwLowDateTime=0xbe4ca790, dwHighDateTime=0x1d2faf2), lpLastWriteTime=0x40753e*(dwLowDateTime=0xbe4ca790, dwHighDateTime=0x1d2faf2)) returned 1 [0140.871] SetFilePointer (in: hFile=0xa4, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0140.871] ReadFile (in: hFile=0xa4, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x1f2, lpOverlapped=0x0) returned 1 [0141.062] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBmUxRK[1].png") returned="BBmUxRK[1].png" [0141.063] SetFilePointer (in: hFile=0xa4, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0141.063] WriteFile (in: hFile=0xa4, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x1f2, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x1f2, lpOverlapped=0x0) returned 1 [0141.063] SetFileTime (hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0141.063] CloseHandle (hObject=0xa4) returned 1 [0141.064] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBmUxRK[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbmuxrk[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBmUxRK[1].png. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbmuxrk[1].png. ")) returned 1 [0141.071] FindNextFileA (in: hFindFile=0x5be3a0, lpFindFileData=0xaea68 | out: lpFindFileData=0xaea68) returned 1 [0141.071] PeekMessageA (in: lpMsg=0xaea44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaea44) returned 0 [0141.071] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BBndhJA[1].png") returned 1 [0141.071] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BBndhJA[1].png") returned 1 [0141.071] lstrcmpiA (lpString1="", lpString2="BBndhJA[1].png") returned -1 [0141.071] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBmUxRK[1].png") returned="BBmUxRK[1].png" [0141.071] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\", lpString2="BBndhJA[1].png" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBndhJA[1].png") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBndhJA[1].png" [0141.072] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBndhJA[1].png", pszSpec="*.zip") returned 0 [0141.072] lstrlenA (lpString="*.zip") returned 5 [0141.072] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBndhJA[1].png", pszSpec="*.rar") returned 0 [0141.072] lstrlenA (lpString="*.rar") returned 5 [0141.072] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBndhJA[1].png", pszSpec="*.7z") returned 0 [0141.072] lstrlenA (lpString="*.7z") returned 4 [0141.072] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBndhJA[1].png", pszSpec="*.tar") returned 0 [0141.072] lstrlenA (lpString="*.tar") returned 5 [0141.072] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBndhJA[1].png", pszSpec="*.gzip") returned 0 [0141.072] lstrlenA (lpString="*.gzip") returned 6 [0141.072] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBndhJA[1].png", pszSpec="*.jpg") returned 0 [0141.072] lstrlenA (lpString="*.jpg") returned 5 [0141.072] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBndhJA[1].png", pszSpec="*.jpeg") returned 0 [0141.072] lstrlenA (lpString="*.jpeg") returned 6 [0141.072] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBndhJA[1].png", pszSpec="*.psd") returned 0 [0141.072] lstrlenA (lpString="*.psd") returned 5 [0141.072] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBndhJA[1].png", pszSpec="*.cdr") returned 0 [0141.073] lstrlenA (lpString="*.cdr") returned 5 [0141.073] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBndhJA[1].png", pszSpec="*.dwg") returned 0 [0141.073] lstrlenA (lpString="*.dwg") returned 5 [0141.073] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBndhJA[1].png", pszSpec="*.max") returned 0 [0141.073] lstrlenA (lpString="*.max") returned 5 [0141.073] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBndhJA[1].png", pszSpec="*.bmp") returned 0 [0141.073] lstrlenA (lpString="*.bmp") returned 5 [0141.073] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBndhJA[1].png", pszSpec="*.gif") returned 0 [0141.073] lstrlenA (lpString="*.gif") returned 5 [0141.073] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBndhJA[1].png", pszSpec="*.png") returned 1 [0141.073] lstrlenA (lpString="*.png") returned 5 [0141.073] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBndhJA[1].png" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBndhJA[1].png") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBndhJA[1].png" [0141.073] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBndhJA[1].png" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBndhJA[1].png") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBndhJA[1].png" [0141.073] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBndhJA[1].png", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBndhJA[1].png.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBndhJA[1].png." [0141.073] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBndhJA[1].png.", lpString2="\xa0" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBndhJA[1].png. ") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBndhJA[1].png. " [0141.073] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBndhJA[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbndhja[1].png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa4 [0141.084] GetFileSize (in: hFile=0xa4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x398 [0141.084] GetFileTime (in: hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x459f9950, dwHighDateTime=0x1d2faf3), lpLastAccessTime=0x407536*(dwLowDateTime=0x459f9950, dwHighDateTime=0x1d2faf3), lpLastWriteTime=0x40753e*(dwLowDateTime=0x459f9950, dwHighDateTime=0x1d2faf3)) returned 1 [0141.084] SetFilePointer (in: hFile=0xa4, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0141.084] ReadFile (in: hFile=0xa4, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x33e, lpOverlapped=0x0) returned 1 [0141.086] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBndhJA[1].png") returned="BBndhJA[1].png" [0141.086] SetFilePointer (in: hFile=0xa4, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0141.086] WriteFile (in: hFile=0xa4, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x33e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x33e, lpOverlapped=0x0) returned 1 [0141.087] SetFileTime (hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0141.087] CloseHandle (hObject=0xa4) returned 1 [0141.087] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBndhJA[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbndhja[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBndhJA[1].png. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbndhja[1].png. ")) returned 1 [0141.089] FindNextFileA (in: hFindFile=0x5be3a0, lpFindFileData=0xaea68 | out: lpFindFileData=0xaea68) returned 1 [0141.089] PeekMessageA (in: lpMsg=0xaea44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaea44) returned 0 [0141.089] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BBoqF0J[1].png") returned 1 [0141.089] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BBoqF0J[1].png") returned 1 [0141.089] lstrcmpiA (lpString1="", lpString2="BBoqF0J[1].png") returned -1 [0141.089] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBndhJA[1].png") returned="BBndhJA[1].png" [0141.089] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\", lpString2="BBoqF0J[1].png" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBoqF0J[1].png") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBoqF0J[1].png" [0141.089] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBoqF0J[1].png", pszSpec="*.zip") returned 0 [0141.089] lstrlenA (lpString="*.zip") returned 5 [0141.089] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBoqF0J[1].png", pszSpec="*.rar") returned 0 [0141.089] lstrlenA (lpString="*.rar") returned 5 [0141.089] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBoqF0J[1].png", pszSpec="*.7z") returned 0 [0141.089] lstrlenA (lpString="*.7z") returned 4 [0141.090] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBoqF0J[1].png", pszSpec="*.tar") returned 0 [0141.090] lstrlenA (lpString="*.tar") returned 5 [0141.090] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBoqF0J[1].png", pszSpec="*.gzip") returned 0 [0141.090] lstrlenA (lpString="*.gzip") returned 6 [0141.090] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBoqF0J[1].png", pszSpec="*.jpg") returned 0 [0141.090] lstrlenA (lpString="*.jpg") returned 5 [0141.090] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBoqF0J[1].png", pszSpec="*.jpeg") returned 0 [0141.090] lstrlenA (lpString="*.jpeg") returned 6 [0141.090] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBoqF0J[1].png", pszSpec="*.psd") returned 0 [0141.090] lstrlenA (lpString="*.psd") returned 5 [0141.090] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBoqF0J[1].png", pszSpec="*.cdr") returned 0 [0141.090] lstrlenA (lpString="*.cdr") returned 5 [0141.090] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBoqF0J[1].png", pszSpec="*.dwg") returned 0 [0141.090] lstrlenA (lpString="*.dwg") returned 5 [0141.090] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBoqF0J[1].png", pszSpec="*.max") returned 0 [0141.090] lstrlenA (lpString="*.max") returned 5 [0141.090] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBoqF0J[1].png", pszSpec="*.bmp") returned 0 [0141.090] lstrlenA (lpString="*.bmp") returned 5 [0141.090] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBoqF0J[1].png", pszSpec="*.gif") returned 0 [0141.090] lstrlenA (lpString="*.gif") returned 5 [0141.090] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBoqF0J[1].png", pszSpec="*.png") returned 1 [0141.090] lstrlenA (lpString="*.png") returned 5 [0141.090] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBoqF0J[1].png" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBoqF0J[1].png") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBoqF0J[1].png" [0141.090] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBoqF0J[1].png" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBoqF0J[1].png") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBoqF0J[1].png" [0141.090] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBoqF0J[1].png", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBoqF0J[1].png.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBoqF0J[1].png." [0141.091] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBoqF0J[1].png.", lpString2="\xa0" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBoqF0J[1].png. ") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBoqF0J[1].png. " [0141.091] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBoqF0J[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bboqf0j[1].png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa4 [0141.094] GetFileSize (in: hFile=0xa4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x230 [0141.094] GetFileTime (in: hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x458c8e50, dwHighDateTime=0x1d2faf3), lpLastAccessTime=0x407536*(dwLowDateTime=0x458c8e50, dwHighDateTime=0x1d2faf3), lpLastWriteTime=0x40753e*(dwLowDateTime=0x458c8e50, dwHighDateTime=0x1d2faf3)) returned 1 [0141.094] SetFilePointer (in: hFile=0xa4, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0141.095] ReadFile (in: hFile=0xa4, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x1d6, lpOverlapped=0x0) returned 1 [0141.103] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBoqF0J[1].png") returned="BBoqF0J[1].png" [0141.103] SetFilePointer (in: hFile=0xa4, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0141.103] WriteFile (in: hFile=0xa4, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x1d6, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x1d6, lpOverlapped=0x0) returned 1 [0141.105] SetFileTime (hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0141.106] CloseHandle (hObject=0xa4) returned 1 [0141.106] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBoqF0J[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bboqf0j[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBoqF0J[1].png. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bboqf0j[1].png. ")) returned 1 [0141.108] FindNextFileA (in: hFindFile=0x5be3a0, lpFindFileData=0xaea68 | out: lpFindFileData=0xaea68) returned 1 [0141.108] PeekMessageA (in: lpMsg=0xaea44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaea44) returned 0 [0141.108] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BBzjV9E[1].png") returned 1 [0141.108] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BBzjV9E[1].png") returned 1 [0141.108] lstrcmpiA (lpString1="", lpString2="BBzjV9E[1].png") returned -1 [0141.108] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBoqF0J[1].png") returned="BBoqF0J[1].png" [0141.108] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\", lpString2="BBzjV9E[1].png" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBzjV9E[1].png") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBzjV9E[1].png" [0141.108] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBzjV9E[1].png", pszSpec="*.zip") returned 0 [0141.108] lstrlenA (lpString="*.zip") returned 5 [0141.108] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBzjV9E[1].png", pszSpec="*.rar") returned 0 [0141.108] lstrlenA (lpString="*.rar") returned 5 [0141.108] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBzjV9E[1].png", pszSpec="*.7z") returned 0 [0141.108] lstrlenA (lpString="*.7z") returned 4 [0141.108] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBzjV9E[1].png", pszSpec="*.tar") returned 0 [0141.108] lstrlenA (lpString="*.tar") returned 5 [0141.108] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBzjV9E[1].png", pszSpec="*.gzip") returned 0 [0141.108] lstrlenA (lpString="*.gzip") returned 6 [0141.108] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBzjV9E[1].png", pszSpec="*.jpg") returned 0 [0141.108] lstrlenA (lpString="*.jpg") returned 5 [0141.108] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBzjV9E[1].png", pszSpec="*.jpeg") returned 0 [0141.108] lstrlenA (lpString="*.jpeg") returned 6 [0141.108] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBzjV9E[1].png", pszSpec="*.psd") returned 0 [0141.108] lstrlenA (lpString="*.psd") returned 5 [0141.109] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBzjV9E[1].png", pszSpec="*.cdr") returned 0 [0141.109] lstrlenA (lpString="*.cdr") returned 5 [0141.109] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBzjV9E[1].png", pszSpec="*.dwg") returned 0 [0141.109] lstrlenA (lpString="*.dwg") returned 5 [0141.109] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBzjV9E[1].png", pszSpec="*.max") returned 0 [0141.109] lstrlenA (lpString="*.max") returned 5 [0141.109] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBzjV9E[1].png", pszSpec="*.bmp") returned 0 [0141.109] lstrlenA (lpString="*.bmp") returned 5 [0141.109] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBzjV9E[1].png", pszSpec="*.gif") returned 0 [0141.109] lstrlenA (lpString="*.gif") returned 5 [0141.109] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBzjV9E[1].png", pszSpec="*.png") returned 1 [0141.109] lstrlenA (lpString="*.png") returned 5 [0141.109] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBzjV9E[1].png" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBzjV9E[1].png") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBzjV9E[1].png" [0141.109] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBzjV9E[1].png" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBzjV9E[1].png") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBzjV9E[1].png" [0141.109] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBzjV9E[1].png", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBzjV9E[1].png.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBzjV9E[1].png." [0141.109] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBzjV9E[1].png.", lpString2="\xa0" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBzjV9E[1].png. ") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBzjV9E[1].png. " [0141.109] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBzjV9E[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbzjv9e[1].png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa4 [0141.110] GetFileSize (in: hFile=0xa4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x116 [0141.110] GetFileTime (in: hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x53063a30, dwHighDateTime=0x1d2dd9e), lpLastAccessTime=0x407536*(dwLowDateTime=0x53063a30, dwHighDateTime=0x1d2dd9e), lpLastWriteTime=0x40753e*(dwLowDateTime=0x53063a30, dwHighDateTime=0x1d2dd9e)) returned 1 [0141.111] SetFilePointer (in: hFile=0xa4, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0141.113] ReadFile (in: hFile=0xa4, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0xbc, lpOverlapped=0x0) returned 1 [0141.117] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBzjV9E[1].png") returned="BBzjV9E[1].png" [0141.117] SetFilePointer (in: hFile=0xa4, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0141.117] WriteFile (in: hFile=0xa4, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0xbc, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0xbc, lpOverlapped=0x0) returned 1 [0141.117] SetFileTime (hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0141.118] CloseHandle (hObject=0xa4) returned 1 [0141.118] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBzjV9E[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbzjv9e[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBzjV9E[1].png. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbzjv9e[1].png. ")) returned 1 [0141.124] FindNextFileA (in: hFindFile=0x5be3a0, lpFindFileData=0xaea68 | out: lpFindFileData=0xaea68) returned 1 [0141.125] PeekMessageA (in: lpMsg=0xaea44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaea44) returned 0 [0141.125] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="benefits-1[1].jpg") returned 1 [0141.125] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="benefits-1[1].jpg") returned 1 [0141.125] lstrcmpiA (lpString1="", lpString2="benefits-1[1].jpg") returned -1 [0141.125] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBzjV9E[1].png") returned="BBzjV9E[1].png" [0141.125] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\", lpString2="benefits-1[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\benefits-1[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\benefits-1[1].jpg" [0141.125] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\benefits-1[1].jpg", pszSpec="*.zip") returned 0 [0141.125] lstrlenA (lpString="*.zip") returned 5 [0141.125] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\benefits-1[1].jpg", pszSpec="*.rar") returned 0 [0141.125] lstrlenA (lpString="*.rar") returned 5 [0141.125] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\benefits-1[1].jpg", pszSpec="*.7z") returned 0 [0141.125] lstrlenA (lpString="*.7z") returned 4 [0141.125] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\benefits-1[1].jpg", pszSpec="*.tar") returned 0 [0141.125] lstrlenA (lpString="*.tar") returned 5 [0141.125] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\benefits-1[1].jpg", pszSpec="*.gzip") returned 0 [0141.125] lstrlenA (lpString="*.gzip") returned 6 [0141.125] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\benefits-1[1].jpg", pszSpec="*.jpg") returned 1 [0141.125] lstrlenA (lpString="*.jpg") returned 5 [0141.125] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\benefits-1[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\benefits-1[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\benefits-1[1].jpg" [0141.125] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\benefits-1[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\benefits-1[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\benefits-1[1].jpg" [0141.125] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\benefits-1[1].jpg", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\benefits-1[1].jpg.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\benefits-1[1].jpg." [0141.126] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\benefits-1[1].jpg.", lpString2="\xa0" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\benefits-1[1].jpg. ") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\benefits-1[1].jpg. " [0141.126] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\benefits-1[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\benefits-1[1].jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa4 [0141.127] GetFileSize (in: hFile=0xa4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1fdaf [0141.127] GetFileTime (in: hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x60cdb940, dwHighDateTime=0x1d2dd9e), lpLastAccessTime=0x407536*(dwLowDateTime=0x60cdb940, dwHighDateTime=0x1d2dd9e), lpLastWriteTime=0x40753e*(dwLowDateTime=0x60d4dd60, dwHighDateTime=0x1d2dd9e)) returned 1 [0141.127] SetFilePointer (in: hFile=0xa4, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0141.127] ReadFile (in: hFile=0xa4, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x1fd55, lpOverlapped=0x0) returned 1 [0141.140] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\benefits-1[1].jpg") returned="benefits-1[1].jpg" [0141.141] SetFilePointer (in: hFile=0xa4, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0141.143] WriteFile (in: hFile=0xa4, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x1fd55, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x1fd55, lpOverlapped=0x0) returned 1 [0141.196] SetFileTime (hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0141.358] CloseHandle (hObject=0xa4) returned 1 [0141.358] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\benefits-1[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\benefits-1[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\benefits-1[1].jpg. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\benefits-1[1].jpg. ")) returned 1 [0141.359] FindNextFileA (in: hFindFile=0x5be3a0, lpFindFileData=0xaea68 | out: lpFindFileData=0xaea68) returned 1 [0141.359] PeekMessageA (in: lpMsg=0xaea44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaea44) returned 0 [0141.359] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="cb=gapi[1].loaded_1") returned 1 [0141.359] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="cb=gapi[1].loaded_1") returned 1 [0141.359] lstrcmpiA (lpString1="", lpString2="cb=gapi[1].loaded_1") returned -1 [0141.359] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\benefits-1[1].jpg") returned="benefits-1[1].jpg" [0141.359] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\", lpString2="cb=gapi[1].loaded_1" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\cb=gapi[1].loaded_1") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\cb=gapi[1].loaded_1" [0141.359] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\cb=gapi[1].loaded_1", pszSpec="*.zip") returned 0 [0141.359] lstrlenA (lpString="*.zip") returned 5 [0141.359] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\cb=gapi[1].loaded_1", pszSpec="*.rar") returned 0 [0141.359] lstrlenA (lpString="*.rar") returned 5 [0141.359] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\cb=gapi[1].loaded_1", pszSpec="*.7z") returned 0 [0141.359] lstrlenA (lpString="*.7z") returned 4 [0141.359] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\cb=gapi[1].loaded_1", pszSpec="*.tar") returned 0 [0141.359] lstrlenA (lpString="*.tar") returned 5 [0141.359] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\cb=gapi[1].loaded_1", pszSpec="*.gzip") returned 0 [0141.359] lstrlenA (lpString="*.gzip") returned 6 [0141.359] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\cb=gapi[1].loaded_1", pszSpec="*.jpg") returned 0 [0141.359] lstrlenA (lpString="*.jpg") returned 5 [0141.360] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\cb=gapi[1].loaded_1", pszSpec="*.jpeg") returned 0 [0141.360] lstrlenA (lpString="*.jpeg") returned 6 [0141.360] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\cb=gapi[1].loaded_1", pszSpec="*.psd") returned 0 [0141.360] lstrlenA (lpString="*.psd") returned 5 [0141.360] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\cb=gapi[1].loaded_1", pszSpec="*.cdr") returned 0 [0141.360] lstrlenA (lpString="*.cdr") returned 5 [0141.360] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\cb=gapi[1].loaded_1", pszSpec="*.dwg") returned 0 [0141.360] lstrlenA (lpString="*.dwg") returned 5 [0141.360] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\cb=gapi[1].loaded_1", pszSpec="*.max") returned 0 [0141.360] lstrlenA (lpString="*.max") returned 5 [0141.360] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\cb=gapi[1].loaded_1", pszSpec="*.bmp") returned 0 [0141.360] lstrlenA (lpString="*.bmp") returned 5 [0141.360] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\cb=gapi[1].loaded_1", pszSpec="*.gif") returned 0 [0141.360] lstrlenA (lpString="*.gif") returned 5 [0141.360] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\cb=gapi[1].loaded_1", pszSpec="*.png") returned 0 [0141.360] lstrlenA (lpString="*.png") returned 5 [0141.360] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\cb=gapi[1].loaded_1", pszSpec="*.doc") returned 0 [0141.360] lstrlenA (lpString="*.doc") returned 5 [0141.360] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\cb=gapi[1].loaded_1", pszSpec="*.docx") returned 0 [0141.360] lstrlenA (lpString="*.docx") returned 6 [0141.360] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\cb=gapi[1].loaded_1", pszSpec="*.xls") returned 0 [0141.360] lstrlenA (lpString="*.xls") returned 5 [0141.360] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\cb=gapi[1].loaded_1", pszSpec="*.xlsx") returned 0 [0141.360] lstrlenA (lpString="*.xlsx") returned 6 [0141.360] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\cb=gapi[1].loaded_1", pszSpec="*.ppt") returned 0 [0141.360] lstrlenA (lpString="*.ppt") returned 5 [0141.360] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\cb=gapi[1].loaded_1", pszSpec="*.pptx") returned 0 [0141.360] lstrlenA (lpString="*.pptx") returned 6 [0141.360] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\cb=gapi[1].loaded_1", pszSpec="*.txt") returned 0 [0141.360] lstrlenA (lpString="*.txt") returned 5 [0141.360] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\cb=gapi[1].loaded_1", pszSpec="*.pdf") returned 0 [0141.360] lstrlenA (lpString="*.pdf") returned 5 [0141.360] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\cb=gapi[1].loaded_1", pszSpec="*.djvu") returned 0 [0141.360] lstrlenA (lpString="*.djvu") returned 6 [0141.360] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\cb=gapi[1].loaded_1", pszSpec="*.htm") returned 0 [0141.360] lstrlenA (lpString="*.htm") returned 5 [0141.360] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\cb=gapi[1].loaded_1", pszSpec="*.html") returned 0 [0141.360] lstrlenA (lpString="*.html") returned 6 [0141.360] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\cb=gapi[1].loaded_1", pszSpec="*.mdb") returned 0 [0141.360] lstrlenA (lpString="*.mdb") returned 5 [0141.360] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\cb=gapi[1].loaded_1", pszSpec="*.cer") returned 0 [0141.360] lstrlenA (lpString="*.cer") returned 5 [0141.360] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\cb=gapi[1].loaded_1", pszSpec="*.p12") returned 0 [0141.361] lstrlenA (lpString="*.p12") returned 5 [0141.361] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\cb=gapi[1].loaded_1", pszSpec="*.pfx") returned 0 [0141.361] lstrlenA (lpString="*.pfx") returned 5 [0141.361] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\cb=gapi[1].loaded_1", pszSpec="*.kwm") returned 0 [0141.361] lstrlenA (lpString="*.kwm") returned 5 [0141.361] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\cb=gapi[1].loaded_1", pszSpec="*.pwm") returned 0 [0141.361] lstrlenA (lpString="*.pwm") returned 5 [0141.361] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\cb=gapi[1].loaded_1", pszSpec="*.1cd") returned 0 [0141.361] lstrlenA (lpString="*.1cd") returned 5 [0141.361] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\cb=gapi[1].loaded_1", pszSpec="*.md") returned 0 [0141.361] lstrlenA (lpString="*.md") returned 4 [0141.361] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\cb=gapi[1].loaded_1", pszSpec="*.mdf") returned 0 [0141.361] lstrlenA (lpString="*.mdf") returned 5 [0141.361] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\cb=gapi[1].loaded_1", pszSpec="*.dbf") returned 0 [0141.361] lstrlenA (lpString="*.dbf") returned 5 [0141.361] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\cb=gapi[1].loaded_1", pszSpec="*.odt") returned 0 [0141.361] lstrlenA (lpString="*.odt") returned 5 [0141.361] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\cb=gapi[1].loaded_1", pszSpec="*.vob") returned 0 [0141.361] lstrlenA (lpString="*.vob") returned 5 [0141.361] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\cb=gapi[1].loaded_1", pszSpec="*.ifo") returned 0 [0141.361] lstrlenA (lpString="*.ifo") returned 5 [0141.361] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\cb=gapi[1].loaded_1", pszSpec="*.lnk") returned 0 [0141.361] lstrlenA (lpString="*.lnk") returned 5 [0141.361] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\cb=gapi[1].loaded_1", pszSpec="*.torrent") returned 0 [0141.361] lstrlenA (lpString="*.torrent") returned 9 [0141.361] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\cb=gapi[1].loaded_1", pszSpec="*.mov") returned 0 [0141.361] lstrlenA (lpString="*.mov") returned 5 [0141.361] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\cb=gapi[1].loaded_1", pszSpec="*.m2v") returned 0 [0141.361] lstrlenA (lpString="*.m2v") returned 5 [0141.361] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\cb=gapi[1].loaded_1", pszSpec="*.3gp") returned 0 [0141.361] lstrlenA (lpString="*.3gp") returned 5 [0141.361] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\cb=gapi[1].loaded_1", pszSpec="*.mpeg") returned 0 [0141.361] lstrlenA (lpString="*.mpeg") returned 6 [0141.361] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\cb=gapi[1].loaded_1", pszSpec="*.mpg") returned 0 [0141.361] lstrlenA (lpString="*.mpg") returned 5 [0141.361] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\cb=gapi[1].loaded_1", pszSpec="*.flv") returned 0 [0141.361] lstrlenA (lpString="*.flv") returned 5 [0141.361] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\cb=gapi[1].loaded_1", pszSpec="*.avi") returned 0 [0141.361] lstrlenA (lpString="*.avi") returned 5 [0141.361] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\cb=gapi[1].loaded_1", pszSpec="*.mp4") returned 0 [0141.361] lstrlenA (lpString="*.mp4") returned 5 [0141.361] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\cb=gapi[1].loaded_1", pszSpec="*.wmv") returned 0 [0141.361] lstrlenA (lpString="*.wmv") returned 5 [0141.361] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\cb=gapi[1].loaded_1", pszSpec="*.divx") returned 0 [0141.361] lstrlenA (lpString="*.divx") returned 6 [0141.361] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\cb=gapi[1].loaded_1", pszSpec="*.mkv") returned 0 [0141.361] lstrlenA (lpString="*.mkv") returned 5 [0141.361] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\cb=gapi[1].loaded_1", pszSpec="*.mp3") returned 0 [0141.362] lstrlenA (lpString="*.mp3") returned 5 [0141.362] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\cb=gapi[1].loaded_1", pszSpec="*.wav") returned 0 [0141.362] lstrlenA (lpString="*.wav") returned 5 [0141.362] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\cb=gapi[1].loaded_1", pszSpec="*.flac") returned 0 [0141.362] lstrlenA (lpString="*.flac") returned 6 [0141.362] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\cb=gapi[1].loaded_1", pszSpec="*.ape") returned 0 [0141.362] lstrlenA (lpString="*.ape") returned 5 [0141.362] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\cb=gapi[1].loaded_1", pszSpec="*.wma") returned 0 [0141.362] lstrlenA (lpString="*.wma") returned 5 [0141.362] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\cb=gapi[1].loaded_1", pszSpec="*.ac3") returned 0 [0141.362] lstrlenA (lpString="*.ac3") returned 5 [0141.362] FindNextFileA (in: hFindFile=0x5be3a0, lpFindFileData=0xaea68 | out: lpFindFileData=0xaea68) returned 1 [0141.362] PeekMessageA (in: lpMsg=0xaea44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaea44) returned 0 [0141.362] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="chartbeat[1].js") returned 1 [0141.362] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="chartbeat[1].js") returned 1 [0141.362] lstrcmpiA (lpString1="", lpString2="chartbeat[1].js") returned -1 [0141.362] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\cb=gapi[1].loaded_1") returned="cb=gapi[1].loaded_1" [0141.362] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\", lpString2="chartbeat[1].js" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chartbeat[1].js") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chartbeat[1].js" [0141.362] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chartbeat[1].js", pszSpec="*.zip") returned 0 [0141.362] lstrlenA (lpString="*.zip") returned 5 [0141.362] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chartbeat[1].js", pszSpec="*.rar") returned 0 [0141.362] lstrlenA (lpString="*.rar") returned 5 [0141.362] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chartbeat[1].js", pszSpec="*.7z") returned 0 [0141.362] lstrlenA (lpString="*.7z") returned 4 [0141.362] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chartbeat[1].js", pszSpec="*.tar") returned 0 [0141.362] lstrlenA (lpString="*.tar") returned 5 [0141.362] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chartbeat[1].js", pszSpec="*.gzip") returned 0 [0141.362] lstrlenA (lpString="*.gzip") returned 6 [0141.362] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chartbeat[1].js", pszSpec="*.jpg") returned 0 [0141.362] lstrlenA (lpString="*.jpg") returned 5 [0141.362] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chartbeat[1].js", pszSpec="*.jpeg") returned 0 [0141.362] lstrlenA (lpString="*.jpeg") returned 6 [0141.362] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chartbeat[1].js", pszSpec="*.psd") returned 0 [0141.362] lstrlenA (lpString="*.psd") returned 5 [0141.362] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chartbeat[1].js", pszSpec="*.cdr") returned 0 [0141.362] lstrlenA (lpString="*.cdr") returned 5 [0141.362] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chartbeat[1].js", pszSpec="*.dwg") returned 0 [0141.362] lstrlenA (lpString="*.dwg") returned 5 [0141.362] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chartbeat[1].js", pszSpec="*.max") returned 0 [0141.362] lstrlenA (lpString="*.max") returned 5 [0141.362] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chartbeat[1].js", pszSpec="*.bmp") returned 0 [0141.362] lstrlenA (lpString="*.bmp") returned 5 [0141.362] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chartbeat[1].js", pszSpec="*.gif") returned 0 [0141.362] lstrlenA (lpString="*.gif") returned 5 [0141.362] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chartbeat[1].js", pszSpec="*.png") returned 0 [0141.362] lstrlenA (lpString="*.png") returned 5 [0141.362] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chartbeat[1].js", pszSpec="*.doc") returned 0 [0141.362] lstrlenA (lpString="*.doc") returned 5 [0141.363] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chartbeat[1].js", pszSpec="*.docx") returned 0 [0141.363] lstrlenA (lpString="*.docx") returned 6 [0141.363] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chartbeat[1].js", pszSpec="*.xls") returned 0 [0141.363] lstrlenA (lpString="*.xls") returned 5 [0141.363] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chartbeat[1].js", pszSpec="*.xlsx") returned 0 [0141.363] lstrlenA (lpString="*.xlsx") returned 6 [0141.363] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chartbeat[1].js", pszSpec="*.ppt") returned 0 [0141.363] lstrlenA (lpString="*.ppt") returned 5 [0141.363] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chartbeat[1].js", pszSpec="*.pptx") returned 0 [0141.363] lstrlenA (lpString="*.pptx") returned 6 [0141.363] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chartbeat[1].js", pszSpec="*.txt") returned 0 [0141.363] lstrlenA (lpString="*.txt") returned 5 [0141.363] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chartbeat[1].js", pszSpec="*.pdf") returned 0 [0141.363] lstrlenA (lpString="*.pdf") returned 5 [0141.363] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chartbeat[1].js", pszSpec="*.djvu") returned 0 [0141.363] lstrlenA (lpString="*.djvu") returned 6 [0141.363] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chartbeat[1].js", pszSpec="*.htm") returned 0 [0141.363] lstrlenA (lpString="*.htm") returned 5 [0141.363] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chartbeat[1].js", pszSpec="*.html") returned 0 [0141.363] lstrlenA (lpString="*.html") returned 6 [0141.363] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chartbeat[1].js", pszSpec="*.mdb") returned 0 [0141.363] lstrlenA (lpString="*.mdb") returned 5 [0141.363] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chartbeat[1].js", pszSpec="*.cer") returned 0 [0141.363] lstrlenA (lpString="*.cer") returned 5 [0141.363] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chartbeat[1].js", pszSpec="*.p12") returned 0 [0141.363] lstrlenA (lpString="*.p12") returned 5 [0141.363] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chartbeat[1].js", pszSpec="*.pfx") returned 0 [0141.363] lstrlenA (lpString="*.pfx") returned 5 [0141.363] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chartbeat[1].js", pszSpec="*.kwm") returned 0 [0141.363] lstrlenA (lpString="*.kwm") returned 5 [0141.363] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chartbeat[1].js", pszSpec="*.pwm") returned 0 [0141.363] lstrlenA (lpString="*.pwm") returned 5 [0141.363] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chartbeat[1].js", pszSpec="*.1cd") returned 0 [0141.363] lstrlenA (lpString="*.1cd") returned 5 [0141.363] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chartbeat[1].js", pszSpec="*.md") returned 0 [0141.363] lstrlenA (lpString="*.md") returned 4 [0141.363] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chartbeat[1].js", pszSpec="*.mdf") returned 0 [0141.363] lstrlenA (lpString="*.mdf") returned 5 [0141.363] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chartbeat[1].js", pszSpec="*.dbf") returned 0 [0141.363] lstrlenA (lpString="*.dbf") returned 5 [0141.363] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chartbeat[1].js", pszSpec="*.odt") returned 0 [0141.363] lstrlenA (lpString="*.odt") returned 5 [0141.363] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chartbeat[1].js", pszSpec="*.vob") returned 0 [0141.363] lstrlenA (lpString="*.vob") returned 5 [0141.363] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chartbeat[1].js", pszSpec="*.ifo") returned 0 [0141.363] lstrlenA (lpString="*.ifo") returned 5 [0141.363] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chartbeat[1].js", pszSpec="*.lnk") returned 0 [0141.363] lstrlenA (lpString="*.lnk") returned 5 [0141.363] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chartbeat[1].js", pszSpec="*.torrent") returned 0 [0141.363] lstrlenA (lpString="*.torrent") returned 9 [0141.364] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chartbeat[1].js", pszSpec="*.mov") returned 0 [0141.364] lstrlenA (lpString="*.mov") returned 5 [0141.364] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chartbeat[1].js", pszSpec="*.m2v") returned 0 [0141.364] lstrlenA (lpString="*.m2v") returned 5 [0141.364] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chartbeat[1].js", pszSpec="*.3gp") returned 0 [0141.364] lstrlenA (lpString="*.3gp") returned 5 [0141.364] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chartbeat[1].js", pszSpec="*.mpeg") returned 0 [0141.364] lstrlenA (lpString="*.mpeg") returned 6 [0141.364] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chartbeat[1].js", pszSpec="*.mpg") returned 0 [0141.364] lstrlenA (lpString="*.mpg") returned 5 [0141.364] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chartbeat[1].js", pszSpec="*.flv") returned 0 [0141.364] lstrlenA (lpString="*.flv") returned 5 [0141.364] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chartbeat[1].js", pszSpec="*.avi") returned 0 [0141.364] lstrlenA (lpString="*.avi") returned 5 [0141.364] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chartbeat[1].js", pszSpec="*.mp4") returned 0 [0141.364] lstrlenA (lpString="*.mp4") returned 5 [0141.364] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chartbeat[1].js", pszSpec="*.wmv") returned 0 [0141.364] lstrlenA (lpString="*.wmv") returned 5 [0141.364] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chartbeat[1].js", pszSpec="*.divx") returned 0 [0141.364] lstrlenA (lpString="*.divx") returned 6 [0141.364] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chartbeat[1].js", pszSpec="*.mkv") returned 0 [0141.364] lstrlenA (lpString="*.mkv") returned 5 [0141.364] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chartbeat[1].js", pszSpec="*.mp3") returned 0 [0141.364] lstrlenA (lpString="*.mp3") returned 5 [0141.364] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chartbeat[1].js", pszSpec="*.wav") returned 0 [0141.364] lstrlenA (lpString="*.wav") returned 5 [0141.364] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chartbeat[1].js", pszSpec="*.flac") returned 0 [0141.364] lstrlenA (lpString="*.flac") returned 6 [0141.364] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chartbeat[1].js", pszSpec="*.ape") returned 0 [0141.364] lstrlenA (lpString="*.ape") returned 5 [0141.364] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chartbeat[1].js", pszSpec="*.wma") returned 0 [0141.364] lstrlenA (lpString="*.wma") returned 5 [0141.364] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chartbeat[1].js", pszSpec="*.ac3") returned 0 [0141.364] lstrlenA (lpString="*.ac3") returned 5 [0141.364] FindNextFileA (in: hFindFile=0x5be3a0, lpFindFileData=0xaea68 | out: lpFindFileData=0xaea68) returned 1 [0141.364] PeekMessageA (in: lpMsg=0xaea44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaea44) returned 0 [0141.364] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="chrome-installer.min[1].js") returned 1 [0141.364] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="chrome-installer.min[1].js") returned 1 [0141.364] lstrcmpiA (lpString1="", lpString2="chrome-installer.min[1].js") returned -1 [0141.364] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chartbeat[1].js") returned="chartbeat[1].js" [0141.364] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\", lpString2="chrome-installer.min[1].js" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chrome-installer.min[1].js") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chrome-installer.min[1].js" [0141.364] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chrome-installer.min[1].js", pszSpec="*.zip") returned 0 [0141.364] lstrlenA (lpString="*.zip") returned 5 [0141.364] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chrome-installer.min[1].js", pszSpec="*.rar") returned 0 [0141.364] lstrlenA (lpString="*.rar") returned 5 [0141.364] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chrome-installer.min[1].js", pszSpec="*.7z") returned 0 [0141.364] lstrlenA (lpString="*.7z") returned 4 [0141.364] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chrome-installer.min[1].js", pszSpec="*.tar") returned 0 [0141.365] lstrlenA (lpString="*.tar") returned 5 [0141.365] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chrome-installer.min[1].js", pszSpec="*.gzip") returned 0 [0141.365] lstrlenA (lpString="*.gzip") returned 6 [0141.365] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chrome-installer.min[1].js", pszSpec="*.jpg") returned 0 [0141.365] lstrlenA (lpString="*.jpg") returned 5 [0141.365] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chrome-installer.min[1].js", pszSpec="*.jpeg") returned 0 [0141.365] lstrlenA (lpString="*.jpeg") returned 6 [0141.365] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chrome-installer.min[1].js", pszSpec="*.psd") returned 0 [0141.365] lstrlenA (lpString="*.psd") returned 5 [0141.365] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chrome-installer.min[1].js", pszSpec="*.cdr") returned 0 [0141.365] lstrlenA (lpString="*.cdr") returned 5 [0141.365] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chrome-installer.min[1].js", pszSpec="*.dwg") returned 0 [0141.365] lstrlenA (lpString="*.dwg") returned 5 [0141.365] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chrome-installer.min[1].js", pszSpec="*.max") returned 0 [0141.365] lstrlenA (lpString="*.max") returned 5 [0141.365] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chrome-installer.min[1].js", pszSpec="*.bmp") returned 0 [0141.365] lstrlenA (lpString="*.bmp") returned 5 [0141.365] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chrome-installer.min[1].js", pszSpec="*.gif") returned 0 [0141.365] lstrlenA (lpString="*.gif") returned 5 [0141.365] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chrome-installer.min[1].js", pszSpec="*.png") returned 0 [0141.365] lstrlenA (lpString="*.png") returned 5 [0141.365] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chrome-installer.min[1].js", pszSpec="*.doc") returned 0 [0141.365] lstrlenA (lpString="*.doc") returned 5 [0141.365] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chrome-installer.min[1].js", pszSpec="*.docx") returned 0 [0141.365] lstrlenA (lpString="*.docx") returned 6 [0141.365] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chrome-installer.min[1].js", pszSpec="*.xls") returned 0 [0141.365] lstrlenA (lpString="*.xls") returned 5 [0141.365] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chrome-installer.min[1].js", pszSpec="*.xlsx") returned 0 [0141.365] lstrlenA (lpString="*.xlsx") returned 6 [0141.365] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chrome-installer.min[1].js", pszSpec="*.ppt") returned 0 [0141.365] lstrlenA (lpString="*.ppt") returned 5 [0141.365] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chrome-installer.min[1].js", pszSpec="*.pptx") returned 0 [0141.365] lstrlenA (lpString="*.pptx") returned 6 [0141.365] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chrome-installer.min[1].js", pszSpec="*.txt") returned 0 [0141.365] lstrlenA (lpString="*.txt") returned 5 [0141.365] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chrome-installer.min[1].js", pszSpec="*.pdf") returned 0 [0141.365] lstrlenA (lpString="*.pdf") returned 5 [0141.365] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chrome-installer.min[1].js", pszSpec="*.djvu") returned 0 [0141.365] lstrlenA (lpString="*.djvu") returned 6 [0141.365] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chrome-installer.min[1].js", pszSpec="*.htm") returned 0 [0141.365] lstrlenA (lpString="*.htm") returned 5 [0141.365] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chrome-installer.min[1].js", pszSpec="*.html") returned 0 [0141.365] lstrlenA (lpString="*.html") returned 6 [0141.365] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chrome-installer.min[1].js", pszSpec="*.mdb") returned 0 [0141.365] lstrlenA (lpString="*.mdb") returned 5 [0141.365] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chrome-installer.min[1].js", pszSpec="*.cer") returned 0 [0141.365] lstrlenA (lpString="*.cer") returned 5 [0141.365] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chrome-installer.min[1].js", pszSpec="*.p12") returned 0 [0141.365] lstrlenA (lpString="*.p12") returned 5 [0141.366] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chrome-installer.min[1].js", pszSpec="*.pfx") returned 0 [0141.366] lstrlenA (lpString="*.pfx") returned 5 [0141.366] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chrome-installer.min[1].js", pszSpec="*.kwm") returned 0 [0141.366] lstrlenA (lpString="*.kwm") returned 5 [0141.366] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chrome-installer.min[1].js", pszSpec="*.pwm") returned 0 [0141.366] lstrlenA (lpString="*.pwm") returned 5 [0141.366] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chrome-installer.min[1].js", pszSpec="*.1cd") returned 0 [0141.366] lstrlenA (lpString="*.1cd") returned 5 [0141.366] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chrome-installer.min[1].js", pszSpec="*.md") returned 0 [0141.366] lstrlenA (lpString="*.md") returned 4 [0141.366] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chrome-installer.min[1].js", pszSpec="*.mdf") returned 0 [0141.366] lstrlenA (lpString="*.mdf") returned 5 [0141.366] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chrome-installer.min[1].js", pszSpec="*.dbf") returned 0 [0141.366] lstrlenA (lpString="*.dbf") returned 5 [0141.366] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chrome-installer.min[1].js", pszSpec="*.odt") returned 0 [0141.366] lstrlenA (lpString="*.odt") returned 5 [0141.366] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chrome-installer.min[1].js", pszSpec="*.vob") returned 0 [0141.366] lstrlenA (lpString="*.vob") returned 5 [0141.366] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chrome-installer.min[1].js", pszSpec="*.ifo") returned 0 [0141.366] lstrlenA (lpString="*.ifo") returned 5 [0141.366] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chrome-installer.min[1].js", pszSpec="*.lnk") returned 0 [0141.366] lstrlenA (lpString="*.lnk") returned 5 [0141.366] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chrome-installer.min[1].js", pszSpec="*.torrent") returned 0 [0141.366] lstrlenA (lpString="*.torrent") returned 9 [0141.366] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chrome-installer.min[1].js", pszSpec="*.mov") returned 0 [0141.366] lstrlenA (lpString="*.mov") returned 5 [0141.366] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chrome-installer.min[1].js", pszSpec="*.m2v") returned 0 [0141.366] lstrlenA (lpString="*.m2v") returned 5 [0141.366] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chrome-installer.min[1].js", pszSpec="*.3gp") returned 0 [0141.366] lstrlenA (lpString="*.3gp") returned 5 [0141.366] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chrome-installer.min[1].js", pszSpec="*.mpeg") returned 0 [0141.366] lstrlenA (lpString="*.mpeg") returned 6 [0141.366] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chrome-installer.min[1].js", pszSpec="*.mpg") returned 0 [0141.366] lstrlenA (lpString="*.mpg") returned 5 [0141.366] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chrome-installer.min[1].js", pszSpec="*.flv") returned 0 [0141.366] lstrlenA (lpString="*.flv") returned 5 [0141.366] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chrome-installer.min[1].js", pszSpec="*.avi") returned 0 [0141.366] lstrlenA (lpString="*.avi") returned 5 [0141.366] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chrome-installer.min[1].js", pszSpec="*.mp4") returned 0 [0141.366] lstrlenA (lpString="*.mp4") returned 5 [0141.366] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chrome-installer.min[1].js", pszSpec="*.wmv") returned 0 [0141.366] lstrlenA (lpString="*.wmv") returned 5 [0141.366] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chrome-installer.min[1].js", pszSpec="*.divx") returned 0 [0141.366] lstrlenA (lpString="*.divx") returned 6 [0141.366] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chrome-installer.min[1].js", pszSpec="*.mkv") returned 0 [0141.366] lstrlenA (lpString="*.mkv") returned 5 [0141.366] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chrome-installer.min[1].js", pszSpec="*.mp3") returned 0 [0141.366] lstrlenA (lpString="*.mp3") returned 5 [0141.366] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chrome-installer.min[1].js", pszSpec="*.wav") returned 0 [0141.366] lstrlenA (lpString="*.wav") returned 5 [0141.367] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chrome-installer.min[1].js", pszSpec="*.flac") returned 0 [0141.367] lstrlenA (lpString="*.flac") returned 6 [0141.367] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chrome-installer.min[1].js", pszSpec="*.ape") returned 0 [0141.367] lstrlenA (lpString="*.ape") returned 5 [0141.367] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chrome-installer.min[1].js", pszSpec="*.wma") returned 0 [0141.367] lstrlenA (lpString="*.wma") returned 5 [0141.367] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chrome-installer.min[1].js", pszSpec="*.ac3") returned 0 [0141.367] lstrlenA (lpString="*.ac3") returned 5 [0141.367] FindNextFileA (in: hFindFile=0x5be3a0, lpFindFileData=0xaea68 | out: lpFindFileData=0xaea68) returned 1 [0141.367] PeekMessageA (in: lpMsg=0xaea44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaea44) returned 0 [0141.367] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="chrome_logo_2x[1].png") returned 1 [0141.367] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="chrome_logo_2x[1].png") returned 1 [0141.367] lstrcmpiA (lpString1="", lpString2="chrome_logo_2x[1].png") returned -1 [0141.367] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chrome-installer.min[1].js") returned="chrome-installer.min[1].js" [0141.367] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\", lpString2="chrome_logo_2x[1].png" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chrome_logo_2x[1].png") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chrome_logo_2x[1].png" [0141.367] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chrome_logo_2x[1].png", pszSpec="*.zip") returned 0 [0141.367] lstrlenA (lpString="*.zip") returned 5 [0141.367] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chrome_logo_2x[1].png", pszSpec="*.rar") returned 0 [0141.367] lstrlenA (lpString="*.rar") returned 5 [0141.367] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chrome_logo_2x[1].png", pszSpec="*.7z") returned 0 [0141.367] lstrlenA (lpString="*.7z") returned 4 [0141.367] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chrome_logo_2x[1].png", pszSpec="*.tar") returned 0 [0141.367] lstrlenA (lpString="*.tar") returned 5 [0141.367] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chrome_logo_2x[1].png", pszSpec="*.gzip") returned 0 [0141.367] lstrlenA (lpString="*.gzip") returned 6 [0141.367] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chrome_logo_2x[1].png", pszSpec="*.jpg") returned 0 [0141.367] lstrlenA (lpString="*.jpg") returned 5 [0141.367] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chrome_logo_2x[1].png", pszSpec="*.jpeg") returned 0 [0141.367] lstrlenA (lpString="*.jpeg") returned 6 [0141.367] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chrome_logo_2x[1].png", pszSpec="*.psd") returned 0 [0141.367] lstrlenA (lpString="*.psd") returned 5 [0141.367] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chrome_logo_2x[1].png", pszSpec="*.cdr") returned 0 [0141.367] lstrlenA (lpString="*.cdr") returned 5 [0141.367] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chrome_logo_2x[1].png", pszSpec="*.dwg") returned 0 [0141.367] lstrlenA (lpString="*.dwg") returned 5 [0141.367] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chrome_logo_2x[1].png", pszSpec="*.max") returned 0 [0141.367] lstrlenA (lpString="*.max") returned 5 [0141.367] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chrome_logo_2x[1].png", pszSpec="*.bmp") returned 0 [0141.367] lstrlenA (lpString="*.bmp") returned 5 [0141.367] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chrome_logo_2x[1].png", pszSpec="*.gif") returned 0 [0141.367] lstrlenA (lpString="*.gif") returned 5 [0141.367] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chrome_logo_2x[1].png", pszSpec="*.png") returned 1 [0141.367] lstrlenA (lpString="*.png") returned 5 [0141.367] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chrome_logo_2x[1].png" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chrome_logo_2x[1].png") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chrome_logo_2x[1].png" [0141.367] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chrome_logo_2x[1].png" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chrome_logo_2x[1].png") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chrome_logo_2x[1].png" [0141.367] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chrome_logo_2x[1].png", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chrome_logo_2x[1].png.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chrome_logo_2x[1].png." [0141.367] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chrome_logo_2x[1].png.", lpString2="\xa0" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chrome_logo_2x[1].png. ") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chrome_logo_2x[1].png. " [0141.368] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chrome_logo_2x[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\chrome_logo_2x[1].png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa4 [0141.369] GetFileSize (in: hFile=0xa4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1622 [0141.369] GetFileTime (in: hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x60aec760, dwHighDateTime=0x1d2dd9e), lpLastAccessTime=0x407536*(dwLowDateTime=0x60aec760, dwHighDateTime=0x1d2dd9e), lpLastWriteTime=0x40753e*(dwLowDateTime=0x60aec760, dwHighDateTime=0x1d2dd9e)) returned 1 [0141.369] SetFilePointer (in: hFile=0xa4, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0141.369] ReadFile (in: hFile=0xa4, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x15c8, lpOverlapped=0x0) returned 1 [0141.370] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chrome_logo_2x[1].png") returned="chrome_logo_2x[1].png" [0141.370] SetFilePointer (in: hFile=0xa4, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0141.370] WriteFile (in: hFile=0xa4, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x15c8, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x15c8, lpOverlapped=0x0) returned 1 [0141.370] SetFileTime (hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0141.370] CloseHandle (hObject=0xa4) returned 1 [0141.370] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chrome_logo_2x[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\chrome_logo_2x[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chrome_logo_2x[1].png. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\chrome_logo_2x[1].png. ")) returned 1 [0141.379] FindNextFileA (in: hFindFile=0x5be3a0, lpFindFileData=0xaea68 | out: lpFindFileData=0xaea68) returned 1 [0141.379] PeekMessageA (in: lpMsg=0xaea44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaea44) returned 0 [0141.379] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="close-icon[1].png") returned 1 [0141.379] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="close-icon[1].png") returned 1 [0141.379] lstrcmpiA (lpString1="", lpString2="close-icon[1].png") returned -1 [0141.379] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chrome_logo_2x[1].png") returned="chrome_logo_2x[1].png" [0141.379] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\", lpString2="close-icon[1].png" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\close-icon[1].png") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\close-icon[1].png" [0141.379] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\close-icon[1].png", pszSpec="*.zip") returned 0 [0141.379] lstrlenA (lpString="*.zip") returned 5 [0141.379] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\close-icon[1].png", pszSpec="*.rar") returned 0 [0141.379] lstrlenA (lpString="*.rar") returned 5 [0141.379] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\close-icon[1].png", pszSpec="*.7z") returned 0 [0141.379] lstrlenA (lpString="*.7z") returned 4 [0141.379] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\close-icon[1].png", pszSpec="*.tar") returned 0 [0141.379] lstrlenA (lpString="*.tar") returned 5 [0141.379] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\close-icon[1].png", pszSpec="*.gzip") returned 0 [0141.379] lstrlenA (lpString="*.gzip") returned 6 [0141.379] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\close-icon[1].png", pszSpec="*.jpg") returned 0 [0141.379] lstrlenA (lpString="*.jpg") returned 5 [0141.379] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\close-icon[1].png", pszSpec="*.jpeg") returned 0 [0141.379] lstrlenA (lpString="*.jpeg") returned 6 [0141.379] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\close-icon[1].png", pszSpec="*.psd") returned 0 [0141.379] lstrlenA (lpString="*.psd") returned 5 [0141.379] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\close-icon[1].png", pszSpec="*.cdr") returned 0 [0141.379] lstrlenA (lpString="*.cdr") returned 5 [0141.379] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\close-icon[1].png", pszSpec="*.dwg") returned 0 [0141.379] lstrlenA (lpString="*.dwg") returned 5 [0141.379] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\close-icon[1].png", pszSpec="*.max") returned 0 [0141.379] lstrlenA (lpString="*.max") returned 5 [0141.379] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\close-icon[1].png", pszSpec="*.bmp") returned 0 [0141.379] lstrlenA (lpString="*.bmp") returned 5 [0141.379] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\close-icon[1].png", pszSpec="*.gif") returned 0 [0141.379] lstrlenA (lpString="*.gif") returned 5 [0141.379] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\close-icon[1].png", pszSpec="*.png") returned 1 [0141.379] lstrlenA (lpString="*.png") returned 5 [0141.379] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\close-icon[1].png" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\close-icon[1].png") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\close-icon[1].png" [0141.379] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\close-icon[1].png" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\close-icon[1].png") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\close-icon[1].png" [0141.379] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\close-icon[1].png", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\close-icon[1].png.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\close-icon[1].png." [0141.379] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\close-icon[1].png.", lpString2="\xa0" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\close-icon[1].png. ") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\close-icon[1].png. " [0141.379] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\close-icon[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\close-icon[1].png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa4 [0141.381] GetFileSize (in: hFile=0xa4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x13d [0141.381] GetFileTime (in: hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x610b9d00, dwHighDateTime=0x1d2dd9e), lpLastAccessTime=0x407536*(dwLowDateTime=0x610b9d00, dwHighDateTime=0x1d2dd9e), lpLastWriteTime=0x40753e*(dwLowDateTime=0x610b9d00, dwHighDateTime=0x1d2dd9e)) returned 1 [0141.381] SetFilePointer (in: hFile=0xa4, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0141.381] ReadFile (in: hFile=0xa4, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0xe3, lpOverlapped=0x0) returned 1 [0141.382] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\close-icon[1].png") returned="close-icon[1].png" [0141.382] SetFilePointer (in: hFile=0xa4, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0141.382] WriteFile (in: hFile=0xa4, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0xe3, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0xe3, lpOverlapped=0x0) returned 1 [0141.382] SetFileTime (hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0141.382] CloseHandle (hObject=0xa4) returned 1 [0141.382] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\close-icon[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\close-icon[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\close-icon[1].png. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\close-icon[1].png. ")) returned 1 [0141.383] FindNextFileA (in: hFindFile=0x5be3a0, lpFindFileData=0xaea68 | out: lpFindFileData=0xaea68) returned 1 [0141.383] PeekMessageA (in: lpMsg=0xaea44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaea44) returned 0 [0141.383] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="css[1].txt") returned 1 [0141.383] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="css[1].txt") returned 1 [0141.383] lstrcmpiA (lpString1="", lpString2="css[1].txt") returned -1 [0141.383] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\close-icon[1].png") returned="close-icon[1].png" [0141.383] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\", lpString2="css[1].txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\css[1].txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\css[1].txt" [0141.383] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\css[1].txt", pszSpec="*.zip") returned 0 [0141.383] lstrlenA (lpString="*.zip") returned 5 [0141.384] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\css[1].txt", pszSpec="*.rar") returned 0 [0141.384] lstrlenA (lpString="*.rar") returned 5 [0141.384] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\css[1].txt", pszSpec="*.7z") returned 0 [0141.384] lstrlenA (lpString="*.7z") returned 4 [0141.384] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\css[1].txt", pszSpec="*.tar") returned 0 [0141.384] lstrlenA (lpString="*.tar") returned 5 [0141.384] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\css[1].txt", pszSpec="*.gzip") returned 0 [0141.384] lstrlenA (lpString="*.gzip") returned 6 [0141.384] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\css[1].txt", pszSpec="*.jpg") returned 0 [0141.384] lstrlenA (lpString="*.jpg") returned 5 [0141.384] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\css[1].txt", pszSpec="*.jpeg") returned 0 [0141.384] lstrlenA (lpString="*.jpeg") returned 6 [0141.384] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\css[1].txt", pszSpec="*.psd") returned 0 [0141.384] lstrlenA (lpString="*.psd") returned 5 [0141.384] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\css[1].txt", pszSpec="*.cdr") returned 0 [0141.384] lstrlenA (lpString="*.cdr") returned 5 [0141.384] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\css[1].txt", pszSpec="*.dwg") returned 0 [0141.384] lstrlenA (lpString="*.dwg") returned 5 [0141.384] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\css[1].txt", pszSpec="*.max") returned 0 [0141.384] lstrlenA (lpString="*.max") returned 5 [0141.384] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\css[1].txt", pszSpec="*.bmp") returned 0 [0141.384] lstrlenA (lpString="*.bmp") returned 5 [0141.384] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\css[1].txt", pszSpec="*.gif") returned 0 [0141.384] lstrlenA (lpString="*.gif") returned 5 [0141.384] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\css[1].txt", pszSpec="*.png") returned 0 [0141.384] lstrlenA (lpString="*.png") returned 5 [0141.384] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\css[1].txt", pszSpec="*.doc") returned 0 [0141.384] lstrlenA (lpString="*.doc") returned 5 [0141.384] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\css[1].txt", pszSpec="*.docx") returned 0 [0141.384] lstrlenA (lpString="*.docx") returned 6 [0141.384] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\css[1].txt", pszSpec="*.xls") returned 0 [0141.384] lstrlenA (lpString="*.xls") returned 5 [0141.384] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\css[1].txt", pszSpec="*.xlsx") returned 0 [0141.384] lstrlenA (lpString="*.xlsx") returned 6 [0141.384] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\css[1].txt", pszSpec="*.ppt") returned 0 [0141.384] lstrlenA (lpString="*.ppt") returned 5 [0141.384] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\css[1].txt", pszSpec="*.pptx") returned 0 [0141.384] lstrlenA (lpString="*.pptx") returned 6 [0141.384] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\css[1].txt", pszSpec="*.txt") returned 1 [0141.384] lstrlenA (lpString="*.txt") returned 5 [0141.384] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\css[1].txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\css[1].txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\css[1].txt" [0141.384] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\css[1].txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\css[1].txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\css[1].txt" [0141.384] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\css[1].txt", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\css[1].txt.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\css[1].txt." [0141.384] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\css[1].txt.", lpString2="\xa0" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\css[1].txt. ") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\css[1].txt. " [0141.384] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\css[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\css[1].txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa4 [0141.385] GetFileSize (in: hFile=0xa4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x269b2 [0141.385] GetFileTime (in: hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x54e4ae90, dwHighDateTime=0x1d2dd9e), lpLastAccessTime=0x407536*(dwLowDateTime=0x54e4ae90, dwHighDateTime=0x1d2dd9e), lpLastWriteTime=0x40753e*(dwLowDateTime=0x54e4ae90, dwHighDateTime=0x1d2dd9e)) returned 1 [0141.385] SetFilePointer (in: hFile=0xa4, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0141.385] ReadFile (in: hFile=0xa4, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x26958, lpOverlapped=0x0) returned 1 [0141.400] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\css[1].txt") returned="css[1].txt" [0141.401] SetFilePointer (in: hFile=0xa4, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0141.401] WriteFile (in: hFile=0xa4, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x26958, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x26958, lpOverlapped=0x0) returned 1 [0141.401] SetFileTime (hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0141.401] CloseHandle (hObject=0xa4) returned 1 [0141.402] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\css[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\css[1].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\css[1].txt. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\css[1].txt. ")) returned 1 [0141.403] FindNextFileA (in: hFindFile=0x5be3a0, lpFindFileData=0xaea68 | out: lpFindFileData=0xaea68) returned 1 [0141.403] PeekMessageA (in: lpMsg=0xaea44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaea44) returned 0 [0141.403] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="desktop.ini") returned 1 [0141.403] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="desktop.ini") returned 1 [0141.403] lstrcmpiA (lpString1="", lpString2="desktop.ini") returned -1 [0141.403] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\css[1].txt") returned="css[1].txt" [0141.403] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\", lpString2="desktop.ini" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\desktop.ini") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\desktop.ini" [0141.403] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\desktop.ini", pszSpec="*.zip") returned 0 [0141.403] lstrlenA (lpString="*.zip") returned 5 [0141.403] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\desktop.ini", pszSpec="*.rar") returned 0 [0141.403] lstrlenA (lpString="*.rar") returned 5 [0141.403] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\desktop.ini", pszSpec="*.7z") returned 0 [0141.403] lstrlenA (lpString="*.7z") returned 4 [0141.403] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\desktop.ini", pszSpec="*.tar") returned 0 [0141.403] lstrlenA (lpString="*.tar") returned 5 [0141.403] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\desktop.ini", pszSpec="*.gzip") returned 0 [0141.403] lstrlenA (lpString="*.gzip") returned 6 [0141.403] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\desktop.ini", pszSpec="*.jpg") returned 0 [0141.403] lstrlenA (lpString="*.jpg") returned 5 [0141.403] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\desktop.ini", pszSpec="*.jpeg") returned 0 [0141.403] lstrlenA (lpString="*.jpeg") returned 6 [0141.403] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\desktop.ini", pszSpec="*.psd") returned 0 [0141.403] lstrlenA (lpString="*.psd") returned 5 [0141.403] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\desktop.ini", pszSpec="*.cdr") returned 0 [0141.403] lstrlenA (lpString="*.cdr") returned 5 [0141.403] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\desktop.ini", pszSpec="*.dwg") returned 0 [0141.403] lstrlenA (lpString="*.dwg") returned 5 [0141.403] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\desktop.ini", pszSpec="*.max") returned 0 [0141.404] lstrlenA (lpString="*.max") returned 5 [0141.404] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\desktop.ini", pszSpec="*.bmp") returned 0 [0141.404] lstrlenA (lpString="*.bmp") returned 5 [0141.404] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\desktop.ini", pszSpec="*.gif") returned 0 [0141.404] lstrlenA (lpString="*.gif") returned 5 [0141.404] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\desktop.ini", pszSpec="*.png") returned 0 [0141.404] lstrlenA (lpString="*.png") returned 5 [0141.404] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\desktop.ini", pszSpec="*.doc") returned 0 [0141.404] lstrlenA (lpString="*.doc") returned 5 [0141.404] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\desktop.ini", pszSpec="*.docx") returned 0 [0141.404] lstrlenA (lpString="*.docx") returned 6 [0141.404] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\desktop.ini", pszSpec="*.xls") returned 0 [0141.404] lstrlenA (lpString="*.xls") returned 5 [0141.404] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\desktop.ini", pszSpec="*.xlsx") returned 0 [0141.404] lstrlenA (lpString="*.xlsx") returned 6 [0141.404] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\desktop.ini", pszSpec="*.ppt") returned 0 [0141.404] lstrlenA (lpString="*.ppt") returned 5 [0141.404] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\desktop.ini", pszSpec="*.pptx") returned 0 [0141.404] lstrlenA (lpString="*.pptx") returned 6 [0141.404] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\desktop.ini", pszSpec="*.txt") returned 0 [0141.404] lstrlenA (lpString="*.txt") returned 5 [0141.404] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\desktop.ini", pszSpec="*.pdf") returned 0 [0141.404] lstrlenA (lpString="*.pdf") returned 5 [0141.404] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\desktop.ini", pszSpec="*.djvu") returned 0 [0141.404] lstrlenA (lpString="*.djvu") returned 6 [0141.404] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\desktop.ini", pszSpec="*.htm") returned 0 [0141.404] lstrlenA (lpString="*.htm") returned 5 [0141.404] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\desktop.ini", pszSpec="*.html") returned 0 [0141.404] lstrlenA (lpString="*.html") returned 6 [0141.404] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\desktop.ini", pszSpec="*.mdb") returned 0 [0141.404] lstrlenA (lpString="*.mdb") returned 5 [0141.404] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\desktop.ini", pszSpec="*.cer") returned 0 [0141.404] lstrlenA (lpString="*.cer") returned 5 [0141.404] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\desktop.ini", pszSpec="*.p12") returned 0 [0141.404] lstrlenA (lpString="*.p12") returned 5 [0141.404] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\desktop.ini", pszSpec="*.pfx") returned 0 [0141.404] lstrlenA (lpString="*.pfx") returned 5 [0141.405] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\desktop.ini", pszSpec="*.kwm") returned 0 [0141.405] lstrlenA (lpString="*.kwm") returned 5 [0141.405] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\desktop.ini", pszSpec="*.pwm") returned 0 [0141.405] lstrlenA (lpString="*.pwm") returned 5 [0141.405] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\desktop.ini", pszSpec="*.1cd") returned 0 [0141.405] lstrlenA (lpString="*.1cd") returned 5 [0141.405] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\desktop.ini", pszSpec="*.md") returned 0 [0141.405] lstrlenA (lpString="*.md") returned 4 [0141.405] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\desktop.ini", pszSpec="*.mdf") returned 0 [0141.405] lstrlenA (lpString="*.mdf") returned 5 [0141.405] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\desktop.ini", pszSpec="*.dbf") returned 0 [0141.405] lstrlenA (lpString="*.dbf") returned 5 [0141.405] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\desktop.ini", pszSpec="*.odt") returned 0 [0141.405] lstrlenA (lpString="*.odt") returned 5 [0141.405] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\desktop.ini", pszSpec="*.vob") returned 0 [0141.405] lstrlenA (lpString="*.vob") returned 5 [0141.405] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\desktop.ini", pszSpec="*.ifo") returned 0 [0141.405] lstrlenA (lpString="*.ifo") returned 5 [0141.405] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\desktop.ini", pszSpec="*.lnk") returned 0 [0141.405] lstrlenA (lpString="*.lnk") returned 5 [0141.405] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\desktop.ini", pszSpec="*.torrent") returned 0 [0141.405] lstrlenA (lpString="*.torrent") returned 9 [0141.405] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\desktop.ini", pszSpec="*.mov") returned 0 [0141.405] lstrlenA (lpString="*.mov") returned 5 [0141.405] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\desktop.ini", pszSpec="*.m2v") returned 0 [0141.405] lstrlenA (lpString="*.m2v") returned 5 [0141.405] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\desktop.ini", pszSpec="*.3gp") returned 0 [0141.405] lstrlenA (lpString="*.3gp") returned 5 [0141.405] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\desktop.ini", pszSpec="*.mpeg") returned 0 [0141.405] lstrlenA (lpString="*.mpeg") returned 6 [0141.405] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\desktop.ini", pszSpec="*.mpg") returned 0 [0141.405] lstrlenA (lpString="*.mpg") returned 5 [0141.405] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\desktop.ini", pszSpec="*.flv") returned 0 [0141.405] lstrlenA (lpString="*.flv") returned 5 [0141.405] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\desktop.ini", pszSpec="*.avi") returned 0 [0141.405] lstrlenA (lpString="*.avi") returned 5 [0141.405] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\desktop.ini", pszSpec="*.mp4") returned 0 [0141.406] lstrlenA (lpString="*.mp4") returned 5 [0141.406] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\desktop.ini", pszSpec="*.wmv") returned 0 [0141.406] lstrlenA (lpString="*.wmv") returned 5 [0141.406] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\desktop.ini", pszSpec="*.divx") returned 0 [0141.406] lstrlenA (lpString="*.divx") returned 6 [0141.406] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\desktop.ini", pszSpec="*.mkv") returned 0 [0141.406] lstrlenA (lpString="*.mkv") returned 5 [0141.406] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\desktop.ini", pszSpec="*.mp3") returned 0 [0141.406] lstrlenA (lpString="*.mp3") returned 5 [0141.406] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\desktop.ini", pszSpec="*.wav") returned 0 [0141.406] lstrlenA (lpString="*.wav") returned 5 [0141.406] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\desktop.ini", pszSpec="*.flac") returned 0 [0141.406] lstrlenA (lpString="*.flac") returned 6 [0141.406] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\desktop.ini", pszSpec="*.ape") returned 0 [0141.406] lstrlenA (lpString="*.ape") returned 5 [0141.406] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\desktop.ini", pszSpec="*.wma") returned 0 [0141.406] lstrlenA (lpString="*.wma") returned 5 [0141.406] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\desktop.ini", pszSpec="*.ac3") returned 0 [0141.406] lstrlenA (lpString="*.ac3") returned 5 [0141.406] FindNextFileA (in: hFindFile=0x5be3a0, lpFindFileData=0xaea68 | out: lpFindFileData=0xaea68) returned 1 [0141.406] PeekMessageA (in: lpMsg=0xaea44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaea44) returned 0 [0141.406] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="ebHtml5Banner[1].js") returned -1 [0141.406] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ebHtml5Banner[1].js") returned 1 [0141.406] lstrcmpiA (lpString1="", lpString2="ebHtml5Banner[1].js") returned -1 [0141.406] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\desktop.ini") returned="desktop.ini" [0141.406] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\", lpString2="ebHtml5Banner[1].js" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ebHtml5Banner[1].js") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ebHtml5Banner[1].js" [0141.406] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ebHtml5Banner[1].js", pszSpec="*.zip") returned 0 [0141.406] lstrlenA (lpString="*.zip") returned 5 [0141.406] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ebHtml5Banner[1].js", pszSpec="*.rar") returned 0 [0141.406] lstrlenA (lpString="*.rar") returned 5 [0141.406] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ebHtml5Banner[1].js", pszSpec="*.7z") returned 0 [0141.406] lstrlenA (lpString="*.7z") returned 4 [0141.406] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ebHtml5Banner[1].js", pszSpec="*.tar") returned 0 [0141.406] lstrlenA (lpString="*.tar") returned 5 [0141.406] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ebHtml5Banner[1].js", pszSpec="*.gzip") returned 0 [0141.406] lstrlenA (lpString="*.gzip") returned 6 [0141.406] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ebHtml5Banner[1].js", pszSpec="*.jpg") returned 0 [0141.407] lstrlenA (lpString="*.jpg") returned 5 [0141.407] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ebHtml5Banner[1].js", pszSpec="*.jpeg") returned 0 [0141.407] lstrlenA (lpString="*.jpeg") returned 6 [0141.407] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ebHtml5Banner[1].js", pszSpec="*.psd") returned 0 [0141.407] lstrlenA (lpString="*.psd") returned 5 [0141.407] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ebHtml5Banner[1].js", pszSpec="*.cdr") returned 0 [0141.407] lstrlenA (lpString="*.cdr") returned 5 [0141.407] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ebHtml5Banner[1].js", pszSpec="*.dwg") returned 0 [0141.407] lstrlenA (lpString="*.dwg") returned 5 [0141.407] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ebHtml5Banner[1].js", pszSpec="*.max") returned 0 [0141.407] lstrlenA (lpString="*.max") returned 5 [0141.407] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ebHtml5Banner[1].js", pszSpec="*.bmp") returned 0 [0141.407] lstrlenA (lpString="*.bmp") returned 5 [0141.407] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ebHtml5Banner[1].js", pszSpec="*.gif") returned 0 [0141.407] lstrlenA (lpString="*.gif") returned 5 [0141.407] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ebHtml5Banner[1].js", pszSpec="*.png") returned 0 [0141.407] lstrlenA (lpString="*.png") returned 5 [0141.407] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ebHtml5Banner[1].js", pszSpec="*.doc") returned 0 [0141.407] lstrlenA (lpString="*.doc") returned 5 [0141.407] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ebHtml5Banner[1].js", pszSpec="*.docx") returned 0 [0141.407] lstrlenA (lpString="*.docx") returned 6 [0141.407] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ebHtml5Banner[1].js", pszSpec="*.xls") returned 0 [0141.407] lstrlenA (lpString="*.xls") returned 5 [0141.407] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ebHtml5Banner[1].js", pszSpec="*.xlsx") returned 0 [0141.407] lstrlenA (lpString="*.xlsx") returned 6 [0141.407] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ebHtml5Banner[1].js", pszSpec="*.ppt") returned 0 [0141.407] lstrlenA (lpString="*.ppt") returned 5 [0141.407] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ebHtml5Banner[1].js", pszSpec="*.pptx") returned 0 [0141.407] lstrlenA (lpString="*.pptx") returned 6 [0141.407] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ebHtml5Banner[1].js", pszSpec="*.txt") returned 0 [0141.407] lstrlenA (lpString="*.txt") returned 5 [0141.407] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ebHtml5Banner[1].js", pszSpec="*.pdf") returned 0 [0141.407] lstrlenA (lpString="*.pdf") returned 5 [0141.407] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ebHtml5Banner[1].js", pszSpec="*.djvu") returned 0 [0141.407] lstrlenA (lpString="*.djvu") returned 6 [0141.407] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ebHtml5Banner[1].js", pszSpec="*.htm") returned 0 [0141.407] lstrlenA (lpString="*.htm") returned 5 [0141.407] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ebHtml5Banner[1].js", pszSpec="*.html") returned 0 [0141.408] lstrlenA (lpString="*.html") returned 6 [0141.408] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ebHtml5Banner[1].js", pszSpec="*.mdb") returned 0 [0141.408] lstrlenA (lpString="*.mdb") returned 5 [0141.408] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ebHtml5Banner[1].js", pszSpec="*.cer") returned 0 [0141.408] lstrlenA (lpString="*.cer") returned 5 [0141.408] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ebHtml5Banner[1].js", pszSpec="*.p12") returned 0 [0141.408] lstrlenA (lpString="*.p12") returned 5 [0141.408] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ebHtml5Banner[1].js", pszSpec="*.pfx") returned 0 [0141.408] lstrlenA (lpString="*.pfx") returned 5 [0141.408] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ebHtml5Banner[1].js", pszSpec="*.kwm") returned 0 [0141.408] lstrlenA (lpString="*.kwm") returned 5 [0141.408] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ebHtml5Banner[1].js", pszSpec="*.pwm") returned 0 [0141.408] lstrlenA (lpString="*.pwm") returned 5 [0141.408] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ebHtml5Banner[1].js", pszSpec="*.1cd") returned 0 [0141.408] lstrlenA (lpString="*.1cd") returned 5 [0141.409] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ebHtml5Banner[1].js", pszSpec="*.md") returned 0 [0141.409] lstrlenA (lpString="*.md") returned 4 [0141.409] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ebHtml5Banner[1].js", pszSpec="*.mdf") returned 0 [0141.409] lstrlenA (lpString="*.mdf") returned 5 [0141.409] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ebHtml5Banner[1].js", pszSpec="*.dbf") returned 0 [0141.409] lstrlenA (lpString="*.dbf") returned 5 [0141.409] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ebHtml5Banner[1].js", pszSpec="*.odt") returned 0 [0141.409] lstrlenA (lpString="*.odt") returned 5 [0141.409] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ebHtml5Banner[1].js", pszSpec="*.vob") returned 0 [0141.409] lstrlenA (lpString="*.vob") returned 5 [0141.409] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ebHtml5Banner[1].js", pszSpec="*.ifo") returned 0 [0141.409] lstrlenA (lpString="*.ifo") returned 5 [0141.409] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ebHtml5Banner[1].js", pszSpec="*.lnk") returned 0 [0141.409] lstrlenA (lpString="*.lnk") returned 5 [0141.409] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ebHtml5Banner[1].js", pszSpec="*.torrent") returned 0 [0141.409] lstrlenA (lpString="*.torrent") returned 9 [0141.409] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ebHtml5Banner[1].js", pszSpec="*.mov") returned 0 [0141.409] lstrlenA (lpString="*.mov") returned 5 [0141.409] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ebHtml5Banner[1].js", pszSpec="*.m2v") returned 0 [0141.409] lstrlenA (lpString="*.m2v") returned 5 [0141.409] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ebHtml5Banner[1].js", pszSpec="*.3gp") returned 0 [0141.409] lstrlenA (lpString="*.3gp") returned 5 [0141.409] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ebHtml5Banner[1].js", pszSpec="*.mpeg") returned 0 [0141.409] lstrlenA (lpString="*.mpeg") returned 6 [0141.409] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ebHtml5Banner[1].js", pszSpec="*.mpg") returned 0 [0141.409] lstrlenA (lpString="*.mpg") returned 5 [0141.409] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ebHtml5Banner[1].js", pszSpec="*.flv") returned 0 [0141.409] lstrlenA (lpString="*.flv") returned 5 [0141.409] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ebHtml5Banner[1].js", pszSpec="*.avi") returned 0 [0141.409] lstrlenA (lpString="*.avi") returned 5 [0141.409] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ebHtml5Banner[1].js", pszSpec="*.mp4") returned 0 [0141.409] lstrlenA (lpString="*.mp4") returned 5 [0141.409] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ebHtml5Banner[1].js", pszSpec="*.wmv") returned 0 [0141.409] lstrlenA (lpString="*.wmv") returned 5 [0141.409] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ebHtml5Banner[1].js", pszSpec="*.divx") returned 0 [0141.409] lstrlenA (lpString="*.divx") returned 6 [0141.409] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ebHtml5Banner[1].js", pszSpec="*.mkv") returned 0 [0141.409] lstrlenA (lpString="*.mkv") returned 5 [0141.409] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ebHtml5Banner[1].js", pszSpec="*.mp3") returned 0 [0141.409] lstrlenA (lpString="*.mp3") returned 5 [0141.409] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ebHtml5Banner[1].js", pszSpec="*.wav") returned 0 [0141.409] lstrlenA (lpString="*.wav") returned 5 [0141.409] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ebHtml5Banner[1].js", pszSpec="*.flac") returned 0 [0141.409] lstrlenA (lpString="*.flac") returned 6 [0141.409] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ebHtml5Banner[1].js", pszSpec="*.ape") returned 0 [0141.409] lstrlenA (lpString="*.ape") returned 5 [0141.409] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ebHtml5Banner[1].js", pszSpec="*.wma") returned 0 [0141.409] lstrlenA (lpString="*.wma") returned 5 [0141.409] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ebHtml5Banner[1].js", pszSpec="*.ac3") returned 0 [0141.409] lstrlenA (lpString="*.ac3") returned 5 [0141.410] FindNextFileA (in: hFindFile=0x5be3a0, lpFindFileData=0xaea68 | out: lpFindFileData=0xaea68) returned 1 [0141.410] PeekMessageA (in: lpMsg=0xaea44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaea44) returned 0 [0141.410] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="eula-win[1].jpg") returned -1 [0141.410] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="eula-win[1].jpg") returned 1 [0141.410] lstrcmpiA (lpString1="", lpString2="eula-win[1].jpg") returned -1 [0141.410] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ebHtml5Banner[1].js") returned="ebHtml5Banner[1].js" [0141.410] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\", lpString2="eula-win[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\eula-win[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\eula-win[1].jpg" [0141.410] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\eula-win[1].jpg", pszSpec="*.zip") returned 0 [0141.410] lstrlenA (lpString="*.zip") returned 5 [0141.410] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\eula-win[1].jpg", pszSpec="*.rar") returned 0 [0141.410] lstrlenA (lpString="*.rar") returned 5 [0141.410] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\eula-win[1].jpg", pszSpec="*.7z") returned 0 [0141.410] lstrlenA (lpString="*.7z") returned 4 [0141.410] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\eula-win[1].jpg", pszSpec="*.tar") returned 0 [0141.410] lstrlenA (lpString="*.tar") returned 5 [0141.410] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\eula-win[1].jpg", pszSpec="*.gzip") returned 0 [0141.410] lstrlenA (lpString="*.gzip") returned 6 [0141.410] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\eula-win[1].jpg", pszSpec="*.jpg") returned 1 [0141.410] lstrlenA (lpString="*.jpg") returned 5 [0141.410] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\eula-win[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\eula-win[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\eula-win[1].jpg" [0141.410] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\eula-win[1].jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\eula-win[1].jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\eula-win[1].jpg" [0141.410] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\eula-win[1].jpg", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\eula-win[1].jpg.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\eula-win[1].jpg." [0141.410] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\eula-win[1].jpg.", lpString2="\xa0" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\eula-win[1].jpg. ") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\eula-win[1].jpg. " [0141.410] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\eula-win[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\eula-win[1].jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa4 [0141.411] GetFileSize (in: hFile=0xa4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x5244 [0141.411] GetFileTime (in: hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x64009240, dwHighDateTime=0x1d2dd9e), lpLastAccessTime=0x407536*(dwLowDateTime=0x64009240, dwHighDateTime=0x1d2dd9e), lpLastWriteTime=0x40753e*(dwLowDateTime=0x6402f3a0, dwHighDateTime=0x1d2dd9e)) returned 1 [0141.411] SetFilePointer (in: hFile=0xa4, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0141.411] ReadFile (in: hFile=0xa4, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x51ea, lpOverlapped=0x0) returned 1 [0141.785] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\eula-win[1].jpg") returned="eula-win[1].jpg" [0141.785] SetFilePointer (in: hFile=0xa4, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0141.785] WriteFile (in: hFile=0xa4, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x51ea, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x51ea, lpOverlapped=0x0) returned 1 [0141.785] SetFileTime (hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0141.785] CloseHandle (hObject=0xa4) returned 1 [0141.785] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\eula-win[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\eula-win[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\eula-win[1].jpg. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\eula-win[1].jpg. ")) returned 1 [0141.786] FindNextFileA (in: hFindFile=0x5be3a0, lpFindFileData=0xaea68 | out: lpFindFileData=0xaea68) returned 1 [0141.797] PeekMessageA (in: lpMsg=0xaea44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaea44) returned 0 [0141.797] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1B;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=3;target=_blank;aduho=600;grp=852361999[1]") returned -1 [0141.797] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1B;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=3;target=_blank;aduho=600;grp=852361999[1]") returned 1 [0141.797] lstrcmpiA (lpString1="", lpString2="getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1B;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=3;target=_blank;aduho=600;grp=852361999[1]") returned -1 [0141.797] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\eula-win[1].jpg") returned="eula-win[1].jpg" [0141.797] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\", lpString2="getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1B;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=3;target=_blank;aduho=600;grp=852361999[1]" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1B;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=3;target=_blank;aduho=600;grp=852361999[1]") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1B;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=3;target=_blank;aduho=600;grp=852361999[1]" [0141.797] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1B;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=3;target=_blank;aduho=600;grp=852361999[1]", pszSpec="*.zip") returned 0 [0141.797] lstrlenA (lpString="*.zip") returned 5 [0141.797] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1B;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=3;target=_blank;aduho=600;grp=852361999[1]", pszSpec="*.rar") returned 0 [0141.797] lstrlenA (lpString="*.rar") returned 5 [0141.797] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1B;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=3;target=_blank;aduho=600;grp=852361999[1]", pszSpec="*.7z") returned 0 [0141.797] lstrlenA (lpString="*.7z") returned 4 [0141.797] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1B;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=3;target=_blank;aduho=600;grp=852361999[1]", pszSpec="*.tar") returned 0 [0141.797] lstrlenA (lpString="*.tar") returned 5 [0141.797] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1B;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=3;target=_blank;aduho=600;grp=852361999[1]", pszSpec="*.gzip") returned 0 [0141.797] lstrlenA (lpString="*.gzip") returned 6 [0141.797] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1B;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=3;target=_blank;aduho=600;grp=852361999[1]", pszSpec="*.jpg") returned 0 [0141.797] lstrlenA (lpString="*.jpg") returned 5 [0141.797] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1B;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=3;target=_blank;aduho=600;grp=852361999[1]", pszSpec="*.jpeg") returned 0 [0141.797] lstrlenA (lpString="*.jpeg") returned 6 [0141.797] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1B;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=3;target=_blank;aduho=600;grp=852361999[1]", pszSpec="*.psd") returned 0 [0141.797] lstrlenA (lpString="*.psd") returned 5 [0141.797] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1B;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=3;target=_blank;aduho=600;grp=852361999[1]", pszSpec="*.cdr") returned 0 [0141.797] lstrlenA (lpString="*.cdr") returned 5 [0141.797] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1B;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=3;target=_blank;aduho=600;grp=852361999[1]", pszSpec="*.dwg") returned 0 [0141.797] lstrlenA (lpString="*.dwg") returned 5 [0141.797] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1B;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=3;target=_blank;aduho=600;grp=852361999[1]", pszSpec="*.max") returned 0 [0141.797] lstrlenA (lpString="*.max") returned 5 [0141.797] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1B;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=3;target=_blank;aduho=600;grp=852361999[1]", pszSpec="*.bmp") returned 0 [0141.797] lstrlenA (lpString="*.bmp") returned 5 [0141.797] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1B;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=3;target=_blank;aduho=600;grp=852361999[1]", pszSpec="*.gif") returned 0 [0141.797] lstrlenA (lpString="*.gif") returned 5 [0141.797] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1B;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=3;target=_blank;aduho=600;grp=852361999[1]", pszSpec="*.png") returned 0 [0141.797] lstrlenA (lpString="*.png") returned 5 [0141.797] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1B;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=3;target=_blank;aduho=600;grp=852361999[1]", pszSpec="*.doc") returned 0 [0141.797] lstrlenA (lpString="*.doc") returned 5 [0141.797] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1B;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=3;target=_blank;aduho=600;grp=852361999[1]", pszSpec="*.docx") returned 0 [0141.797] lstrlenA (lpString="*.docx") returned 6 [0141.797] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1B;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=3;target=_blank;aduho=600;grp=852361999[1]", pszSpec="*.xls") returned 0 [0141.797] lstrlenA (lpString="*.xls") returned 5 [0141.798] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1B;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=3;target=_blank;aduho=600;grp=852361999[1]", pszSpec="*.xlsx") returned 0 [0141.798] lstrlenA (lpString="*.xlsx") returned 6 [0141.798] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1B;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=3;target=_blank;aduho=600;grp=852361999[1]", pszSpec="*.ppt") returned 0 [0141.798] lstrlenA (lpString="*.ppt") returned 5 [0141.798] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1B;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=3;target=_blank;aduho=600;grp=852361999[1]", pszSpec="*.pptx") returned 0 [0141.798] lstrlenA (lpString="*.pptx") returned 6 [0141.798] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1B;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=3;target=_blank;aduho=600;grp=852361999[1]", pszSpec="*.txt") returned 0 [0141.798] lstrlenA (lpString="*.txt") returned 5 [0141.798] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1B;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=3;target=_blank;aduho=600;grp=852361999[1]", pszSpec="*.pdf") returned 0 [0141.798] lstrlenA (lpString="*.pdf") returned 5 [0141.798] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1B;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=3;target=_blank;aduho=600;grp=852361999[1]", pszSpec="*.djvu") returned 0 [0141.798] lstrlenA (lpString="*.djvu") returned 6 [0141.798] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1B;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=3;target=_blank;aduho=600;grp=852361999[1]", pszSpec="*.htm") returned 0 [0141.798] lstrlenA (lpString="*.htm") returned 5 [0141.798] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1B;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=3;target=_blank;aduho=600;grp=852361999[1]", pszSpec="*.html") returned 0 [0141.798] lstrlenA (lpString="*.html") returned 6 [0141.798] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1B;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=3;target=_blank;aduho=600;grp=852361999[1]", pszSpec="*.mdb") returned 0 [0141.798] lstrlenA (lpString="*.mdb") returned 5 [0141.798] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1B;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=3;target=_blank;aduho=600;grp=852361999[1]", pszSpec="*.cer") returned 0 [0141.798] lstrlenA (lpString="*.cer") returned 5 [0141.798] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1B;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=3;target=_blank;aduho=600;grp=852361999[1]", pszSpec="*.p12") returned 0 [0141.798] lstrlenA (lpString="*.p12") returned 5 [0141.798] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1B;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=3;target=_blank;aduho=600;grp=852361999[1]", pszSpec="*.pfx") returned 0 [0141.798] lstrlenA (lpString="*.pfx") returned 5 [0141.798] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1B;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=3;target=_blank;aduho=600;grp=852361999[1]", pszSpec="*.kwm") returned 0 [0141.798] lstrlenA (lpString="*.kwm") returned 5 [0141.798] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1B;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=3;target=_blank;aduho=600;grp=852361999[1]", pszSpec="*.pwm") returned 0 [0141.798] lstrlenA (lpString="*.pwm") returned 5 [0141.798] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1B;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=3;target=_blank;aduho=600;grp=852361999[1]", pszSpec="*.1cd") returned 0 [0141.798] lstrlenA (lpString="*.1cd") returned 5 [0141.798] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1B;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=3;target=_blank;aduho=600;grp=852361999[1]", pszSpec="*.md") returned 0 [0141.798] lstrlenA (lpString="*.md") returned 4 [0141.798] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1B;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=3;target=_blank;aduho=600;grp=852361999[1]", pszSpec="*.mdf") returned 0 [0141.798] lstrlenA (lpString="*.mdf") returned 5 [0141.798] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1B;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=3;target=_blank;aduho=600;grp=852361999[1]", pszSpec="*.dbf") returned 0 [0141.798] lstrlenA (lpString="*.dbf") returned 5 [0141.798] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1B;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=3;target=_blank;aduho=600;grp=852361999[1]", pszSpec="*.odt") returned 0 [0141.798] lstrlenA (lpString="*.odt") returned 5 [0141.798] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1B;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=3;target=_blank;aduho=600;grp=852361999[1]", pszSpec="*.vob") returned 0 [0141.798] lstrlenA (lpString="*.vob") returned 5 [0141.798] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1B;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=3;target=_blank;aduho=600;grp=852361999[1]", pszSpec="*.ifo") returned 0 [0141.798] lstrlenA (lpString="*.ifo") returned 5 [0141.798] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1B;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=3;target=_blank;aduho=600;grp=852361999[1]", pszSpec="*.lnk") returned 0 [0141.798] lstrlenA (lpString="*.lnk") returned 5 [0141.798] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1B;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=3;target=_blank;aduho=600;grp=852361999[1]", pszSpec="*.torrent") returned 0 [0141.798] lstrlenA (lpString="*.torrent") returned 9 [0141.798] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1B;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=3;target=_blank;aduho=600;grp=852361999[1]", pszSpec="*.mov") returned 0 [0141.798] lstrlenA (lpString="*.mov") returned 5 [0141.798] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1B;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=3;target=_blank;aduho=600;grp=852361999[1]", pszSpec="*.m2v") returned 0 [0141.799] lstrlenA (lpString="*.m2v") returned 5 [0141.799] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1B;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=3;target=_blank;aduho=600;grp=852361999[1]", pszSpec="*.3gp") returned 0 [0141.799] lstrlenA (lpString="*.3gp") returned 5 [0141.799] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1B;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=3;target=_blank;aduho=600;grp=852361999[1]", pszSpec="*.mpeg") returned 0 [0141.799] lstrlenA (lpString="*.mpeg") returned 6 [0141.799] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1B;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=3;target=_blank;aduho=600;grp=852361999[1]", pszSpec="*.mpg") returned 0 [0141.799] lstrlenA (lpString="*.mpg") returned 5 [0141.799] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1B;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=3;target=_blank;aduho=600;grp=852361999[1]", pszSpec="*.flv") returned 0 [0141.799] lstrlenA (lpString="*.flv") returned 5 [0141.799] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1B;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=3;target=_blank;aduho=600;grp=852361999[1]", pszSpec="*.avi") returned 0 [0141.799] lstrlenA (lpString="*.avi") returned 5 [0141.799] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1B;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=3;target=_blank;aduho=600;grp=852361999[1]", pszSpec="*.mp4") returned 0 [0141.799] lstrlenA (lpString="*.mp4") returned 5 [0141.799] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1B;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=3;target=_blank;aduho=600;grp=852361999[1]", pszSpec="*.wmv") returned 0 [0141.799] lstrlenA (lpString="*.wmv") returned 5 [0141.799] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1B;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=3;target=_blank;aduho=600;grp=852361999[1]", pszSpec="*.divx") returned 0 [0141.799] lstrlenA (lpString="*.divx") returned 6 [0141.799] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1B;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=3;target=_blank;aduho=600;grp=852361999[1]", pszSpec="*.mkv") returned 0 [0141.799] lstrlenA (lpString="*.mkv") returned 5 [0141.799] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1B;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=3;target=_blank;aduho=600;grp=852361999[1]", pszSpec="*.mp3") returned 0 [0141.799] lstrlenA (lpString="*.mp3") returned 5 [0141.799] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1B;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=3;target=_blank;aduho=600;grp=852361999[1]", pszSpec="*.wav") returned 0 [0141.799] lstrlenA (lpString="*.wav") returned 5 [0141.799] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1B;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=3;target=_blank;aduho=600;grp=852361999[1]", pszSpec="*.flac") returned 0 [0141.799] lstrlenA (lpString="*.flac") returned 6 [0141.799] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1B;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=3;target=_blank;aduho=600;grp=852361999[1]", pszSpec="*.ape") returned 0 [0141.799] lstrlenA (lpString="*.ape") returned 5 [0141.799] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1B;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=3;target=_blank;aduho=600;grp=852361999[1]", pszSpec="*.wma") returned 0 [0141.799] lstrlenA (lpString="*.wma") returned 5 [0141.799] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1B;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=3;target=_blank;aduho=600;grp=852361999[1]", pszSpec="*.ac3") returned 0 [0141.799] lstrlenA (lpString="*.ac3") returned 5 [0141.799] FindNextFileA (in: hFindFile=0x5be3a0, lpFindFileData=0xaea68 | out: lpFindFileData=0xaea68) returned 1 [0141.799] PeekMessageA (in: lpMsg=0xaea44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaea44) returned 0 [0141.799] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1C;kvgrp=627518548;kvismob=2;extmirroring=0;kvtile=4;target=_blank;aduho=600;grp=627518548[1]") returned -1 [0141.799] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1C;kvgrp=627518548;kvismob=2;extmirroring=0;kvtile=4;target=_blank;aduho=600;grp=627518548[1]") returned 1 [0141.799] lstrcmpiA (lpString1="", lpString2="getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1C;kvgrp=627518548;kvismob=2;extmirroring=0;kvtile=4;target=_blank;aduho=600;grp=627518548[1]") returned -1 [0141.799] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1B;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=3;target=_blank;aduho=600;grp=852361999[1]") returned="getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1B;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=3;target=_blank;aduho=600;grp=852361999[1]" [0141.799] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\", lpString2="getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1C;kvgrp=627518548;kvismob=2;extmirroring=0;kvtile=4;target=_blank;aduho=600;grp=627518548[1]" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1C;kvgrp=627518548;kvismob=2;extmirroring=0;kvtile=4;target=_blank;aduho=600;grp=627518548[1]") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1C;kvgrp=627518548;kvismob=2;extmirroring=0;kvtile=4;target=_blank;aduho=600;grp=627518548[1]" [0141.799] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1C;kvgrp=627518548;kvismob=2;extmirroring=0;kvtile=4;target=_blank;aduho=600;grp=627518548[1]", pszSpec="*.zip") returned 0 [0141.799] lstrlenA (lpString="*.zip") returned 5 [0141.799] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1C;kvgrp=627518548;kvismob=2;extmirroring=0;kvtile=4;target=_blank;aduho=600;grp=627518548[1]", pszSpec="*.rar") returned 0 [0141.799] lstrlenA (lpString="*.rar") returned 5 [0141.799] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1C;kvgrp=627518548;kvismob=2;extmirroring=0;kvtile=4;target=_blank;aduho=600;grp=627518548[1]", pszSpec="*.7z") returned 0 [0141.799] lstrlenA (lpString="*.7z") returned 4 [0141.799] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1C;kvgrp=627518548;kvismob=2;extmirroring=0;kvtile=4;target=_blank;aduho=600;grp=627518548[1]", pszSpec="*.tar") returned 0 [0141.799] lstrlenA (lpString="*.tar") returned 5 [0141.799] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1C;kvgrp=627518548;kvismob=2;extmirroring=0;kvtile=4;target=_blank;aduho=600;grp=627518548[1]", pszSpec="*.gzip") returned 0 [0141.799] lstrlenA (lpString="*.gzip") returned 6 [0141.800] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1C;kvgrp=627518548;kvismob=2;extmirroring=0;kvtile=4;target=_blank;aduho=600;grp=627518548[1]", pszSpec="*.jpg") returned 0 [0141.800] lstrlenA (lpString="*.jpg") returned 5 [0141.800] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1C;kvgrp=627518548;kvismob=2;extmirroring=0;kvtile=4;target=_blank;aduho=600;grp=627518548[1]", pszSpec="*.jpeg") returned 0 [0141.800] lstrlenA (lpString="*.jpeg") returned 6 [0141.800] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1C;kvgrp=627518548;kvismob=2;extmirroring=0;kvtile=4;target=_blank;aduho=600;grp=627518548[1]", pszSpec="*.psd") returned 0 [0141.800] lstrlenA (lpString="*.psd") returned 5 [0141.800] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1C;kvgrp=627518548;kvismob=2;extmirroring=0;kvtile=4;target=_blank;aduho=600;grp=627518548[1]", pszSpec="*.cdr") returned 0 [0141.800] lstrlenA (lpString="*.cdr") returned 5 [0141.800] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1C;kvgrp=627518548;kvismob=2;extmirroring=0;kvtile=4;target=_blank;aduho=600;grp=627518548[1]", pszSpec="*.dwg") returned 0 [0141.800] lstrlenA (lpString="*.dwg") returned 5 [0141.800] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1C;kvgrp=627518548;kvismob=2;extmirroring=0;kvtile=4;target=_blank;aduho=600;grp=627518548[1]", pszSpec="*.max") returned 0 [0141.800] lstrlenA (lpString="*.max") returned 5 [0141.800] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1C;kvgrp=627518548;kvismob=2;extmirroring=0;kvtile=4;target=_blank;aduho=600;grp=627518548[1]", pszSpec="*.bmp") returned 0 [0141.800] lstrlenA (lpString="*.bmp") returned 5 [0141.800] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1C;kvgrp=627518548;kvismob=2;extmirroring=0;kvtile=4;target=_blank;aduho=600;grp=627518548[1]", pszSpec="*.gif") returned 0 [0141.800] lstrlenA (lpString="*.gif") returned 5 [0141.800] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1C;kvgrp=627518548;kvismob=2;extmirroring=0;kvtile=4;target=_blank;aduho=600;grp=627518548[1]", pszSpec="*.png") returned 0 [0141.800] lstrlenA (lpString="*.png") returned 5 [0141.800] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1C;kvgrp=627518548;kvismob=2;extmirroring=0;kvtile=4;target=_blank;aduho=600;grp=627518548[1]", pszSpec="*.doc") returned 0 [0141.800] lstrlenA (lpString="*.doc") returned 5 [0141.800] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1C;kvgrp=627518548;kvismob=2;extmirroring=0;kvtile=4;target=_blank;aduho=600;grp=627518548[1]", pszSpec="*.docx") returned 0 [0141.800] lstrlenA (lpString="*.docx") returned 6 [0141.800] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1C;kvgrp=627518548;kvismob=2;extmirroring=0;kvtile=4;target=_blank;aduho=600;grp=627518548[1]", pszSpec="*.xls") returned 0 [0141.800] lstrlenA (lpString="*.xls") returned 5 [0141.800] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1C;kvgrp=627518548;kvismob=2;extmirroring=0;kvtile=4;target=_blank;aduho=600;grp=627518548[1]", pszSpec="*.xlsx") returned 0 [0141.800] lstrlenA (lpString="*.xlsx") returned 6 [0141.800] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1C;kvgrp=627518548;kvismob=2;extmirroring=0;kvtile=4;target=_blank;aduho=600;grp=627518548[1]", pszSpec="*.ppt") returned 0 [0141.800] lstrlenA (lpString="*.ppt") returned 5 [0141.800] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1C;kvgrp=627518548;kvismob=2;extmirroring=0;kvtile=4;target=_blank;aduho=600;grp=627518548[1]", pszSpec="*.pptx") returned 0 [0141.800] lstrlenA (lpString="*.pptx") returned 6 [0141.800] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1C;kvgrp=627518548;kvismob=2;extmirroring=0;kvtile=4;target=_blank;aduho=600;grp=627518548[1]", pszSpec="*.txt") returned 0 [0141.800] lstrlenA (lpString="*.txt") returned 5 [0141.800] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1C;kvgrp=627518548;kvismob=2;extmirroring=0;kvtile=4;target=_blank;aduho=600;grp=627518548[1]", pszSpec="*.pdf") returned 0 [0141.800] lstrlenA (lpString="*.pdf") returned 5 [0141.800] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1C;kvgrp=627518548;kvismob=2;extmirroring=0;kvtile=4;target=_blank;aduho=600;grp=627518548[1]", pszSpec="*.djvu") returned 0 [0141.800] lstrlenA (lpString="*.djvu") returned 6 [0141.800] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1C;kvgrp=627518548;kvismob=2;extmirroring=0;kvtile=4;target=_blank;aduho=600;grp=627518548[1]", pszSpec="*.htm") returned 0 [0141.800] lstrlenA (lpString="*.htm") returned 5 [0141.800] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1C;kvgrp=627518548;kvismob=2;extmirroring=0;kvtile=4;target=_blank;aduho=600;grp=627518548[1]", pszSpec="*.html") returned 0 [0141.800] lstrlenA (lpString="*.html") returned 6 [0141.800] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1C;kvgrp=627518548;kvismob=2;extmirroring=0;kvtile=4;target=_blank;aduho=600;grp=627518548[1]", pszSpec="*.mdb") returned 0 [0141.800] lstrlenA (lpString="*.mdb") returned 5 [0141.800] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1C;kvgrp=627518548;kvismob=2;extmirroring=0;kvtile=4;target=_blank;aduho=600;grp=627518548[1]", pszSpec="*.cer") returned 0 [0141.800] lstrlenA (lpString="*.cer") returned 5 [0141.800] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1C;kvgrp=627518548;kvismob=2;extmirroring=0;kvtile=4;target=_blank;aduho=600;grp=627518548[1]", pszSpec="*.p12") returned 0 [0141.800] lstrlenA (lpString="*.p12") returned 5 [0141.800] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1C;kvgrp=627518548;kvismob=2;extmirroring=0;kvtile=4;target=_blank;aduho=600;grp=627518548[1]", pszSpec="*.pfx") returned 0 [0141.800] lstrlenA (lpString="*.pfx") returned 5 [0141.800] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1C;kvgrp=627518548;kvismob=2;extmirroring=0;kvtile=4;target=_blank;aduho=600;grp=627518548[1]", pszSpec="*.kwm") returned 0 [0141.801] lstrlenA (lpString="*.kwm") returned 5 [0141.801] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1C;kvgrp=627518548;kvismob=2;extmirroring=0;kvtile=4;target=_blank;aduho=600;grp=627518548[1]", pszSpec="*.pwm") returned 0 [0141.801] lstrlenA (lpString="*.pwm") returned 5 [0141.801] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1C;kvgrp=627518548;kvismob=2;extmirroring=0;kvtile=4;target=_blank;aduho=600;grp=627518548[1]", pszSpec="*.1cd") returned 0 [0141.801] lstrlenA (lpString="*.1cd") returned 5 [0141.801] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1C;kvgrp=627518548;kvismob=2;extmirroring=0;kvtile=4;target=_blank;aduho=600;grp=627518548[1]", pszSpec="*.md") returned 0 [0141.801] lstrlenA (lpString="*.md") returned 4 [0141.801] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1C;kvgrp=627518548;kvismob=2;extmirroring=0;kvtile=4;target=_blank;aduho=600;grp=627518548[1]", pszSpec="*.mdf") returned 0 [0141.801] lstrlenA (lpString="*.mdf") returned 5 [0141.801] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1C;kvgrp=627518548;kvismob=2;extmirroring=0;kvtile=4;target=_blank;aduho=600;grp=627518548[1]", pszSpec="*.dbf") returned 0 [0141.801] lstrlenA (lpString="*.dbf") returned 5 [0141.801] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1C;kvgrp=627518548;kvismob=2;extmirroring=0;kvtile=4;target=_blank;aduho=600;grp=627518548[1]", pszSpec="*.odt") returned 0 [0141.801] lstrlenA (lpString="*.odt") returned 5 [0141.801] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1C;kvgrp=627518548;kvismob=2;extmirroring=0;kvtile=4;target=_blank;aduho=600;grp=627518548[1]", pszSpec="*.vob") returned 0 [0141.801] lstrlenA (lpString="*.vob") returned 5 [0141.801] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1C;kvgrp=627518548;kvismob=2;extmirroring=0;kvtile=4;target=_blank;aduho=600;grp=627518548[1]", pszSpec="*.ifo") returned 0 [0141.801] lstrlenA (lpString="*.ifo") returned 5 [0141.801] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1C;kvgrp=627518548;kvismob=2;extmirroring=0;kvtile=4;target=_blank;aduho=600;grp=627518548[1]", pszSpec="*.lnk") returned 0 [0141.801] lstrlenA (lpString="*.lnk") returned 5 [0141.801] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1C;kvgrp=627518548;kvismob=2;extmirroring=0;kvtile=4;target=_blank;aduho=600;grp=627518548[1]", pszSpec="*.torrent") returned 0 [0141.801] lstrlenA (lpString="*.torrent") returned 9 [0141.801] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1C;kvgrp=627518548;kvismob=2;extmirroring=0;kvtile=4;target=_blank;aduho=600;grp=627518548[1]", pszSpec="*.mov") returned 0 [0141.801] lstrlenA (lpString="*.mov") returned 5 [0141.801] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1C;kvgrp=627518548;kvismob=2;extmirroring=0;kvtile=4;target=_blank;aduho=600;grp=627518548[1]", pszSpec="*.m2v") returned 0 [0141.801] lstrlenA (lpString="*.m2v") returned 5 [0141.801] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1C;kvgrp=627518548;kvismob=2;extmirroring=0;kvtile=4;target=_blank;aduho=600;grp=627518548[1]", pszSpec="*.3gp") returned 0 [0141.801] lstrlenA (lpString="*.3gp") returned 5 [0141.801] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1C;kvgrp=627518548;kvismob=2;extmirroring=0;kvtile=4;target=_blank;aduho=600;grp=627518548[1]", pszSpec="*.mpeg") returned 0 [0141.801] lstrlenA (lpString="*.mpeg") returned 6 [0141.801] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1C;kvgrp=627518548;kvismob=2;extmirroring=0;kvtile=4;target=_blank;aduho=600;grp=627518548[1]", pszSpec="*.mpg") returned 0 [0141.801] lstrlenA (lpString="*.mpg") returned 5 [0141.801] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1C;kvgrp=627518548;kvismob=2;extmirroring=0;kvtile=4;target=_blank;aduho=600;grp=627518548[1]", pszSpec="*.flv") returned 0 [0141.801] lstrlenA (lpString="*.flv") returned 5 [0141.801] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1C;kvgrp=627518548;kvismob=2;extmirroring=0;kvtile=4;target=_blank;aduho=600;grp=627518548[1]", pszSpec="*.avi") returned 0 [0141.801] lstrlenA (lpString="*.avi") returned 5 [0141.801] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1C;kvgrp=627518548;kvismob=2;extmirroring=0;kvtile=4;target=_blank;aduho=600;grp=627518548[1]", pszSpec="*.mp4") returned 0 [0141.801] lstrlenA (lpString="*.mp4") returned 5 [0141.801] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1C;kvgrp=627518548;kvismob=2;extmirroring=0;kvtile=4;target=_blank;aduho=600;grp=627518548[1]", pszSpec="*.wmv") returned 0 [0141.801] lstrlenA (lpString="*.wmv") returned 5 [0141.801] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1C;kvgrp=627518548;kvismob=2;extmirroring=0;kvtile=4;target=_blank;aduho=600;grp=627518548[1]", pszSpec="*.divx") returned 0 [0141.801] lstrlenA (lpString="*.divx") returned 6 [0141.801] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1C;kvgrp=627518548;kvismob=2;extmirroring=0;kvtile=4;target=_blank;aduho=600;grp=627518548[1]", pszSpec="*.mkv") returned 0 [0141.801] lstrlenA (lpString="*.mkv") returned 5 [0141.801] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1C;kvgrp=627518548;kvismob=2;extmirroring=0;kvtile=4;target=_blank;aduho=600;grp=627518548[1]", pszSpec="*.mp3") returned 0 [0141.801] lstrlenA (lpString="*.mp3") returned 5 [0141.801] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1C;kvgrp=627518548;kvismob=2;extmirroring=0;kvtile=4;target=_blank;aduho=600;grp=627518548[1]", pszSpec="*.wav") returned 0 [0141.801] lstrlenA (lpString="*.wav") returned 5 [0141.801] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1C;kvgrp=627518548;kvismob=2;extmirroring=0;kvtile=4;target=_blank;aduho=600;grp=627518548[1]", pszSpec="*.flac") returned 0 [0141.801] lstrlenA (lpString="*.flac") returned 6 [0141.802] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1C;kvgrp=627518548;kvismob=2;extmirroring=0;kvtile=4;target=_blank;aduho=600;grp=627518548[1]", pszSpec="*.ape") returned 0 [0141.802] lstrlenA (lpString="*.ape") returned 5 [0141.802] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1C;kvgrp=627518548;kvismob=2;extmirroring=0;kvtile=4;target=_blank;aduho=600;grp=627518548[1]", pszSpec="*.wma") returned 0 [0141.802] lstrlenA (lpString="*.wma") returned 5 [0141.802] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1C;kvgrp=627518548;kvismob=2;extmirroring=0;kvtile=4;target=_blank;aduho=600;grp=627518548[1]", pszSpec="*.ac3") returned 0 [0141.802] lstrlenA (lpString="*.ac3") returned 5 [0141.802] FindNextFileA (in: hFindFile=0x5be3a0, lpFindFileData=0xaea68 | out: lpFindFileData=0xaea68) returned 1 [0141.802] PeekMessageA (in: lpMsg=0xaea44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaea44) returned 0 [0141.802] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1C;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=4;target=_blank;aduho=600;grp=852361999[1]") returned -1 [0141.802] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1C;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=4;target=_blank;aduho=600;grp=852361999[1]") returned 1 [0141.802] lstrcmpiA (lpString1="", lpString2="getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1C;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=4;target=_blank;aduho=600;grp=852361999[1]") returned -1 [0141.802] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1C;kvgrp=627518548;kvismob=2;extmirroring=0;kvtile=4;target=_blank;aduho=600;grp=627518548[1]") returned="getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1C;kvgrp=627518548;kvismob=2;extmirroring=0;kvtile=4;target=_blank;aduho=600;grp=627518548[1]" [0141.802] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\", lpString2="getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1C;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=4;target=_blank;aduho=600;grp=852361999[1]" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1C;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=4;target=_blank;aduho=600;grp=852361999[1]") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1C;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=4;target=_blank;aduho=600;grp=852361999[1]" [0141.802] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1C;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=4;target=_blank;aduho=600;grp=852361999[1]", pszSpec="*.zip") returned 0 [0141.802] lstrlenA (lpString="*.zip") returned 5 [0141.802] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1C;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=4;target=_blank;aduho=600;grp=852361999[1]", pszSpec="*.rar") returned 0 [0141.802] lstrlenA (lpString="*.rar") returned 5 [0141.802] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1C;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=4;target=_blank;aduho=600;grp=852361999[1]", pszSpec="*.7z") returned 0 [0141.802] lstrlenA (lpString="*.7z") returned 4 [0141.802] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1C;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=4;target=_blank;aduho=600;grp=852361999[1]", pszSpec="*.tar") returned 0 [0141.802] lstrlenA (lpString="*.tar") returned 5 [0141.802] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1C;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=4;target=_blank;aduho=600;grp=852361999[1]", pszSpec="*.gzip") returned 0 [0141.802] lstrlenA (lpString="*.gzip") returned 6 [0141.802] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1C;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=4;target=_blank;aduho=600;grp=852361999[1]", pszSpec="*.jpg") returned 0 [0141.802] lstrlenA (lpString="*.jpg") returned 5 [0141.802] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1C;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=4;target=_blank;aduho=600;grp=852361999[1]", pszSpec="*.jpeg") returned 0 [0141.802] lstrlenA (lpString="*.jpeg") returned 6 [0141.802] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1C;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=4;target=_blank;aduho=600;grp=852361999[1]", pszSpec="*.psd") returned 0 [0141.802] lstrlenA (lpString="*.psd") returned 5 [0141.802] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1C;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=4;target=_blank;aduho=600;grp=852361999[1]", pszSpec="*.cdr") returned 0 [0141.802] lstrlenA (lpString="*.cdr") returned 5 [0141.802] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1C;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=4;target=_blank;aduho=600;grp=852361999[1]", pszSpec="*.dwg") returned 0 [0141.802] lstrlenA (lpString="*.dwg") returned 5 [0141.802] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1C;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=4;target=_blank;aduho=600;grp=852361999[1]", pszSpec="*.max") returned 0 [0141.802] lstrlenA (lpString="*.max") returned 5 [0141.802] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1C;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=4;target=_blank;aduho=600;grp=852361999[1]", pszSpec="*.bmp") returned 0 [0141.802] lstrlenA (lpString="*.bmp") returned 5 [0141.802] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1C;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=4;target=_blank;aduho=600;grp=852361999[1]", pszSpec="*.gif") returned 0 [0141.802] lstrlenA (lpString="*.gif") returned 5 [0141.802] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1C;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=4;target=_blank;aduho=600;grp=852361999[1]", pszSpec="*.png") returned 0 [0141.802] lstrlenA (lpString="*.png") returned 5 [0141.802] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1C;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=4;target=_blank;aduho=600;grp=852361999[1]", pszSpec="*.doc") returned 0 [0141.802] lstrlenA (lpString="*.doc") returned 5 [0141.802] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1C;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=4;target=_blank;aduho=600;grp=852361999[1]", pszSpec="*.docx") returned 0 [0141.802] lstrlenA (lpString="*.docx") returned 6 [0141.802] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1C;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=4;target=_blank;aduho=600;grp=852361999[1]", pszSpec="*.xls") returned 0 [0141.802] lstrlenA (lpString="*.xls") returned 5 [0141.802] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1C;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=4;target=_blank;aduho=600;grp=852361999[1]", pszSpec="*.xlsx") returned 0 [0141.803] lstrlenA (lpString="*.xlsx") returned 6 [0141.803] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1C;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=4;target=_blank;aduho=600;grp=852361999[1]", pszSpec="*.ppt") returned 0 [0141.803] lstrlenA (lpString="*.ppt") returned 5 [0141.803] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1C;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=4;target=_blank;aduho=600;grp=852361999[1]", pszSpec="*.pptx") returned 0 [0141.803] lstrlenA (lpString="*.pptx") returned 6 [0141.803] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1C;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=4;target=_blank;aduho=600;grp=852361999[1]", pszSpec="*.txt") returned 0 [0141.803] lstrlenA (lpString="*.txt") returned 5 [0141.803] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1C;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=4;target=_blank;aduho=600;grp=852361999[1]", pszSpec="*.pdf") returned 0 [0141.803] lstrlenA (lpString="*.pdf") returned 5 [0141.803] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1C;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=4;target=_blank;aduho=600;grp=852361999[1]", pszSpec="*.djvu") returned 0 [0141.803] lstrlenA (lpString="*.djvu") returned 6 [0141.803] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1C;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=4;target=_blank;aduho=600;grp=852361999[1]", pszSpec="*.htm") returned 0 [0141.803] lstrlenA (lpString="*.htm") returned 5 [0141.803] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1C;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=4;target=_blank;aduho=600;grp=852361999[1]", pszSpec="*.html") returned 0 [0141.803] lstrlenA (lpString="*.html") returned 6 [0141.803] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1C;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=4;target=_blank;aduho=600;grp=852361999[1]", pszSpec="*.mdb") returned 0 [0141.803] lstrlenA (lpString="*.mdb") returned 5 [0141.803] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1C;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=4;target=_blank;aduho=600;grp=852361999[1]", pszSpec="*.cer") returned 0 [0141.803] lstrlenA (lpString="*.cer") returned 5 [0141.803] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1C;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=4;target=_blank;aduho=600;grp=852361999[1]", pszSpec="*.p12") returned 0 [0141.803] lstrlenA (lpString="*.p12") returned 5 [0141.803] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1C;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=4;target=_blank;aduho=600;grp=852361999[1]", pszSpec="*.pfx") returned 0 [0141.803] lstrlenA (lpString="*.pfx") returned 5 [0141.803] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1C;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=4;target=_blank;aduho=600;grp=852361999[1]", pszSpec="*.kwm") returned 0 [0141.803] lstrlenA (lpString="*.kwm") returned 5 [0141.803] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1C;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=4;target=_blank;aduho=600;grp=852361999[1]", pszSpec="*.pwm") returned 0 [0141.803] lstrlenA (lpString="*.pwm") returned 5 [0141.803] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1C;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=4;target=_blank;aduho=600;grp=852361999[1]", pszSpec="*.1cd") returned 0 [0141.803] lstrlenA (lpString="*.1cd") returned 5 [0141.803] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1C;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=4;target=_blank;aduho=600;grp=852361999[1]", pszSpec="*.md") returned 0 [0141.803] lstrlenA (lpString="*.md") returned 4 [0141.803] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1C;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=4;target=_blank;aduho=600;grp=852361999[1]", pszSpec="*.mdf") returned 0 [0141.803] lstrlenA (lpString="*.mdf") returned 5 [0141.803] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1C;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=4;target=_blank;aduho=600;grp=852361999[1]", pszSpec="*.dbf") returned 0 [0141.803] lstrlenA (lpString="*.dbf") returned 5 [0141.803] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1C;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=4;target=_blank;aduho=600;grp=852361999[1]", pszSpec="*.odt") returned 0 [0141.803] lstrlenA (lpString="*.odt") returned 5 [0141.803] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1C;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=4;target=_blank;aduho=600;grp=852361999[1]", pszSpec="*.vob") returned 0 [0141.803] lstrlenA (lpString="*.vob") returned 5 [0141.803] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1C;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=4;target=_blank;aduho=600;grp=852361999[1]", pszSpec="*.ifo") returned 0 [0141.803] lstrlenA (lpString="*.ifo") returned 5 [0141.803] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1C;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=4;target=_blank;aduho=600;grp=852361999[1]", pszSpec="*.lnk") returned 0 [0141.803] lstrlenA (lpString="*.lnk") returned 5 [0141.803] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1C;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=4;target=_blank;aduho=600;grp=852361999[1]", pszSpec="*.torrent") returned 0 [0141.803] lstrlenA (lpString="*.torrent") returned 9 [0141.803] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1C;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=4;target=_blank;aduho=600;grp=852361999[1]", pszSpec="*.mov") returned 0 [0141.803] lstrlenA (lpString="*.mov") returned 5 [0141.803] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1C;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=4;target=_blank;aduho=600;grp=852361999[1]", pszSpec="*.m2v") returned 0 [0141.803] lstrlenA (lpString="*.m2v") returned 5 [0141.804] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1C;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=4;target=_blank;aduho=600;grp=852361999[1]", pszSpec="*.3gp") returned 0 [0141.804] lstrlenA (lpString="*.3gp") returned 5 [0141.804] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1C;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=4;target=_blank;aduho=600;grp=852361999[1]", pszSpec="*.mpeg") returned 0 [0141.804] lstrlenA (lpString="*.mpeg") returned 6 [0141.804] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1C;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=4;target=_blank;aduho=600;grp=852361999[1]", pszSpec="*.mpg") returned 0 [0141.804] lstrlenA (lpString="*.mpg") returned 5 [0141.804] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1C;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=4;target=_blank;aduho=600;grp=852361999[1]", pszSpec="*.flv") returned 0 [0141.804] lstrlenA (lpString="*.flv") returned 5 [0141.804] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1C;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=4;target=_blank;aduho=600;grp=852361999[1]", pszSpec="*.avi") returned 0 [0141.804] lstrlenA (lpString="*.avi") returned 5 [0141.804] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1C;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=4;target=_blank;aduho=600;grp=852361999[1]", pszSpec="*.mp4") returned 0 [0141.804] lstrlenA (lpString="*.mp4") returned 5 [0141.804] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1C;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=4;target=_blank;aduho=600;grp=852361999[1]", pszSpec="*.wmv") returned 0 [0141.804] lstrlenA (lpString="*.wmv") returned 5 [0141.804] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1C;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=4;target=_blank;aduho=600;grp=852361999[1]", pszSpec="*.divx") returned 0 [0141.804] lstrlenA (lpString="*.divx") returned 6 [0141.804] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1C;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=4;target=_blank;aduho=600;grp=852361999[1]", pszSpec="*.mkv") returned 0 [0141.804] lstrlenA (lpString="*.mkv") returned 5 [0141.804] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1C;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=4;target=_blank;aduho=600;grp=852361999[1]", pszSpec="*.mp3") returned 0 [0141.804] lstrlenA (lpString="*.mp3") returned 5 [0141.804] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1C;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=4;target=_blank;aduho=600;grp=852361999[1]", pszSpec="*.wav") returned 0 [0141.804] lstrlenA (lpString="*.wav") returned 5 [0141.804] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1C;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=4;target=_blank;aduho=600;grp=852361999[1]", pszSpec="*.flac") returned 0 [0141.804] lstrlenA (lpString="*.flac") returned 6 [0141.804] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1C;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=4;target=_blank;aduho=600;grp=852361999[1]", pszSpec="*.ape") returned 0 [0141.804] lstrlenA (lpString="*.ape") returned 5 [0141.804] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1C;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=4;target=_blank;aduho=600;grp=852361999[1]", pszSpec="*.wma") returned 0 [0141.804] lstrlenA (lpString="*.wma") returned 5 [0141.804] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1C;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=4;target=_blank;aduho=600;grp=852361999[1]", pszSpec="*.ac3") returned 0 [0141.804] lstrlenA (lpString="*.ac3") returned 5 [0141.804] FindNextFileA (in: hFindFile=0x5be3a0, lpFindFileData=0xaea68 | out: lpFindFileData=0xaea68) returned 1 [0141.804] PeekMessageA (in: lpMsg=0xaea44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaea44) returned 0 [0141.804] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="jquery-1.11.1.min[1].js") returned -1 [0141.804] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="jquery-1.11.1.min[1].js") returned -1 [0141.804] lstrcmpiA (lpString1="", lpString2="jquery-1.11.1.min[1].js") returned -1 [0141.804] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1C;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=4;target=_blank;aduho=600;grp=852361999[1]") returned="getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1C;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=4;target=_blank;aduho=600;grp=852361999[1]" [0141.804] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\", lpString2="jquery-1.11.1.min[1].js" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\jquery-1.11.1.min[1].js") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\jquery-1.11.1.min[1].js" [0141.804] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\jquery-1.11.1.min[1].js", pszSpec="*.zip") returned 0 [0141.804] lstrlenA (lpString="*.zip") returned 5 [0141.804] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\jquery-1.11.1.min[1].js", pszSpec="*.rar") returned 0 [0141.804] lstrlenA (lpString="*.rar") returned 5 [0141.804] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\jquery-1.11.1.min[1].js", pszSpec="*.7z") returned 0 [0141.804] lstrlenA (lpString="*.7z") returned 4 [0141.804] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\jquery-1.11.1.min[1].js", pszSpec="*.tar") returned 0 [0141.804] lstrlenA (lpString="*.tar") returned 5 [0141.804] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\jquery-1.11.1.min[1].js", pszSpec="*.gzip") returned 0 [0141.804] lstrlenA (lpString="*.gzip") returned 6 [0141.804] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\jquery-1.11.1.min[1].js", pszSpec="*.jpg") returned 0 [0141.804] lstrlenA (lpString="*.jpg") returned 5 [0141.805] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\jquery-1.11.1.min[1].js", pszSpec="*.jpeg") returned 0 [0141.805] lstrlenA (lpString="*.jpeg") returned 6 [0141.805] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\jquery-1.11.1.min[1].js", pszSpec="*.psd") returned 0 [0141.805] lstrlenA (lpString="*.psd") returned 5 [0141.805] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\jquery-1.11.1.min[1].js", pszSpec="*.cdr") returned 0 [0141.805] lstrlenA (lpString="*.cdr") returned 5 [0141.805] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\jquery-1.11.1.min[1].js", pszSpec="*.dwg") returned 0 [0141.805] lstrlenA (lpString="*.dwg") returned 5 [0141.805] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\jquery-1.11.1.min[1].js", pszSpec="*.max") returned 0 [0141.805] lstrlenA (lpString="*.max") returned 5 [0141.805] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\jquery-1.11.1.min[1].js", pszSpec="*.bmp") returned 0 [0141.805] lstrlenA (lpString="*.bmp") returned 5 [0141.805] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\jquery-1.11.1.min[1].js", pszSpec="*.gif") returned 0 [0141.805] lstrlenA (lpString="*.gif") returned 5 [0141.805] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\jquery-1.11.1.min[1].js", pszSpec="*.png") returned 0 [0141.805] lstrlenA (lpString="*.png") returned 5 [0141.805] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\jquery-1.11.1.min[1].js", pszSpec="*.doc") returned 0 [0141.805] lstrlenA (lpString="*.doc") returned 5 [0141.805] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\jquery-1.11.1.min[1].js", pszSpec="*.docx") returned 0 [0141.805] lstrlenA (lpString="*.docx") returned 6 [0141.805] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\jquery-1.11.1.min[1].js", pszSpec="*.xls") returned 0 [0141.805] lstrlenA (lpString="*.xls") returned 5 [0141.805] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\jquery-1.11.1.min[1].js", pszSpec="*.xlsx") returned 0 [0141.805] lstrlenA (lpString="*.xlsx") returned 6 [0141.805] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\jquery-1.11.1.min[1].js", pszSpec="*.ppt") returned 0 [0141.805] lstrlenA (lpString="*.ppt") returned 5 [0141.805] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\jquery-1.11.1.min[1].js", pszSpec="*.pptx") returned 0 [0141.805] lstrlenA (lpString="*.pptx") returned 6 [0141.805] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\jquery-1.11.1.min[1].js", pszSpec="*.txt") returned 0 [0141.805] lstrlenA (lpString="*.txt") returned 5 [0141.805] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\jquery-1.11.1.min[1].js", pszSpec="*.pdf") returned 0 [0141.805] lstrlenA (lpString="*.pdf") returned 5 [0141.805] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\jquery-1.11.1.min[1].js", pszSpec="*.djvu") returned 0 [0141.805] lstrlenA (lpString="*.djvu") returned 6 [0141.805] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\jquery-1.11.1.min[1].js", pszSpec="*.htm") returned 0 [0141.805] lstrlenA (lpString="*.htm") returned 5 [0141.805] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\jquery-1.11.1.min[1].js", pszSpec="*.html") returned 0 [0141.805] lstrlenA (lpString="*.html") returned 6 [0141.805] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\jquery-1.11.1.min[1].js", pszSpec="*.mdb") returned 0 [0141.805] lstrlenA (lpString="*.mdb") returned 5 [0141.805] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\jquery-1.11.1.min[1].js", pszSpec="*.cer") returned 0 [0141.805] lstrlenA (lpString="*.cer") returned 5 [0141.805] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\jquery-1.11.1.min[1].js", pszSpec="*.p12") returned 0 [0141.805] lstrlenA (lpString="*.p12") returned 5 [0141.805] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\jquery-1.11.1.min[1].js", pszSpec="*.pfx") returned 0 [0141.805] lstrlenA (lpString="*.pfx") returned 5 [0141.805] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\jquery-1.11.1.min[1].js", pszSpec="*.kwm") returned 0 [0141.805] lstrlenA (lpString="*.kwm") returned 5 [0141.805] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\jquery-1.11.1.min[1].js", pszSpec="*.pwm") returned 0 [0141.806] lstrlenA (lpString="*.pwm") returned 5 [0141.806] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\jquery-1.11.1.min[1].js", pszSpec="*.1cd") returned 0 [0141.806] lstrlenA (lpString="*.1cd") returned 5 [0141.806] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\jquery-1.11.1.min[1].js", pszSpec="*.md") returned 0 [0141.806] lstrlenA (lpString="*.md") returned 4 [0141.806] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\jquery-1.11.1.min[1].js", pszSpec="*.mdf") returned 0 [0141.806] lstrlenA (lpString="*.mdf") returned 5 [0141.806] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\jquery-1.11.1.min[1].js", pszSpec="*.dbf") returned 0 [0141.806] lstrlenA (lpString="*.dbf") returned 5 [0141.806] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\jquery-1.11.1.min[1].js", pszSpec="*.odt") returned 0 [0141.806] lstrlenA (lpString="*.odt") returned 5 [0141.806] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\jquery-1.11.1.min[1].js", pszSpec="*.vob") returned 0 [0141.806] lstrlenA (lpString="*.vob") returned 5 [0141.806] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\jquery-1.11.1.min[1].js", pszSpec="*.ifo") returned 0 [0141.806] lstrlenA (lpString="*.ifo") returned 5 [0141.806] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\jquery-1.11.1.min[1].js", pszSpec="*.lnk") returned 0 [0141.806] lstrlenA (lpString="*.lnk") returned 5 [0141.806] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\jquery-1.11.1.min[1].js", pszSpec="*.torrent") returned 0 [0141.806] lstrlenA (lpString="*.torrent") returned 9 [0141.806] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\jquery-1.11.1.min[1].js", pszSpec="*.mov") returned 0 [0141.806] lstrlenA (lpString="*.mov") returned 5 [0141.806] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\jquery-1.11.1.min[1].js", pszSpec="*.m2v") returned 0 [0141.806] lstrlenA (lpString="*.m2v") returned 5 [0141.806] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\jquery-1.11.1.min[1].js", pszSpec="*.3gp") returned 0 [0141.806] lstrlenA (lpString="*.3gp") returned 5 [0141.806] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\jquery-1.11.1.min[1].js", pszSpec="*.mpeg") returned 0 [0141.806] lstrlenA (lpString="*.mpeg") returned 6 [0141.806] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\jquery-1.11.1.min[1].js", pszSpec="*.mpg") returned 0 [0141.806] lstrlenA (lpString="*.mpg") returned 5 [0141.806] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\jquery-1.11.1.min[1].js", pszSpec="*.flv") returned 0 [0141.806] lstrlenA (lpString="*.flv") returned 5 [0141.806] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\jquery-1.11.1.min[1].js", pszSpec="*.avi") returned 0 [0141.806] lstrlenA (lpString="*.avi") returned 5 [0141.806] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\jquery-1.11.1.min[1].js", pszSpec="*.mp4") returned 0 [0141.806] lstrlenA (lpString="*.mp4") returned 5 [0141.806] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\jquery-1.11.1.min[1].js", pszSpec="*.wmv") returned 0 [0141.806] lstrlenA (lpString="*.wmv") returned 5 [0141.806] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\jquery-1.11.1.min[1].js", pszSpec="*.divx") returned 0 [0141.806] lstrlenA (lpString="*.divx") returned 6 [0141.806] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\jquery-1.11.1.min[1].js", pszSpec="*.mkv") returned 0 [0141.806] lstrlenA (lpString="*.mkv") returned 5 [0141.806] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\jquery-1.11.1.min[1].js", pszSpec="*.mp3") returned 0 [0141.806] lstrlenA (lpString="*.mp3") returned 5 [0141.807] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\jquery-1.11.1.min[1].js", pszSpec="*.wav") returned 0 [0141.807] lstrlenA (lpString="*.wav") returned 5 [0141.807] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\jquery-1.11.1.min[1].js", pszSpec="*.flac") returned 0 [0141.807] lstrlenA (lpString="*.flac") returned 6 [0141.807] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\jquery-1.11.1.min[1].js", pszSpec="*.ape") returned 0 [0141.807] lstrlenA (lpString="*.ape") returned 5 [0141.807] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\jquery-1.11.1.min[1].js", pszSpec="*.wma") returned 0 [0141.807] lstrlenA (lpString="*.wma") returned 5 [0141.807] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\jquery-1.11.1.min[1].js", pszSpec="*.ac3") returned 0 [0141.807] lstrlenA (lpString="*.ac3") returned 5 [0141.807] FindNextFileA (in: hFindFile=0x5be3a0, lpFindFileData=0xaea68 | out: lpFindFileData=0xaea68) returned 1 [0141.807] PeekMessageA (in: lpMsg=0xaea44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaea44) returned 0 [0141.807] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="js[1]") returned -1 [0141.807] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="js[1]") returned -1 [0141.807] lstrcmpiA (lpString1="", lpString2="js[1]") returned -1 [0141.807] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\jquery-1.11.1.min[1].js") returned="jquery-1.11.1.min[1].js" [0141.807] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\", lpString2="js[1]" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\js[1]") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\js[1]" [0141.807] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\js[1]", pszSpec="*.zip") returned 0 [0141.807] lstrlenA (lpString="*.zip") returned 5 [0141.807] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\js[1]", pszSpec="*.rar") returned 0 [0141.807] lstrlenA (lpString="*.rar") returned 5 [0141.807] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\js[1]", pszSpec="*.7z") returned 0 [0141.807] lstrlenA (lpString="*.7z") returned 4 [0141.807] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\js[1]", pszSpec="*.tar") returned 0 [0141.807] lstrlenA (lpString="*.tar") returned 5 [0141.807] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\js[1]", pszSpec="*.gzip") returned 0 [0141.807] lstrlenA (lpString="*.gzip") returned 6 [0141.807] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\js[1]", pszSpec="*.jpg") returned 0 [0141.807] lstrlenA (lpString="*.jpg") returned 5 [0141.807] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\js[1]", pszSpec="*.jpeg") returned 0 [0141.807] lstrlenA (lpString="*.jpeg") returned 6 [0141.807] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\js[1]", pszSpec="*.psd") returned 0 [0141.807] lstrlenA (lpString="*.psd") returned 5 [0141.807] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\js[1]", pszSpec="*.cdr") returned 0 [0141.807] lstrlenA (lpString="*.cdr") returned 5 [0141.807] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\js[1]", pszSpec="*.dwg") returned 0 [0141.807] lstrlenA (lpString="*.dwg") returned 5 [0141.809] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\js[1]", pszSpec="*.max") returned 0 [0141.809] lstrlenA (lpString="*.max") returned 5 [0141.809] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\js[1]", pszSpec="*.bmp") returned 0 [0141.809] lstrlenA (lpString="*.bmp") returned 5 [0141.809] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\js[1]", pszSpec="*.gif") returned 0 [0141.809] lstrlenA (lpString="*.gif") returned 5 [0141.809] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\js[1]", pszSpec="*.png") returned 0 [0141.809] lstrlenA (lpString="*.png") returned 5 [0141.809] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\js[1]", pszSpec="*.doc") returned 0 [0141.809] lstrlenA (lpString="*.doc") returned 5 [0141.809] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\js[1]", pszSpec="*.docx") returned 0 [0141.809] lstrlenA (lpString="*.docx") returned 6 [0141.809] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\js[1]", pszSpec="*.xls") returned 0 [0141.809] lstrlenA (lpString="*.xls") returned 5 [0141.809] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\js[1]", pszSpec="*.xlsx") returned 0 [0141.809] lstrlenA (lpString="*.xlsx") returned 6 [0141.809] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\js[1]", pszSpec="*.ppt") returned 0 [0141.809] lstrlenA (lpString="*.ppt") returned 5 [0141.809] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\js[1]", pszSpec="*.pptx") returned 0 [0141.809] lstrlenA (lpString="*.pptx") returned 6 [0141.809] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\js[1]", pszSpec="*.txt") returned 0 [0141.809] lstrlenA (lpString="*.txt") returned 5 [0141.811] FindNextFileA (in: hFindFile=0x5be3a0, lpFindFileData=0xaea68 | out: lpFindFileData=0xaea68) returned 1 [0141.811] PeekMessageA (in: lpMsg=0xaea44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaea44) returned 0 [0141.811] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="js[2]") returned -1 [0141.811] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="js[2]") returned -1 [0141.811] lstrcmpiA (lpString1="", lpString2="js[2]") returned -1 [0141.811] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\js[1]") returned="js[1]" [0141.811] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\", lpString2="js[2]" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\js[2]") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\js[2]" [0141.811] FindNextFileA (in: hFindFile=0x5be3a0, lpFindFileData=0xaea68 | out: lpFindFileData=0xaea68) returned 1 [0141.811] PeekMessageA (in: lpMsg=0xaea44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaea44) returned 0 [0141.811] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="latest[1].eot") returned -1 [0141.811] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="latest[1].eot") returned -1 [0141.811] lstrcmpiA (lpString1="", lpString2="latest[1].eot") returned -1 [0141.811] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\js[2]") returned="js[2]" [0141.811] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\", lpString2="latest[1].eot" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\latest[1].eot") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\latest[1].eot" [0141.812] FindNextFileA (in: hFindFile=0x5be3a0, lpFindFileData=0xaea68 | out: lpFindFileData=0xaea68) returned 1 [0141.812] PeekMessageA (in: lpMsg=0xaea44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaea44) returned 0 [0141.812] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="latest[2].eot") returned -1 [0141.812] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="latest[2].eot") returned -1 [0141.812] lstrcmpiA (lpString1="", lpString2="latest[2].eot") returned -1 [0141.812] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\latest[1].eot") returned="latest[1].eot" [0141.812] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\", lpString2="latest[2].eot" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\latest[2].eot") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\latest[2].eot" [0141.812] FindNextFileA (in: hFindFile=0x5be3a0, lpFindFileData=0xaea68 | out: lpFindFileData=0xaea68) returned 1 [0141.812] PeekMessageA (in: lpMsg=0xaea44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaea44) returned 0 [0141.812] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="latest[3].eot") returned -1 [0141.812] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="latest[3].eot") returned -1 [0141.812] lstrcmpiA (lpString1="", lpString2="latest[3].eot") returned -1 [0141.812] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\latest[2].eot") returned="latest[2].eot" [0141.812] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\", lpString2="latest[3].eot" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\latest[3].eot") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\latest[3].eot" [0141.812] FindNextFileA (in: hFindFile=0x5be3a0, lpFindFileData=0xaea68 | out: lpFindFileData=0xaea68) returned 1 [0141.812] PeekMessageA (in: lpMsg=0xaea44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaea44) returned 0 [0141.812] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="msn[1].htm") returned -1 [0141.812] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="msn[1].htm") returned -1 [0141.812] lstrcmpiA (lpString1="", lpString2="msn[1].htm") returned -1 [0141.812] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\latest[3].eot") returned="latest[3].eot" [0141.812] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\", lpString2="msn[1].htm" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\msn[1].htm") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\msn[1].htm" [0141.812] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\msn[1].htm" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\msn[1].htm") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\msn[1].htm" [0141.812] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\msn[1].htm" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\msn[1].htm") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\msn[1].htm" [0141.812] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\msn[1].htm", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\msn[1].htm.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\msn[1].htm." [0141.812] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\msn[1].htm.", lpString2="\xa0" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\msn[1].htm. ") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\msn[1].htm. " [0141.812] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\msn[1].htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\msn[1].htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa4 [0141.813] GetFileSize (in: hFile=0xa4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x922 [0141.813] GetFileTime (in: hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x52e4e6f0, dwHighDateTime=0x1d2dd9e), lpLastAccessTime=0x407536*(dwLowDateTime=0x52e4e6f0, dwHighDateTime=0x1d2dd9e), lpLastWriteTime=0x40753e*(dwLowDateTime=0x53122110, dwHighDateTime=0x1d2dd9e)) returned 1 [0141.813] SetFilePointer (in: hFile=0xa4, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0141.813] ReadFile (in: hFile=0xa4, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x8c8, lpOverlapped=0x0) returned 1 [0141.814] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\msn[1].htm") returned="msn[1].htm" [0141.814] SetFilePointer (in: hFile=0xa4, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0141.814] WriteFile (in: hFile=0xa4, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x8c8, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x8c8, lpOverlapped=0x0) returned 1 [0141.814] SetFileTime (hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0141.815] CloseHandle (hObject=0xa4) returned 1 [0141.815] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\msn[1].htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\msn[1].htm"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\msn[1].htm. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\msn[1].htm. ")) returned 1 [0141.815] FindNextFileA (in: hFindFile=0x5be3a0, lpFindFileData=0xaea68 | out: lpFindFileData=0xaea68) returned 1 [0141.815] PeekMessageA (in: lpMsg=0xaea44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaea44) returned 0 [0141.815] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="rpc_shindig_random[1].js") returned -1 [0141.815] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="rpc_shindig_random[1].js") returned -1 [0141.816] lstrcmpiA (lpString1="", lpString2="rpc_shindig_random[1].js") returned -1 [0141.816] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\msn[1].htm") returned="msn[1].htm" [0141.816] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\", lpString2="rpc_shindig_random[1].js" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\rpc_shindig_random[1].js") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\rpc_shindig_random[1].js" [0141.816] FindNextFileA (in: hFindFile=0x5be3a0, lpFindFileData=0xaea68 | out: lpFindFileData=0xaea68) returned 1 [0141.816] PeekMessageA (in: lpMsg=0xaea44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaea44) returned 0 [0141.816] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="thirdparty[1]") returned -1 [0141.816] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="thirdparty[1]") returned -1 [0141.816] lstrcmpiA (lpString1="", lpString2="thirdparty[1]") returned -1 [0141.816] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\rpc_shindig_random[1].js") returned="rpc_shindig_random[1].js" [0141.816] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\", lpString2="thirdparty[1]" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\thirdparty[1]") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\thirdparty[1]" [0141.816] FindNextFileA (in: hFindFile=0x5be3a0, lpFindFileData=0xaea68 | out: lpFindFileData=0xaea68) returned 1 [0141.816] PeekMessageA (in: lpMsg=0xaea44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaea44) returned 0 [0141.816] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="uid[1].htm") returned -1 [0141.816] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="uid[1].htm") returned -1 [0141.816] lstrcmpiA (lpString1="", lpString2="uid[1].htm") returned -1 [0141.816] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\thirdparty[1]") returned="thirdparty[1]" [0141.816] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\", lpString2="uid[1].htm" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\uid[1].htm") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\uid[1].htm" [0141.816] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\uid[1].htm" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\uid[1].htm") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\uid[1].htm" [0141.816] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\uid[1].htm" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\uid[1].htm") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\uid[1].htm" [0141.816] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\uid[1].htm", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\uid[1].htm.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\uid[1].htm." [0141.816] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\uid[1].htm.", lpString2="\xa0" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\uid[1].htm. ") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\uid[1].htm. " [0141.816] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\uid[1].htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\uid[1].htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa4 [0141.817] GetFileSize (in: hFile=0xa4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xa33 [0141.817] GetFileTime (in: hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x54a20810, dwHighDateTime=0x1d2dd9e), lpLastAccessTime=0x407536*(dwLowDateTime=0x54a20810, dwHighDateTime=0x1d2dd9e), lpLastWriteTime=0x40753e*(dwLowDateTime=0x54adeef0, dwHighDateTime=0x1d2dd9e)) returned 1 [0141.817] SetFilePointer (in: hFile=0xa4, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0141.817] ReadFile (in: hFile=0xa4, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x9d9, lpOverlapped=0x0) returned 1 [0141.879] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\uid[1].htm") returned="uid[1].htm" [0141.879] SetFilePointer (in: hFile=0xa4, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0141.879] WriteFile (in: hFile=0xa4, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x9d9, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x9d9, lpOverlapped=0x0) returned 1 [0141.879] SetFileTime (hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0141.879] CloseHandle (hObject=0xa4) returned 1 [0141.880] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\uid[1].htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\uid[1].htm"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\uid[1].htm. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\uid[1].htm. ")) returned 1 [0141.881] FindNextFileA (in: hFindFile=0x5be3a0, lpFindFileData=0xaea68 | out: lpFindFileData=0xaea68) returned 1 [0141.881] PeekMessageA (in: lpMsg=0xaea44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaea44) returned 0 [0141.881] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="v2[1]") returned -1 [0141.881] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="v2[1]") returned -1 [0141.881] lstrcmpiA (lpString1="", lpString2="v2[1]") returned -1 [0141.881] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\uid[1].htm") returned="uid[1].htm" [0141.881] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\", lpString2="v2[1]" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\v2[1]") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\v2[1]" [0141.881] FindNextFileA (in: hFindFile=0x5be3a0, lpFindFileData=0xaea68 | out: lpFindFileData=0xaea68) returned 1 [0141.881] PeekMessageA (in: lpMsg=0xaea44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaea44) returned 0 [0141.881] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="wc-addons[1].css") returned -1 [0141.881] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="wc-addons[1].css") returned -1 [0141.881] lstrcmpiA (lpString1="", lpString2="wc-addons[1].css") returned -1 [0141.881] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\v2[1]") returned="v2[1]" [0141.881] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\", lpString2="wc-addons[1].css" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\wc-addons[1].css") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\wc-addons[1].css" [0141.881] FindNextFileA (in: hFindFile=0x5be3a0, lpFindFileData=0xaea68 | out: lpFindFileData=0xaea68) returned 0 [0141.881] FindClose (in: hFindFile=0x5be3a0 | out: hFindFile=0x5be3a0) returned 1 [0141.881] FindNextFileA (in: hFindFile=0x5be360, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 0 [0141.881] FindClose (in: hFindFile=0x5be360 | out: hFindFile=0x5be360) returned 1 [0141.881] FindNextFileA (in: hFindFile=0x5be320, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0141.882] PeekMessageA (in: lpMsg=0xaece4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaece4) returned 0 [0141.882] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="desktop.ini") returned 1 [0141.882] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="desktop.ini") returned 1 [0141.882] lstrcmpiA (lpString1="", lpString2="desktop.ini") returned -1 [0141.882] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\*.*") returned="*.*" [0141.882] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\", lpString2="desktop.ini" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\desktop.ini") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\desktop.ini" [0141.882] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\desktop.ini", pszSpec="*.zip") returned 0 [0141.882] lstrlenA (lpString="*.zip") returned 5 [0141.882] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\desktop.ini", pszSpec="*.rar") returned 0 [0141.882] lstrlenA (lpString="*.rar") returned 5 [0141.882] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\desktop.ini", pszSpec="*.7z") returned 0 [0141.882] lstrlenA (lpString="*.7z") returned 4 [0141.882] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\desktop.ini", pszSpec="*.tar") returned 0 [0141.882] lstrlenA (lpString="*.tar") returned 5 [0141.882] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\desktop.ini", pszSpec="*.gzip") returned 0 [0141.882] lstrlenA (lpString="*.gzip") returned 6 [0141.882] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\desktop.ini", pszSpec="*.jpg") returned 0 [0141.882] lstrlenA (lpString="*.jpg") returned 5 [0141.882] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\desktop.ini", pszSpec="*.jpeg") returned 0 [0141.882] lstrlenA (lpString="*.jpeg") returned 6 [0141.882] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\desktop.ini", pszSpec="*.psd") returned 0 [0141.882] lstrlenA (lpString="*.psd") returned 5 [0141.882] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\desktop.ini", pszSpec="*.cdr") returned 0 [0141.882] lstrlenA (lpString="*.cdr") returned 5 [0141.882] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\desktop.ini", pszSpec="*.dwg") returned 0 [0141.882] lstrlenA (lpString="*.dwg") returned 5 [0141.882] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\desktop.ini", pszSpec="*.max") returned 0 [0141.882] lstrlenA (lpString="*.max") returned 5 [0141.882] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\desktop.ini", pszSpec="*.bmp") returned 0 [0141.882] lstrlenA (lpString="*.bmp") returned 5 [0141.882] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\desktop.ini", pszSpec="*.gif") returned 0 [0141.882] lstrlenA (lpString="*.gif") returned 5 [0141.882] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\desktop.ini", pszSpec="*.png") returned 0 [0141.882] lstrlenA (lpString="*.png") returned 5 [0141.882] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\desktop.ini", pszSpec="*.doc") returned 0 [0141.882] lstrlenA (lpString="*.doc") returned 5 [0141.883] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\desktop.ini", pszSpec="*.docx") returned 0 [0141.883] lstrlenA (lpString="*.docx") returned 6 [0141.883] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\desktop.ini", pszSpec="*.xls") returned 0 [0141.883] lstrlenA (lpString="*.xls") returned 5 [0141.883] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\desktop.ini", pszSpec="*.xlsx") returned 0 [0141.883] lstrlenA (lpString="*.xlsx") returned 6 [0141.883] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\desktop.ini", pszSpec="*.ppt") returned 0 [0141.883] lstrlenA (lpString="*.ppt") returned 5 [0141.883] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\desktop.ini", pszSpec="*.pptx") returned 0 [0141.883] lstrlenA (lpString="*.pptx") returned 6 [0141.883] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\desktop.ini", pszSpec="*.txt") returned 0 [0141.883] lstrlenA (lpString="*.txt") returned 5 [0141.883] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\desktop.ini", pszSpec="*.pdf") returned 0 [0141.883] lstrlenA (lpString="*.pdf") returned 5 [0141.883] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\desktop.ini", pszSpec="*.djvu") returned 0 [0141.883] lstrlenA (lpString="*.djvu") returned 6 [0141.883] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\desktop.ini", pszSpec="*.htm") returned 0 [0141.883] lstrlenA (lpString="*.htm") returned 5 [0141.883] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\desktop.ini", pszSpec="*.html") returned 0 [0141.883] lstrlenA (lpString="*.html") returned 6 [0141.883] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\desktop.ini", pszSpec="*.mdb") returned 0 [0141.883] lstrlenA (lpString="*.mdb") returned 5 [0141.883] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\desktop.ini", pszSpec="*.cer") returned 0 [0141.883] lstrlenA (lpString="*.cer") returned 5 [0141.883] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\desktop.ini", pszSpec="*.p12") returned 0 [0141.883] lstrlenA (lpString="*.p12") returned 5 [0141.883] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\desktop.ini", pszSpec="*.pfx") returned 0 [0141.883] lstrlenA (lpString="*.pfx") returned 5 [0141.883] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\desktop.ini", pszSpec="*.kwm") returned 0 [0141.883] lstrlenA (lpString="*.kwm") returned 5 [0141.883] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\desktop.ini", pszSpec="*.pwm") returned 0 [0141.883] lstrlenA (lpString="*.pwm") returned 5 [0141.883] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\desktop.ini", pszSpec="*.1cd") returned 0 [0141.883] lstrlenA (lpString="*.1cd") returned 5 [0141.883] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\desktop.ini", pszSpec="*.md") returned 0 [0141.883] lstrlenA (lpString="*.md") returned 4 [0141.883] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\desktop.ini", pszSpec="*.mdf") returned 0 [0141.884] lstrlenA (lpString="*.mdf") returned 5 [0141.884] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\desktop.ini", pszSpec="*.dbf") returned 0 [0141.884] lstrlenA (lpString="*.dbf") returned 5 [0141.884] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\desktop.ini", pszSpec="*.odt") returned 0 [0141.884] lstrlenA (lpString="*.odt") returned 5 [0141.884] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\desktop.ini", pszSpec="*.vob") returned 0 [0141.884] lstrlenA (lpString="*.vob") returned 5 [0141.884] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\desktop.ini", pszSpec="*.ifo") returned 0 [0141.884] lstrlenA (lpString="*.ifo") returned 5 [0141.884] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\desktop.ini", pszSpec="*.lnk") returned 0 [0141.884] lstrlenA (lpString="*.lnk") returned 5 [0141.884] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\desktop.ini", pszSpec="*.torrent") returned 0 [0141.884] lstrlenA (lpString="*.torrent") returned 9 [0141.884] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\desktop.ini", pszSpec="*.mov") returned 0 [0141.884] lstrlenA (lpString="*.mov") returned 5 [0141.884] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\desktop.ini", pszSpec="*.m2v") returned 0 [0141.884] lstrlenA (lpString="*.m2v") returned 5 [0141.884] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\desktop.ini", pszSpec="*.3gp") returned 0 [0141.884] lstrlenA (lpString="*.3gp") returned 5 [0141.884] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\desktop.ini", pszSpec="*.mpeg") returned 0 [0141.884] lstrlenA (lpString="*.mpeg") returned 6 [0141.884] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\desktop.ini", pszSpec="*.mpg") returned 0 [0141.884] lstrlenA (lpString="*.mpg") returned 5 [0141.884] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\desktop.ini", pszSpec="*.flv") returned 0 [0141.884] lstrlenA (lpString="*.flv") returned 5 [0141.884] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\desktop.ini", pszSpec="*.avi") returned 0 [0141.884] lstrlenA (lpString="*.avi") returned 5 [0141.884] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\desktop.ini", pszSpec="*.mp4") returned 0 [0141.884] lstrlenA (lpString="*.mp4") returned 5 [0141.884] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\desktop.ini", pszSpec="*.wmv") returned 0 [0141.884] lstrlenA (lpString="*.wmv") returned 5 [0141.884] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\desktop.ini", pszSpec="*.divx") returned 0 [0141.884] lstrlenA (lpString="*.divx") returned 6 [0141.884] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\desktop.ini", pszSpec="*.mkv") returned 0 [0141.884] lstrlenA (lpString="*.mkv") returned 5 [0141.884] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\desktop.ini", pszSpec="*.mp3") returned 0 [0141.884] lstrlenA (lpString="*.mp3") returned 5 [0141.884] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\desktop.ini", pszSpec="*.wav") returned 0 [0141.884] lstrlenA (lpString="*.wav") returned 5 [0141.885] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\desktop.ini", pszSpec="*.flac") returned 0 [0141.885] lstrlenA (lpString="*.flac") returned 6 [0141.885] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\desktop.ini", pszSpec="*.ape") returned 0 [0141.885] lstrlenA (lpString="*.ape") returned 5 [0141.885] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\desktop.ini", pszSpec="*.wma") returned 0 [0141.885] lstrlenA (lpString="*.wma") returned 5 [0141.885] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\desktop.ini", pszSpec="*.ac3") returned 0 [0141.885] lstrlenA (lpString="*.ac3") returned 5 [0141.885] FindNextFileA (in: hFindFile=0x5be320, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0141.885] PeekMessageA (in: lpMsg=0xaece4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaece4) returned 0 [0141.885] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="MSIMGSIZ.DAT") returned -1 [0141.885] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSIMGSIZ.DAT") returned -1 [0141.885] lstrcmpiA (lpString1="", lpString2="MSIMGSIZ.DAT") returned -1 [0141.885] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\desktop.ini") returned="desktop.ini" [0141.885] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\", lpString2="MSIMGSIZ.DAT" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\MSIMGSIZ.DAT") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\MSIMGSIZ.DAT" [0141.885] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\MSIMGSIZ.DAT", pszSpec="*.zip") returned 0 [0141.885] lstrlenA (lpString="*.zip") returned 5 [0141.885] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\MSIMGSIZ.DAT", pszSpec="*.rar") returned 0 [0141.885] lstrlenA (lpString="*.rar") returned 5 [0141.885] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\MSIMGSIZ.DAT", pszSpec="*.7z") returned 0 [0141.885] lstrlenA (lpString="*.7z") returned 4 [0141.885] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\MSIMGSIZ.DAT", pszSpec="*.tar") returned 0 [0141.885] lstrlenA (lpString="*.tar") returned 5 [0141.885] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\MSIMGSIZ.DAT", pszSpec="*.gzip") returned 0 [0141.885] lstrlenA (lpString="*.gzip") returned 6 [0141.885] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\MSIMGSIZ.DAT", pszSpec="*.jpg") returned 0 [0141.885] lstrlenA (lpString="*.jpg") returned 5 [0141.885] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\MSIMGSIZ.DAT", pszSpec="*.jpeg") returned 0 [0141.885] lstrlenA (lpString="*.jpeg") returned 6 [0141.885] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\MSIMGSIZ.DAT", pszSpec="*.psd") returned 0 [0141.885] lstrlenA (lpString="*.psd") returned 5 [0141.885] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\MSIMGSIZ.DAT", pszSpec="*.cdr") returned 0 [0141.885] lstrlenA (lpString="*.cdr") returned 5 [0141.885] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\MSIMGSIZ.DAT", pszSpec="*.dwg") returned 0 [0141.885] lstrlenA (lpString="*.dwg") returned 5 [0141.886] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\MSIMGSIZ.DAT", pszSpec="*.max") returned 0 [0141.886] lstrlenA (lpString="*.max") returned 5 [0141.886] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\MSIMGSIZ.DAT", pszSpec="*.bmp") returned 0 [0141.886] lstrlenA (lpString="*.bmp") returned 5 [0141.886] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\MSIMGSIZ.DAT", pszSpec="*.gif") returned 0 [0141.886] lstrlenA (lpString="*.gif") returned 5 [0141.886] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\MSIMGSIZ.DAT", pszSpec="*.png") returned 0 [0141.886] lstrlenA (lpString="*.png") returned 5 [0141.886] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\MSIMGSIZ.DAT", pszSpec="*.doc") returned 0 [0141.886] lstrlenA (lpString="*.doc") returned 5 [0141.886] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\MSIMGSIZ.DAT", pszSpec="*.docx") returned 0 [0141.886] lstrlenA (lpString="*.docx") returned 6 [0141.886] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\MSIMGSIZ.DAT", pszSpec="*.xls") returned 0 [0141.886] lstrlenA (lpString="*.xls") returned 5 [0141.886] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\MSIMGSIZ.DAT", pszSpec="*.xlsx") returned 0 [0141.886] lstrlenA (lpString="*.xlsx") returned 6 [0141.886] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\MSIMGSIZ.DAT", pszSpec="*.ppt") returned 0 [0141.886] lstrlenA (lpString="*.ppt") returned 5 [0141.886] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\MSIMGSIZ.DAT", pszSpec="*.pptx") returned 0 [0141.886] lstrlenA (lpString="*.pptx") returned 6 [0141.886] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\MSIMGSIZ.DAT", pszSpec="*.txt") returned 0 [0141.886] lstrlenA (lpString="*.txt") returned 5 [0141.886] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\MSIMGSIZ.DAT", pszSpec="*.pdf") returned 0 [0141.886] lstrlenA (lpString="*.pdf") returned 5 [0141.886] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\MSIMGSIZ.DAT", pszSpec="*.djvu") returned 0 [0141.886] lstrlenA (lpString="*.djvu") returned 6 [0141.886] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\MSIMGSIZ.DAT", pszSpec="*.htm") returned 0 [0141.886] lstrlenA (lpString="*.htm") returned 5 [0141.886] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\MSIMGSIZ.DAT", pszSpec="*.html") returned 0 [0141.886] lstrlenA (lpString="*.html") returned 6 [0141.886] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\MSIMGSIZ.DAT", pszSpec="*.mdb") returned 0 [0141.886] lstrlenA (lpString="*.mdb") returned 5 [0141.886] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\MSIMGSIZ.DAT", pszSpec="*.cer") returned 0 [0141.886] lstrlenA (lpString="*.cer") returned 5 [0141.886] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\MSIMGSIZ.DAT", pszSpec="*.p12") returned 0 [0141.886] lstrlenA (lpString="*.p12") returned 5 [0141.886] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\MSIMGSIZ.DAT", pszSpec="*.pfx") returned 0 [0141.886] lstrlenA (lpString="*.pfx") returned 5 [0141.886] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\MSIMGSIZ.DAT", pszSpec="*.kwm") returned 0 [0141.887] lstrlenA (lpString="*.kwm") returned 5 [0141.887] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\MSIMGSIZ.DAT", pszSpec="*.pwm") returned 0 [0141.887] lstrlenA (lpString="*.pwm") returned 5 [0141.887] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\MSIMGSIZ.DAT", pszSpec="*.1cd") returned 0 [0141.887] lstrlenA (lpString="*.1cd") returned 5 [0141.887] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\MSIMGSIZ.DAT", pszSpec="*.md") returned 0 [0141.887] lstrlenA (lpString="*.md") returned 4 [0141.887] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\MSIMGSIZ.DAT", pszSpec="*.mdf") returned 0 [0141.887] lstrlenA (lpString="*.mdf") returned 5 [0141.887] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\MSIMGSIZ.DAT", pszSpec="*.dbf") returned 0 [0141.887] lstrlenA (lpString="*.dbf") returned 5 [0141.887] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\MSIMGSIZ.DAT", pszSpec="*.odt") returned 0 [0141.887] lstrlenA (lpString="*.odt") returned 5 [0141.887] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\MSIMGSIZ.DAT", pszSpec="*.vob") returned 0 [0141.887] lstrlenA (lpString="*.vob") returned 5 [0141.887] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\MSIMGSIZ.DAT", pszSpec="*.ifo") returned 0 [0141.887] lstrlenA (lpString="*.ifo") returned 5 [0141.887] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\MSIMGSIZ.DAT", pszSpec="*.lnk") returned 0 [0141.887] lstrlenA (lpString="*.lnk") returned 5 [0141.887] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\MSIMGSIZ.DAT", pszSpec="*.torrent") returned 0 [0141.887] lstrlenA (lpString="*.torrent") returned 9 [0141.887] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\MSIMGSIZ.DAT", pszSpec="*.mov") returned 0 [0141.887] lstrlenA (lpString="*.mov") returned 5 [0141.887] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\MSIMGSIZ.DAT", pszSpec="*.m2v") returned 0 [0141.887] lstrlenA (lpString="*.m2v") returned 5 [0141.887] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\MSIMGSIZ.DAT", pszSpec="*.3gp") returned 0 [0141.887] lstrlenA (lpString="*.3gp") returned 5 [0141.887] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\MSIMGSIZ.DAT", pszSpec="*.mpeg") returned 0 [0141.887] lstrlenA (lpString="*.mpeg") returned 6 [0141.887] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\MSIMGSIZ.DAT", pszSpec="*.mpg") returned 0 [0141.887] lstrlenA (lpString="*.mpg") returned 5 [0141.887] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\MSIMGSIZ.DAT", pszSpec="*.flv") returned 0 [0141.887] lstrlenA (lpString="*.flv") returned 5 [0141.887] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\MSIMGSIZ.DAT", pszSpec="*.avi") returned 0 [0141.887] lstrlenA (lpString="*.avi") returned 5 [0141.887] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\MSIMGSIZ.DAT", pszSpec="*.mp4") returned 0 [0141.887] lstrlenA (lpString="*.mp4") returned 5 [0141.887] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\MSIMGSIZ.DAT", pszSpec="*.wmv") returned 0 [0141.888] lstrlenA (lpString="*.wmv") returned 5 [0141.888] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\MSIMGSIZ.DAT", pszSpec="*.divx") returned 0 [0141.888] lstrlenA (lpString="*.divx") returned 6 [0141.888] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\MSIMGSIZ.DAT", pszSpec="*.mkv") returned 0 [0141.888] lstrlenA (lpString="*.mkv") returned 5 [0141.888] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\MSIMGSIZ.DAT", pszSpec="*.mp3") returned 0 [0141.888] lstrlenA (lpString="*.mp3") returned 5 [0141.888] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\MSIMGSIZ.DAT", pszSpec="*.wav") returned 0 [0141.888] lstrlenA (lpString="*.wav") returned 5 [0141.888] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\MSIMGSIZ.DAT", pszSpec="*.flac") returned 0 [0141.888] lstrlenA (lpString="*.flac") returned 6 [0141.888] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\MSIMGSIZ.DAT", pszSpec="*.ape") returned 0 [0141.888] lstrlenA (lpString="*.ape") returned 5 [0141.888] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\MSIMGSIZ.DAT", pszSpec="*.wma") returned 0 [0141.888] lstrlenA (lpString="*.wma") returned 5 [0141.888] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\MSIMGSIZ.DAT", pszSpec="*.ac3") returned 0 [0141.888] lstrlenA (lpString="*.ac3") returned 5 [0141.888] FindNextFileA (in: hFindFile=0x5be320, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 0 [0141.888] FindClose (in: hFindFile=0x5be320 | out: hFindFile=0x5be320) returned 1 [0141.888] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0141.888] lstrcmpA (lpString1=".", lpString2="Virtualized") returned -1 [0141.888] lstrcmpA (lpString1="..", lpString2="Virtualized") returned -1 [0141.888] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\*.*") returned="*.*" [0141.888] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\", lpString2="Virtualized" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized" [0141.888] lstrlenA (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized") returned 98 [0141.888] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\*.*", lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 0x5be320 [0141.889] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0141.889] FindNextFileA (in: hFindFile=0x5be320, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0141.889] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0141.889] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0141.889] FindNextFileA (in: hFindFile=0x5be320, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0141.889] lstrcmpA (lpString1=".", lpString2="C") returned -1 [0141.889] lstrcmpA (lpString1="..", lpString2="C") returned -1 [0141.889] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\*.*") returned="*.*" [0141.889] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\", lpString2="C" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C" [0141.889] lstrlenA (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C") returned 100 [0141.889] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\*.*", lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 0x5be360 [0141.890] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0141.890] FindNextFileA (in: hFindFile=0x5be360, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 1 [0141.890] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0141.890] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0141.890] FindNextFileA (in: hFindFile=0x5be360, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 1 [0141.890] lstrcmpA (lpString1=".", lpString2="Users") returned -1 [0141.890] lstrcmpA (lpString1="..", lpString2="Users") returned -1 [0141.890] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\*.*") returned="*.*" [0141.891] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\", lpString2="Users" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users" [0141.891] lstrlenA (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users") returned 106 [0141.891] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\*.*", lpFindFileData=0xaea68 | out: lpFindFileData=0xaea68) returned 0x5be3a0 [0141.891] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0141.891] FindNextFileA (in: hFindFile=0x5be3a0, lpFindFileData=0xaea68 | out: lpFindFileData=0xaea68) returned 1 [0141.891] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0141.891] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0141.891] FindNextFileA (in: hFindFile=0x5be3a0, lpFindFileData=0xaea68 | out: lpFindFileData=0xaea68) returned 1 [0141.891] lstrcmpA (lpString1=".", lpString2="5p5NrGJn0jS HALPmcxz") returned -1 [0141.891] lstrcmpA (lpString1="..", lpString2="5p5NrGJn0jS HALPmcxz") returned -1 [0141.891] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\*.*") returned="*.*" [0141.891] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\", lpString2="5p5NrGJn0jS HALPmcxz" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\5p5NrGJn0jS HALPmcxz") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\5p5NrGJn0jS HALPmcxz" [0141.891] lstrlenA (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\5p5NrGJn0jS HALPmcxz") returned 127 [0141.891] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\5p5NrGJn0jS HALPmcxz\\*.*", lpFindFileData=0xae918 | out: lpFindFileData=0xae918) returned 0x5be3e0 [0141.891] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0141.891] FindNextFileA (in: hFindFile=0x5be3e0, lpFindFileData=0xae918 | out: lpFindFileData=0xae918) returned 1 [0141.891] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0141.891] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0141.892] FindNextFileA (in: hFindFile=0x5be3e0, lpFindFileData=0xae918 | out: lpFindFileData=0xae918) returned 1 [0141.892] lstrcmpA (lpString1=".", lpString2="AppData") returned -1 [0141.892] lstrcmpA (lpString1="..", lpString2="AppData") returned -1 [0141.892] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\5p5NrGJn0jS HALPmcxz\\*.*") returned="*.*" [0141.892] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\5p5NrGJn0jS HALPmcxz\\", lpString2="AppData" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\5p5NrGJn0jS HALPmcxz\\AppData") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\5p5NrGJn0jS HALPmcxz\\AppData" [0141.892] lstrlenA (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\5p5NrGJn0jS HALPmcxz\\AppData") returned 135 [0141.892] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\*.*", lpFindFileData=0xae7c8 | out: lpFindFileData=0xae7c8) returned 0x5be420 [0141.893] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0141.893] FindNextFileA (in: hFindFile=0x5be420, lpFindFileData=0xae7c8 | out: lpFindFileData=0xae7c8) returned 1 [0141.893] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0141.893] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0141.893] FindNextFileA (in: hFindFile=0x5be420, lpFindFileData=0xae7c8 | out: lpFindFileData=0xae7c8) returned 1 [0141.893] lstrcmpA (lpString1=".", lpString2="Roaming") returned -1 [0141.893] lstrcmpA (lpString1="..", lpString2="Roaming") returned -1 [0141.893] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\*.*") returned="*.*" [0141.893] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\", lpString2="Roaming" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming" [0141.893] lstrlenA (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 143 [0141.893] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\*.*", lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0x5be460 [0141.893] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0141.893] FindNextFileA (in: hFindFile=0x5be460, lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 1 [0141.893] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0141.893] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0141.893] FindNextFileA (in: hFindFile=0x5be460, lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 1 [0141.893] lstrcmpA (lpString1=".", lpString2="Microsoft") returned -1 [0141.893] lstrcmpA (lpString1="..", lpString2="Microsoft") returned -1 [0141.893] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\*.*") returned="*.*" [0141.893] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\", lpString2="Microsoft" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft" [0141.893] lstrlenA (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft") returned 153 [0141.893] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\*.*", lpFindFileData=0xae528 | out: lpFindFileData=0xae528) returned 0x5be4a0 [0141.894] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0141.894] FindNextFileA (in: hFindFile=0x5be4a0, lpFindFileData=0xae528 | out: lpFindFileData=0xae528) returned 1 [0141.894] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0141.894] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0141.894] FindNextFileA (in: hFindFile=0x5be4a0, lpFindFileData=0xae528 | out: lpFindFileData=0xae528) returned 1 [0141.894] lstrcmpA (lpString1=".", lpString2="Windows") returned -1 [0141.894] lstrcmpA (lpString1="..", lpString2="Windows") returned -1 [0141.894] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\*.*") returned="*.*" [0141.894] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\", lpString2="Windows" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows" [0141.894] lstrlenA (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows") returned 161 [0141.894] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\*.*", lpFindFileData=0xae3d8 | out: lpFindFileData=0xae3d8) returned 0x5be4e0 [0141.895] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0141.895] FindNextFileA (in: hFindFile=0x5be4e0, lpFindFileData=0xae3d8 | out: lpFindFileData=0xae3d8) returned 1 [0141.895] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0141.895] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0141.895] FindNextFileA (in: hFindFile=0x5be4e0, lpFindFileData=0xae3d8 | out: lpFindFileData=0xae3d8) returned 1 [0141.895] lstrcmpA (lpString1=".", lpString2="PrivacIE") returned -1 [0141.895] lstrcmpA (lpString1="..", lpString2="PrivacIE") returned -1 [0141.895] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\*.*") returned="*.*" [0141.895] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\", lpString2="PrivacIE" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE" [0141.895] lstrlenA (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE") returned 170 [0141.895] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\*.*", lpFindFileData=0xae288 | out: lpFindFileData=0xae288) returned 0x5be520 [0141.895] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0141.895] FindNextFileA (in: hFindFile=0x5be520, lpFindFileData=0xae288 | out: lpFindFileData=0xae288) returned 1 [0141.895] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0141.895] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0141.895] FindNextFileA (in: hFindFile=0x5be520, lpFindFileData=0xae288 | out: lpFindFileData=0xae288) returned 1 [0141.895] lstrcmpA (lpString1=".", lpString2="Low") returned -1 [0141.895] lstrcmpA (lpString1="..", lpString2="Low") returned -1 [0141.895] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\*.*") returned="*.*" [0141.895] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\", lpString2="Low" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\Low") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\Low" [0141.896] lstrlenA (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\Low") returned 174 [0141.896] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\Low\\*.*", lpFindFileData=0xae138 | out: lpFindFileData=0xae138) returned 0x5be560 [0141.896] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0141.896] FindNextFileA (in: hFindFile=0x5be560, lpFindFileData=0xae138 | out: lpFindFileData=0xae138) returned 1 [0141.896] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0141.896] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0141.896] FindNextFileA (in: hFindFile=0x5be560, lpFindFileData=0xae138 | out: lpFindFileData=0xae138) returned 0 [0141.896] FindClose (in: hFindFile=0x5be560 | out: hFindFile=0x5be560) returned 1 [0141.896] FindNextFileA (in: hFindFile=0x5be520, lpFindFileData=0xae288 | out: lpFindFileData=0xae288) returned 0 [0141.896] FindClose (in: hFindFile=0x5be520 | out: hFindFile=0x5be520) returned 1 [0141.896] FindNextFileA (in: hFindFile=0x5be4e0, lpFindFileData=0xae3d8 | out: lpFindFileData=0xae3d8) returned 0 [0141.896] FindClose (in: hFindFile=0x5be4e0 | out: hFindFile=0x5be4e0) returned 1 [0141.896] FindNextFileA (in: hFindFile=0x5be4a0, lpFindFileData=0xae528 | out: lpFindFileData=0xae528) returned 0 [0141.896] FindClose (in: hFindFile=0x5be4a0 | out: hFindFile=0x5be4a0) returned 1 [0141.896] FindNextFileA (in: hFindFile=0x5be460, lpFindFileData=0xae678 | out: lpFindFileData=0xae678) returned 0 [0141.896] FindClose (in: hFindFile=0x5be460 | out: hFindFile=0x5be460) returned 1 [0141.896] FindNextFileA (in: hFindFile=0x5be420, lpFindFileData=0xae7c8 | out: lpFindFileData=0xae7c8) returned 0 [0141.896] FindClose (in: hFindFile=0x5be420 | out: hFindFile=0x5be420) returned 1 [0141.896] FindNextFileA (in: hFindFile=0x5be3e0, lpFindFileData=0xae918 | out: lpFindFileData=0xae918) returned 0 [0141.897] FindClose (in: hFindFile=0x5be3e0 | out: hFindFile=0x5be3e0) returned 1 [0141.897] FindNextFileA (in: hFindFile=0x5be3a0, lpFindFileData=0xaea68 | out: lpFindFileData=0xaea68) returned 0 [0141.897] FindClose (in: hFindFile=0x5be3a0 | out: hFindFile=0x5be3a0) returned 1 [0141.897] FindNextFileA (in: hFindFile=0x5be360, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 0 [0141.897] FindClose (in: hFindFile=0x5be360 | out: hFindFile=0x5be360) returned 1 [0141.897] FindNextFileA (in: hFindFile=0x5be320, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 0 [0141.897] FindClose (in: hFindFile=0x5be320 | out: hFindFile=0x5be320) returned 1 [0141.897] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 0 [0141.897] FindClose (in: hFindFile=0x5be2e0 | out: hFindFile=0x5be2e0) returned 1 [0141.897] FindNextFileA (in: hFindFile=0x5be2a0, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0141.897] lstrcmpA (lpString1=".", lpString2="Themes") returned -1 [0141.897] lstrcmpA (lpString1="..", lpString2="Themes") returned -1 [0141.897] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\*.*") returned="*.*" [0141.897] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\", lpString2="Themes" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Themes") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Themes" [0141.897] lstrlenA (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Themes") returned 68 [0141.897] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Themes\\*.*", lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 0x5be2e0 [0141.898] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0141.898] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0141.898] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0141.898] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0141.898] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0141.898] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0141.898] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Custom.theme") returned 1 [0141.898] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Custom.theme") returned 1 [0141.898] lstrcmpiA (lpString1="", lpString2="Custom.theme") returned -1 [0141.898] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Themes\\*.*") returned="*.*" [0141.898] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Themes\\", lpString2="Custom.theme" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Themes\\Custom.theme") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Themes\\Custom.theme" [0141.898] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Themes\\Custom.theme", pszSpec="*.zip") returned 0 [0141.898] lstrlenA (lpString="*.zip") returned 5 [0141.898] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Themes\\Custom.theme", pszSpec="*.rar") returned 0 [0141.898] lstrlenA (lpString="*.rar") returned 5 [0141.898] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Themes\\Custom.theme", pszSpec="*.7z") returned 0 [0141.898] lstrlenA (lpString="*.7z") returned 4 [0141.898] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Themes\\Custom.theme", pszSpec="*.tar") returned 0 [0141.898] lstrlenA (lpString="*.tar") returned 5 [0141.898] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Themes\\Custom.theme", pszSpec="*.gzip") returned 0 [0141.898] lstrlenA (lpString="*.gzip") returned 6 [0141.898] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Themes\\Custom.theme", pszSpec="*.jpg") returned 0 [0141.898] lstrlenA (lpString="*.jpg") returned 5 [0141.898] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Themes\\Custom.theme", pszSpec="*.jpeg") returned 0 [0141.898] lstrlenA (lpString="*.jpeg") returned 6 [0141.898] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Themes\\Custom.theme", pszSpec="*.psd") returned 0 [0141.898] lstrlenA (lpString="*.psd") returned 5 [0141.898] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Themes\\Custom.theme", pszSpec="*.cdr") returned 0 [0141.898] lstrlenA (lpString="*.cdr") returned 5 [0141.899] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Themes\\Custom.theme", pszSpec="*.dwg") returned 0 [0141.899] lstrlenA (lpString="*.dwg") returned 5 [0141.899] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Themes\\Custom.theme", pszSpec="*.max") returned 0 [0141.899] lstrlenA (lpString="*.max") returned 5 [0141.899] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Themes\\Custom.theme", pszSpec="*.bmp") returned 0 [0141.899] lstrlenA (lpString="*.bmp") returned 5 [0141.899] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Themes\\Custom.theme", pszSpec="*.gif") returned 0 [0141.899] lstrlenA (lpString="*.gif") returned 5 [0141.899] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Themes\\Custom.theme", pszSpec="*.png") returned 0 [0141.899] lstrlenA (lpString="*.png") returned 5 [0141.899] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Themes\\Custom.theme", pszSpec="*.doc") returned 0 [0141.899] lstrlenA (lpString="*.doc") returned 5 [0141.899] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Themes\\Custom.theme", pszSpec="*.docx") returned 0 [0141.899] lstrlenA (lpString="*.docx") returned 6 [0141.899] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Themes\\Custom.theme", pszSpec="*.xls") returned 0 [0141.899] lstrlenA (lpString="*.xls") returned 5 [0141.899] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Themes\\Custom.theme", pszSpec="*.xlsx") returned 0 [0141.899] lstrlenA (lpString="*.xlsx") returned 6 [0141.899] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Themes\\Custom.theme", pszSpec="*.ppt") returned 0 [0141.899] lstrlenA (lpString="*.ppt") returned 5 [0141.899] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Themes\\Custom.theme", pszSpec="*.pptx") returned 0 [0141.899] lstrlenA (lpString="*.pptx") returned 6 [0141.899] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Themes\\Custom.theme", pszSpec="*.txt") returned 0 [0141.899] lstrlenA (lpString="*.txt") returned 5 [0141.899] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Themes\\Custom.theme", pszSpec="*.pdf") returned 0 [0141.899] lstrlenA (lpString="*.pdf") returned 5 [0141.899] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Themes\\Custom.theme", pszSpec="*.djvu") returned 0 [0141.899] lstrlenA (lpString="*.djvu") returned 6 [0141.899] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Themes\\Custom.theme", pszSpec="*.htm") returned 0 [0141.899] lstrlenA (lpString="*.htm") returned 5 [0141.899] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Themes\\Custom.theme", pszSpec="*.html") returned 0 [0141.899] lstrlenA (lpString="*.html") returned 6 [0141.899] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Themes\\Custom.theme", pszSpec="*.mdb") returned 0 [0141.899] lstrlenA (lpString="*.mdb") returned 5 [0141.899] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Themes\\Custom.theme", pszSpec="*.cer") returned 0 [0141.899] lstrlenA (lpString="*.cer") returned 5 [0141.900] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Themes\\Custom.theme", pszSpec="*.p12") returned 0 [0141.900] lstrlenA (lpString="*.p12") returned 5 [0141.900] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Themes\\Custom.theme", pszSpec="*.pfx") returned 0 [0141.900] lstrlenA (lpString="*.pfx") returned 5 [0141.900] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Themes\\Custom.theme", pszSpec="*.kwm") returned 0 [0141.900] lstrlenA (lpString="*.kwm") returned 5 [0141.900] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Themes\\Custom.theme", pszSpec="*.pwm") returned 0 [0141.900] lstrlenA (lpString="*.pwm") returned 5 [0141.900] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Themes\\Custom.theme", pszSpec="*.1cd") returned 0 [0141.900] lstrlenA (lpString="*.1cd") returned 5 [0141.900] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Themes\\Custom.theme", pszSpec="*.md") returned 0 [0141.900] lstrlenA (lpString="*.md") returned 4 [0141.900] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Themes\\Custom.theme", pszSpec="*.mdf") returned 0 [0141.900] lstrlenA (lpString="*.mdf") returned 5 [0141.900] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Themes\\Custom.theme", pszSpec="*.dbf") returned 0 [0141.900] lstrlenA (lpString="*.dbf") returned 5 [0141.900] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Themes\\Custom.theme", pszSpec="*.odt") returned 0 [0141.900] lstrlenA (lpString="*.odt") returned 5 [0141.900] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Themes\\Custom.theme", pszSpec="*.vob") returned 0 [0141.900] lstrlenA (lpString="*.vob") returned 5 [0141.900] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Themes\\Custom.theme", pszSpec="*.ifo") returned 0 [0141.900] lstrlenA (lpString="*.ifo") returned 5 [0141.900] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Themes\\Custom.theme", pszSpec="*.lnk") returned 0 [0141.900] lstrlenA (lpString="*.lnk") returned 5 [0141.900] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Themes\\Custom.theme", pszSpec="*.torrent") returned 0 [0141.900] lstrlenA (lpString="*.torrent") returned 9 [0141.900] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Themes\\Custom.theme", pszSpec="*.mov") returned 0 [0141.900] lstrlenA (lpString="*.mov") returned 5 [0141.900] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Themes\\Custom.theme", pszSpec="*.m2v") returned 0 [0141.900] lstrlenA (lpString="*.m2v") returned 5 [0141.900] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Themes\\Custom.theme", pszSpec="*.3gp") returned 0 [0141.900] lstrlenA (lpString="*.3gp") returned 5 [0141.900] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Themes\\Custom.theme", pszSpec="*.mpeg") returned 0 [0141.900] lstrlenA (lpString="*.mpeg") returned 6 [0141.900] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Themes\\Custom.theme", pszSpec="*.mpg") returned 0 [0141.900] lstrlenA (lpString="*.mpg") returned 5 [0141.900] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Themes\\Custom.theme", pszSpec="*.flv") returned 0 [0141.900] lstrlenA (lpString="*.flv") returned 5 [0141.901] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Themes\\Custom.theme", pszSpec="*.avi") returned 0 [0141.901] lstrlenA (lpString="*.avi") returned 5 [0141.901] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Themes\\Custom.theme", pszSpec="*.mp4") returned 0 [0141.901] lstrlenA (lpString="*.mp4") returned 5 [0141.901] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Themes\\Custom.theme", pszSpec="*.wmv") returned 0 [0141.901] lstrlenA (lpString="*.wmv") returned 5 [0141.901] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Themes\\Custom.theme", pszSpec="*.divx") returned 0 [0141.901] lstrlenA (lpString="*.divx") returned 6 [0141.901] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Themes\\Custom.theme", pszSpec="*.mkv") returned 0 [0141.901] lstrlenA (lpString="*.mkv") returned 5 [0141.901] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Themes\\Custom.theme", pszSpec="*.mp3") returned 0 [0141.901] lstrlenA (lpString="*.mp3") returned 5 [0141.901] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Themes\\Custom.theme", pszSpec="*.wav") returned 0 [0141.901] lstrlenA (lpString="*.wav") returned 5 [0141.901] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Themes\\Custom.theme", pszSpec="*.flac") returned 0 [0141.901] lstrlenA (lpString="*.flac") returned 6 [0141.901] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Themes\\Custom.theme", pszSpec="*.ape") returned 0 [0141.901] lstrlenA (lpString="*.ape") returned 5 [0141.901] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Themes\\Custom.theme", pszSpec="*.wma") returned 0 [0141.901] lstrlenA (lpString="*.wma") returned 5 [0141.901] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Themes\\Custom.theme", pszSpec="*.ac3") returned 0 [0141.901] lstrlenA (lpString="*.ac3") returned 5 [0141.901] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 0 [0141.901] FindClose (in: hFindFile=0x5be2e0 | out: hFindFile=0x5be2e0) returned 1 [0141.901] FindNextFileA (in: hFindFile=0x5be2a0, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0141.901] PeekMessageA (in: lpMsg=0xaef84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaef84) returned 0 [0141.901] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="UsrClass.dat") returned -1 [0141.901] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="UsrClass.dat") returned -1 [0141.901] lstrcmpiA (lpString1="", lpString2="UsrClass.dat") returned -1 [0141.901] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\*.*") returned="*.*" [0141.901] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\", lpString2="UsrClass.dat" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat" [0141.902] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat", pszSpec="*.zip") returned 0 [0141.902] lstrlenA (lpString="*.zip") returned 5 [0141.902] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat", pszSpec="*.rar") returned 0 [0141.902] lstrlenA (lpString="*.rar") returned 5 [0141.902] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat", pszSpec="*.7z") returned 0 [0141.902] lstrlenA (lpString="*.7z") returned 4 [0141.902] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat", pszSpec="*.tar") returned 0 [0141.902] lstrlenA (lpString="*.tar") returned 5 [0141.902] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat", pszSpec="*.gzip") returned 0 [0141.902] lstrlenA (lpString="*.gzip") returned 6 [0141.902] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat", pszSpec="*.jpg") returned 0 [0141.902] lstrlenA (lpString="*.jpg") returned 5 [0141.902] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat", pszSpec="*.jpeg") returned 0 [0141.902] lstrlenA (lpString="*.jpeg") returned 6 [0141.902] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat", pszSpec="*.psd") returned 0 [0141.902] lstrlenA (lpString="*.psd") returned 5 [0141.902] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat", pszSpec="*.cdr") returned 0 [0141.902] lstrlenA (lpString="*.cdr") returned 5 [0141.902] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat", pszSpec="*.dwg") returned 0 [0141.902] lstrlenA (lpString="*.dwg") returned 5 [0141.902] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat", pszSpec="*.max") returned 0 [0141.902] lstrlenA (lpString="*.max") returned 5 [0141.902] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat", pszSpec="*.bmp") returned 0 [0141.902] lstrlenA (lpString="*.bmp") returned 5 [0141.902] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat", pszSpec="*.gif") returned 0 [0141.902] lstrlenA (lpString="*.gif") returned 5 [0141.902] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat", pszSpec="*.png") returned 0 [0141.902] lstrlenA (lpString="*.png") returned 5 [0141.902] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat", pszSpec="*.doc") returned 0 [0141.902] lstrlenA (lpString="*.doc") returned 5 [0141.902] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat", pszSpec="*.docx") returned 0 [0141.902] lstrlenA (lpString="*.docx") returned 6 [0141.902] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat", pszSpec="*.xls") returned 0 [0141.902] lstrlenA (lpString="*.xls") returned 5 [0141.902] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat", pszSpec="*.xlsx") returned 0 [0141.902] lstrlenA (lpString="*.xlsx") returned 6 [0141.902] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat", pszSpec="*.ppt") returned 0 [0141.903] lstrlenA (lpString="*.ppt") returned 5 [0141.903] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat", pszSpec="*.pptx") returned 0 [0141.903] lstrlenA (lpString="*.pptx") returned 6 [0141.903] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat", pszSpec="*.txt") returned 0 [0141.903] lstrlenA (lpString="*.txt") returned 5 [0141.903] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat", pszSpec="*.pdf") returned 0 [0141.903] lstrlenA (lpString="*.pdf") returned 5 [0141.903] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat", pszSpec="*.djvu") returned 0 [0141.903] lstrlenA (lpString="*.djvu") returned 6 [0141.903] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat", pszSpec="*.htm") returned 0 [0141.903] lstrlenA (lpString="*.htm") returned 5 [0141.903] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat", pszSpec="*.html") returned 0 [0141.903] lstrlenA (lpString="*.html") returned 6 [0141.903] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat", pszSpec="*.mdb") returned 0 [0141.903] lstrlenA (lpString="*.mdb") returned 5 [0141.903] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat", pszSpec="*.cer") returned 0 [0141.903] lstrlenA (lpString="*.cer") returned 5 [0141.903] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat", pszSpec="*.p12") returned 0 [0141.903] lstrlenA (lpString="*.p12") returned 5 [0141.903] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat", pszSpec="*.pfx") returned 0 [0141.903] lstrlenA (lpString="*.pfx") returned 5 [0141.903] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat", pszSpec="*.kwm") returned 0 [0141.903] lstrlenA (lpString="*.kwm") returned 5 [0141.903] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat", pszSpec="*.pwm") returned 0 [0141.903] lstrlenA (lpString="*.pwm") returned 5 [0141.903] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat", pszSpec="*.1cd") returned 0 [0141.903] lstrlenA (lpString="*.1cd") returned 5 [0141.903] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat", pszSpec="*.md") returned 0 [0141.903] lstrlenA (lpString="*.md") returned 4 [0141.903] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat", pszSpec="*.mdf") returned 0 [0141.903] lstrlenA (lpString="*.mdf") returned 5 [0141.903] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat", pszSpec="*.dbf") returned 0 [0141.903] lstrlenA (lpString="*.dbf") returned 5 [0141.903] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat", pszSpec="*.odt") returned 0 [0141.903] lstrlenA (lpString="*.odt") returned 5 [0141.903] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat", pszSpec="*.vob") returned 0 [0141.903] lstrlenA (lpString="*.vob") returned 5 [0141.904] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat", pszSpec="*.ifo") returned 0 [0141.904] lstrlenA (lpString="*.ifo") returned 5 [0141.904] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat", pszSpec="*.lnk") returned 0 [0141.904] lstrlenA (lpString="*.lnk") returned 5 [0141.904] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat", pszSpec="*.torrent") returned 0 [0141.904] lstrlenA (lpString="*.torrent") returned 9 [0141.904] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat", pszSpec="*.mov") returned 0 [0141.904] lstrlenA (lpString="*.mov") returned 5 [0141.904] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat", pszSpec="*.m2v") returned 0 [0141.904] lstrlenA (lpString="*.m2v") returned 5 [0141.904] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat", pszSpec="*.3gp") returned 0 [0141.904] lstrlenA (lpString="*.3gp") returned 5 [0141.904] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat", pszSpec="*.mpeg") returned 0 [0141.904] lstrlenA (lpString="*.mpeg") returned 6 [0141.904] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat", pszSpec="*.mpg") returned 0 [0141.904] lstrlenA (lpString="*.mpg") returned 5 [0141.904] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat", pszSpec="*.flv") returned 0 [0141.904] lstrlenA (lpString="*.flv") returned 5 [0141.904] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat", pszSpec="*.avi") returned 0 [0141.904] lstrlenA (lpString="*.avi") returned 5 [0141.904] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat", pszSpec="*.mp4") returned 0 [0141.904] lstrlenA (lpString="*.mp4") returned 5 [0141.904] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat", pszSpec="*.wmv") returned 0 [0141.904] lstrlenA (lpString="*.wmv") returned 5 [0141.904] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat", pszSpec="*.divx") returned 0 [0141.904] lstrlenA (lpString="*.divx") returned 6 [0141.904] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat", pszSpec="*.mkv") returned 0 [0141.904] lstrlenA (lpString="*.mkv") returned 5 [0141.904] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat", pszSpec="*.mp3") returned 0 [0141.904] lstrlenA (lpString="*.mp3") returned 5 [0141.904] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat", pszSpec="*.wav") returned 0 [0141.904] lstrlenA (lpString="*.wav") returned 5 [0141.904] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat", pszSpec="*.flac") returned 0 [0141.904] lstrlenA (lpString="*.flac") returned 6 [0141.904] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat", pszSpec="*.ape") returned 0 [0141.904] lstrlenA (lpString="*.ape") returned 5 [0141.905] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat", pszSpec="*.wma") returned 0 [0141.905] lstrlenA (lpString="*.wma") returned 5 [0141.905] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat", pszSpec="*.ac3") returned 0 [0141.905] lstrlenA (lpString="*.ac3") returned 5 [0141.905] FindNextFileA (in: hFindFile=0x5be2a0, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0141.905] PeekMessageA (in: lpMsg=0xaef84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaef84) returned 0 [0141.905] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="UsrClass.dat.LOG1") returned -1 [0141.905] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="UsrClass.dat.LOG1") returned -1 [0141.905] lstrcmpiA (lpString1="", lpString2="UsrClass.dat.LOG1") returned -1 [0141.905] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat") returned="UsrClass.dat" [0141.905] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\", lpString2="UsrClass.dat.LOG1" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat.LOG1") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat.LOG1" [0141.905] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat.LOG1", pszSpec="*.zip") returned 0 [0141.905] lstrlenA (lpString="*.zip") returned 5 [0141.905] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat.LOG1", pszSpec="*.rar") returned 0 [0141.905] lstrlenA (lpString="*.rar") returned 5 [0141.905] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat.LOG1", pszSpec="*.7z") returned 0 [0141.905] lstrlenA (lpString="*.7z") returned 4 [0141.905] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat.LOG1", pszSpec="*.tar") returned 0 [0141.905] lstrlenA (lpString="*.tar") returned 5 [0141.905] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat.LOG1", pszSpec="*.gzip") returned 0 [0141.905] lstrlenA (lpString="*.gzip") returned 6 [0141.905] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat.LOG1", pszSpec="*.jpg") returned 0 [0141.905] lstrlenA (lpString="*.jpg") returned 5 [0141.905] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat.LOG1", pszSpec="*.jpeg") returned 0 [0141.905] lstrlenA (lpString="*.jpeg") returned 6 [0141.905] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat.LOG1", pszSpec="*.psd") returned 0 [0141.905] lstrlenA (lpString="*.psd") returned 5 [0141.905] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat.LOG1", pszSpec="*.cdr") returned 0 [0141.905] lstrlenA (lpString="*.cdr") returned 5 [0141.905] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat.LOG1", pszSpec="*.dwg") returned 0 [0141.905] lstrlenA (lpString="*.dwg") returned 5 [0141.905] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat.LOG1", pszSpec="*.max") returned 0 [0141.905] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat.LOG1", pszSpec="*.bmp") returned 0 [0141.906] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat.LOG1", pszSpec="*.gif") returned 0 [0141.906] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat.LOG1", pszSpec="*.png") returned 0 [0141.906] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat.LOG1", pszSpec="*.doc") returned 0 [0141.906] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat.LOG1", pszSpec="*.docx") returned 0 [0141.906] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat.LOG1", pszSpec="*.xls") returned 0 [0141.906] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat.LOG1", pszSpec="*.xlsx") returned 0 [0141.906] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat.LOG1", pszSpec="*.ppt") returned 0 [0141.906] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat.LOG1", pszSpec="*.pptx") returned 0 [0141.906] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat.LOG1", pszSpec="*.txt") returned 0 [0141.906] FindNextFileA (in: hFindFile=0x5be2a0, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0141.906] PeekMessageA (in: lpMsg=0xaef84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaef84) returned 0 [0141.906] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="UsrClass.dat.LOG2") returned -1 [0141.906] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="UsrClass.dat.LOG2") returned -1 [0141.906] lstrcmpiA (lpString1="", lpString2="UsrClass.dat.LOG2") returned -1 [0141.906] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat.LOG1") returned="UsrClass.dat.LOG1" [0141.906] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\", lpString2="UsrClass.dat.LOG2" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat.LOG2") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat.LOG2" [0141.906] FindNextFileA (in: hFindFile=0x5be2a0, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0141.906] PeekMessageA (in: lpMsg=0xaef84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaef84) returned 0 [0141.906] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="UsrClass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.TM.blf") returned -1 [0141.906] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="UsrClass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.TM.blf") returned -1 [0141.906] lstrcmpiA (lpString1="", lpString2="UsrClass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.TM.blf") returned -1 [0141.906] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat.LOG2") returned="UsrClass.dat.LOG2" [0141.907] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\", lpString2="UsrClass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.TM.blf" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.TM.blf") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.TM.blf" [0141.907] FindNextFileA (in: hFindFile=0x5be2a0, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0141.907] PeekMessageA (in: lpMsg=0xaef84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaef84) returned 0 [0141.907] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="UsrClass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.TMContainer00000000000000000001.regtrans-ms") returned -1 [0141.907] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="UsrClass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.TMContainer00000000000000000001.regtrans-ms") returned -1 [0141.907] lstrcmpiA (lpString1="", lpString2="UsrClass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.TMContainer00000000000000000001.regtrans-ms") returned -1 [0141.907] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.TM.blf") returned="UsrClass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.TM.blf" [0141.907] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\", lpString2="UsrClass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.TMContainer00000000000000000001.regtrans-ms" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.TMContainer00000000000000000001.regtrans-ms") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.TMContainer00000000000000000001.regtrans-ms" [0141.907] FindNextFileA (in: hFindFile=0x5be2a0, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0141.907] PeekMessageA (in: lpMsg=0xaef84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaef84) returned 0 [0141.907] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="UsrClass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.TMContainer00000000000000000002.regtrans-ms") returned -1 [0141.907] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="UsrClass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.TMContainer00000000000000000002.regtrans-ms") returned -1 [0141.907] lstrcmpiA (lpString1="", lpString2="UsrClass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.TMContainer00000000000000000002.regtrans-ms") returned -1 [0141.907] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.TMContainer00000000000000000001.regtrans-ms") returned="UsrClass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.TMContainer00000000000000000001.regtrans-ms" [0141.907] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\", lpString2="UsrClass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.TMContainer00000000000000000002.regtrans-ms" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.TMContainer00000000000000000002.regtrans-ms") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.TMContainer00000000000000000002.regtrans-ms" [0141.907] FindNextFileA (in: hFindFile=0x5be2a0, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0141.907] lstrcmpA (lpString1=".", lpString2="WER") returned -1 [0141.907] lstrcmpA (lpString1="..", lpString2="WER") returned -1 [0141.907] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.TMContainer00000000000000000002.regtrans-ms") returned="UsrClass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.TMContainer00000000000000000002.regtrans-ms" [0141.907] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\", lpString2="WER" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\WER") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\WER" [0141.908] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\WER\\*.*", lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 0x5be2e0 [0141.908] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0141.908] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0141.908] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0141.908] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0141.908] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0141.908] lstrcmpA (lpString1=".", lpString2="ERC") returned -1 [0141.908] lstrcmpA (lpString1="..", lpString2="ERC") returned -1 [0141.908] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\WER\\*.*") returned="*.*" [0141.908] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\WER\\", lpString2="ERC" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\WER\\ERC") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\WER\\ERC" [0141.908] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\WER\\ERC\\*.*", lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 0x5be320 [0141.909] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0141.909] FindNextFileA (in: hFindFile=0x5be320, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0141.909] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0141.909] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0141.909] FindNextFileA (in: hFindFile=0x5be320, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 0 [0141.909] FindClose (in: hFindFile=0x5be320 | out: hFindFile=0x5be320) returned 1 [0141.909] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0141.909] lstrcmpA (lpString1=".", lpString2="ReportArchive") returned -1 [0141.909] lstrcmpA (lpString1="..", lpString2="ReportArchive") returned -1 [0141.909] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\WER\\*.*") returned="*.*" [0141.909] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\WER\\", lpString2="ReportArchive" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\WER\\ReportArchive") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\WER\\ReportArchive" [0141.909] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\WER\\ReportArchive\\*.*", lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 0x5be320 [0141.909] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0141.909] FindNextFileA (in: hFindFile=0x5be320, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0141.909] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0141.909] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0141.909] FindNextFileA (in: hFindFile=0x5be320, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 0 [0141.909] FindClose (in: hFindFile=0x5be320 | out: hFindFile=0x5be320) returned 1 [0141.909] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 0 [0141.909] FindClose (in: hFindFile=0x5be2e0 | out: hFindFile=0x5be2e0) returned 1 [0141.910] FindNextFileA (in: hFindFile=0x5be2a0, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0141.910] PeekMessageA (in: lpMsg=0xaef84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaef84) returned 0 [0141.910] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="WindowsUpdate.log") returned -1 [0141.910] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WindowsUpdate.log") returned -1 [0141.910] lstrcmpiA (lpString1="", lpString2="WindowsUpdate.log") returned -1 [0141.910] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\*.*") returned="*.*" [0141.910] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\", lpString2="WindowsUpdate.log" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\WindowsUpdate.log") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\WindowsUpdate.log" [0141.910] FindNextFileA (in: hFindFile=0x5be2a0, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0 [0141.910] FindClose (in: hFindFile=0x5be2a0 | out: hFindFile=0x5be2a0) returned 1 [0141.910] FindNextFileA (in: hFindFile=0x5be260, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0141.910] lstrcmpA (lpString1=".", lpString2="Windows Mail") returned -1 [0141.910] lstrcmpA (lpString1="..", lpString2="Windows Mail") returned -1 [0141.910] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\*.*") returned="*.*" [0141.910] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\", lpString2="Windows Mail" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail" [0141.910] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0141.912] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0141.912] FindNextFileA (in: hFindFile=0x5be2a0, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0141.912] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0141.912] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0141.912] FindNextFileA (in: hFindFile=0x5be2a0, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0141.912] PeekMessageA (in: lpMsg=0xaef84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaef84) returned 0 [0141.912] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="account{047EF9CE-9C1F-4250-9CA7-D206DB8B643C}.oeaccount") returned 1 [0141.912] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="account{047EF9CE-9C1F-4250-9CA7-D206DB8B643C}.oeaccount") returned 1 [0141.912] lstrcmpiA (lpString1="", lpString2="account{047EF9CE-9C1F-4250-9CA7-D206DB8B643C}.oeaccount") returned -1 [0141.912] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\*.*") returned="*.*" [0141.913] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\", lpString2="account{047EF9CE-9C1F-4250-9CA7-D206DB8B643C}.oeaccount" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\account{047EF9CE-9C1F-4250-9CA7-D206DB8B643C}.oeaccount") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\account{047EF9CE-9C1F-4250-9CA7-D206DB8B643C}.oeaccount" [0141.913] FindNextFileA (in: hFindFile=0x5be2a0, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0141.913] PeekMessageA (in: lpMsg=0xaef84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaef84) returned 0 [0141.913] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="account{1CD43F3B-668B-4CA8-B816-34F74122EC0F}.oeaccount") returned 1 [0141.913] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="account{1CD43F3B-668B-4CA8-B816-34F74122EC0F}.oeaccount") returned 1 [0141.913] lstrcmpiA (lpString1="", lpString2="account{1CD43F3B-668B-4CA8-B816-34F74122EC0F}.oeaccount") returned -1 [0141.913] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\account{047EF9CE-9C1F-4250-9CA7-D206DB8B643C}.oeaccount") returned="account{047EF9CE-9C1F-4250-9CA7-D206DB8B643C}.oeaccount" [0141.913] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\", lpString2="account{1CD43F3B-668B-4CA8-B816-34F74122EC0F}.oeaccount" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\account{1CD43F3B-668B-4CA8-B816-34F74122EC0F}.oeaccount") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\account{1CD43F3B-668B-4CA8-B816-34F74122EC0F}.oeaccount" [0141.913] FindNextFileA (in: hFindFile=0x5be2a0, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0141.913] PeekMessageA (in: lpMsg=0xaef84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaef84) returned 0 [0141.913] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="account{AF0DB737-2EF9-4633-BF5E-1A6761ED1577}.oeaccount") returned 1 [0141.913] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="account{AF0DB737-2EF9-4633-BF5E-1A6761ED1577}.oeaccount") returned 1 [0141.913] lstrcmpiA (lpString1="", lpString2="account{AF0DB737-2EF9-4633-BF5E-1A6761ED1577}.oeaccount") returned -1 [0141.913] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\account{1CD43F3B-668B-4CA8-B816-34F74122EC0F}.oeaccount") returned="account{1CD43F3B-668B-4CA8-B816-34F74122EC0F}.oeaccount" [0141.913] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\", lpString2="account{AF0DB737-2EF9-4633-BF5E-1A6761ED1577}.oeaccount" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\account{AF0DB737-2EF9-4633-BF5E-1A6761ED1577}.oeaccount") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\account{AF0DB737-2EF9-4633-BF5E-1A6761ED1577}.oeaccount" [0141.913] FindNextFileA (in: hFindFile=0x5be2a0, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0141.913] lstrcmpA (lpString1=".", lpString2="Backup") returned -1 [0141.913] lstrcmpA (lpString1="..", lpString2="Backup") returned -1 [0141.913] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\account{AF0DB737-2EF9-4633-BF5E-1A6761ED1577}.oeaccount") returned="account{AF0DB737-2EF9-4633-BF5E-1A6761ED1577}.oeaccount" [0141.913] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\", lpString2="Backup" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Backup") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Backup" [0141.913] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\*.*", lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 0x5be2e0 [0141.914] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0141.914] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0141.914] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0141.914] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0141.914] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0141.914] lstrcmpA (lpString1=".", lpString2="old") returned -1 [0141.914] lstrcmpA (lpString1="..", lpString2="old") returned -1 [0141.914] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\*.*") returned="*.*" [0141.914] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\", lpString2="old" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\old") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\old" [0141.914] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\old\\*.*", lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 0x5be320 [0141.915] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0141.915] FindNextFileA (in: hFindFile=0x5be320, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0141.915] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0141.915] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0141.916] FindNextFileA (in: hFindFile=0x5be320, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0141.916] PeekMessageA (in: lpMsg=0xaece4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaece4) returned 0 [0141.916] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="edb00001.log") returned -1 [0141.916] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="edb00001.log") returned 1 [0141.916] lstrcmpiA (lpString1="", lpString2="edb00001.log") returned -1 [0141.916] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\old\\*.*") returned="*.*" [0141.916] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\old\\", lpString2="edb00001.log" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\old\\edb00001.log") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\old\\edb00001.log" [0141.916] FindNextFileA (in: hFindFile=0x5be320, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0141.916] PeekMessageA (in: lpMsg=0xaece4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaece4) returned 0 [0141.916] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="WindowsMail.MSMessageStore") returned -1 [0141.916] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WindowsMail.MSMessageStore") returned -1 [0141.916] lstrcmpiA (lpString1="", lpString2="WindowsMail.MSMessageStore") returned -1 [0141.916] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\old\\edb00001.log") returned="edb00001.log" [0141.916] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\old\\", lpString2="WindowsMail.MSMessageStore" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\old\\WindowsMail.MSMessageStore") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\old\\WindowsMail.MSMessageStore" [0141.916] FindNextFileA (in: hFindFile=0x5be320, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0141.916] PeekMessageA (in: lpMsg=0xaece4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaece4) returned 0 [0141.916] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="WindowsMail.pat") returned -1 [0141.916] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WindowsMail.pat") returned -1 [0141.916] lstrcmpiA (lpString1="", lpString2="WindowsMail.pat") returned -1 [0141.916] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\old\\WindowsMail.MSMessageStore") returned="WindowsMail.MSMessageStore" [0141.916] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\old\\", lpString2="WindowsMail.pat" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\old\\WindowsMail.pat") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\old\\WindowsMail.pat" [0141.916] FindNextFileA (in: hFindFile=0x5be320, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 0 [0141.916] FindClose (in: hFindFile=0x5be320 | out: hFindFile=0x5be320) returned 1 [0141.917] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 0 [0141.917] FindClose (in: hFindFile=0x5be2e0 | out: hFindFile=0x5be2e0) returned 1 [0141.917] FindNextFileA (in: hFindFile=0x5be2a0, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0141.917] PeekMessageA (in: lpMsg=0xaef84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaef84) returned 0 [0141.917] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="edb.chk") returned -1 [0141.917] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="edb.chk") returned 1 [0141.917] lstrcmpiA (lpString1="", lpString2="edb.chk") returned -1 [0141.917] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\*.*") returned="*.*" [0141.917] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\", lpString2="edb.chk" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\edb.chk") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\edb.chk" [0141.917] FindNextFileA (in: hFindFile=0x5be2a0, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0141.917] PeekMessageA (in: lpMsg=0xaef84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaef84) returned 0 [0141.917] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="edb.log") returned -1 [0141.917] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="edb.log") returned 1 [0141.917] lstrcmpiA (lpString1="", lpString2="edb.log") returned -1 [0141.917] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\edb.chk") returned="edb.chk" [0141.917] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\", lpString2="edb.log" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\edb.log") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\edb.log" [0141.918] FindNextFileA (in: hFindFile=0x5be2a0, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0141.918] PeekMessageA (in: lpMsg=0xaef84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaef84) returned 0 [0141.918] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="edb00001.log") returned -1 [0141.918] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="edb00001.log") returned 1 [0141.918] lstrcmpiA (lpString1="", lpString2="edb00001.log") returned -1 [0141.918] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\edb.log") returned="edb.log" [0141.918] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\", lpString2="edb00001.log" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\edb00001.log") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\edb00001.log" [0141.918] FindNextFileA (in: hFindFile=0x5be2a0, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0141.918] PeekMessageA (in: lpMsg=0xaef84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaef84) returned 0 [0141.918] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="edbres00001.jrs") returned -1 [0141.918] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="edbres00001.jrs") returned 1 [0141.918] lstrcmpiA (lpString1="", lpString2="edbres00001.jrs") returned -1 [0141.918] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\edb00001.log") returned="edb00001.log" [0141.918] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\", lpString2="edbres00001.jrs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\edbres00001.jrs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\edbres00001.jrs" [0141.918] FindNextFileA (in: hFindFile=0x5be2a0, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0141.918] PeekMessageA (in: lpMsg=0xaef84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaef84) returned 0 [0141.918] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="edbres00002.jrs") returned -1 [0141.918] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="edbres00002.jrs") returned 1 [0141.918] lstrcmpiA (lpString1="", lpString2="edbres00002.jrs") returned -1 [0141.918] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\edbres00001.jrs") returned="edbres00001.jrs" [0141.918] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\", lpString2="edbres00002.jrs" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\edbres00002.jrs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\edbres00002.jrs" [0141.918] FindNextFileA (in: hFindFile=0x5be2a0, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0141.918] PeekMessageA (in: lpMsg=0xaef84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaef84) returned 0 [0141.918] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="oeold.xml") returned -1 [0141.918] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="oeold.xml") returned -1 [0141.918] lstrcmpiA (lpString1="", lpString2="oeold.xml") returned -1 [0141.918] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\edbres00002.jrs") returned="edbres00002.jrs" [0141.919] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\", lpString2="oeold.xml" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\oeold.xml") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\oeold.xml" [0141.919] FindNextFileA (in: hFindFile=0x5be2a0, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0141.919] lstrcmpA (lpString1=".", lpString2="Stationery") returned -1 [0141.919] lstrcmpA (lpString1="..", lpString2="Stationery") returned -1 [0141.919] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\oeold.xml") returned="oeold.xml" [0141.919] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\", lpString2="Stationery" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery" [0141.919] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\*.*", lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 0x5be2e0 [0141.920] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0141.920] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0141.920] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0141.920] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0141.920] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0141.920] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0141.920] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Bears.htm") returned 1 [0141.920] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Bears.htm") returned 1 [0141.920] lstrcmpiA (lpString1="", lpString2="Bears.htm") returned -1 [0141.920] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\*.*") returned="*.*" [0141.920] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\", lpString2="Bears.htm" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.htm") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.htm" [0141.921] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.htm" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.htm") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.htm" [0141.921] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.htm" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.htm") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.htm" [0141.921] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.htm", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.htm.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.htm." [0141.921] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.htm.", lpString2="\xa0" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.htm. ") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.htm. " [0141.921] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\bears.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0141.922] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xff [0141.922] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x28e09fe0, dwHighDateTime=0x1d2dd9c), lpLastAccessTime=0x407536*(dwLowDateTime=0x28e09fe0, dwHighDateTime=0x1d2dd9c), lpLastWriteTime=0x40753e*(dwLowDateTime=0xcdfff30e, dwHighDateTime=0x1ca040d)) returned 1 [0141.922] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0141.922] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0xa5, lpOverlapped=0x0) returned 1 [0141.923] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.htm") returned="Bears.htm" [0141.923] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0141.923] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0xa5, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0xa5, lpOverlapped=0x0) returned 1 [0141.923] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0141.923] CloseHandle (hObject=0x98) returned 1 [0141.923] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\bears.htm"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.htm. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\bears.htm. ")) returned 1 [0141.924] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0141.924] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0141.924] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Bears.jpg") returned 1 [0141.925] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Bears.jpg") returned 1 [0141.925] lstrcmpiA (lpString1="", lpString2="Bears.jpg") returned -1 [0141.925] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.htm") returned="Bears.htm" [0141.925] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\", lpString2="Bears.jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.jpg" [0141.925] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.jpg", pszSpec="*.zip") returned 0 [0141.925] lstrlenA (lpString="*.zip") returned 5 [0141.925] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.jpg", pszSpec="*.rar") returned 0 [0141.925] lstrlenA (lpString="*.rar") returned 5 [0141.925] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.jpg", pszSpec="*.7z") returned 0 [0141.925] lstrlenA (lpString="*.7z") returned 4 [0141.925] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.jpg", pszSpec="*.tar") returned 0 [0141.925] lstrlenA (lpString="*.tar") returned 5 [0141.925] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.jpg", pszSpec="*.gzip") returned 0 [0141.925] lstrlenA (lpString="*.gzip") returned 6 [0141.925] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.jpg", pszSpec="*.jpg") returned 1 [0141.925] lstrlenA (lpString="*.jpg") returned 5 [0141.925] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.jpg" [0141.925] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.jpg" [0141.925] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.jpg", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.jpg.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.jpg." [0141.925] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.jpg.", lpString2="\xa0" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.jpg. ") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.jpg. " [0141.925] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\bears.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0141.926] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x432 [0141.926] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x28e09fe0, dwHighDateTime=0x1d2dd9c), lpLastAccessTime=0x407536*(dwLowDateTime=0x28e09fe0, dwHighDateTime=0x1d2dd9c), lpLastWriteTime=0x40753e*(dwLowDateTime=0xaa352261, dwHighDateTime=0x1c9ea0c)) returned 1 [0141.927] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0141.927] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x3d8, lpOverlapped=0x0) returned 1 [0142.058] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.jpg") returned="Bears.jpg" [0142.058] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0142.058] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x3d8, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x3d8, lpOverlapped=0x0) returned 1 [0142.058] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0142.058] CloseHandle (hObject=0x98) returned 1 [0142.058] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\bears.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.jpg. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\bears.jpg. ")) returned 1 [0142.059] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0142.059] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0142.059] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Desktop.ini") returned 1 [0142.059] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Desktop.ini") returned 1 [0142.059] lstrcmpiA (lpString1="", lpString2="Desktop.ini") returned -1 [0142.059] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.jpg") returned="Bears.jpg" [0142.059] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\", lpString2="Desktop.ini" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Desktop.ini") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Desktop.ini" [0142.059] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Desktop.ini", pszSpec="*.zip") returned 0 [0142.059] lstrlenA (lpString="*.zip") returned 5 [0142.059] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Desktop.ini", pszSpec="*.rar") returned 0 [0142.059] lstrlenA (lpString="*.rar") returned 5 [0142.059] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Desktop.ini", pszSpec="*.7z") returned 0 [0142.059] lstrlenA (lpString="*.7z") returned 4 [0142.059] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Desktop.ini", pszSpec="*.tar") returned 0 [0142.059] lstrlenA (lpString="*.tar") returned 5 [0142.059] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Desktop.ini", pszSpec="*.gzip") returned 0 [0142.059] lstrlenA (lpString="*.gzip") returned 6 [0142.059] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Desktop.ini", pszSpec="*.jpg") returned 0 [0142.059] lstrlenA (lpString="*.jpg") returned 5 [0142.059] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Desktop.ini", pszSpec="*.jpeg") returned 0 [0142.059] lstrlenA (lpString="*.jpeg") returned 6 [0142.060] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Desktop.ini", pszSpec="*.psd") returned 0 [0142.060] lstrlenA (lpString="*.psd") returned 5 [0142.060] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Desktop.ini", pszSpec="*.cdr") returned 0 [0142.060] lstrlenA (lpString="*.cdr") returned 5 [0142.060] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Desktop.ini", pszSpec="*.dwg") returned 0 [0142.060] lstrlenA (lpString="*.dwg") returned 5 [0142.060] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Desktop.ini", pszSpec="*.max") returned 0 [0142.060] lstrlenA (lpString="*.max") returned 5 [0142.060] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Desktop.ini", pszSpec="*.bmp") returned 0 [0142.060] lstrlenA (lpString="*.bmp") returned 5 [0142.060] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Desktop.ini", pszSpec="*.gif") returned 0 [0142.060] lstrlenA (lpString="*.gif") returned 5 [0142.060] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Desktop.ini", pszSpec="*.png") returned 0 [0142.060] lstrlenA (lpString="*.png") returned 5 [0142.060] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Desktop.ini", pszSpec="*.doc") returned 0 [0142.060] lstrlenA (lpString="*.doc") returned 5 [0142.060] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Desktop.ini", pszSpec="*.docx") returned 0 [0142.060] lstrlenA (lpString="*.docx") returned 6 [0142.060] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Desktop.ini", pszSpec="*.xls") returned 0 [0142.060] lstrlenA (lpString="*.xls") returned 5 [0142.060] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Desktop.ini", pszSpec="*.xlsx") returned 0 [0142.060] lstrlenA (lpString="*.xlsx") returned 6 [0142.060] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Desktop.ini", pszSpec="*.ppt") returned 0 [0142.060] lstrlenA (lpString="*.ppt") returned 5 [0142.060] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Desktop.ini", pszSpec="*.pptx") returned 0 [0142.060] lstrlenA (lpString="*.pptx") returned 6 [0142.060] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Desktop.ini", pszSpec="*.txt") returned 0 [0142.060] lstrlenA (lpString="*.txt") returned 5 [0142.060] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Desktop.ini", pszSpec="*.pdf") returned 0 [0142.060] lstrlenA (lpString="*.pdf") returned 5 [0142.060] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Desktop.ini", pszSpec="*.djvu") returned 0 [0142.060] lstrlenA (lpString="*.djvu") returned 6 [0142.060] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Desktop.ini", pszSpec="*.htm") returned 0 [0142.060] lstrlenA (lpString="*.htm") returned 5 [0142.060] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Desktop.ini", pszSpec="*.html") returned 0 [0142.060] lstrlenA (lpString="*.html") returned 6 [0142.060] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Desktop.ini", pszSpec="*.mdb") returned 0 [0142.060] lstrlenA (lpString="*.mdb") returned 5 [0142.060] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Desktop.ini", pszSpec="*.cer") returned 0 [0142.060] lstrlenA (lpString="*.cer") returned 5 [0142.060] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Desktop.ini", pszSpec="*.p12") returned 0 [0142.060] lstrlenA (lpString="*.p12") returned 5 [0142.060] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Desktop.ini", pszSpec="*.pfx") returned 0 [0142.060] lstrlenA (lpString="*.pfx") returned 5 [0142.060] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Desktop.ini", pszSpec="*.kwm") returned 0 [0142.060] lstrlenA (lpString="*.kwm") returned 5 [0142.060] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Desktop.ini", pszSpec="*.pwm") returned 0 [0142.060] lstrlenA (lpString="*.pwm") returned 5 [0142.060] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Desktop.ini", pszSpec="*.1cd") returned 0 [0142.060] lstrlenA (lpString="*.1cd") returned 5 [0142.061] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Desktop.ini", pszSpec="*.md") returned 0 [0142.061] lstrlenA (lpString="*.md") returned 4 [0142.061] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Desktop.ini", pszSpec="*.mdf") returned 0 [0142.061] lstrlenA (lpString="*.mdf") returned 5 [0142.061] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Desktop.ini", pszSpec="*.dbf") returned 0 [0142.061] lstrlenA (lpString="*.dbf") returned 5 [0142.061] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Desktop.ini", pszSpec="*.odt") returned 0 [0142.061] lstrlenA (lpString="*.odt") returned 5 [0142.061] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Desktop.ini", pszSpec="*.vob") returned 0 [0142.061] lstrlenA (lpString="*.vob") returned 5 [0142.061] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Desktop.ini", pszSpec="*.ifo") returned 0 [0142.061] lstrlenA (lpString="*.ifo") returned 5 [0142.061] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Desktop.ini", pszSpec="*.lnk") returned 0 [0142.061] lstrlenA (lpString="*.lnk") returned 5 [0142.061] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Desktop.ini", pszSpec="*.torrent") returned 0 [0142.061] lstrlenA (lpString="*.torrent") returned 9 [0142.061] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Desktop.ini", pszSpec="*.mov") returned 0 [0142.061] lstrlenA (lpString="*.mov") returned 5 [0142.061] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Desktop.ini", pszSpec="*.m2v") returned 0 [0142.061] lstrlenA (lpString="*.m2v") returned 5 [0142.061] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Desktop.ini", pszSpec="*.3gp") returned 0 [0142.061] lstrlenA (lpString="*.3gp") returned 5 [0142.061] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Desktop.ini", pszSpec="*.mpeg") returned 0 [0142.061] lstrlenA (lpString="*.mpeg") returned 6 [0142.061] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Desktop.ini", pszSpec="*.mpg") returned 0 [0142.061] lstrlenA (lpString="*.mpg") returned 5 [0142.061] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Desktop.ini", pszSpec="*.flv") returned 0 [0142.061] lstrlenA (lpString="*.flv") returned 5 [0142.061] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Desktop.ini", pszSpec="*.avi") returned 0 [0142.061] lstrlenA (lpString="*.avi") returned 5 [0142.061] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Desktop.ini", pszSpec="*.mp4") returned 0 [0142.061] lstrlenA (lpString="*.mp4") returned 5 [0142.061] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Desktop.ini", pszSpec="*.wmv") returned 0 [0142.061] lstrlenA (lpString="*.wmv") returned 5 [0142.062] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Desktop.ini", pszSpec="*.divx") returned 0 [0142.062] lstrlenA (lpString="*.divx") returned 6 [0142.062] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Desktop.ini", pszSpec="*.mkv") returned 0 [0142.062] lstrlenA (lpString="*.mkv") returned 5 [0142.062] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Desktop.ini", pszSpec="*.mp3") returned 0 [0142.062] lstrlenA (lpString="*.mp3") returned 5 [0142.062] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Desktop.ini", pszSpec="*.wav") returned 0 [0142.062] lstrlenA (lpString="*.wav") returned 5 [0142.062] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Desktop.ini", pszSpec="*.flac") returned 0 [0142.062] lstrlenA (lpString="*.flac") returned 6 [0142.062] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Desktop.ini", pszSpec="*.ape") returned 0 [0142.062] lstrlenA (lpString="*.ape") returned 5 [0142.062] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Desktop.ini", pszSpec="*.wma") returned 0 [0142.062] lstrlenA (lpString="*.wma") returned 5 [0142.062] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Desktop.ini", pszSpec="*.ac3") returned 0 [0142.062] lstrlenA (lpString="*.ac3") returned 5 [0142.062] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0142.062] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0142.062] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Garden.htm") returned -1 [0142.062] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Garden.htm") returned 1 [0142.062] lstrcmpiA (lpString1="", lpString2="Garden.htm") returned -1 [0142.063] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Desktop.ini") returned="Desktop.ini" [0142.063] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\", lpString2="Garden.htm" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.htm") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.htm" [0142.063] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.htm", pszSpec="*.zip") returned 0 [0142.063] lstrlenA (lpString="*.zip") returned 5 [0142.063] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.htm", pszSpec="*.rar") returned 0 [0142.063] lstrlenA (lpString="*.rar") returned 5 [0142.063] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.htm", pszSpec="*.7z") returned 0 [0142.063] lstrlenA (lpString="*.7z") returned 4 [0142.063] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.htm", pszSpec="*.tar") returned 0 [0142.063] lstrlenA (lpString="*.tar") returned 5 [0142.063] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.htm", pszSpec="*.gzip") returned 0 [0142.063] lstrlenA (lpString="*.gzip") returned 6 [0142.063] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.htm", pszSpec="*.jpg") returned 0 [0142.063] lstrlenA (lpString="*.jpg") returned 5 [0142.063] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.htm", pszSpec="*.jpeg") returned 0 [0142.063] lstrlenA (lpString="*.jpeg") returned 6 [0142.063] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.htm", pszSpec="*.psd") returned 0 [0142.063] lstrlenA (lpString="*.psd") returned 5 [0142.063] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.htm", pszSpec="*.cdr") returned 0 [0142.063] lstrlenA (lpString="*.cdr") returned 5 [0142.063] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.htm", pszSpec="*.dwg") returned 0 [0142.063] lstrlenA (lpString="*.dwg") returned 5 [0142.063] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.htm", pszSpec="*.max") returned 0 [0142.063] lstrlenA (lpString="*.max") returned 5 [0142.063] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.htm", pszSpec="*.bmp") returned 0 [0142.063] lstrlenA (lpString="*.bmp") returned 5 [0142.063] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.htm", pszSpec="*.gif") returned 0 [0142.063] lstrlenA (lpString="*.gif") returned 5 [0142.063] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.htm", pszSpec="*.png") returned 0 [0142.063] lstrlenA (lpString="*.png") returned 5 [0142.063] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.htm", pszSpec="*.doc") returned 0 [0142.063] lstrlenA (lpString="*.doc") returned 5 [0142.063] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.htm", pszSpec="*.docx") returned 0 [0142.063] lstrlenA (lpString="*.docx") returned 6 [0142.063] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.htm", pszSpec="*.xls") returned 0 [0142.063] lstrlenA (lpString="*.xls") returned 5 [0142.063] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.htm", pszSpec="*.xlsx") returned 0 [0142.063] lstrlenA (lpString="*.xlsx") returned 6 [0142.063] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.htm", pszSpec="*.ppt") returned 0 [0142.063] lstrlenA (lpString="*.ppt") returned 5 [0142.063] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.htm", pszSpec="*.pptx") returned 0 [0142.063] lstrlenA (lpString="*.pptx") returned 6 [0142.063] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.htm", pszSpec="*.txt") returned 0 [0142.063] lstrlenA (lpString="*.txt") returned 5 [0142.063] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.htm", pszSpec="*.pdf") returned 0 [0142.063] lstrlenA (lpString="*.pdf") returned 5 [0142.063] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.htm", pszSpec="*.djvu") returned 0 [0142.063] lstrlenA (lpString="*.djvu") returned 6 [0142.063] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.htm", pszSpec="*.htm") returned 1 [0142.063] lstrlenA (lpString="*.htm") returned 5 [0142.063] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.htm" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.htm") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.htm" [0142.064] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.htm" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.htm") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.htm" [0142.064] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.htm", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.htm.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.htm." [0142.064] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.htm.", lpString2="\xa0" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.htm. ") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.htm. " [0142.064] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\garden.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0142.064] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xe7 [0142.064] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x28e09fe0, dwHighDateTime=0x1d2dd9c), lpLastAccessTime=0x407536*(dwLowDateTime=0x28e09fe0, dwHighDateTime=0x1d2dd9c), lpLastWriteTime=0x40753e*(dwLowDateTime=0xce04b5c8, dwHighDateTime=0x1ca040d)) returned 1 [0142.064] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0142.064] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x8d, lpOverlapped=0x0) returned 1 [0142.065] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.htm") returned="Garden.htm" [0142.065] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0142.065] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x8d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x8d, lpOverlapped=0x0) returned 1 [0142.065] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0142.065] CloseHandle (hObject=0x98) returned 1 [0142.065] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\garden.htm"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.htm. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\garden.htm. ")) returned 1 [0142.066] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0142.066] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0142.066] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Garden.jpg") returned -1 [0142.066] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Garden.jpg") returned 1 [0142.066] lstrcmpiA (lpString1="", lpString2="Garden.jpg") returned -1 [0142.066] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.htm") returned="Garden.htm" [0142.066] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\", lpString2="Garden.jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.jpg" [0142.068] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.jpg", pszSpec="*.zip") returned 0 [0142.068] lstrlenA (lpString="*.zip") returned 5 [0142.068] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.jpg", pszSpec="*.rar") returned 0 [0142.068] lstrlenA (lpString="*.rar") returned 5 [0142.068] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.jpg", pszSpec="*.7z") returned 0 [0142.068] lstrlenA (lpString="*.7z") returned 4 [0142.068] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.jpg", pszSpec="*.tar") returned 0 [0142.068] lstrlenA (lpString="*.tar") returned 5 [0142.068] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.jpg", pszSpec="*.gzip") returned 0 [0142.068] lstrlenA (lpString="*.gzip") returned 6 [0142.068] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.jpg", pszSpec="*.jpg") returned 1 [0142.068] lstrlenA (lpString="*.jpg") returned 5 [0142.068] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.jpg" [0142.068] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.jpg" [0142.068] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.jpg", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.jpg.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.jpg." [0142.068] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.jpg.", lpString2="\xa0" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.jpg. ") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.jpg. " [0142.069] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\garden.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0142.069] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x5d3f [0142.069] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x28e09fe0, dwHighDateTime=0x1d2dd9c), lpLastAccessTime=0x407536*(dwLowDateTime=0x28e09fe0, dwHighDateTime=0x1d2dd9c), lpLastWriteTime=0x40753e*(dwLowDateTime=0xaa410937, dwHighDateTime=0x1c9ea0c)) returned 1 [0142.069] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0142.069] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x5ce5, lpOverlapped=0x0) returned 1 [0142.214] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.jpg") returned="Garden.jpg" [0142.215] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0142.215] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x5ce5, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x5ce5, lpOverlapped=0x0) returned 1 [0142.215] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0142.215] CloseHandle (hObject=0x98) returned 1 [0142.215] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\garden.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.jpg. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\garden.jpg. ")) returned 1 [0142.216] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0142.216] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0142.216] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Green Bubbles.htm") returned -1 [0142.216] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Green Bubbles.htm") returned 1 [0142.216] lstrcmpiA (lpString1="", lpString2="Green Bubbles.htm") returned -1 [0142.216] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.jpg") returned="Garden.jpg" [0142.216] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\", lpString2="Green Bubbles.htm" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Green Bubbles.htm") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Green Bubbles.htm" [0142.216] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Green Bubbles.htm", pszSpec="*.zip") returned 0 [0142.216] lstrlenA (lpString="*.zip") returned 5 [0142.216] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Green Bubbles.htm", pszSpec="*.rar") returned 0 [0142.216] lstrlenA (lpString="*.rar") returned 5 [0142.216] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Green Bubbles.htm", pszSpec="*.7z") returned 0 [0142.216] lstrlenA (lpString="*.7z") returned 4 [0142.216] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Green Bubbles.htm", pszSpec="*.tar") returned 0 [0142.216] lstrlenA (lpString="*.tar") returned 5 [0142.216] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Green Bubbles.htm", pszSpec="*.gzip") returned 0 [0142.216] lstrlenA (lpString="*.gzip") returned 6 [0142.216] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Green Bubbles.htm", pszSpec="*.jpg") returned 0 [0142.216] lstrlenA (lpString="*.jpg") returned 5 [0142.216] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Green Bubbles.htm", pszSpec="*.jpeg") returned 0 [0142.216] lstrlenA (lpString="*.jpeg") returned 6 [0142.216] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Green Bubbles.htm", pszSpec="*.psd") returned 0 [0142.216] lstrlenA (lpString="*.psd") returned 5 [0142.216] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Green Bubbles.htm", pszSpec="*.cdr") returned 0 [0142.216] lstrlenA (lpString="*.cdr") returned 5 [0142.216] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Green Bubbles.htm", pszSpec="*.dwg") returned 0 [0142.216] lstrlenA (lpString="*.dwg") returned 5 [0142.216] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Green Bubbles.htm", pszSpec="*.max") returned 0 [0142.217] lstrlenA (lpString="*.max") returned 5 [0142.217] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Green Bubbles.htm", pszSpec="*.bmp") returned 0 [0142.217] lstrlenA (lpString="*.bmp") returned 5 [0142.217] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Green Bubbles.htm", pszSpec="*.gif") returned 0 [0142.217] lstrlenA (lpString="*.gif") returned 5 [0142.217] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Green Bubbles.htm", pszSpec="*.png") returned 0 [0142.217] lstrlenA (lpString="*.png") returned 5 [0142.217] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Green Bubbles.htm", pszSpec="*.doc") returned 0 [0142.217] lstrlenA (lpString="*.doc") returned 5 [0142.217] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Green Bubbles.htm", pszSpec="*.docx") returned 0 [0142.217] lstrlenA (lpString="*.docx") returned 6 [0142.217] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Green Bubbles.htm", pszSpec="*.xls") returned 0 [0142.217] lstrlenA (lpString="*.xls") returned 5 [0142.217] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Green Bubbles.htm", pszSpec="*.xlsx") returned 0 [0142.217] lstrlenA (lpString="*.xlsx") returned 6 [0142.217] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Green Bubbles.htm", pszSpec="*.ppt") returned 0 [0142.217] lstrlenA (lpString="*.ppt") returned 5 [0142.217] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Green Bubbles.htm", pszSpec="*.pptx") returned 0 [0142.217] lstrlenA (lpString="*.pptx") returned 6 [0142.217] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Green Bubbles.htm", pszSpec="*.txt") returned 0 [0142.217] lstrlenA (lpString="*.txt") returned 5 [0142.217] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Green Bubbles.htm", pszSpec="*.pdf") returned 0 [0142.217] lstrlenA (lpString="*.pdf") returned 5 [0142.217] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Green Bubbles.htm", pszSpec="*.djvu") returned 0 [0142.217] lstrlenA (lpString="*.djvu") returned 6 [0142.217] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Green Bubbles.htm", pszSpec="*.htm") returned 1 [0142.217] lstrlenA (lpString="*.htm") returned 5 [0142.217] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Green Bubbles.htm" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Green Bubbles.htm") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Green Bubbles.htm" [0142.217] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Green Bubbles.htm" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Green Bubbles.htm") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Green Bubbles.htm" [0142.217] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Green Bubbles.htm", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Green Bubbles.htm.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Green Bubbles.htm." [0142.217] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Green Bubbles.htm.", lpString2="\xa0" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Green Bubbles.htm. ") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Green Bubbles.htm. " [0142.217] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Green Bubbles.htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\green bubbles.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0142.218] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xed [0142.218] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x28e09fe0, dwHighDateTime=0x1d2dd9c), lpLastAccessTime=0x407536*(dwLowDateTime=0x28e09fe0, dwHighDateTime=0x1d2dd9c), lpLastWriteTime=0x40753e*(dwLowDateTime=0xce071725, dwHighDateTime=0x1ca040d)) returned 1 [0142.218] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0142.218] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x93, lpOverlapped=0x0) returned 1 [0142.219] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Green Bubbles.htm") returned="Green Bubbles.htm" [0142.219] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0142.219] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x93, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x93, lpOverlapped=0x0) returned 1 [0142.221] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0142.221] CloseHandle (hObject=0x98) returned 1 [0142.221] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Green Bubbles.htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\green bubbles.htm"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Green Bubbles.htm. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\green bubbles.htm. ")) returned 1 [0142.222] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0142.222] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0142.222] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="GreenBubbles.jpg") returned -1 [0142.222] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="GreenBubbles.jpg") returned 1 [0142.222] lstrcmpiA (lpString1="", lpString2="GreenBubbles.jpg") returned -1 [0142.222] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Green Bubbles.htm") returned="Green Bubbles.htm" [0142.222] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\", lpString2="GreenBubbles.jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\GreenBubbles.jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\GreenBubbles.jpg" [0142.222] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\GreenBubbles.jpg", pszSpec="*.zip") returned 0 [0142.222] lstrlenA (lpString="*.zip") returned 5 [0142.222] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\GreenBubbles.jpg", pszSpec="*.rar") returned 0 [0142.222] lstrlenA (lpString="*.rar") returned 5 [0142.222] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\GreenBubbles.jpg", pszSpec="*.7z") returned 0 [0142.222] lstrlenA (lpString="*.7z") returned 4 [0142.222] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\GreenBubbles.jpg", pszSpec="*.tar") returned 0 [0142.222] lstrlenA (lpString="*.tar") returned 5 [0142.222] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\GreenBubbles.jpg", pszSpec="*.gzip") returned 0 [0142.222] lstrlenA (lpString="*.gzip") returned 6 [0142.222] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\GreenBubbles.jpg", pszSpec="*.jpg") returned 1 [0142.222] lstrlenA (lpString="*.jpg") returned 5 [0142.222] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\GreenBubbles.jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\GreenBubbles.jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\GreenBubbles.jpg" [0142.222] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\GreenBubbles.jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\GreenBubbles.jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\GreenBubbles.jpg" [0142.222] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\GreenBubbles.jpg", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\GreenBubbles.jpg.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\GreenBubbles.jpg." [0142.222] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\GreenBubbles.jpg.", lpString2="\xa0" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\GreenBubbles.jpg. ") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\GreenBubbles.jpg. " [0142.222] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\GreenBubbles.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\greenbubbles.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0142.223] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1906 [0142.223] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x28e09fe0, dwHighDateTime=0x1d2dd9c), lpLastAccessTime=0x407536*(dwLowDateTime=0x28e09fe0, dwHighDateTime=0x1d2dd9c), lpLastWriteTime=0x40753e*(dwLowDateTime=0xaa436a95, dwHighDateTime=0x1c9ea0c)) returned 1 [0142.223] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0142.223] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x18ac, lpOverlapped=0x0) returned 1 [0142.236] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\GreenBubbles.jpg") returned="GreenBubbles.jpg" [0142.236] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0142.236] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x18ac, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x18ac, lpOverlapped=0x0) returned 1 [0142.236] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0142.236] CloseHandle (hObject=0x98) returned 1 [0142.236] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\GreenBubbles.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\greenbubbles.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\GreenBubbles.jpg. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\greenbubbles.jpg. ")) returned 1 [0142.237] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0142.237] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0142.237] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Hand Prints.htm") returned -1 [0142.237] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Hand Prints.htm") returned 1 [0142.237] lstrcmpiA (lpString1="", lpString2="Hand Prints.htm") returned -1 [0142.237] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\GreenBubbles.jpg") returned="GreenBubbles.jpg" [0142.237] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\", lpString2="Hand Prints.htm" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Hand Prints.htm") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Hand Prints.htm" [0142.238] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Hand Prints.htm", pszSpec="*.zip") returned 0 [0142.238] lstrlenA (lpString="*.zip") returned 5 [0142.238] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Hand Prints.htm", pszSpec="*.rar") returned 0 [0142.238] lstrlenA (lpString="*.rar") returned 5 [0142.238] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Hand Prints.htm", pszSpec="*.7z") returned 0 [0142.238] lstrlenA (lpString="*.7z") returned 4 [0142.238] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Hand Prints.htm", pszSpec="*.tar") returned 0 [0142.238] lstrlenA (lpString="*.tar") returned 5 [0142.238] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Hand Prints.htm", pszSpec="*.gzip") returned 0 [0142.238] lstrlenA (lpString="*.gzip") returned 6 [0142.238] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Hand Prints.htm", pszSpec="*.jpg") returned 0 [0142.238] lstrlenA (lpString="*.jpg") returned 5 [0142.238] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Hand Prints.htm", pszSpec="*.jpeg") returned 0 [0142.238] lstrlenA (lpString="*.jpeg") returned 6 [0142.238] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Hand Prints.htm", pszSpec="*.psd") returned 0 [0142.238] lstrlenA (lpString="*.psd") returned 5 [0142.238] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Hand Prints.htm", pszSpec="*.cdr") returned 0 [0142.238] lstrlenA (lpString="*.cdr") returned 5 [0142.238] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Hand Prints.htm", pszSpec="*.dwg") returned 0 [0142.238] lstrlenA (lpString="*.dwg") returned 5 [0142.238] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Hand Prints.htm", pszSpec="*.max") returned 0 [0142.238] lstrlenA (lpString="*.max") returned 5 [0142.238] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Hand Prints.htm", pszSpec="*.bmp") returned 0 [0142.238] lstrlenA (lpString="*.bmp") returned 5 [0142.238] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Hand Prints.htm", pszSpec="*.gif") returned 0 [0142.238] lstrlenA (lpString="*.gif") returned 5 [0142.238] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Hand Prints.htm", pszSpec="*.png") returned 0 [0142.238] lstrlenA (lpString="*.png") returned 5 [0142.238] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Hand Prints.htm", pszSpec="*.doc") returned 0 [0142.238] lstrlenA (lpString="*.doc") returned 5 [0142.238] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Hand Prints.htm", pszSpec="*.docx") returned 0 [0142.238] lstrlenA (lpString="*.docx") returned 6 [0142.238] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Hand Prints.htm", pszSpec="*.xls") returned 0 [0142.238] lstrlenA (lpString="*.xls") returned 5 [0142.238] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Hand Prints.htm", pszSpec="*.xlsx") returned 0 [0142.238] lstrlenA (lpString="*.xlsx") returned 6 [0142.238] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Hand Prints.htm", pszSpec="*.ppt") returned 0 [0142.238] lstrlenA (lpString="*.ppt") returned 5 [0142.238] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Hand Prints.htm", pszSpec="*.pptx") returned 0 [0142.238] lstrlenA (lpString="*.pptx") returned 6 [0142.238] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Hand Prints.htm", pszSpec="*.txt") returned 0 [0142.238] lstrlenA (lpString="*.txt") returned 5 [0142.238] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Hand Prints.htm", pszSpec="*.pdf") returned 0 [0142.238] lstrlenA (lpString="*.pdf") returned 5 [0142.238] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Hand Prints.htm", pszSpec="*.djvu") returned 0 [0142.239] lstrlenA (lpString="*.djvu") returned 6 [0142.239] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Hand Prints.htm", pszSpec="*.htm") returned 1 [0142.239] lstrlenA (lpString="*.htm") returned 5 [0142.239] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Hand Prints.htm" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Hand Prints.htm") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Hand Prints.htm" [0142.239] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Hand Prints.htm" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Hand Prints.htm") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Hand Prints.htm" [0142.239] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Hand Prints.htm", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Hand Prints.htm.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Hand Prints.htm." [0142.239] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Hand Prints.htm.", lpString2="\xa0" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Hand Prints.htm. ") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Hand Prints.htm. " [0142.239] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Hand Prints.htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\hand prints.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0142.239] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xeb [0142.239] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x28e09fe0, dwHighDateTime=0x1d2dd9c), lpLastAccessTime=0x407536*(dwLowDateTime=0x28e09fe0, dwHighDateTime=0x1d2dd9c), lpLastWriteTime=0x40753e*(dwLowDateTime=0xce0bd9df, dwHighDateTime=0x1ca040d)) returned 1 [0142.239] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0142.239] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x91, lpOverlapped=0x0) returned 1 [0142.240] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Hand Prints.htm") returned="Hand Prints.htm" [0142.240] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0142.240] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x91, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x91, lpOverlapped=0x0) returned 1 [0142.240] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0142.240] CloseHandle (hObject=0x98) returned 1 [0142.240] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Hand Prints.htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\hand prints.htm"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Hand Prints.htm. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\hand prints.htm. ")) returned 1 [0142.241] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0142.241] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0142.241] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="HandPrints.jpg") returned -1 [0142.241] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="HandPrints.jpg") returned 1 [0142.241] lstrcmpiA (lpString1="", lpString2="HandPrints.jpg") returned -1 [0142.241] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Hand Prints.htm") returned="Hand Prints.htm" [0142.241] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\", lpString2="HandPrints.jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\HandPrints.jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\HandPrints.jpg" [0142.242] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\HandPrints.jpg", pszSpec="*.zip") returned 0 [0142.242] lstrlenA (lpString="*.zip") returned 5 [0142.242] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\HandPrints.jpg", pszSpec="*.rar") returned 0 [0142.242] lstrlenA (lpString="*.rar") returned 5 [0142.242] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\HandPrints.jpg", pszSpec="*.7z") returned 0 [0142.242] lstrlenA (lpString="*.7z") returned 4 [0142.242] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\HandPrints.jpg", pszSpec="*.tar") returned 0 [0142.242] lstrlenA (lpString="*.tar") returned 5 [0142.242] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\HandPrints.jpg", pszSpec="*.gzip") returned 0 [0142.242] lstrlenA (lpString="*.gzip") returned 6 [0142.242] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\HandPrints.jpg", pszSpec="*.jpg") returned 1 [0142.242] lstrlenA (lpString="*.jpg") returned 5 [0142.242] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\HandPrints.jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\HandPrints.jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\HandPrints.jpg" [0142.242] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\HandPrints.jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\HandPrints.jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\HandPrints.jpg" [0142.242] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\HandPrints.jpg", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\HandPrints.jpg.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\HandPrints.jpg." [0142.242] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\HandPrints.jpg.", lpString2="\xa0" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\HandPrints.jpg. ") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\HandPrints.jpg. " [0142.242] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\HandPrints.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\handprints.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0142.242] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x107e [0142.242] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x28e09fe0, dwHighDateTime=0x1d2dd9c), lpLastAccessTime=0x407536*(dwLowDateTime=0x28e09fe0, dwHighDateTime=0x1d2dd9c), lpLastWriteTime=0x40753e*(dwLowDateTime=0xaa45cbf3, dwHighDateTime=0x1c9ea0c)) returned 1 [0142.243] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0142.243] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x1024, lpOverlapped=0x0) returned 1 [0142.272] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\HandPrints.jpg") returned="HandPrints.jpg" [0142.272] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0142.272] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x1024, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x1024, lpOverlapped=0x0) returned 1 [0142.272] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0142.272] CloseHandle (hObject=0x98) returned 1 [0142.272] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\HandPrints.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\handprints.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\HandPrints.jpg. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\handprints.jpg. ")) returned 1 [0142.273] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0142.273] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0142.273] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Orange Circles.htm") returned -1 [0142.273] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Orange Circles.htm") returned -1 [0142.273] lstrcmpiA (lpString1="", lpString2="Orange Circles.htm") returned -1 [0142.273] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\HandPrints.jpg") returned="HandPrints.jpg" [0142.273] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\", lpString2="Orange Circles.htm" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Orange Circles.htm") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Orange Circles.htm" [0142.273] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Orange Circles.htm", pszSpec="*.zip") returned 0 [0142.273] lstrlenA (lpString="*.zip") returned 5 [0142.273] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Orange Circles.htm", pszSpec="*.rar") returned 0 [0142.273] lstrlenA (lpString="*.rar") returned 5 [0142.273] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Orange Circles.htm", pszSpec="*.7z") returned 0 [0142.273] lstrlenA (lpString="*.7z") returned 4 [0142.273] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Orange Circles.htm", pszSpec="*.tar") returned 0 [0142.273] lstrlenA (lpString="*.tar") returned 5 [0142.273] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Orange Circles.htm", pszSpec="*.gzip") returned 0 [0142.273] lstrlenA (lpString="*.gzip") returned 6 [0142.273] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Orange Circles.htm", pszSpec="*.jpg") returned 0 [0142.273] lstrlenA (lpString="*.jpg") returned 5 [0142.273] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Orange Circles.htm", pszSpec="*.jpeg") returned 0 [0142.273] lstrlenA (lpString="*.jpeg") returned 6 [0142.273] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Orange Circles.htm", pszSpec="*.psd") returned 0 [0142.274] lstrlenA (lpString="*.psd") returned 5 [0142.274] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Orange Circles.htm", pszSpec="*.cdr") returned 0 [0142.274] lstrlenA (lpString="*.cdr") returned 5 [0142.274] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Orange Circles.htm", pszSpec="*.dwg") returned 0 [0142.274] lstrlenA (lpString="*.dwg") returned 5 [0142.274] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Orange Circles.htm", pszSpec="*.max") returned 0 [0142.274] lstrlenA (lpString="*.max") returned 5 [0142.274] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Orange Circles.htm", pszSpec="*.bmp") returned 0 [0142.274] lstrlenA (lpString="*.bmp") returned 5 [0142.274] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Orange Circles.htm", pszSpec="*.gif") returned 0 [0142.274] lstrlenA (lpString="*.gif") returned 5 [0142.274] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Orange Circles.htm", pszSpec="*.png") returned 0 [0142.274] lstrlenA (lpString="*.png") returned 5 [0142.274] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Orange Circles.htm", pszSpec="*.doc") returned 0 [0142.274] lstrlenA (lpString="*.doc") returned 5 [0142.274] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Orange Circles.htm", pszSpec="*.docx") returned 0 [0142.274] lstrlenA (lpString="*.docx") returned 6 [0142.274] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Orange Circles.htm", pszSpec="*.xls") returned 0 [0142.274] lstrlenA (lpString="*.xls") returned 5 [0142.274] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Orange Circles.htm", pszSpec="*.xlsx") returned 0 [0142.274] lstrlenA (lpString="*.xlsx") returned 6 [0142.274] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Orange Circles.htm", pszSpec="*.ppt") returned 0 [0142.274] lstrlenA (lpString="*.ppt") returned 5 [0142.274] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Orange Circles.htm", pszSpec="*.pptx") returned 0 [0142.274] lstrlenA (lpString="*.pptx") returned 6 [0142.274] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Orange Circles.htm", pszSpec="*.txt") returned 0 [0142.274] lstrlenA (lpString="*.txt") returned 5 [0142.274] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Orange Circles.htm", pszSpec="*.pdf") returned 0 [0142.274] lstrlenA (lpString="*.pdf") returned 5 [0142.274] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Orange Circles.htm", pszSpec="*.djvu") returned 0 [0142.274] lstrlenA (lpString="*.djvu") returned 6 [0142.274] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Orange Circles.htm", pszSpec="*.htm") returned 1 [0142.274] lstrlenA (lpString="*.htm") returned 5 [0142.274] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Orange Circles.htm" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Orange Circles.htm") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Orange Circles.htm" [0142.274] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Orange Circles.htm" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Orange Circles.htm") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Orange Circles.htm" [0142.274] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Orange Circles.htm", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Orange Circles.htm.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Orange Circles.htm." [0142.274] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Orange Circles.htm.", lpString2="\xa0" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Orange Circles.htm. ") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Orange Circles.htm. " [0142.274] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Orange Circles.htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\orange circles.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0142.278] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xed [0142.278] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x28e09fe0, dwHighDateTime=0x1d2dd9c), lpLastAccessTime=0x407536*(dwLowDateTime=0x28e09fe0, dwHighDateTime=0x1d2dd9c), lpLastWriteTime=0x40753e*(dwLowDateTime=0xce0e3b3c, dwHighDateTime=0x1ca040d)) returned 1 [0142.278] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0142.278] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x93, lpOverlapped=0x0) returned 1 [0142.278] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Orange Circles.htm") returned="Orange Circles.htm" [0142.278] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0142.278] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x93, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x93, lpOverlapped=0x0) returned 1 [0142.279] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0142.280] CloseHandle (hObject=0x98) returned 1 [0142.280] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Orange Circles.htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\orange circles.htm"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Orange Circles.htm. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\orange circles.htm. ")) returned 1 [0142.280] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0142.280] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0142.280] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="OrangeCircles.jpg") returned -1 [0142.281] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="OrangeCircles.jpg") returned -1 [0142.281] lstrcmpiA (lpString1="", lpString2="OrangeCircles.jpg") returned -1 [0142.281] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Orange Circles.htm") returned="Orange Circles.htm" [0142.281] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\", lpString2="OrangeCircles.jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\OrangeCircles.jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\OrangeCircles.jpg" [0142.281] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\OrangeCircles.jpg", pszSpec="*.zip") returned 0 [0142.281] lstrlenA (lpString="*.zip") returned 5 [0142.281] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\OrangeCircles.jpg", pszSpec="*.rar") returned 0 [0142.281] lstrlenA (lpString="*.rar") returned 5 [0142.281] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\OrangeCircles.jpg", pszSpec="*.7z") returned 0 [0142.281] lstrlenA (lpString="*.7z") returned 4 [0142.281] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\OrangeCircles.jpg", pszSpec="*.tar") returned 0 [0142.281] lstrlenA (lpString="*.tar") returned 5 [0142.281] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\OrangeCircles.jpg", pszSpec="*.gzip") returned 0 [0142.281] lstrlenA (lpString="*.gzip") returned 6 [0142.281] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\OrangeCircles.jpg", pszSpec="*.jpg") returned 1 [0142.281] lstrlenA (lpString="*.jpg") returned 5 [0142.281] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\OrangeCircles.jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\OrangeCircles.jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\OrangeCircles.jpg" [0142.281] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\OrangeCircles.jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\OrangeCircles.jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\OrangeCircles.jpg" [0142.281] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\OrangeCircles.jpg", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\OrangeCircles.jpg.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\OrangeCircles.jpg." [0142.281] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\OrangeCircles.jpg.", lpString2="\xa0" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\OrangeCircles.jpg. ") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\OrangeCircles.jpg. " [0142.281] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\OrangeCircles.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\orangecircles.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0142.282] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x18ed [0142.282] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x28e09fe0, dwHighDateTime=0x1d2dd9c), lpLastAccessTime=0x407536*(dwLowDateTime=0x28e09fe0, dwHighDateTime=0x1d2dd9c), lpLastWriteTime=0x40753e*(dwLowDateTime=0xaa4cf00d, dwHighDateTime=0x1c9ea0c)) returned 1 [0142.282] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0142.282] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x1893, lpOverlapped=0x0) returned 1 [0142.309] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\OrangeCircles.jpg") returned="OrangeCircles.jpg" [0142.309] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0142.309] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x1893, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x1893, lpOverlapped=0x0) returned 1 [0142.309] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0142.309] CloseHandle (hObject=0x98) returned 1 [0142.309] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\OrangeCircles.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\orangecircles.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\OrangeCircles.jpg. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\orangecircles.jpg. ")) returned 1 [0142.310] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0142.310] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0142.310] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Peacock.htm") returned -1 [0142.310] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Peacock.htm") returned -1 [0142.310] lstrcmpiA (lpString1="", lpString2="Peacock.htm") returned -1 [0142.310] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\OrangeCircles.jpg") returned="OrangeCircles.jpg" [0142.310] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\", lpString2="Peacock.htm" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.htm") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.htm" [0142.310] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.htm", pszSpec="*.zip") returned 0 [0142.310] lstrlenA (lpString="*.zip") returned 5 [0142.311] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.htm", pszSpec="*.rar") returned 0 [0142.311] lstrlenA (lpString="*.rar") returned 5 [0142.311] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.htm", pszSpec="*.7z") returned 0 [0142.311] lstrlenA (lpString="*.7z") returned 4 [0142.311] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.htm", pszSpec="*.tar") returned 0 [0142.311] lstrlenA (lpString="*.tar") returned 5 [0142.311] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.htm", pszSpec="*.gzip") returned 0 [0142.311] lstrlenA (lpString="*.gzip") returned 6 [0142.311] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.htm", pszSpec="*.jpg") returned 0 [0142.311] lstrlenA (lpString="*.jpg") returned 5 [0142.311] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.htm", pszSpec="*.jpeg") returned 0 [0142.311] lstrlenA (lpString="*.jpeg") returned 6 [0142.311] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.htm", pszSpec="*.psd") returned 0 [0142.311] lstrlenA (lpString="*.psd") returned 5 [0142.311] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.htm", pszSpec="*.cdr") returned 0 [0142.311] lstrlenA (lpString="*.cdr") returned 5 [0142.311] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.htm", pszSpec="*.dwg") returned 0 [0142.311] lstrlenA (lpString="*.dwg") returned 5 [0142.311] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.htm", pszSpec="*.max") returned 0 [0142.311] lstrlenA (lpString="*.max") returned 5 [0142.311] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.htm", pszSpec="*.bmp") returned 0 [0142.311] lstrlenA (lpString="*.bmp") returned 5 [0142.311] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.htm", pszSpec="*.gif") returned 0 [0142.311] lstrlenA (lpString="*.gif") returned 5 [0142.311] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.htm", pszSpec="*.png") returned 0 [0142.311] lstrlenA (lpString="*.png") returned 5 [0142.311] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.htm", pszSpec="*.doc") returned 0 [0142.311] lstrlenA (lpString="*.doc") returned 5 [0142.311] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.htm", pszSpec="*.docx") returned 0 [0142.311] lstrlenA (lpString="*.docx") returned 6 [0142.311] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.htm", pszSpec="*.xls") returned 0 [0142.312] lstrlenA (lpString="*.xls") returned 5 [0142.312] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.htm", pszSpec="*.xlsx") returned 0 [0142.312] lstrlenA (lpString="*.xlsx") returned 6 [0142.312] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.htm", pszSpec="*.ppt") returned 0 [0142.312] lstrlenA (lpString="*.ppt") returned 5 [0142.312] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.htm", pszSpec="*.pptx") returned 0 [0142.312] lstrlenA (lpString="*.pptx") returned 6 [0142.312] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.htm", pszSpec="*.txt") returned 0 [0142.312] lstrlenA (lpString="*.txt") returned 5 [0142.313] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.htm", pszSpec="*.pdf") returned 0 [0142.313] lstrlenA (lpString="*.pdf") returned 5 [0142.313] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.htm", pszSpec="*.djvu") returned 0 [0142.313] lstrlenA (lpString="*.djvu") returned 6 [0142.313] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.htm", pszSpec="*.htm") returned 1 [0142.313] lstrlenA (lpString="*.htm") returned 5 [0142.313] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.htm" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.htm") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.htm" [0142.313] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.htm" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.htm") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.htm" [0142.313] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.htm", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.htm.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.htm." [0142.313] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.htm.", lpString2="\xa0" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.htm. ") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.htm. " [0142.313] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\peacock.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0142.313] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xe8 [0142.313] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x28e09fe0, dwHighDateTime=0x1d2dd9c), lpLastAccessTime=0x407536*(dwLowDateTime=0x28e09fe0, dwHighDateTime=0x1d2dd9c), lpLastWriteTime=0x40753e*(dwLowDateTime=0xce109c99, dwHighDateTime=0x1ca040d)) returned 1 [0142.313] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0142.313] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x8e, lpOverlapped=0x0) returned 1 [0142.314] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.htm") returned="Peacock.htm" [0142.314] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0142.314] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x8e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x8e, lpOverlapped=0x0) returned 1 [0142.314] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0142.314] CloseHandle (hObject=0x98) returned 1 [0142.315] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\peacock.htm"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.htm. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\peacock.htm. ")) returned 1 [0142.317] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0142.317] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0142.317] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Peacock.jpg") returned -1 [0142.317] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Peacock.jpg") returned -1 [0142.317] lstrcmpiA (lpString1="", lpString2="Peacock.jpg") returned -1 [0142.317] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.htm") returned="Peacock.htm" [0142.317] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\", lpString2="Peacock.jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.jpg" [0142.317] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.jpg", pszSpec="*.zip") returned 0 [0142.317] lstrlenA (lpString="*.zip") returned 5 [0142.317] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.jpg", pszSpec="*.rar") returned 0 [0142.317] lstrlenA (lpString="*.rar") returned 5 [0142.317] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.jpg", pszSpec="*.7z") returned 0 [0142.317] lstrlenA (lpString="*.7z") returned 4 [0142.317] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.jpg", pszSpec="*.tar") returned 0 [0142.317] lstrlenA (lpString="*.tar") returned 5 [0142.317] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.jpg", pszSpec="*.gzip") returned 0 [0142.317] lstrlenA (lpString="*.gzip") returned 6 [0142.317] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.jpg", pszSpec="*.jpg") returned 1 [0142.317] lstrlenA (lpString="*.jpg") returned 5 [0142.317] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.jpg" [0142.317] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.jpg" [0142.318] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.jpg", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.jpg.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.jpg." [0142.318] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.jpg.", lpString2="\xa0" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.jpg. ") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.jpg. " [0142.318] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\peacock.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0142.318] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x13fb [0142.318] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x28e09fe0, dwHighDateTime=0x1d2dd9c), lpLastAccessTime=0x407536*(dwLowDateTime=0x28e09fe0, dwHighDateTime=0x1d2dd9c), lpLastWriteTime=0x40753e*(dwLowDateTime=0xaa51b2c9, dwHighDateTime=0x1c9ea0c)) returned 1 [0142.318] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0142.318] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x13a1, lpOverlapped=0x0) returned 1 [0142.331] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.jpg") returned="Peacock.jpg" [0142.331] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0142.331] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x13a1, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x13a1, lpOverlapped=0x0) returned 1 [0142.331] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0142.331] CloseHandle (hObject=0x98) returned 1 [0142.331] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\peacock.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.jpg. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\peacock.jpg. ")) returned 1 [0142.332] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0142.332] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0142.332] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Roses.htm") returned -1 [0142.332] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Roses.htm") returned -1 [0142.332] lstrcmpiA (lpString1="", lpString2="Roses.htm") returned -1 [0142.332] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.jpg") returned="Peacock.jpg" [0142.332] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\", lpString2="Roses.htm" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.htm") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.htm" [0142.332] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.htm", pszSpec="*.zip") returned 0 [0142.333] lstrlenA (lpString="*.zip") returned 5 [0142.333] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.htm", pszSpec="*.rar") returned 0 [0142.333] lstrlenA (lpString="*.rar") returned 5 [0142.333] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.htm", pszSpec="*.7z") returned 0 [0142.333] lstrlenA (lpString="*.7z") returned 4 [0142.333] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.htm", pszSpec="*.tar") returned 0 [0142.333] lstrlenA (lpString="*.tar") returned 5 [0142.333] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.htm", pszSpec="*.gzip") returned 0 [0142.333] lstrlenA (lpString="*.gzip") returned 6 [0142.333] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.htm", pszSpec="*.jpg") returned 0 [0142.333] lstrlenA (lpString="*.jpg") returned 5 [0142.333] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.htm", pszSpec="*.jpeg") returned 0 [0142.333] lstrlenA (lpString="*.jpeg") returned 6 [0142.333] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.htm", pszSpec="*.psd") returned 0 [0142.333] lstrlenA (lpString="*.psd") returned 5 [0142.333] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.htm", pszSpec="*.cdr") returned 0 [0142.333] lstrlenA (lpString="*.cdr") returned 5 [0142.333] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.htm", pszSpec="*.dwg") returned 0 [0142.333] lstrlenA (lpString="*.dwg") returned 5 [0142.333] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.htm", pszSpec="*.max") returned 0 [0142.333] lstrlenA (lpString="*.max") returned 5 [0142.333] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.htm", pszSpec="*.bmp") returned 0 [0142.333] lstrlenA (lpString="*.bmp") returned 5 [0142.333] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.htm", pszSpec="*.gif") returned 0 [0142.333] lstrlenA (lpString="*.gif") returned 5 [0142.333] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.htm", pszSpec="*.png") returned 0 [0142.333] lstrlenA (lpString="*.png") returned 5 [0142.333] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.htm", pszSpec="*.doc") returned 0 [0142.333] lstrlenA (lpString="*.doc") returned 5 [0142.333] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.htm", pszSpec="*.docx") returned 0 [0142.333] lstrlenA (lpString="*.docx") returned 6 [0142.333] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.htm", pszSpec="*.xls") returned 0 [0142.333] lstrlenA (lpString="*.xls") returned 5 [0142.333] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.htm", pszSpec="*.xlsx") returned 0 [0142.333] lstrlenA (lpString="*.xlsx") returned 6 [0142.333] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.htm", pszSpec="*.ppt") returned 0 [0142.333] lstrlenA (lpString="*.ppt") returned 5 [0142.333] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.htm", pszSpec="*.pptx") returned 0 [0142.333] lstrlenA (lpString="*.pptx") returned 6 [0142.333] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.htm", pszSpec="*.txt") returned 0 [0142.333] lstrlenA (lpString="*.txt") returned 5 [0142.333] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.htm", pszSpec="*.pdf") returned 0 [0142.334] lstrlenA (lpString="*.pdf") returned 5 [0142.334] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.htm", pszSpec="*.djvu") returned 0 [0142.334] lstrlenA (lpString="*.djvu") returned 6 [0142.334] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.htm", pszSpec="*.htm") returned 1 [0142.334] lstrlenA (lpString="*.htm") returned 5 [0142.334] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.htm" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.htm") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.htm" [0142.334] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.htm" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.htm") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.htm" [0142.334] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.htm", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.htm.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.htm." [0142.334] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.htm.", lpString2="\xa0" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.htm. ") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.htm. " [0142.334] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\roses.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0142.334] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xe9 [0142.334] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x28f3aae0, dwHighDateTime=0x1d2dd9c), lpLastAccessTime=0x407536*(dwLowDateTime=0x28f3aae0, dwHighDateTime=0x1d2dd9c), lpLastWriteTime=0x40753e*(dwLowDateTime=0xce12fdf6, dwHighDateTime=0x1ca040d)) returned 1 [0142.337] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0142.337] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x8f, lpOverlapped=0x0) returned 1 [0142.337] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.htm") returned="Roses.htm" [0142.337] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0142.337] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x8f, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x8f, lpOverlapped=0x0) returned 1 [0142.338] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0142.338] CloseHandle (hObject=0x98) returned 1 [0142.338] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\roses.htm"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.htm. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\roses.htm. ")) returned 1 [0142.413] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0142.413] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0142.413] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Roses.jpg") returned -1 [0142.413] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Roses.jpg") returned -1 [0142.413] lstrcmpiA (lpString1="", lpString2="Roses.jpg") returned -1 [0142.413] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.htm") returned="Roses.htm" [0142.413] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\", lpString2="Roses.jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.jpg" [0142.413] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.jpg", pszSpec="*.zip") returned 0 [0142.413] lstrlenA (lpString="*.zip") returned 5 [0142.413] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.jpg", pszSpec="*.rar") returned 0 [0142.413] lstrlenA (lpString="*.rar") returned 5 [0142.413] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.jpg", pszSpec="*.7z") returned 0 [0142.413] lstrlenA (lpString="*.7z") returned 4 [0142.413] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.jpg", pszSpec="*.tar") returned 0 [0142.413] lstrlenA (lpString="*.tar") returned 5 [0142.413] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.jpg", pszSpec="*.gzip") returned 0 [0142.413] lstrlenA (lpString="*.gzip") returned 6 [0142.413] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.jpg", pszSpec="*.jpg") returned 1 [0142.413] lstrlenA (lpString="*.jpg") returned 5 [0142.413] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.jpg" [0142.413] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.jpg" [0142.413] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.jpg", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.jpg.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.jpg." [0142.413] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.jpg.", lpString2="\xa0" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.jpg. ") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.jpg. " [0142.413] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\roses.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0142.414] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x780 [0142.414] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x28f3aae0, dwHighDateTime=0x1d2dd9c), lpLastAccessTime=0x407536*(dwLowDateTime=0x28f3aae0, dwHighDateTime=0x1d2dd9c), lpLastWriteTime=0x40753e*(dwLowDateTime=0xaa567585, dwHighDateTime=0x1c9ea0c)) returned 1 [0142.414] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0142.414] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x726, lpOverlapped=0x0) returned 1 [0142.416] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.jpg") returned="Roses.jpg" [0142.416] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0142.416] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x726, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x726, lpOverlapped=0x0) returned 1 [0142.416] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0142.416] CloseHandle (hObject=0x98) returned 1 [0142.416] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\roses.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.jpg. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\roses.jpg. ")) returned 1 [0142.417] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0142.417] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0142.417] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Shades of Blue.htm") returned -1 [0142.417] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Shades of Blue.htm") returned -1 [0142.417] lstrcmpiA (lpString1="", lpString2="Shades of Blue.htm") returned -1 [0142.417] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.jpg") returned="Roses.jpg" [0142.417] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\", lpString2="Shades of Blue.htm" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Shades of Blue.htm") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Shades of Blue.htm" [0142.417] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Shades of Blue.htm", pszSpec="*.zip") returned 0 [0142.417] lstrlenA (lpString="*.zip") returned 5 [0142.417] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Shades of Blue.htm", pszSpec="*.rar") returned 0 [0142.417] lstrlenA (lpString="*.rar") returned 5 [0142.417] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Shades of Blue.htm", pszSpec="*.7z") returned 0 [0142.417] lstrlenA (lpString="*.7z") returned 4 [0142.417] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Shades of Blue.htm", pszSpec="*.tar") returned 0 [0142.417] lstrlenA (lpString="*.tar") returned 5 [0142.417] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Shades of Blue.htm", pszSpec="*.gzip") returned 0 [0142.417] lstrlenA (lpString="*.gzip") returned 6 [0142.417] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Shades of Blue.htm", pszSpec="*.jpg") returned 0 [0142.417] lstrlenA (lpString="*.jpg") returned 5 [0142.417] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Shades of Blue.htm", pszSpec="*.jpeg") returned 0 [0142.417] lstrlenA (lpString="*.jpeg") returned 6 [0142.417] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Shades of Blue.htm", pszSpec="*.psd") returned 0 [0142.417] lstrlenA (lpString="*.psd") returned 5 [0142.417] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Shades of Blue.htm", pszSpec="*.cdr") returned 0 [0142.417] lstrlenA (lpString="*.cdr") returned 5 [0142.417] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Shades of Blue.htm", pszSpec="*.dwg") returned 0 [0142.417] lstrlenA (lpString="*.dwg") returned 5 [0142.417] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Shades of Blue.htm", pszSpec="*.max") returned 0 [0142.417] lstrlenA (lpString="*.max") returned 5 [0142.417] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Shades of Blue.htm", pszSpec="*.bmp") returned 0 [0142.417] lstrlenA (lpString="*.bmp") returned 5 [0142.417] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Shades of Blue.htm", pszSpec="*.gif") returned 0 [0142.417] lstrlenA (lpString="*.gif") returned 5 [0142.418] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Shades of Blue.htm", pszSpec="*.png") returned 0 [0142.418] lstrlenA (lpString="*.png") returned 5 [0142.418] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Shades of Blue.htm", pszSpec="*.doc") returned 0 [0142.418] lstrlenA (lpString="*.doc") returned 5 [0142.418] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Shades of Blue.htm", pszSpec="*.docx") returned 0 [0142.418] lstrlenA (lpString="*.docx") returned 6 [0142.418] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Shades of Blue.htm", pszSpec="*.xls") returned 0 [0142.418] lstrlenA (lpString="*.xls") returned 5 [0142.418] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Shades of Blue.htm", pszSpec="*.xlsx") returned 0 [0142.418] lstrlenA (lpString="*.xlsx") returned 6 [0142.418] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Shades of Blue.htm", pszSpec="*.ppt") returned 0 [0142.418] lstrlenA (lpString="*.ppt") returned 5 [0142.418] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Shades of Blue.htm", pszSpec="*.pptx") returned 0 [0142.418] lstrlenA (lpString="*.pptx") returned 6 [0142.418] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Shades of Blue.htm", pszSpec="*.txt") returned 0 [0142.418] lstrlenA (lpString="*.txt") returned 5 [0142.418] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Shades of Blue.htm", pszSpec="*.pdf") returned 0 [0142.418] lstrlenA (lpString="*.pdf") returned 5 [0142.418] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Shades of Blue.htm", pszSpec="*.djvu") returned 0 [0142.418] lstrlenA (lpString="*.djvu") returned 6 [0142.418] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Shades of Blue.htm", pszSpec="*.htm") returned 1 [0142.418] lstrlenA (lpString="*.htm") returned 5 [0142.418] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Shades of Blue.htm" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Shades of Blue.htm") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Shades of Blue.htm" [0142.418] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Shades of Blue.htm" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Shades of Blue.htm") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Shades of Blue.htm" [0142.418] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Shades of Blue.htm", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Shades of Blue.htm.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Shades of Blue.htm." [0142.418] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Shades of Blue.htm.", lpString2="\xa0" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Shades of Blue.htm. ") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Shades of Blue.htm. " [0142.418] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Shades of Blue.htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\shades of blue.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0142.419] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xed [0142.419] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x28f3aae0, dwHighDateTime=0x1d2dd9c), lpLastAccessTime=0x407536*(dwLowDateTime=0x28f3aae0, dwHighDateTime=0x1d2dd9c), lpLastWriteTime=0x40753e*(dwLowDateTime=0xce17c0b0, dwHighDateTime=0x1ca040d)) returned 1 [0142.419] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0142.419] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x93, lpOverlapped=0x0) returned 1 [0142.419] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Shades of Blue.htm") returned="Shades of Blue.htm" [0142.419] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0142.419] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x93, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x93, lpOverlapped=0x0) returned 1 [0142.420] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0142.420] CloseHandle (hObject=0x98) returned 1 [0142.420] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Shades of Blue.htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\shades of blue.htm"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Shades of Blue.htm. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\shades of blue.htm. ")) returned 1 [0142.421] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0142.421] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0142.421] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="ShadesOfBlue.jpg") returned -1 [0142.421] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ShadesOfBlue.jpg") returned -1 [0142.421] lstrcmpiA (lpString1="", lpString2="ShadesOfBlue.jpg") returned -1 [0142.421] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Shades of Blue.htm") returned="Shades of Blue.htm" [0142.421] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\", lpString2="ShadesOfBlue.jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\ShadesOfBlue.jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\ShadesOfBlue.jpg" [0142.421] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\ShadesOfBlue.jpg", pszSpec="*.zip") returned 0 [0142.421] lstrlenA (lpString="*.zip") returned 5 [0142.421] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\ShadesOfBlue.jpg", pszSpec="*.rar") returned 0 [0142.421] lstrlenA (lpString="*.rar") returned 5 [0142.421] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\ShadesOfBlue.jpg", pszSpec="*.7z") returned 0 [0142.421] lstrlenA (lpString="*.7z") returned 4 [0142.421] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\ShadesOfBlue.jpg", pszSpec="*.tar") returned 0 [0142.421] lstrlenA (lpString="*.tar") returned 5 [0142.421] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\ShadesOfBlue.jpg", pszSpec="*.gzip") returned 0 [0142.421] lstrlenA (lpString="*.gzip") returned 6 [0142.421] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\ShadesOfBlue.jpg", pszSpec="*.jpg") returned 1 [0142.421] lstrlenA (lpString="*.jpg") returned 5 [0142.421] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\ShadesOfBlue.jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\ShadesOfBlue.jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\ShadesOfBlue.jpg" [0142.421] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\ShadesOfBlue.jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\ShadesOfBlue.jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\ShadesOfBlue.jpg" [0142.422] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\ShadesOfBlue.jpg", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\ShadesOfBlue.jpg.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\ShadesOfBlue.jpg." [0142.422] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\ShadesOfBlue.jpg.", lpString2="\xa0" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\ShadesOfBlue.jpg. ") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\ShadesOfBlue.jpg. " [0142.422] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\ShadesOfBlue.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\shadesofblue.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0142.422] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x127e [0142.422] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x28f3aae0, dwHighDateTime=0x1d2dd9c), lpLastAccessTime=0x407536*(dwLowDateTime=0x28f3aae0, dwHighDateTime=0x1d2dd9c), lpLastWriteTime=0x40753e*(dwLowDateTime=0xaa58d6e3, dwHighDateTime=0x1c9ea0c)) returned 1 [0142.422] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0142.422] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x1224, lpOverlapped=0x0) returned 1 [0142.570] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\ShadesOfBlue.jpg") returned="ShadesOfBlue.jpg" [0142.571] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0142.571] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x1224, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x1224, lpOverlapped=0x0) returned 1 [0142.571] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0142.571] CloseHandle (hObject=0x98) returned 1 [0142.571] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\ShadesOfBlue.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\shadesofblue.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\ShadesOfBlue.jpg. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\shadesofblue.jpg. ")) returned 1 [0142.572] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0142.572] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0142.572] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Soft Blue.htm") returned -1 [0142.572] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Soft Blue.htm") returned -1 [0142.572] lstrcmpiA (lpString1="", lpString2="Soft Blue.htm") returned -1 [0142.572] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\ShadesOfBlue.jpg") returned="ShadesOfBlue.jpg" [0142.572] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\", lpString2="Soft Blue.htm" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Soft Blue.htm") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Soft Blue.htm" [0142.572] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Soft Blue.htm", pszSpec="*.zip") returned 0 [0142.572] lstrlenA (lpString="*.zip") returned 5 [0142.572] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Soft Blue.htm", pszSpec="*.rar") returned 0 [0142.572] lstrlenA (lpString="*.rar") returned 5 [0142.572] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Soft Blue.htm", pszSpec="*.7z") returned 0 [0142.572] lstrlenA (lpString="*.7z") returned 4 [0142.572] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Soft Blue.htm", pszSpec="*.tar") returned 0 [0142.572] lstrlenA (lpString="*.tar") returned 5 [0142.572] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Soft Blue.htm", pszSpec="*.gzip") returned 0 [0142.572] lstrlenA (lpString="*.gzip") returned 6 [0142.572] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Soft Blue.htm", pszSpec="*.jpg") returned 0 [0142.572] lstrlenA (lpString="*.jpg") returned 5 [0142.572] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Soft Blue.htm", pszSpec="*.jpeg") returned 0 [0142.572] lstrlenA (lpString="*.jpeg") returned 6 [0142.573] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Soft Blue.htm", pszSpec="*.psd") returned 0 [0142.573] lstrlenA (lpString="*.psd") returned 5 [0142.573] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Soft Blue.htm", pszSpec="*.cdr") returned 0 [0142.573] lstrlenA (lpString="*.cdr") returned 5 [0142.573] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Soft Blue.htm", pszSpec="*.dwg") returned 0 [0142.582] lstrlenA (lpString="*.dwg") returned 5 [0142.582] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Soft Blue.htm", pszSpec="*.max") returned 0 [0142.582] lstrlenA (lpString="*.max") returned 5 [0142.582] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Soft Blue.htm", pszSpec="*.bmp") returned 0 [0142.582] lstrlenA (lpString="*.bmp") returned 5 [0142.582] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Soft Blue.htm", pszSpec="*.gif") returned 0 [0142.582] lstrlenA (lpString="*.gif") returned 5 [0142.582] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Soft Blue.htm", pszSpec="*.png") returned 0 [0142.582] lstrlenA (lpString="*.png") returned 5 [0142.582] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Soft Blue.htm", pszSpec="*.doc") returned 0 [0142.582] lstrlenA (lpString="*.doc") returned 5 [0142.582] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Soft Blue.htm", pszSpec="*.docx") returned 0 [0142.582] lstrlenA (lpString="*.docx") returned 6 [0142.582] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Soft Blue.htm", pszSpec="*.xls") returned 0 [0142.582] lstrlenA (lpString="*.xls") returned 5 [0142.582] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Soft Blue.htm", pszSpec="*.xlsx") returned 0 [0142.582] lstrlenA (lpString="*.xlsx") returned 6 [0142.582] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Soft Blue.htm", pszSpec="*.ppt") returned 0 [0142.582] lstrlenA (lpString="*.ppt") returned 5 [0142.582] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Soft Blue.htm", pszSpec="*.pptx") returned 0 [0142.582] lstrlenA (lpString="*.pptx") returned 6 [0142.582] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Soft Blue.htm", pszSpec="*.txt") returned 0 [0142.582] lstrlenA (lpString="*.txt") returned 5 [0142.582] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Soft Blue.htm", pszSpec="*.pdf") returned 0 [0142.582] lstrlenA (lpString="*.pdf") returned 5 [0142.583] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Soft Blue.htm", pszSpec="*.djvu") returned 0 [0142.583] lstrlenA (lpString="*.djvu") returned 6 [0142.583] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Soft Blue.htm", pszSpec="*.htm") returned 1 [0142.583] lstrlenA (lpString="*.htm") returned 5 [0142.583] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Soft Blue.htm" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Soft Blue.htm") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Soft Blue.htm" [0142.583] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Soft Blue.htm" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Soft Blue.htm") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Soft Blue.htm" [0142.583] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Soft Blue.htm", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Soft Blue.htm.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Soft Blue.htm." [0142.583] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Soft Blue.htm.", lpString2="\xa0" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Soft Blue.htm. ") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Soft Blue.htm. " [0142.583] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Soft Blue.htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\soft blue.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0142.583] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xe8 [0142.584] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x28de3e80, dwHighDateTime=0x1d2dd9c), lpLastAccessTime=0x407536*(dwLowDateTime=0x28de3e80, dwHighDateTime=0x1d2dd9c), lpLastWriteTime=0x40753e*(dwLowDateTime=0xce1a220d, dwHighDateTime=0x1ca040d)) returned 1 [0142.584] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0142.584] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x8e, lpOverlapped=0x0) returned 1 [0142.584] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Soft Blue.htm") returned="Soft Blue.htm" [0142.584] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0142.585] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x8e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x8e, lpOverlapped=0x0) returned 1 [0142.589] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0142.589] CloseHandle (hObject=0x98) returned 1 [0142.589] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Soft Blue.htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\soft blue.htm"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Soft Blue.htm. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\soft blue.htm. ")) returned 1 [0142.590] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0142.591] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0142.591] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="SoftBlue.jpg") returned -1 [0142.591] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SoftBlue.jpg") returned -1 [0142.591] lstrcmpiA (lpString1="", lpString2="SoftBlue.jpg") returned -1 [0142.591] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Soft Blue.htm") returned="Soft Blue.htm" [0142.591] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\", lpString2="SoftBlue.jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\SoftBlue.jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\SoftBlue.jpg" [0142.591] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\SoftBlue.jpg", pszSpec="*.zip") returned 0 [0142.591] lstrlenA (lpString="*.zip") returned 5 [0142.591] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\SoftBlue.jpg", pszSpec="*.rar") returned 0 [0142.591] lstrlenA (lpString="*.rar") returned 5 [0142.591] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\SoftBlue.jpg", pszSpec="*.7z") returned 0 [0142.591] lstrlenA (lpString="*.7z") returned 4 [0142.591] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\SoftBlue.jpg", pszSpec="*.tar") returned 0 [0142.591] lstrlenA (lpString="*.tar") returned 5 [0142.591] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\SoftBlue.jpg", pszSpec="*.gzip") returned 0 [0142.591] lstrlenA (lpString="*.gzip") returned 6 [0142.591] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\SoftBlue.jpg", pszSpec="*.jpg") returned 1 [0142.591] lstrlenA (lpString="*.jpg") returned 5 [0142.591] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\SoftBlue.jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\SoftBlue.jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\SoftBlue.jpg" [0142.591] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\SoftBlue.jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\SoftBlue.jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\SoftBlue.jpg" [0142.591] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\SoftBlue.jpg", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\SoftBlue.jpg.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\SoftBlue.jpg." [0142.591] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\SoftBlue.jpg.", lpString2="\xa0" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\SoftBlue.jpg. ") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\SoftBlue.jpg. " [0142.592] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\SoftBlue.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\softblue.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0142.593] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2949 [0142.593] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x28de3e80, dwHighDateTime=0x1d2dd9c), lpLastAccessTime=0x407536*(dwLowDateTime=0x28de3e80, dwHighDateTime=0x1d2dd9c), lpLastWriteTime=0x40753e*(dwLowDateTime=0xaa5b3841, dwHighDateTime=0x1c9ea0c)) returned 1 [0142.593] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0142.593] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x28ef, lpOverlapped=0x0) returned 1 [0142.648] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\SoftBlue.jpg") returned="SoftBlue.jpg" [0142.648] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0142.648] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x28ef, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x28ef, lpOverlapped=0x0) returned 1 [0142.649] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0142.649] CloseHandle (hObject=0x98) returned 1 [0142.649] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\SoftBlue.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\softblue.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\SoftBlue.jpg. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\softblue.jpg. ")) returned 1 [0142.650] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0142.650] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0142.650] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Stars.htm") returned -1 [0142.650] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Stars.htm") returned -1 [0142.650] lstrcmpiA (lpString1="", lpString2="Stars.htm") returned -1 [0142.650] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\SoftBlue.jpg") returned="SoftBlue.jpg" [0142.650] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\", lpString2="Stars.htm" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.htm") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.htm" [0142.650] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.htm", pszSpec="*.zip") returned 0 [0142.650] lstrlenA (lpString="*.zip") returned 5 [0142.650] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.htm", pszSpec="*.rar") returned 0 [0142.650] lstrlenA (lpString="*.rar") returned 5 [0142.650] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.htm", pszSpec="*.7z") returned 0 [0142.650] lstrlenA (lpString="*.7z") returned 4 [0142.650] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.htm", pszSpec="*.tar") returned 0 [0142.650] lstrlenA (lpString="*.tar") returned 5 [0142.650] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.htm", pszSpec="*.gzip") returned 0 [0142.650] lstrlenA (lpString="*.gzip") returned 6 [0142.650] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.htm", pszSpec="*.jpg") returned 0 [0142.650] lstrlenA (lpString="*.jpg") returned 5 [0142.650] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.htm", pszSpec="*.jpeg") returned 0 [0142.650] lstrlenA (lpString="*.jpeg") returned 6 [0142.650] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.htm", pszSpec="*.psd") returned 0 [0142.650] lstrlenA (lpString="*.psd") returned 5 [0142.650] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.htm", pszSpec="*.cdr") returned 0 [0142.650] lstrlenA (lpString="*.cdr") returned 5 [0142.650] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.htm", pszSpec="*.dwg") returned 0 [0142.650] lstrlenA (lpString="*.dwg") returned 5 [0142.650] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.htm", pszSpec="*.max") returned 0 [0142.650] lstrlenA (lpString="*.max") returned 5 [0142.650] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.htm", pszSpec="*.bmp") returned 0 [0142.650] lstrlenA (lpString="*.bmp") returned 5 [0142.650] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.htm", pszSpec="*.gif") returned 0 [0142.650] lstrlenA (lpString="*.gif") returned 5 [0142.650] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.htm", pszSpec="*.png") returned 0 [0142.650] lstrlenA (lpString="*.png") returned 5 [0142.650] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.htm", pszSpec="*.doc") returned 0 [0142.650] lstrlenA (lpString="*.doc") returned 5 [0142.650] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.htm", pszSpec="*.docx") returned 0 [0142.650] lstrlenA (lpString="*.docx") returned 6 [0142.650] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.htm", pszSpec="*.xls") returned 0 [0142.650] lstrlenA (lpString="*.xls") returned 5 [0142.651] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.htm", pszSpec="*.xlsx") returned 0 [0142.651] lstrlenA (lpString="*.xlsx") returned 6 [0142.651] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.htm", pszSpec="*.ppt") returned 0 [0142.651] lstrlenA (lpString="*.ppt") returned 5 [0142.651] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.htm", pszSpec="*.pptx") returned 0 [0142.651] lstrlenA (lpString="*.pptx") returned 6 [0142.651] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.htm", pszSpec="*.txt") returned 0 [0142.651] lstrlenA (lpString="*.txt") returned 5 [0142.651] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.htm", pszSpec="*.pdf") returned 0 [0142.651] lstrlenA (lpString="*.pdf") returned 5 [0142.651] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.htm", pszSpec="*.djvu") returned 0 [0142.651] lstrlenA (lpString="*.djvu") returned 6 [0142.651] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.htm", pszSpec="*.htm") returned 1 [0142.651] lstrlenA (lpString="*.htm") returned 5 [0142.651] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.htm" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.htm") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.htm" [0142.651] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.htm" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.htm") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.htm" [0142.651] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.htm", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.htm.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.htm." [0142.651] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.htm.", lpString2="\xa0" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.htm. ") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.htm. " [0142.651] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\stars.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0142.652] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xe6 [0142.652] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x28de3e80, dwHighDateTime=0x1d2dd9c), lpLastAccessTime=0x407536*(dwLowDateTime=0x28de3e80, dwHighDateTime=0x1d2dd9c), lpLastWriteTime=0x40753e*(dwLowDateTime=0xce1c836a, dwHighDateTime=0x1ca040d)) returned 1 [0142.652] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0142.652] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x8c, lpOverlapped=0x0) returned 1 [0142.653] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.htm") returned="Stars.htm" [0142.653] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0142.653] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x8c, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x8c, lpOverlapped=0x0) returned 1 [0142.654] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0142.654] CloseHandle (hObject=0x98) returned 1 [0142.654] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\stars.htm"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.htm. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\stars.htm. ")) returned 1 [0142.654] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0142.654] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0142.654] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Stars.jpg") returned -1 [0142.654] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Stars.jpg") returned -1 [0142.654] lstrcmpiA (lpString1="", lpString2="Stars.jpg") returned -1 [0142.655] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.htm") returned="Stars.htm" [0142.655] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\", lpString2="Stars.jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.jpg" [0142.655] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.jpg", pszSpec="*.zip") returned 0 [0142.655] lstrlenA (lpString="*.zip") returned 5 [0142.655] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.jpg", pszSpec="*.rar") returned 0 [0142.655] lstrlenA (lpString="*.rar") returned 5 [0142.655] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.jpg", pszSpec="*.7z") returned 0 [0142.655] lstrlenA (lpString="*.7z") returned 4 [0142.655] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.jpg", pszSpec="*.tar") returned 0 [0142.655] lstrlenA (lpString="*.tar") returned 5 [0142.655] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.jpg", pszSpec="*.gzip") returned 0 [0142.655] lstrlenA (lpString="*.gzip") returned 6 [0142.655] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.jpg", pszSpec="*.jpg") returned 1 [0142.655] lstrlenA (lpString="*.jpg") returned 5 [0142.655] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.jpg" [0142.655] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.jpg" [0142.655] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.jpg", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.jpg.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.jpg." [0142.655] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.jpg.", lpString2="\xa0" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.jpg. ") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.jpg. " [0142.655] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\stars.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0142.655] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1d51 [0142.656] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x28de3e80, dwHighDateTime=0x1d2dd9c), lpLastAccessTime=0x407536*(dwLowDateTime=0x28de3e80, dwHighDateTime=0x1d2dd9c), lpLastWriteTime=0x40753e*(dwLowDateTime=0xaa5ffafd, dwHighDateTime=0x1c9ea0c)) returned 1 [0142.656] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0142.656] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x1cf7, lpOverlapped=0x0) returned 1 [0142.705] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.jpg") returned="Stars.jpg" [0142.705] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0142.705] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x1cf7, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x1cf7, lpOverlapped=0x0) returned 1 [0142.705] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0142.705] CloseHandle (hObject=0x98) returned 1 [0142.705] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\stars.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.jpg. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\stars.jpg. ")) returned 1 [0142.706] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 0 [0142.706] FindClose (in: hFindFile=0x5be2e0 | out: hFindFile=0x5be2e0) returned 1 [0142.706] FindNextFileA (in: hFindFile=0x5be2a0, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0142.706] PeekMessageA (in: lpMsg=0xaef84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaef84) returned 0 [0142.706] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="WindowsMail.MSMessageStore") returned -1 [0142.706] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WindowsMail.MSMessageStore") returned -1 [0142.706] lstrcmpiA (lpString1="", lpString2="WindowsMail.MSMessageStore") returned -1 [0142.706] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\*.*") returned="*.*" [0142.706] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\", lpString2="WindowsMail.MSMessageStore" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.MSMessageStore") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.MSMessageStore" [0142.706] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.MSMessageStore", pszSpec="*.zip") returned 0 [0142.706] lstrlenA (lpString="*.zip") returned 5 [0142.706] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.MSMessageStore", pszSpec="*.rar") returned 0 [0142.706] lstrlenA (lpString="*.rar") returned 5 [0142.706] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.MSMessageStore", pszSpec="*.7z") returned 0 [0142.706] lstrlenA (lpString="*.7z") returned 4 [0142.706] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.MSMessageStore", pszSpec="*.tar") returned 0 [0142.706] lstrlenA (lpString="*.tar") returned 5 [0142.706] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.MSMessageStore", pszSpec="*.gzip") returned 0 [0142.706] lstrlenA (lpString="*.gzip") returned 6 [0142.706] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.MSMessageStore", pszSpec="*.jpg") returned 0 [0142.707] lstrlenA (lpString="*.jpg") returned 5 [0142.707] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.MSMessageStore", pszSpec="*.jpeg") returned 0 [0142.707] lstrlenA (lpString="*.jpeg") returned 6 [0142.707] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.MSMessageStore", pszSpec="*.psd") returned 0 [0142.707] lstrlenA (lpString="*.psd") returned 5 [0142.707] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.MSMessageStore", pszSpec="*.cdr") returned 0 [0142.707] lstrlenA (lpString="*.cdr") returned 5 [0142.707] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.MSMessageStore", pszSpec="*.dwg") returned 0 [0142.707] lstrlenA (lpString="*.dwg") returned 5 [0142.707] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.MSMessageStore", pszSpec="*.max") returned 0 [0142.707] lstrlenA (lpString="*.max") returned 5 [0142.707] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.MSMessageStore", pszSpec="*.bmp") returned 0 [0142.707] lstrlenA (lpString="*.bmp") returned 5 [0142.707] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.MSMessageStore", pszSpec="*.gif") returned 0 [0142.707] lstrlenA (lpString="*.gif") returned 5 [0142.707] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.MSMessageStore", pszSpec="*.png") returned 0 [0142.707] lstrlenA (lpString="*.png") returned 5 [0142.707] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.MSMessageStore", pszSpec="*.doc") returned 0 [0142.707] lstrlenA (lpString="*.doc") returned 5 [0142.707] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.MSMessageStore", pszSpec="*.docx") returned 0 [0142.707] lstrlenA (lpString="*.docx") returned 6 [0142.707] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.MSMessageStore", pszSpec="*.xls") returned 0 [0142.707] lstrlenA (lpString="*.xls") returned 5 [0142.707] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.MSMessageStore", pszSpec="*.xlsx") returned 0 [0142.707] lstrlenA (lpString="*.xlsx") returned 6 [0142.707] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.MSMessageStore", pszSpec="*.ppt") returned 0 [0142.707] lstrlenA (lpString="*.ppt") returned 5 [0142.707] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.MSMessageStore", pszSpec="*.pptx") returned 0 [0142.707] lstrlenA (lpString="*.pptx") returned 6 [0142.707] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.MSMessageStore", pszSpec="*.txt") returned 0 [0142.707] lstrlenA (lpString="*.txt") returned 5 [0142.707] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.MSMessageStore", pszSpec="*.pdf") returned 0 [0142.707] lstrlenA (lpString="*.pdf") returned 5 [0142.707] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.MSMessageStore", pszSpec="*.djvu") returned 0 [0142.707] lstrlenA (lpString="*.djvu") returned 6 [0142.707] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.MSMessageStore", pszSpec="*.htm") returned 0 [0142.707] lstrlenA (lpString="*.htm") returned 5 [0142.708] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.MSMessageStore", pszSpec="*.html") returned 0 [0142.708] lstrlenA (lpString="*.html") returned 6 [0142.708] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.MSMessageStore", pszSpec="*.mdb") returned 0 [0142.708] lstrlenA (lpString="*.mdb") returned 5 [0142.708] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.MSMessageStore", pszSpec="*.cer") returned 0 [0142.708] lstrlenA (lpString="*.cer") returned 5 [0142.708] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.MSMessageStore", pszSpec="*.p12") returned 0 [0142.708] lstrlenA (lpString="*.p12") returned 5 [0142.708] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.MSMessageStore", pszSpec="*.pfx") returned 0 [0142.708] lstrlenA (lpString="*.pfx") returned 5 [0142.708] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.MSMessageStore", pszSpec="*.kwm") returned 0 [0142.708] lstrlenA (lpString="*.kwm") returned 5 [0142.708] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.MSMessageStore", pszSpec="*.pwm") returned 0 [0142.708] lstrlenA (lpString="*.pwm") returned 5 [0142.708] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.MSMessageStore", pszSpec="*.1cd") returned 0 [0142.708] lstrlenA (lpString="*.1cd") returned 5 [0142.708] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.MSMessageStore", pszSpec="*.md") returned 0 [0142.708] lstrlenA (lpString="*.md") returned 4 [0142.708] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.MSMessageStore", pszSpec="*.mdf") returned 0 [0142.708] lstrlenA (lpString="*.mdf") returned 5 [0142.708] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.MSMessageStore", pszSpec="*.dbf") returned 0 [0142.708] lstrlenA (lpString="*.dbf") returned 5 [0142.708] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.MSMessageStore", pszSpec="*.odt") returned 0 [0142.708] lstrlenA (lpString="*.odt") returned 5 [0142.708] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.MSMessageStore", pszSpec="*.vob") returned 0 [0142.708] lstrlenA (lpString="*.vob") returned 5 [0142.708] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.MSMessageStore", pszSpec="*.ifo") returned 0 [0142.708] lstrlenA (lpString="*.ifo") returned 5 [0142.708] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.MSMessageStore", pszSpec="*.lnk") returned 0 [0142.708] lstrlenA (lpString="*.lnk") returned 5 [0142.708] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.MSMessageStore", pszSpec="*.torrent") returned 0 [0142.708] lstrlenA (lpString="*.torrent") returned 9 [0142.708] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.MSMessageStore", pszSpec="*.mov") returned 0 [0142.708] lstrlenA (lpString="*.mov") returned 5 [0142.708] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.MSMessageStore", pszSpec="*.m2v") returned 0 [0142.708] lstrlenA (lpString="*.m2v") returned 5 [0142.708] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.MSMessageStore", pszSpec="*.3gp") returned 0 [0142.708] lstrlenA (lpString="*.3gp") returned 5 [0142.708] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.MSMessageStore", pszSpec="*.mpeg") returned 0 [0142.709] lstrlenA (lpString="*.mpeg") returned 6 [0142.709] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.MSMessageStore", pszSpec="*.mpg") returned 0 [0142.709] lstrlenA (lpString="*.mpg") returned 5 [0142.709] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.MSMessageStore", pszSpec="*.flv") returned 0 [0142.709] lstrlenA (lpString="*.flv") returned 5 [0142.709] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.MSMessageStore", pszSpec="*.avi") returned 0 [0142.709] lstrlenA (lpString="*.avi") returned 5 [0142.709] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.MSMessageStore", pszSpec="*.mp4") returned 0 [0142.709] lstrlenA (lpString="*.mp4") returned 5 [0142.709] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.MSMessageStore", pszSpec="*.wmv") returned 0 [0142.709] lstrlenA (lpString="*.wmv") returned 5 [0142.709] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.MSMessageStore", pszSpec="*.divx") returned 0 [0142.709] lstrlenA (lpString="*.divx") returned 6 [0142.709] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.MSMessageStore", pszSpec="*.mkv") returned 0 [0142.709] lstrlenA (lpString="*.mkv") returned 5 [0142.709] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.MSMessageStore", pszSpec="*.mp3") returned 0 [0142.709] lstrlenA (lpString="*.mp3") returned 5 [0142.709] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.MSMessageStore", pszSpec="*.wav") returned 0 [0142.709] lstrlenA (lpString="*.wav") returned 5 [0142.709] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.MSMessageStore", pszSpec="*.flac") returned 0 [0142.709] lstrlenA (lpString="*.flac") returned 6 [0142.709] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.MSMessageStore", pszSpec="*.ape") returned 0 [0142.709] lstrlenA (lpString="*.ape") returned 5 [0142.709] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.MSMessageStore", pszSpec="*.wma") returned 0 [0142.709] lstrlenA (lpString="*.wma") returned 5 [0142.709] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.MSMessageStore", pszSpec="*.ac3") returned 0 [0142.709] lstrlenA (lpString="*.ac3") returned 5 [0142.709] FindNextFileA (in: hFindFile=0x5be2a0, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0142.709] PeekMessageA (in: lpMsg=0xaef84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaef84) returned 0 [0142.709] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="WindowsMail.pat") returned -1 [0142.709] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WindowsMail.pat") returned -1 [0142.709] lstrcmpiA (lpString1="", lpString2="WindowsMail.pat") returned -1 [0142.709] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.MSMessageStore") returned="WindowsMail.MSMessageStore" [0142.709] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\", lpString2="WindowsMail.pat" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.pat") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.pat" [0142.710] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.pat", pszSpec="*.zip") returned 0 [0142.710] lstrlenA (lpString="*.zip") returned 5 [0142.710] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.pat", pszSpec="*.rar") returned 0 [0142.710] lstrlenA (lpString="*.rar") returned 5 [0142.710] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.pat", pszSpec="*.7z") returned 0 [0142.710] lstrlenA (lpString="*.7z") returned 4 [0142.710] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.pat", pszSpec="*.tar") returned 0 [0142.710] lstrlenA (lpString="*.tar") returned 5 [0142.710] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.pat", pszSpec="*.gzip") returned 0 [0142.710] lstrlenA (lpString="*.gzip") returned 6 [0142.710] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.pat", pszSpec="*.jpg") returned 0 [0142.710] lstrlenA (lpString="*.jpg") returned 5 [0142.710] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.pat", pszSpec="*.jpeg") returned 0 [0142.710] lstrlenA (lpString="*.jpeg") returned 6 [0142.710] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.pat", pszSpec="*.psd") returned 0 [0142.710] lstrlenA (lpString="*.psd") returned 5 [0142.710] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.pat", pszSpec="*.cdr") returned 0 [0142.710] lstrlenA (lpString="*.cdr") returned 5 [0142.710] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.pat", pszSpec="*.dwg") returned 0 [0142.710] lstrlenA (lpString="*.dwg") returned 5 [0142.710] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.pat", pszSpec="*.max") returned 0 [0142.710] lstrlenA (lpString="*.max") returned 5 [0142.710] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.pat", pszSpec="*.bmp") returned 0 [0142.710] lstrlenA (lpString="*.bmp") returned 5 [0142.710] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.pat", pszSpec="*.gif") returned 0 [0142.710] lstrlenA (lpString="*.gif") returned 5 [0142.710] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.pat", pszSpec="*.png") returned 0 [0142.710] lstrlenA (lpString="*.png") returned 5 [0142.710] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.pat", pszSpec="*.doc") returned 0 [0142.710] lstrlenA (lpString="*.doc") returned 5 [0142.710] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.pat", pszSpec="*.docx") returned 0 [0142.710] lstrlenA (lpString="*.docx") returned 6 [0142.710] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.pat", pszSpec="*.xls") returned 0 [0142.710] lstrlenA (lpString="*.xls") returned 5 [0142.710] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.pat", pszSpec="*.xlsx") returned 0 [0142.710] lstrlenA (lpString="*.xlsx") returned 6 [0142.710] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.pat", pszSpec="*.ppt") returned 0 [0142.710] lstrlenA (lpString="*.ppt") returned 5 [0142.711] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.pat", pszSpec="*.pptx") returned 0 [0142.711] lstrlenA (lpString="*.pptx") returned 6 [0142.711] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.pat", pszSpec="*.txt") returned 0 [0142.711] lstrlenA (lpString="*.txt") returned 5 [0142.711] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.pat", pszSpec="*.pdf") returned 0 [0142.711] lstrlenA (lpString="*.pdf") returned 5 [0142.711] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.pat", pszSpec="*.djvu") returned 0 [0142.711] lstrlenA (lpString="*.djvu") returned 6 [0142.711] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.pat", pszSpec="*.htm") returned 0 [0142.711] lstrlenA (lpString="*.htm") returned 5 [0142.711] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.pat", pszSpec="*.html") returned 0 [0142.711] lstrlenA (lpString="*.html") returned 6 [0142.711] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.pat", pszSpec="*.mdb") returned 0 [0142.711] lstrlenA (lpString="*.mdb") returned 5 [0142.711] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.pat", pszSpec="*.cer") returned 0 [0142.711] lstrlenA (lpString="*.cer") returned 5 [0142.711] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.pat", pszSpec="*.p12") returned 0 [0142.711] lstrlenA (lpString="*.p12") returned 5 [0142.711] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.pat", pszSpec="*.pfx") returned 0 [0142.711] lstrlenA (lpString="*.pfx") returned 5 [0142.711] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.pat", pszSpec="*.kwm") returned 0 [0142.711] lstrlenA (lpString="*.kwm") returned 5 [0142.711] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.pat", pszSpec="*.pwm") returned 0 [0142.711] lstrlenA (lpString="*.pwm") returned 5 [0142.711] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.pat", pszSpec="*.1cd") returned 0 [0142.711] lstrlenA (lpString="*.1cd") returned 5 [0142.711] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.pat", pszSpec="*.md") returned 0 [0142.711] lstrlenA (lpString="*.md") returned 4 [0142.711] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.pat", pszSpec="*.mdf") returned 0 [0142.711] lstrlenA (lpString="*.mdf") returned 5 [0142.711] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.pat", pszSpec="*.dbf") returned 0 [0142.711] lstrlenA (lpString="*.dbf") returned 5 [0142.711] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.pat", pszSpec="*.odt") returned 0 [0142.711] lstrlenA (lpString="*.odt") returned 5 [0142.711] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.pat", pszSpec="*.vob") returned 0 [0142.711] lstrlenA (lpString="*.vob") returned 5 [0142.711] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.pat", pszSpec="*.ifo") returned 0 [0142.711] lstrlenA (lpString="*.ifo") returned 5 [0142.712] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.pat", pszSpec="*.lnk") returned 0 [0142.712] lstrlenA (lpString="*.lnk") returned 5 [0142.712] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.pat", pszSpec="*.torrent") returned 0 [0142.712] lstrlenA (lpString="*.torrent") returned 9 [0142.712] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.pat", pszSpec="*.mov") returned 0 [0142.712] lstrlenA (lpString="*.mov") returned 5 [0142.712] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.pat", pszSpec="*.m2v") returned 0 [0142.712] lstrlenA (lpString="*.m2v") returned 5 [0142.712] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.pat", pszSpec="*.3gp") returned 0 [0142.712] lstrlenA (lpString="*.3gp") returned 5 [0142.712] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.pat", pszSpec="*.mpeg") returned 0 [0142.712] lstrlenA (lpString="*.mpeg") returned 6 [0142.712] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.pat", pszSpec="*.mpg") returned 0 [0142.712] lstrlenA (lpString="*.mpg") returned 5 [0142.712] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.pat", pszSpec="*.flv") returned 0 [0142.712] lstrlenA (lpString="*.flv") returned 5 [0142.712] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.pat", pszSpec="*.avi") returned 0 [0142.712] lstrlenA (lpString="*.avi") returned 5 [0142.712] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.pat", pszSpec="*.mp4") returned 0 [0142.712] lstrlenA (lpString="*.mp4") returned 5 [0142.712] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.pat", pszSpec="*.wmv") returned 0 [0142.712] lstrlenA (lpString="*.wmv") returned 5 [0142.712] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.pat", pszSpec="*.divx") returned 0 [0142.712] lstrlenA (lpString="*.divx") returned 6 [0142.712] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.pat", pszSpec="*.mkv") returned 0 [0142.712] lstrlenA (lpString="*.mkv") returned 5 [0142.712] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.pat", pszSpec="*.mp3") returned 0 [0142.712] lstrlenA (lpString="*.mp3") returned 5 [0142.712] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.pat", pszSpec="*.wav") returned 0 [0142.712] lstrlenA (lpString="*.wav") returned 5 [0142.712] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.pat", pszSpec="*.flac") returned 0 [0142.712] lstrlenA (lpString="*.flac") returned 6 [0142.712] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.pat", pszSpec="*.ape") returned 0 [0142.712] lstrlenA (lpString="*.ape") returned 5 [0142.712] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.pat", pszSpec="*.wma") returned 0 [0142.712] lstrlenA (lpString="*.wma") returned 5 [0142.713] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.pat", pszSpec="*.ac3") returned 0 [0142.713] lstrlenA (lpString="*.ac3") returned 5 [0142.713] FindNextFileA (in: hFindFile=0x5be2a0, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0 [0142.713] FindClose (in: hFindFile=0x5be2a0 | out: hFindFile=0x5be2a0) returned 1 [0142.713] FindNextFileA (in: hFindFile=0x5be260, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0142.713] lstrcmpA (lpString1=".", lpString2="Windows Media") returned -1 [0142.713] lstrcmpA (lpString1="..", lpString2="Windows Media") returned -1 [0142.713] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\*.*") returned="*.*" [0142.713] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\", lpString2="Windows Media" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media" [0142.713] lstrlenA (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media") returned 67 [0142.713] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0142.713] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0142.713] FindNextFileA (in: hFindFile=0x5be2a0, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0142.713] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0142.713] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0142.713] FindNextFileA (in: hFindFile=0x5be2a0, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0142.714] lstrcmpA (lpString1=".", lpString2="12.0") returned -1 [0142.714] lstrcmpA (lpString1="..", lpString2="12.0") returned -1 [0142.714] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\*.*") returned="*.*" [0142.714] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\", lpString2="12.0" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0" [0142.714] lstrlenA (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0") returned 72 [0142.714] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\*.*", lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 0x5be2e0 [0142.714] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0142.714] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0142.714] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0142.714] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0142.714] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0142.714] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0142.714] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="WMSDKNS.DTD") returned -1 [0142.714] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WMSDKNS.DTD") returned -1 [0142.714] lstrcmpiA (lpString1="", lpString2="WMSDKNS.DTD") returned -1 [0142.714] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\*.*") returned="*.*" [0142.714] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\", lpString2="WMSDKNS.DTD" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\WMSDKNS.DTD") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\WMSDKNS.DTD" [0142.714] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\WMSDKNS.DTD", pszSpec="*.zip") returned 0 [0142.714] lstrlenA (lpString="*.zip") returned 5 [0142.714] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\WMSDKNS.DTD", pszSpec="*.rar") returned 0 [0142.714] lstrlenA (lpString="*.rar") returned 5 [0142.714] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\WMSDKNS.DTD", pszSpec="*.7z") returned 0 [0142.714] lstrlenA (lpString="*.7z") returned 4 [0142.714] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\WMSDKNS.DTD", pszSpec="*.tar") returned 0 [0142.714] lstrlenA (lpString="*.tar") returned 5 [0142.714] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\WMSDKNS.DTD", pszSpec="*.gzip") returned 0 [0142.714] lstrlenA (lpString="*.gzip") returned 6 [0142.714] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\WMSDKNS.DTD", pszSpec="*.jpg") returned 0 [0142.715] lstrlenA (lpString="*.jpg") returned 5 [0142.715] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\WMSDKNS.DTD", pszSpec="*.jpeg") returned 0 [0142.715] lstrlenA (lpString="*.jpeg") returned 6 [0142.715] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\WMSDKNS.DTD", pszSpec="*.psd") returned 0 [0142.715] lstrlenA (lpString="*.psd") returned 5 [0142.715] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\WMSDKNS.DTD", pszSpec="*.cdr") returned 0 [0142.715] lstrlenA (lpString="*.cdr") returned 5 [0142.715] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\WMSDKNS.DTD", pszSpec="*.dwg") returned 0 [0142.715] lstrlenA (lpString="*.dwg") returned 5 [0142.715] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\WMSDKNS.DTD", pszSpec="*.max") returned 0 [0142.715] lstrlenA (lpString="*.max") returned 5 [0142.715] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\WMSDKNS.DTD", pszSpec="*.bmp") returned 0 [0142.715] lstrlenA (lpString="*.bmp") returned 5 [0142.715] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\WMSDKNS.DTD", pszSpec="*.gif") returned 0 [0142.715] lstrlenA (lpString="*.gif") returned 5 [0142.715] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\WMSDKNS.DTD", pszSpec="*.png") returned 0 [0142.715] lstrlenA (lpString="*.png") returned 5 [0142.715] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\WMSDKNS.DTD", pszSpec="*.doc") returned 0 [0142.715] lstrlenA (lpString="*.doc") returned 5 [0142.715] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\WMSDKNS.DTD", pszSpec="*.docx") returned 0 [0142.715] lstrlenA (lpString="*.docx") returned 6 [0142.715] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\WMSDKNS.DTD", pszSpec="*.xls") returned 0 [0142.715] lstrlenA (lpString="*.xls") returned 5 [0142.715] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\WMSDKNS.DTD", pszSpec="*.xlsx") returned 0 [0142.715] lstrlenA (lpString="*.xlsx") returned 6 [0142.715] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\WMSDKNS.DTD", pszSpec="*.ppt") returned 0 [0142.715] lstrlenA (lpString="*.ppt") returned 5 [0142.715] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\WMSDKNS.DTD", pszSpec="*.pptx") returned 0 [0142.715] lstrlenA (lpString="*.pptx") returned 6 [0142.715] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\WMSDKNS.DTD", pszSpec="*.txt") returned 0 [0142.715] lstrlenA (lpString="*.txt") returned 5 [0142.715] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\WMSDKNS.DTD", pszSpec="*.pdf") returned 0 [0142.715] lstrlenA (lpString="*.pdf") returned 5 [0142.715] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\WMSDKNS.DTD", pszSpec="*.djvu") returned 0 [0142.715] lstrlenA (lpString="*.djvu") returned 6 [0142.715] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\WMSDKNS.DTD", pszSpec="*.htm") returned 0 [0142.715] lstrlenA (lpString="*.htm") returned 5 [0142.715] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\WMSDKNS.DTD", pszSpec="*.html") returned 0 [0142.715] lstrlenA (lpString="*.html") returned 6 [0142.716] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\WMSDKNS.DTD", pszSpec="*.mdb") returned 0 [0142.716] lstrlenA (lpString="*.mdb") returned 5 [0142.716] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\WMSDKNS.DTD", pszSpec="*.cer") returned 0 [0142.716] lstrlenA (lpString="*.cer") returned 5 [0142.716] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\WMSDKNS.DTD", pszSpec="*.p12") returned 0 [0142.716] lstrlenA (lpString="*.p12") returned 5 [0142.716] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\WMSDKNS.DTD", pszSpec="*.pfx") returned 0 [0142.716] lstrlenA (lpString="*.pfx") returned 5 [0142.716] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\WMSDKNS.DTD", pszSpec="*.kwm") returned 0 [0142.716] lstrlenA (lpString="*.kwm") returned 5 [0142.716] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\WMSDKNS.DTD", pszSpec="*.pwm") returned 0 [0142.716] lstrlenA (lpString="*.pwm") returned 5 [0142.716] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\WMSDKNS.DTD", pszSpec="*.1cd") returned 0 [0142.716] lstrlenA (lpString="*.1cd") returned 5 [0142.716] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\WMSDKNS.DTD", pszSpec="*.md") returned 0 [0142.716] lstrlenA (lpString="*.md") returned 4 [0142.716] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\WMSDKNS.DTD", pszSpec="*.mdf") returned 0 [0142.716] lstrlenA (lpString="*.mdf") returned 5 [0142.716] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\WMSDKNS.DTD", pszSpec="*.dbf") returned 0 [0142.716] lstrlenA (lpString="*.dbf") returned 5 [0142.716] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\WMSDKNS.DTD", pszSpec="*.odt") returned 0 [0142.716] lstrlenA (lpString="*.odt") returned 5 [0142.716] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\WMSDKNS.DTD", pszSpec="*.vob") returned 0 [0142.716] lstrlenA (lpString="*.vob") returned 5 [0142.716] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\WMSDKNS.DTD", pszSpec="*.ifo") returned 0 [0142.716] lstrlenA (lpString="*.ifo") returned 5 [0142.716] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\WMSDKNS.DTD", pszSpec="*.lnk") returned 0 [0142.716] lstrlenA (lpString="*.lnk") returned 5 [0142.716] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\WMSDKNS.DTD", pszSpec="*.torrent") returned 0 [0142.716] lstrlenA (lpString="*.torrent") returned 9 [0142.716] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\WMSDKNS.DTD", pszSpec="*.mov") returned 0 [0142.716] lstrlenA (lpString="*.mov") returned 5 [0142.716] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\WMSDKNS.DTD", pszSpec="*.m2v") returned 0 [0142.716] lstrlenA (lpString="*.m2v") returned 5 [0142.716] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\WMSDKNS.DTD", pszSpec="*.3gp") returned 0 [0142.716] lstrlenA (lpString="*.3gp") returned 5 [0142.717] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\WMSDKNS.DTD", pszSpec="*.mpeg") returned 0 [0142.717] lstrlenA (lpString="*.mpeg") returned 6 [0142.717] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\WMSDKNS.DTD", pszSpec="*.mpg") returned 0 [0142.717] lstrlenA (lpString="*.mpg") returned 5 [0142.717] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\WMSDKNS.DTD", pszSpec="*.flv") returned 0 [0142.717] lstrlenA (lpString="*.flv") returned 5 [0142.717] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\WMSDKNS.DTD", pszSpec="*.avi") returned 0 [0142.717] lstrlenA (lpString="*.avi") returned 5 [0142.717] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\WMSDKNS.DTD", pszSpec="*.mp4") returned 0 [0142.717] lstrlenA (lpString="*.mp4") returned 5 [0142.717] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\WMSDKNS.DTD", pszSpec="*.wmv") returned 0 [0142.717] lstrlenA (lpString="*.wmv") returned 5 [0142.717] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\WMSDKNS.DTD", pszSpec="*.divx") returned 0 [0142.717] lstrlenA (lpString="*.divx") returned 6 [0142.717] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\WMSDKNS.DTD", pszSpec="*.mkv") returned 0 [0142.717] lstrlenA (lpString="*.mkv") returned 5 [0142.717] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\WMSDKNS.DTD", pszSpec="*.mp3") returned 0 [0142.717] lstrlenA (lpString="*.mp3") returned 5 [0142.717] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\WMSDKNS.DTD", pszSpec="*.wav") returned 0 [0142.717] lstrlenA (lpString="*.wav") returned 5 [0142.717] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\WMSDKNS.DTD", pszSpec="*.flac") returned 0 [0142.717] lstrlenA (lpString="*.flac") returned 6 [0142.717] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\WMSDKNS.DTD", pszSpec="*.ape") returned 0 [0142.717] lstrlenA (lpString="*.ape") returned 5 [0142.717] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\WMSDKNS.DTD", pszSpec="*.wma") returned 0 [0142.717] lstrlenA (lpString="*.wma") returned 5 [0142.717] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\WMSDKNS.DTD", pszSpec="*.ac3") returned 0 [0142.717] lstrlenA (lpString="*.ac3") returned 5 [0142.717] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0142.717] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0142.717] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="WMSDKNS.XML") returned -1 [0142.717] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="WMSDKNS.XML") returned -1 [0142.717] lstrcmpiA (lpString1="", lpString2="WMSDKNS.XML") returned -1 [0142.717] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\WMSDKNS.DTD") returned="WMSDKNS.DTD" [0142.717] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\", lpString2="WMSDKNS.XML" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\WMSDKNS.XML") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\WMSDKNS.XML" [0142.718] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\WMSDKNS.XML", pszSpec="*.zip") returned 0 [0142.718] lstrlenA (lpString="*.zip") returned 5 [0142.718] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\WMSDKNS.XML", pszSpec="*.rar") returned 0 [0142.718] lstrlenA (lpString="*.rar") returned 5 [0142.718] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\WMSDKNS.XML", pszSpec="*.7z") returned 0 [0142.718] lstrlenA (lpString="*.7z") returned 4 [0142.718] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\WMSDKNS.XML", pszSpec="*.tar") returned 0 [0142.718] lstrlenA (lpString="*.tar") returned 5 [0142.718] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\WMSDKNS.XML", pszSpec="*.gzip") returned 0 [0142.718] lstrlenA (lpString="*.gzip") returned 6 [0142.718] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\WMSDKNS.XML", pszSpec="*.jpg") returned 0 [0142.718] lstrlenA (lpString="*.jpg") returned 5 [0142.718] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\WMSDKNS.XML", pszSpec="*.jpeg") returned 0 [0142.718] lstrlenA (lpString="*.jpeg") returned 6 [0142.718] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\WMSDKNS.XML", pszSpec="*.psd") returned 0 [0142.718] lstrlenA (lpString="*.psd") returned 5 [0142.718] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\WMSDKNS.XML", pszSpec="*.cdr") returned 0 [0142.718] lstrlenA (lpString="*.cdr") returned 5 [0142.718] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\WMSDKNS.XML", pszSpec="*.dwg") returned 0 [0142.718] lstrlenA (lpString="*.dwg") returned 5 [0142.718] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\WMSDKNS.XML", pszSpec="*.max") returned 0 [0142.718] lstrlenA (lpString="*.max") returned 5 [0142.718] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\WMSDKNS.XML", pszSpec="*.bmp") returned 0 [0142.718] lstrlenA (lpString="*.bmp") returned 5 [0142.718] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\WMSDKNS.XML", pszSpec="*.gif") returned 0 [0142.718] lstrlenA (lpString="*.gif") returned 5 [0142.718] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\WMSDKNS.XML", pszSpec="*.png") returned 0 [0142.718] lstrlenA (lpString="*.png") returned 5 [0142.718] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\WMSDKNS.XML", pszSpec="*.doc") returned 0 [0142.718] lstrlenA (lpString="*.doc") returned 5 [0142.718] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\WMSDKNS.XML", pszSpec="*.docx") returned 0 [0142.718] lstrlenA (lpString="*.docx") returned 6 [0142.718] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\WMSDKNS.XML", pszSpec="*.xls") returned 0 [0142.718] lstrlenA (lpString="*.xls") returned 5 [0142.718] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\WMSDKNS.XML", pszSpec="*.xlsx") returned 0 [0142.718] lstrlenA (lpString="*.xlsx") returned 6 [0142.719] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\WMSDKNS.XML", pszSpec="*.ppt") returned 0 [0142.719] lstrlenA (lpString="*.ppt") returned 5 [0142.719] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\WMSDKNS.XML", pszSpec="*.pptx") returned 0 [0142.719] lstrlenA (lpString="*.pptx") returned 6 [0142.719] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\WMSDKNS.XML", pszSpec="*.txt") returned 0 [0142.719] lstrlenA (lpString="*.txt") returned 5 [0142.719] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\WMSDKNS.XML", pszSpec="*.pdf") returned 0 [0142.719] lstrlenA (lpString="*.pdf") returned 5 [0142.719] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\WMSDKNS.XML", pszSpec="*.djvu") returned 0 [0142.719] lstrlenA (lpString="*.djvu") returned 6 [0142.719] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\WMSDKNS.XML", pszSpec="*.htm") returned 0 [0142.719] lstrlenA (lpString="*.htm") returned 5 [0142.719] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\WMSDKNS.XML", pszSpec="*.html") returned 0 [0142.719] lstrlenA (lpString="*.html") returned 6 [0142.719] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\WMSDKNS.XML", pszSpec="*.mdb") returned 0 [0142.719] lstrlenA (lpString="*.mdb") returned 5 [0142.719] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\WMSDKNS.XML", pszSpec="*.cer") returned 0 [0142.719] lstrlenA (lpString="*.cer") returned 5 [0142.719] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\WMSDKNS.XML", pszSpec="*.p12") returned 0 [0142.719] lstrlenA (lpString="*.p12") returned 5 [0142.719] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\WMSDKNS.XML", pszSpec="*.pfx") returned 0 [0142.719] lstrlenA (lpString="*.pfx") returned 5 [0142.719] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\WMSDKNS.XML", pszSpec="*.kwm") returned 0 [0142.719] lstrlenA (lpString="*.kwm") returned 5 [0142.719] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\WMSDKNS.XML", pszSpec="*.pwm") returned 0 [0142.719] lstrlenA (lpString="*.pwm") returned 5 [0142.719] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\WMSDKNS.XML", pszSpec="*.1cd") returned 0 [0142.719] lstrlenA (lpString="*.1cd") returned 5 [0142.719] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\WMSDKNS.XML", pszSpec="*.md") returned 0 [0142.719] lstrlenA (lpString="*.md") returned 4 [0142.719] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\WMSDKNS.XML", pszSpec="*.mdf") returned 0 [0142.719] lstrlenA (lpString="*.mdf") returned 5 [0142.719] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\WMSDKNS.XML", pszSpec="*.dbf") returned 0 [0142.719] lstrlenA (lpString="*.dbf") returned 5 [0142.719] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\WMSDKNS.XML", pszSpec="*.odt") returned 0 [0142.719] lstrlenA (lpString="*.odt") returned 5 [0142.720] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\WMSDKNS.XML", pszSpec="*.vob") returned 0 [0142.720] lstrlenA (lpString="*.vob") returned 5 [0142.720] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\WMSDKNS.XML", pszSpec="*.ifo") returned 0 [0142.720] lstrlenA (lpString="*.ifo") returned 5 [0142.720] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\WMSDKNS.XML", pszSpec="*.lnk") returned 0 [0142.720] lstrlenA (lpString="*.lnk") returned 5 [0142.720] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\WMSDKNS.XML", pszSpec="*.torrent") returned 0 [0142.720] lstrlenA (lpString="*.torrent") returned 9 [0142.720] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\WMSDKNS.XML", pszSpec="*.mov") returned 0 [0142.720] lstrlenA (lpString="*.mov") returned 5 [0142.720] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\WMSDKNS.XML", pszSpec="*.m2v") returned 0 [0142.720] lstrlenA (lpString="*.m2v") returned 5 [0142.720] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\WMSDKNS.XML", pszSpec="*.3gp") returned 0 [0142.720] lstrlenA (lpString="*.3gp") returned 5 [0142.720] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\WMSDKNS.XML", pszSpec="*.mpeg") returned 0 [0142.720] lstrlenA (lpString="*.mpeg") returned 6 [0142.720] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\WMSDKNS.XML", pszSpec="*.mpg") returned 0 [0142.720] lstrlenA (lpString="*.mpg") returned 5 [0142.720] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\WMSDKNS.XML", pszSpec="*.flv") returned 0 [0142.720] lstrlenA (lpString="*.flv") returned 5 [0142.720] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\WMSDKNS.XML", pszSpec="*.avi") returned 0 [0142.720] lstrlenA (lpString="*.avi") returned 5 [0142.720] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\WMSDKNS.XML", pszSpec="*.mp4") returned 0 [0142.720] lstrlenA (lpString="*.mp4") returned 5 [0142.720] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\WMSDKNS.XML", pszSpec="*.wmv") returned 0 [0142.720] lstrlenA (lpString="*.wmv") returned 5 [0142.720] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\WMSDKNS.XML", pszSpec="*.divx") returned 0 [0142.720] lstrlenA (lpString="*.divx") returned 6 [0142.720] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\WMSDKNS.XML", pszSpec="*.mkv") returned 0 [0142.720] lstrlenA (lpString="*.mkv") returned 5 [0142.720] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\WMSDKNS.XML", pszSpec="*.mp3") returned 0 [0142.720] lstrlenA (lpString="*.mp3") returned 5 [0142.720] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\WMSDKNS.XML", pszSpec="*.wav") returned 0 [0142.720] lstrlenA (lpString="*.wav") returned 5 [0142.720] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\WMSDKNS.XML", pszSpec="*.flac") returned 0 [0142.720] lstrlenA (lpString="*.flac") returned 6 [0142.720] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\WMSDKNS.XML", pszSpec="*.ape") returned 0 [0142.721] lstrlenA (lpString="*.ape") returned 5 [0142.721] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\WMSDKNS.XML", pszSpec="*.wma") returned 0 [0142.721] lstrlenA (lpString="*.wma") returned 5 [0142.721] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\WMSDKNS.XML", pszSpec="*.ac3") returned 0 [0142.721] lstrlenA (lpString="*.ac3") returned 5 [0142.721] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 0 [0142.721] FindClose (in: hFindFile=0x5be2e0 | out: hFindFile=0x5be2e0) returned 1 [0142.721] FindNextFileA (in: hFindFile=0x5be2a0, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0 [0142.721] FindClose (in: hFindFile=0x5be2a0 | out: hFindFile=0x5be2a0) returned 1 [0142.721] FindNextFileA (in: hFindFile=0x5be260, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0142.721] lstrcmpA (lpString1=".", lpString2="Windows Sidebar") returned -1 [0142.721] lstrcmpA (lpString1="..", lpString2="Windows Sidebar") returned -1 [0142.721] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\*.*") returned="*.*" [0142.721] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\", lpString2="Windows Sidebar" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Sidebar") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Sidebar" [0142.721] lstrlenA (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Sidebar") returned 69 [0142.721] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Sidebar\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0142.722] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0142.722] FindNextFileA (in: hFindFile=0x5be2a0, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0142.722] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0142.722] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0142.722] FindNextFileA (in: hFindFile=0x5be2a0, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0142.722] lstrcmpA (lpString1=".", lpString2="Gadgets") returned -1 [0142.722] lstrcmpA (lpString1="..", lpString2="Gadgets") returned -1 [0142.722] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Sidebar\\*.*") returned="*.*" [0142.722] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Sidebar\\", lpString2="Gadgets" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Sidebar\\Gadgets") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Sidebar\\Gadgets" [0142.722] lstrlenA (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Sidebar\\Gadgets") returned 77 [0142.722] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Sidebar\\Gadgets\\*.*", lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 0x5be2e0 [0142.722] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0142.722] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0142.722] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0142.722] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0142.722] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 0 [0142.722] FindClose (in: hFindFile=0x5be2e0 | out: hFindFile=0x5be2e0) returned 1 [0142.722] FindNextFileA (in: hFindFile=0x5be2a0, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0142.722] PeekMessageA (in: lpMsg=0xaef84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaef84) returned 0 [0142.722] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Settings.ini") returned -1 [0142.722] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Settings.ini") returned -1 [0142.722] lstrcmpiA (lpString1="", lpString2="Settings.ini") returned -1 [0142.723] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Sidebar\\*.*") returned="*.*" [0142.723] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Sidebar\\", lpString2="Settings.ini" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Sidebar\\Settings.ini") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Sidebar\\Settings.ini" [0142.723] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Sidebar\\Settings.ini", pszSpec="*.zip") returned 0 [0142.723] lstrlenA (lpString="*.zip") returned 5 [0142.723] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Sidebar\\Settings.ini", pszSpec="*.rar") returned 0 [0142.723] lstrlenA (lpString="*.rar") returned 5 [0142.723] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Sidebar\\Settings.ini", pszSpec="*.7z") returned 0 [0142.723] lstrlenA (lpString="*.7z") returned 4 [0142.723] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Sidebar\\Settings.ini", pszSpec="*.tar") returned 0 [0142.723] lstrlenA (lpString="*.tar") returned 5 [0142.723] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Sidebar\\Settings.ini", pszSpec="*.gzip") returned 0 [0142.723] lstrlenA (lpString="*.gzip") returned 6 [0142.723] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Sidebar\\Settings.ini", pszSpec="*.jpg") returned 0 [0142.723] lstrlenA (lpString="*.jpg") returned 5 [0142.723] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Sidebar\\Settings.ini", pszSpec="*.jpeg") returned 0 [0142.723] lstrlenA (lpString="*.jpeg") returned 6 [0142.723] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Sidebar\\Settings.ini", pszSpec="*.psd") returned 0 [0142.723] lstrlenA (lpString="*.psd") returned 5 [0142.723] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Sidebar\\Settings.ini", pszSpec="*.cdr") returned 0 [0142.723] lstrlenA (lpString="*.cdr") returned 5 [0142.723] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Sidebar\\Settings.ini", pszSpec="*.dwg") returned 0 [0142.723] lstrlenA (lpString="*.dwg") returned 5 [0142.723] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Sidebar\\Settings.ini", pszSpec="*.max") returned 0 [0142.723] lstrlenA (lpString="*.max") returned 5 [0142.723] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Sidebar\\Settings.ini", pszSpec="*.bmp") returned 0 [0142.723] lstrlenA (lpString="*.bmp") returned 5 [0142.723] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Sidebar\\Settings.ini", pszSpec="*.gif") returned 0 [0142.723] lstrlenA (lpString="*.gif") returned 5 [0142.723] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Sidebar\\Settings.ini", pszSpec="*.png") returned 0 [0142.723] lstrlenA (lpString="*.png") returned 5 [0142.723] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Sidebar\\Settings.ini", pszSpec="*.doc") returned 0 [0142.723] lstrlenA (lpString="*.doc") returned 5 [0142.723] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Sidebar\\Settings.ini", pszSpec="*.docx") returned 0 [0142.723] lstrlenA (lpString="*.docx") returned 6 [0142.723] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Sidebar\\Settings.ini", pszSpec="*.xls") returned 0 [0142.723] lstrlenA (lpString="*.xls") returned 5 [0142.723] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Sidebar\\Settings.ini", pszSpec="*.xlsx") returned 0 [0142.724] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Sidebar\\Settings.ini", pszSpec="*.ppt") returned 0 [0142.724] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Sidebar\\Settings.ini", pszSpec="*.pptx") returned 0 [0142.724] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Sidebar\\Settings.ini", pszSpec="*.txt") returned 0 [0142.724] FindNextFileA (in: hFindFile=0x5be2a0, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0 [0142.724] FindClose (in: hFindFile=0x5be2a0 | out: hFindFile=0x5be2a0) returned 1 [0142.724] FindNextFileA (in: hFindFile=0x5be260, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0 [0142.724] FindClose (in: hFindFile=0x5be260 | out: hFindFile=0x5be260) returned 1 [0142.724] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0142.724] lstrcmpA (lpString1=".", lpString2="Microsoft Help") returned -1 [0142.724] lstrcmpA (lpString1="..", lpString2="Microsoft Help") returned -1 [0142.724] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\*.*") returned="*.*" [0142.724] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\", lpString2="Microsoft Help" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft Help") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft Help" [0142.724] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft Help\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0142.725] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0142.725] FindNextFileA (in: hFindFile=0x5be260, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0142.725] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0142.725] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0142.725] FindNextFileA (in: hFindFile=0x5be260, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0 [0142.725] FindClose (in: hFindFile=0x5be260 | out: hFindFile=0x5be260) returned 1 [0142.725] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0142.725] lstrcmpA (lpString1=".", lpString2="Mozilla") returned -1 [0142.725] lstrcmpA (lpString1="..", lpString2="Mozilla") returned -1 [0142.725] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\*.*") returned="*.*" [0142.725] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\", lpString2="Mozilla" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla" [0142.725] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0142.725] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0142.725] FindNextFileA (in: hFindFile=0x5be260, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0142.725] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0142.725] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0142.725] FindNextFileA (in: hFindFile=0x5be260, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0142.726] lstrcmpA (lpString1=".", lpString2="Firefox") returned -1 [0142.726] lstrcmpA (lpString1="..", lpString2="Firefox") returned -1 [0142.726] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\*.*") returned="*.*" [0142.726] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\", lpString2="Firefox" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox" [0142.726] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0142.726] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0142.726] FindNextFileA (in: hFindFile=0x5be2a0, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0142.726] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0142.727] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0142.727] FindNextFileA (in: hFindFile=0x5be2a0, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0142.727] lstrcmpA (lpString1=".", lpString2="Profiles") returned -1 [0142.727] lstrcmpA (lpString1="..", lpString2="Profiles") returned -1 [0142.727] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\*.*") returned="*.*" [0142.727] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\", lpString2="Profiles" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles" [0142.727] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\*.*", lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 0x5be2e0 [0142.727] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0142.727] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0142.727] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0142.727] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0142.727] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0142.727] lstrcmpA (lpString1=".", lpString2="silmbjec.default") returned -1 [0142.727] lstrcmpA (lpString1="..", lpString2="silmbjec.default") returned -1 [0142.727] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\*.*") returned="*.*" [0142.727] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\", lpString2="silmbjec.default" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default" [0142.727] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\*.*", lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 0x5be320 [0142.729] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0142.729] FindNextFileA (in: hFindFile=0x5be320, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0142.729] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0142.729] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0142.729] FindNextFileA (in: hFindFile=0x5be320, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0142.729] lstrcmpA (lpString1=".", lpString2="Cache") returned -1 [0142.729] lstrcmpA (lpString1="..", lpString2="Cache") returned -1 [0142.729] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\*.*") returned="*.*" [0142.729] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\", lpString2="Cache" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache" [0142.729] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\*.*", lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 0x5be360 [0142.731] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0142.731] FindNextFileA (in: hFindFile=0x5be360, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 1 [0142.731] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0142.732] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0142.732] FindNextFileA (in: hFindFile=0x5be360, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 1 [0142.732] lstrcmpA (lpString1=".", lpString2="0") returned -1 [0142.732] lstrcmpA (lpString1="..", lpString2="0") returned -1 [0142.732] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\*.*") returned="*.*" [0142.732] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\", lpString2="0" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0" [0142.732] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\*.*", lpFindFileData=0xaea68 | out: lpFindFileData=0xaea68) returned 0x5be3a0 [0142.732] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0142.733] FindNextFileA (in: hFindFile=0x5be3a0, lpFindFileData=0xaea68 | out: lpFindFileData=0xaea68) returned 1 [0142.733] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0142.733] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0142.733] FindNextFileA (in: hFindFile=0x5be3a0, lpFindFileData=0xaea68 | out: lpFindFileData=0xaea68) returned 1 [0142.733] lstrcmpA (lpString1=".", lpString2="98") returned -1 [0142.733] lstrcmpA (lpString1="..", lpString2="98") returned -1 [0142.733] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\*.*") returned="*.*" [0142.733] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\", lpString2="98" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\98") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\98" [0142.733] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\98\\*.*", lpFindFileData=0xae918 | out: lpFindFileData=0xae918) returned 0x5be3e0 [0142.733] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0142.733] FindNextFileA (in: hFindFile=0x5be3e0, lpFindFileData=0xae918 | out: lpFindFileData=0xae918) returned 1 [0142.733] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0142.733] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0142.733] FindNextFileA (in: hFindFile=0x5be3e0, lpFindFileData=0xae918 | out: lpFindFileData=0xae918) returned 1 [0142.733] PeekMessageA (in: lpMsg=0xae8f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xae8f4) returned 0 [0142.733] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="B60F3d01") returned 1 [0142.733] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="B60F3d01") returned 1 [0142.733] lstrcmpiA (lpString1="", lpString2="B60F3d01") returned -1 [0142.733] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\98\\*.*") returned="*.*" [0142.733] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\98\\", lpString2="B60F3d01" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\98\\B60F3d01") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\98\\B60F3d01" [0142.733] FindNextFileA (in: hFindFile=0x5be3e0, lpFindFileData=0xae918 | out: lpFindFileData=0xae918) returned 0 [0142.733] FindClose (in: hFindFile=0x5be3e0 | out: hFindFile=0x5be3e0) returned 1 [0142.734] FindNextFileA (in: hFindFile=0x5be3a0, lpFindFileData=0xaea68 | out: lpFindFileData=0xaea68) returned 1 [0142.734] lstrcmpA (lpString1=".", lpString2="A8") returned -1 [0142.734] lstrcmpA (lpString1="..", lpString2="A8") returned -1 [0142.734] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\*.*") returned="*.*" [0142.734] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\", lpString2="A8" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\A8") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\A8" [0142.734] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\A8\\*.*", lpFindFileData=0xae918 | out: lpFindFileData=0xae918) returned 0x5be3e0 [0142.735] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0142.735] FindNextFileA (in: hFindFile=0x5be3e0, lpFindFileData=0xae918 | out: lpFindFileData=0xae918) returned 1 [0142.735] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0142.735] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0142.735] FindNextFileA (in: hFindFile=0x5be3e0, lpFindFileData=0xae918 | out: lpFindFileData=0xae918) returned 1 [0142.735] PeekMessageA (in: lpMsg=0xae8f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xae8f4) returned 0 [0142.735] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="C3B7Bd01") returned 1 [0142.735] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="C3B7Bd01") returned 1 [0142.735] lstrcmpiA (lpString1="", lpString2="C3B7Bd01") returned -1 [0142.735] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\A8\\*.*") returned="*.*" [0142.735] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\A8\\", lpString2="C3B7Bd01" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\A8\\C3B7Bd01") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\A8\\C3B7Bd01" [0142.735] FindNextFileA (in: hFindFile=0x5be3e0, lpFindFileData=0xae918 | out: lpFindFileData=0xae918) returned 0 [0142.735] FindClose (in: hFindFile=0x5be3e0 | out: hFindFile=0x5be3e0) returned 1 [0142.735] FindNextFileA (in: hFindFile=0x5be3a0, lpFindFileData=0xaea68 | out: lpFindFileData=0xaea68) returned 0 [0142.735] FindClose (in: hFindFile=0x5be3a0 | out: hFindFile=0x5be3a0) returned 1 [0142.735] FindNextFileA (in: hFindFile=0x5be360, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 1 [0142.735] lstrcmpA (lpString1=".", lpString2="1") returned -1 [0142.735] lstrcmpA (lpString1="..", lpString2="1") returned -1 [0142.735] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\*.*") returned="*.*" [0142.735] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\", lpString2="1" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1" [0142.735] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\*.*", lpFindFileData=0xaea68 | out: lpFindFileData=0xaea68) returned 0x5be3a0 [0142.736] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0142.736] FindNextFileA (in: hFindFile=0x5be3a0, lpFindFileData=0xaea68 | out: lpFindFileData=0xaea68) returned 1 [0142.736] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0142.736] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0142.736] FindNextFileA (in: hFindFile=0x5be3a0, lpFindFileData=0xaea68 | out: lpFindFileData=0xaea68) returned 1 [0142.736] lstrcmpA (lpString1=".", lpString2="0B") returned -1 [0142.736] lstrcmpA (lpString1="..", lpString2="0B") returned -1 [0142.736] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\*.*") returned="*.*" [0142.736] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\", lpString2="0B" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\0B") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\0B" [0142.736] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\0B\\*.*", lpFindFileData=0xae918 | out: lpFindFileData=0xae918) returned 0x5be3e0 [0142.736] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0142.736] FindNextFileA (in: hFindFile=0x5be3e0, lpFindFileData=0xae918 | out: lpFindFileData=0xae918) returned 1 [0142.736] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0142.736] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0142.736] FindNextFileA (in: hFindFile=0x5be3e0, lpFindFileData=0xae918 | out: lpFindFileData=0xae918) returned 1 [0142.736] PeekMessageA (in: lpMsg=0xae8f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xae8f4) returned 0 [0142.736] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="FCBF5d01") returned -1 [0142.736] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FCBF5d01") returned 1 [0142.736] lstrcmpiA (lpString1="", lpString2="FCBF5d01") returned -1 [0142.737] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\0B\\*.*") returned="*.*" [0142.737] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\0B\\", lpString2="FCBF5d01" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\0B\\FCBF5d01") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\0B\\FCBF5d01" [0142.737] FindNextFileA (in: hFindFile=0x5be3e0, lpFindFileData=0xae918 | out: lpFindFileData=0xae918) returned 0 [0142.737] FindClose (in: hFindFile=0x5be3e0 | out: hFindFile=0x5be3e0) returned 1 [0142.737] FindNextFileA (in: hFindFile=0x5be3a0, lpFindFileData=0xaea68 | out: lpFindFileData=0xaea68) returned 1 [0142.737] lstrcmpA (lpString1=".", lpString2="C2") returned -1 [0142.737] lstrcmpA (lpString1="..", lpString2="C2") returned -1 [0142.737] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\*.*") returned="*.*" [0142.737] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\", lpString2="C2" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\C2") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\C2" [0142.737] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\C2\\*.*", lpFindFileData=0xae918 | out: lpFindFileData=0xae918) returned 0x5be3e0 [0142.738] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0142.738] FindNextFileA (in: hFindFile=0x5be3e0, lpFindFileData=0xae918 | out: lpFindFileData=0xae918) returned 1 [0142.738] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0142.738] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0142.738] FindNextFileA (in: hFindFile=0x5be3e0, lpFindFileData=0xae918 | out: lpFindFileData=0xae918) returned 1 [0142.738] PeekMessageA (in: lpMsg=0xae8f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xae8f4) returned 0 [0142.738] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="0B619d01") returned 1 [0142.738] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="0B619d01") returned 1 [0142.738] lstrcmpiA (lpString1="", lpString2="0B619d01") returned -1 [0142.738] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\C2\\*.*") returned="*.*" [0142.738] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\C2\\", lpString2="0B619d01" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\C2\\0B619d01") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\C2\\0B619d01" [0142.738] FindNextFileA (in: hFindFile=0x5be3e0, lpFindFileData=0xae918 | out: lpFindFileData=0xae918) returned 0 [0142.738] FindClose (in: hFindFile=0x5be3e0 | out: hFindFile=0x5be3e0) returned 1 [0142.738] FindNextFileA (in: hFindFile=0x5be3a0, lpFindFileData=0xaea68 | out: lpFindFileData=0xaea68) returned 1 [0142.738] lstrcmpA (lpString1=".", lpString2="F6") returned -1 [0142.738] lstrcmpA (lpString1="..", lpString2="F6") returned -1 [0142.738] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\*.*") returned="*.*" [0142.738] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\", lpString2="F6" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\F6") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\F6" [0142.739] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\F6\\*.*", lpFindFileData=0xae918 | out: lpFindFileData=0xae918) returned 0x5be3e0 [0142.739] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0142.739] FindNextFileA (in: hFindFile=0x5be3e0, lpFindFileData=0xae918 | out: lpFindFileData=0xae918) returned 1 [0142.739] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0142.739] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0142.739] FindNextFileA (in: hFindFile=0x5be3e0, lpFindFileData=0xae918 | out: lpFindFileData=0xae918) returned 1 [0142.739] PeekMessageA (in: lpMsg=0xae8f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xae8f4) returned 0 [0142.739] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="CBD4Dd01") returned 1 [0142.739] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="CBD4Dd01") returned 1 [0142.739] lstrcmpiA (lpString1="", lpString2="CBD4Dd01") returned -1 [0142.739] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\F6\\*.*") returned="*.*" [0142.739] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\F6\\", lpString2="CBD4Dd01" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\F6\\CBD4Dd01") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\F6\\CBD4Dd01" [0142.739] FindNextFileA (in: hFindFile=0x5be3e0, lpFindFileData=0xae918 | out: lpFindFileData=0xae918) returned 0 [0142.739] FindClose (in: hFindFile=0x5be3e0 | out: hFindFile=0x5be3e0) returned 1 [0142.739] FindNextFileA (in: hFindFile=0x5be3a0, lpFindFileData=0xaea68 | out: lpFindFileData=0xaea68) returned 0 [0142.739] FindClose (in: hFindFile=0x5be3a0 | out: hFindFile=0x5be3a0) returned 1 [0142.739] FindNextFileA (in: hFindFile=0x5be360, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 1 [0142.739] lstrcmpA (lpString1=".", lpString2="2") returned -1 [0142.739] lstrcmpA (lpString1="..", lpString2="2") returned -1 [0142.739] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\*.*") returned="*.*" [0142.740] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\", lpString2="2" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\2") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\2" [0142.740] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\2\\*.*", lpFindFileData=0xaea68 | out: lpFindFileData=0xaea68) returned 0x5be3a0 [0142.740] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0142.740] FindNextFileA (in: hFindFile=0x5be3a0, lpFindFileData=0xaea68 | out: lpFindFileData=0xaea68) returned 1 [0142.740] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0142.740] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0142.740] FindNextFileA (in: hFindFile=0x5be3a0, lpFindFileData=0xaea68 | out: lpFindFileData=0xaea68) returned 0 [0142.740] FindClose (in: hFindFile=0x5be3a0 | out: hFindFile=0x5be3a0) returned 1 [0142.741] FindNextFileA (in: hFindFile=0x5be360, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 1 [0142.741] lstrcmpA (lpString1=".", lpString2="3") returned -1 [0142.741] lstrcmpA (lpString1="..", lpString2="3") returned -1 [0142.741] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\*.*") returned="*.*" [0142.741] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\", lpString2="3" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\3") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\3" [0142.741] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\3\\*.*", lpFindFileData=0xaea68 | out: lpFindFileData=0xaea68) returned 0x5be3a0 [0142.742] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0142.742] FindNextFileA (in: hFindFile=0x5be3a0, lpFindFileData=0xaea68 | out: lpFindFileData=0xaea68) returned 1 [0142.742] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0142.742] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0142.742] FindNextFileA (in: hFindFile=0x5be3a0, lpFindFileData=0xaea68 | out: lpFindFileData=0xaea68) returned 1 [0142.742] lstrcmpA (lpString1=".", lpString2="4B") returned -1 [0142.742] lstrcmpA (lpString1="..", lpString2="4B") returned -1 [0142.742] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\3\\*.*") returned="*.*" [0142.742] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\3\\", lpString2="4B" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\3\\4B") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\3\\4B" [0142.742] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\3\\4B\\*.*", lpFindFileData=0xae918 | out: lpFindFileData=0xae918) returned 0x5be3e0 [0142.743] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0142.743] FindNextFileA (in: hFindFile=0x5be3e0, lpFindFileData=0xae918 | out: lpFindFileData=0xae918) returned 1 [0142.743] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0142.743] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0142.743] FindNextFileA (in: hFindFile=0x5be3e0, lpFindFileData=0xae918 | out: lpFindFileData=0xae918) returned 1 [0142.743] PeekMessageA (in: lpMsg=0xae8f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xae8f4) returned 0 [0142.743] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="1D8FDd01") returned 1 [0142.743] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="1D8FDd01") returned 1 [0142.743] lstrcmpiA (lpString1="", lpString2="1D8FDd01") returned -1 [0142.743] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\3\\4B\\*.*") returned="*.*" [0142.743] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\3\\4B\\", lpString2="1D8FDd01" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\3\\4B\\1D8FDd01") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\3\\4B\\1D8FDd01" [0142.743] FindNextFileA (in: hFindFile=0x5be3e0, lpFindFileData=0xae918 | out: lpFindFileData=0xae918) returned 0 [0142.743] FindClose (in: hFindFile=0x5be3e0 | out: hFindFile=0x5be3e0) returned 1 [0142.743] FindNextFileA (in: hFindFile=0x5be3a0, lpFindFileData=0xaea68 | out: lpFindFileData=0xaea68) returned 0 [0142.743] FindClose (in: hFindFile=0x5be3a0 | out: hFindFile=0x5be3a0) returned 1 [0142.743] FindNextFileA (in: hFindFile=0x5be360, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 1 [0142.743] lstrcmpA (lpString1=".", lpString2="4") returned -1 [0142.743] lstrcmpA (lpString1="..", lpString2="4") returned -1 [0142.743] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\*.*") returned="*.*" [0142.743] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\", lpString2="4" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\4") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\4" [0142.743] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\4\\*.*", lpFindFileData=0xaea68 | out: lpFindFileData=0xaea68) returned 0x5be3a0 [0142.744] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0142.744] FindNextFileA (in: hFindFile=0x5be3a0, lpFindFileData=0xaea68 | out: lpFindFileData=0xaea68) returned 1 [0142.744] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0142.744] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0142.744] FindNextFileA (in: hFindFile=0x5be3a0, lpFindFileData=0xaea68 | out: lpFindFileData=0xaea68) returned 0 [0142.744] FindClose (in: hFindFile=0x5be3a0 | out: hFindFile=0x5be3a0) returned 1 [0142.744] FindNextFileA (in: hFindFile=0x5be360, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 1 [0142.744] lstrcmpA (lpString1=".", lpString2="5") returned -1 [0142.744] lstrcmpA (lpString1="..", lpString2="5") returned -1 [0142.744] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\*.*") returned="*.*" [0142.744] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\", lpString2="5" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\5") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\5" [0142.744] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\5\\*.*", lpFindFileData=0xaea68 | out: lpFindFileData=0xaea68) returned 0x5be3a0 [0142.745] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0142.745] FindNextFileA (in: hFindFile=0x5be3a0, lpFindFileData=0xaea68 | out: lpFindFileData=0xaea68) returned 1 [0142.745] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0142.745] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0142.745] FindNextFileA (in: hFindFile=0x5be3a0, lpFindFileData=0xaea68 | out: lpFindFileData=0xaea68) returned 0 [0142.745] FindClose (in: hFindFile=0x5be3a0 | out: hFindFile=0x5be3a0) returned 1 [0142.745] FindNextFileA (in: hFindFile=0x5be360, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 1 [0142.745] lstrcmpA (lpString1=".", lpString2="6") returned -1 [0142.745] lstrcmpA (lpString1="..", lpString2="6") returned -1 [0142.745] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\*.*") returned="*.*" [0142.745] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\", lpString2="6" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\6") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\6" [0142.745] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\6\\*.*", lpFindFileData=0xaea68 | out: lpFindFileData=0xaea68) returned 0x5be3a0 [0142.745] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0142.745] FindNextFileA (in: hFindFile=0x5be3a0, lpFindFileData=0xaea68 | out: lpFindFileData=0xaea68) returned 1 [0142.745] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0142.745] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0142.745] FindNextFileA (in: hFindFile=0x5be3a0, lpFindFileData=0xaea68 | out: lpFindFileData=0xaea68) returned 0 [0142.746] FindClose (in: hFindFile=0x5be3a0 | out: hFindFile=0x5be3a0) returned 1 [0142.746] FindNextFileA (in: hFindFile=0x5be360, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 1 [0142.746] lstrcmpA (lpString1=".", lpString2="7") returned -1 [0142.746] lstrcmpA (lpString1="..", lpString2="7") returned -1 [0142.746] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\*.*") returned="*.*" [0142.746] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\", lpString2="7" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\7") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\7" [0142.746] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\7\\*.*", lpFindFileData=0xaea68 | out: lpFindFileData=0xaea68) returned 0x5be3a0 [0142.746] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0142.746] FindNextFileA (in: hFindFile=0x5be3a0, lpFindFileData=0xaea68 | out: lpFindFileData=0xaea68) returned 1 [0142.746] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0142.746] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0142.746] FindNextFileA (in: hFindFile=0x5be3a0, lpFindFileData=0xaea68 | out: lpFindFileData=0xaea68) returned 0 [0142.746] FindClose (in: hFindFile=0x5be3a0 | out: hFindFile=0x5be3a0) returned 1 [0142.747] FindNextFileA (in: hFindFile=0x5be360, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 1 [0142.747] lstrcmpA (lpString1=".", lpString2="8") returned -1 [0142.747] lstrcmpA (lpString1="..", lpString2="8") returned -1 [0142.747] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\*.*") returned="*.*" [0142.747] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\", lpString2="8" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\8") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\8" [0142.747] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\8\\*.*", lpFindFileData=0xaea68 | out: lpFindFileData=0xaea68) returned 0x5be3a0 [0142.747] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0142.747] FindNextFileA (in: hFindFile=0x5be3a0, lpFindFileData=0xaea68 | out: lpFindFileData=0xaea68) returned 1 [0142.747] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0142.747] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0142.747] FindNextFileA (in: hFindFile=0x5be3a0, lpFindFileData=0xaea68 | out: lpFindFileData=0xaea68) returned 0 [0142.747] FindClose (in: hFindFile=0x5be3a0 | out: hFindFile=0x5be3a0) returned 1 [0142.747] FindNextFileA (in: hFindFile=0x5be360, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 1 [0142.747] lstrcmpA (lpString1=".", lpString2="9") returned -1 [0142.747] lstrcmpA (lpString1="..", lpString2="9") returned -1 [0142.747] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\*.*") returned="*.*" [0142.747] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\", lpString2="9" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9" [0142.747] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\*.*", lpFindFileData=0xaea68 | out: lpFindFileData=0xaea68) returned 0x5be3a0 [0142.748] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0142.748] FindNextFileA (in: hFindFile=0x5be3a0, lpFindFileData=0xaea68 | out: lpFindFileData=0xaea68) returned 1 [0142.748] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0142.748] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0142.748] FindNextFileA (in: hFindFile=0x5be3a0, lpFindFileData=0xaea68 | out: lpFindFileData=0xaea68) returned 1 [0142.748] lstrcmpA (lpString1=".", lpString2="10") returned -1 [0142.748] lstrcmpA (lpString1="..", lpString2="10") returned -1 [0142.748] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\*.*") returned="*.*" [0142.748] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\", lpString2="10" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\10") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\10" [0142.748] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\10\\*.*", lpFindFileData=0xae918 | out: lpFindFileData=0xae918) returned 0x5be3e0 [0142.748] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0142.748] FindNextFileA (in: hFindFile=0x5be3e0, lpFindFileData=0xae918 | out: lpFindFileData=0xae918) returned 1 [0142.748] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0142.748] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0142.748] FindNextFileA (in: hFindFile=0x5be3e0, lpFindFileData=0xae918 | out: lpFindFileData=0xae918) returned 1 [0142.748] PeekMessageA (in: lpMsg=0xae8f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xae8f4) returned 0 [0142.748] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="16A09d01") returned 1 [0142.748] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="16A09d01") returned 1 [0142.748] lstrcmpiA (lpString1="", lpString2="16A09d01") returned -1 [0142.748] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\10\\*.*") returned="*.*" [0142.748] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\10\\", lpString2="16A09d01" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\10\\16A09d01") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\10\\16A09d01" [0142.748] FindNextFileA (in: hFindFile=0x5be3e0, lpFindFileData=0xae918 | out: lpFindFileData=0xae918) returned 0 [0142.748] FindClose (in: hFindFile=0x5be3e0 | out: hFindFile=0x5be3e0) returned 1 [0142.748] FindNextFileA (in: hFindFile=0x5be3a0, lpFindFileData=0xaea68 | out: lpFindFileData=0xaea68) returned 1 [0142.748] lstrcmpA (lpString1=".", lpString2="2C") returned -1 [0142.749] lstrcmpA (lpString1="..", lpString2="2C") returned -1 [0142.749] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\*.*") returned="*.*" [0142.749] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\", lpString2="2C" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\2C") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\2C" [0142.749] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\2C\\*.*", lpFindFileData=0xae918 | out: lpFindFileData=0xae918) returned 0x5be3e0 [0142.749] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0142.749] FindNextFileA (in: hFindFile=0x5be3e0, lpFindFileData=0xae918 | out: lpFindFileData=0xae918) returned 1 [0142.749] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0142.749] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0142.749] FindNextFileA (in: hFindFile=0x5be3e0, lpFindFileData=0xae918 | out: lpFindFileData=0xae918) returned 1 [0142.749] PeekMessageA (in: lpMsg=0xae8f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xae8f4) returned 0 [0142.749] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="24B53d01") returned 1 [0142.749] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="24B53d01") returned 1 [0142.749] lstrcmpiA (lpString1="", lpString2="24B53d01") returned -1 [0142.749] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\2C\\*.*") returned="*.*" [0142.749] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\2C\\", lpString2="24B53d01" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\2C\\24B53d01") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\2C\\24B53d01" [0142.749] FindNextFileA (in: hFindFile=0x5be3e0, lpFindFileData=0xae918 | out: lpFindFileData=0xae918) returned 0 [0142.749] FindClose (in: hFindFile=0x5be3e0 | out: hFindFile=0x5be3e0) returned 1 [0142.749] FindNextFileA (in: hFindFile=0x5be3a0, lpFindFileData=0xaea68 | out: lpFindFileData=0xaea68) returned 1 [0142.749] lstrcmpA (lpString1=".", lpString2="61") returned -1 [0142.749] lstrcmpA (lpString1="..", lpString2="61") returned -1 [0142.749] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\*.*") returned="*.*" [0142.749] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\", lpString2="61" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\61") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\61" [0142.749] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\61\\*.*", lpFindFileData=0xae918 | out: lpFindFileData=0xae918) returned 0x5be3e0 [0142.749] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0142.749] FindNextFileA (in: hFindFile=0x5be3e0, lpFindFileData=0xae918 | out: lpFindFileData=0xae918) returned 1 [0142.749] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0142.750] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0142.750] FindNextFileA (in: hFindFile=0x5be3e0, lpFindFileData=0xae918 | out: lpFindFileData=0xae918) returned 1 [0142.750] PeekMessageA (in: lpMsg=0xae8f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xae8f4) returned 0 [0142.750] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="28E95d01") returned 1 [0142.750] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="28E95d01") returned 1 [0142.750] lstrcmpiA (lpString1="", lpString2="28E95d01") returned -1 [0142.750] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\61\\*.*") returned="*.*" [0142.750] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\61\\", lpString2="28E95d01" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\61\\28E95d01") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\61\\28E95d01" [0142.750] FindNextFileA (in: hFindFile=0x5be3e0, lpFindFileData=0xae918 | out: lpFindFileData=0xae918) returned 0 [0142.750] FindClose (in: hFindFile=0x5be3e0 | out: hFindFile=0x5be3e0) returned 1 [0142.750] FindNextFileA (in: hFindFile=0x5be3a0, lpFindFileData=0xaea68 | out: lpFindFileData=0xaea68) returned 1 [0142.750] lstrcmpA (lpString1=".", lpString2="E0") returned -1 [0142.750] lstrcmpA (lpString1="..", lpString2="E0") returned -1 [0142.750] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\*.*") returned="*.*" [0142.750] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\", lpString2="E0" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\E0") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\E0" [0142.750] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\E0\\*.*", lpFindFileData=0xae918 | out: lpFindFileData=0xae918) returned 0x5be3e0 [0142.751] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0142.751] FindNextFileA (in: hFindFile=0x5be3e0, lpFindFileData=0xae918 | out: lpFindFileData=0xae918) returned 1 [0142.751] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0142.751] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0142.751] FindNextFileA (in: hFindFile=0x5be3e0, lpFindFileData=0xae918 | out: lpFindFileData=0xae918) returned 1 [0142.751] PeekMessageA (in: lpMsg=0xae8f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xae8f4) returned 0 [0142.751] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="F17B2d01") returned -1 [0142.751] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="F17B2d01") returned 1 [0142.751] lstrcmpiA (lpString1="", lpString2="F17B2d01") returned -1 [0142.751] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\E0\\*.*") returned="*.*" [0142.751] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\E0\\", lpString2="F17B2d01" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\E0\\F17B2d01") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\E0\\F17B2d01" [0142.751] FindNextFileA (in: hFindFile=0x5be3e0, lpFindFileData=0xae918 | out: lpFindFileData=0xae918) returned 0 [0142.751] FindClose (in: hFindFile=0x5be3e0 | out: hFindFile=0x5be3e0) returned 1 [0142.751] FindNextFileA (in: hFindFile=0x5be3a0, lpFindFileData=0xaea68 | out: lpFindFileData=0xaea68) returned 0 [0142.751] FindClose (in: hFindFile=0x5be3a0 | out: hFindFile=0x5be3a0) returned 1 [0142.751] FindNextFileA (in: hFindFile=0x5be360, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 1 [0142.751] lstrcmpA (lpString1=".", lpString2="A") returned -1 [0142.751] lstrcmpA (lpString1="..", lpString2="A") returned -1 [0142.751] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\*.*") returned="*.*" [0142.751] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\", lpString2="A" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\A") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\A" [0142.751] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\A\\*.*", lpFindFileData=0xaea68 | out: lpFindFileData=0xaea68) returned 0x5be3a0 [0142.751] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0142.751] FindNextFileA (in: hFindFile=0x5be3a0, lpFindFileData=0xaea68 | out: lpFindFileData=0xaea68) returned 1 [0142.752] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0142.752] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0142.752] FindNextFileA (in: hFindFile=0x5be3a0, lpFindFileData=0xaea68 | out: lpFindFileData=0xaea68) returned 0 [0142.752] FindClose (in: hFindFile=0x5be3a0 | out: hFindFile=0x5be3a0) returned 1 [0142.752] FindNextFileA (in: hFindFile=0x5be360, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 1 [0142.752] lstrcmpA (lpString1=".", lpString2="B") returned -1 [0142.752] lstrcmpA (lpString1="..", lpString2="B") returned -1 [0142.752] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\*.*") returned="*.*" [0142.752] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\", lpString2="B" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\B") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\B" [0142.752] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\B\\*.*", lpFindFileData=0xaea68 | out: lpFindFileData=0xaea68) returned 0x5be3a0 [0142.752] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0142.752] FindNextFileA (in: hFindFile=0x5be3a0, lpFindFileData=0xaea68 | out: lpFindFileData=0xaea68) returned 1 [0142.752] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0142.752] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0142.752] FindNextFileA (in: hFindFile=0x5be3a0, lpFindFileData=0xaea68 | out: lpFindFileData=0xaea68) returned 0 [0142.752] FindClose (in: hFindFile=0x5be3a0 | out: hFindFile=0x5be3a0) returned 1 [0142.753] FindNextFileA (in: hFindFile=0x5be360, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 1 [0142.753] lstrcmpA (lpString1=".", lpString2="C") returned -1 [0142.753] lstrcmpA (lpString1="..", lpString2="C") returned -1 [0142.753] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\*.*") returned="*.*" [0142.753] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\", lpString2="C" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\C") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\C" [0142.753] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\C\\*.*", lpFindFileData=0xaea68 | out: lpFindFileData=0xaea68) returned 0x5be3a0 [0142.753] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0142.753] FindNextFileA (in: hFindFile=0x5be3a0, lpFindFileData=0xaea68 | out: lpFindFileData=0xaea68) returned 1 [0142.753] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0142.753] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0142.753] FindNextFileA (in: hFindFile=0x5be3a0, lpFindFileData=0xaea68 | out: lpFindFileData=0xaea68) returned 1 [0142.753] lstrcmpA (lpString1=".", lpString2="E6") returned -1 [0142.753] lstrcmpA (lpString1="..", lpString2="E6") returned -1 [0142.753] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\C\\*.*") returned="*.*" [0142.753] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\C\\", lpString2="E6" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\C\\E6") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\C\\E6" [0142.753] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\C\\E6\\*.*", lpFindFileData=0xae918 | out: lpFindFileData=0xae918) returned 0x5be3e0 [0142.753] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0142.753] FindNextFileA (in: hFindFile=0x5be3e0, lpFindFileData=0xae918 | out: lpFindFileData=0xae918) returned 1 [0142.753] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0142.753] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0142.753] FindNextFileA (in: hFindFile=0x5be3e0, lpFindFileData=0xae918 | out: lpFindFileData=0xae918) returned 1 [0142.753] PeekMessageA (in: lpMsg=0xae8f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xae8f4) returned 0 [0142.753] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="9DCB7d01") returned 1 [0142.753] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="9DCB7d01") returned 1 [0142.753] lstrcmpiA (lpString1="", lpString2="9DCB7d01") returned -1 [0142.753] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\C\\E6\\*.*") returned="*.*" [0142.753] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\C\\E6\\", lpString2="9DCB7d01" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\C\\E6\\9DCB7d01") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\C\\E6\\9DCB7d01" [0142.753] FindNextFileA (in: hFindFile=0x5be3e0, lpFindFileData=0xae918 | out: lpFindFileData=0xae918) returned 0 [0142.754] FindClose (in: hFindFile=0x5be3e0 | out: hFindFile=0x5be3e0) returned 1 [0142.755] FindNextFileA (in: hFindFile=0x5be3a0, lpFindFileData=0xaea68 | out: lpFindFileData=0xaea68) returned 0 [0142.755] FindClose (in: hFindFile=0x5be3a0 | out: hFindFile=0x5be3a0) returned 1 [0142.755] FindNextFileA (in: hFindFile=0x5be360, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 1 [0142.755] lstrcmpA (lpString1=".", lpString2="D") returned -1 [0142.755] lstrcmpA (lpString1="..", lpString2="D") returned -1 [0142.755] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\*.*") returned="*.*" [0142.755] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\", lpString2="D" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\D") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\D" [0142.755] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\D\\*.*", lpFindFileData=0xaea68 | out: lpFindFileData=0xaea68) returned 0x5be3a0 [0142.756] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0142.756] FindNextFileA (in: hFindFile=0x5be3a0, lpFindFileData=0xaea68 | out: lpFindFileData=0xaea68) returned 1 [0142.756] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0142.756] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0142.756] FindNextFileA (in: hFindFile=0x5be3a0, lpFindFileData=0xaea68 | out: lpFindFileData=0xaea68) returned 1 [0142.756] lstrcmpA (lpString1=".", lpString2="08") returned -1 [0142.756] lstrcmpA (lpString1="..", lpString2="08") returned -1 [0142.756] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\D\\*.*") returned="*.*" [0142.756] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\D\\", lpString2="08" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\D\\08") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\D\\08" [0142.756] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\D\\08\\*.*", lpFindFileData=0xae918 | out: lpFindFileData=0xae918) returned 0x5be3e0 [0142.757] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0142.757] FindNextFileA (in: hFindFile=0x5be3e0, lpFindFileData=0xae918 | out: lpFindFileData=0xae918) returned 1 [0142.757] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0142.757] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0142.757] FindNextFileA (in: hFindFile=0x5be3e0, lpFindFileData=0xae918 | out: lpFindFileData=0xae918) returned 1 [0142.757] PeekMessageA (in: lpMsg=0xae8f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xae8f4) returned 0 [0142.757] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="71469d01") returned 1 [0142.757] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="71469d01") returned 1 [0142.757] lstrcmpiA (lpString1="", lpString2="71469d01") returned -1 [0142.757] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\D\\08\\*.*") returned="*.*" [0142.757] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\D\\08\\", lpString2="71469d01" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\D\\08\\71469d01") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\D\\08\\71469d01" [0142.757] FindNextFileA (in: hFindFile=0x5be3e0, lpFindFileData=0xae918 | out: lpFindFileData=0xae918) returned 0 [0142.757] FindClose (in: hFindFile=0x5be3e0 | out: hFindFile=0x5be3e0) returned 1 [0142.757] FindNextFileA (in: hFindFile=0x5be3a0, lpFindFileData=0xaea68 | out: lpFindFileData=0xaea68) returned 0 [0142.757] FindClose (in: hFindFile=0x5be3a0 | out: hFindFile=0x5be3a0) returned 1 [0142.757] FindNextFileA (in: hFindFile=0x5be360, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 1 [0142.757] lstrcmpA (lpString1=".", lpString2="E") returned -1 [0142.757] lstrcmpA (lpString1="..", lpString2="E") returned -1 [0142.757] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\*.*") returned="*.*" [0142.757] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\", lpString2="E" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\E") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\E" [0142.757] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\E\\*.*", lpFindFileData=0xaea68 | out: lpFindFileData=0xaea68) returned 0x5be3a0 [0142.757] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0142.757] FindNextFileA (in: hFindFile=0x5be3a0, lpFindFileData=0xaea68 | out: lpFindFileData=0xaea68) returned 1 [0142.757] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0142.757] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0142.757] FindNextFileA (in: hFindFile=0x5be3a0, lpFindFileData=0xaea68 | out: lpFindFileData=0xaea68) returned 1 [0142.757] lstrcmpA (lpString1=".", lpString2="69") returned -1 [0142.757] lstrcmpA (lpString1="..", lpString2="69") returned -1 [0142.757] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\E\\*.*") returned="*.*" [0142.757] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\E\\", lpString2="69" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\E\\69") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\E\\69" [0142.757] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\E\\69\\*.*", lpFindFileData=0xae918 | out: lpFindFileData=0xae918) returned 0x5be3e0 [0142.758] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0142.758] FindNextFileA (in: hFindFile=0x5be3e0, lpFindFileData=0xae918 | out: lpFindFileData=0xae918) returned 1 [0142.758] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0142.758] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0142.758] FindNextFileA (in: hFindFile=0x5be3e0, lpFindFileData=0xae918 | out: lpFindFileData=0xae918) returned 1 [0142.758] PeekMessageA (in: lpMsg=0xae8f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xae8f4) returned 0 [0142.758] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="885EEd01") returned 1 [0142.758] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="885EEd01") returned 1 [0142.758] lstrcmpiA (lpString1="", lpString2="885EEd01") returned -1 [0142.758] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\E\\69\\*.*") returned="*.*" [0142.758] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\E\\69\\", lpString2="885EEd01" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\E\\69\\885EEd01") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\E\\69\\885EEd01" [0142.758] FindNextFileA (in: hFindFile=0x5be3e0, lpFindFileData=0xae918 | out: lpFindFileData=0xae918) returned 0 [0142.758] FindClose (in: hFindFile=0x5be3e0 | out: hFindFile=0x5be3e0) returned 1 [0142.758] FindNextFileA (in: hFindFile=0x5be3a0, lpFindFileData=0xaea68 | out: lpFindFileData=0xaea68) returned 0 [0142.758] FindClose (in: hFindFile=0x5be3a0 | out: hFindFile=0x5be3a0) returned 1 [0142.758] FindNextFileA (in: hFindFile=0x5be360, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 1 [0142.758] lstrcmpA (lpString1=".", lpString2="F") returned -1 [0142.758] lstrcmpA (lpString1="..", lpString2="F") returned -1 [0142.758] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\*.*") returned="*.*" [0142.758] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\", lpString2="F" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\F") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\F" [0142.758] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\F\\*.*", lpFindFileData=0xaea68 | out: lpFindFileData=0xaea68) returned 0x5be3a0 [0142.759] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0142.759] FindNextFileA (in: hFindFile=0x5be3a0, lpFindFileData=0xaea68 | out: lpFindFileData=0xaea68) returned 1 [0142.759] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0142.759] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0142.759] FindNextFileA (in: hFindFile=0x5be3a0, lpFindFileData=0xaea68 | out: lpFindFileData=0xaea68) returned 1 [0142.759] lstrcmpA (lpString1=".", lpString2="23") returned -1 [0142.759] lstrcmpA (lpString1="..", lpString2="23") returned -1 [0142.759] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\F\\*.*") returned="*.*" [0142.759] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\F\\", lpString2="23" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\F\\23") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\F\\23" [0142.759] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\F\\23\\*.*", lpFindFileData=0xae918 | out: lpFindFileData=0xae918) returned 0x5be3e0 [0142.759] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0142.759] FindNextFileA (in: hFindFile=0x5be3e0, lpFindFileData=0xae918 | out: lpFindFileData=0xae918) returned 1 [0142.759] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0142.759] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0142.759] FindNextFileA (in: hFindFile=0x5be3e0, lpFindFileData=0xae918 | out: lpFindFileData=0xae918) returned 1 [0142.759] PeekMessageA (in: lpMsg=0xae8f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xae8f4) returned 0 [0142.759] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="7E0FEd01") returned 1 [0142.759] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="7E0FEd01") returned 1 [0142.759] lstrcmpiA (lpString1="", lpString2="7E0FEd01") returned -1 [0142.759] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\F\\23\\*.*") returned="*.*" [0142.759] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\F\\23\\", lpString2="7E0FEd01" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\F\\23\\7E0FEd01") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\F\\23\\7E0FEd01" [0142.759] FindNextFileA (in: hFindFile=0x5be3e0, lpFindFileData=0xae918 | out: lpFindFileData=0xae918) returned 0 [0142.759] FindClose (in: hFindFile=0x5be3e0 | out: hFindFile=0x5be3e0) returned 1 [0142.759] FindNextFileA (in: hFindFile=0x5be3a0, lpFindFileData=0xaea68 | out: lpFindFileData=0xaea68) returned 1 [0142.759] lstrcmpA (lpString1=".", lpString2="F0") returned -1 [0142.759] lstrcmpA (lpString1="..", lpString2="F0") returned -1 [0142.759] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\F\\*.*") returned="*.*" [0142.760] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\F\\", lpString2="F0" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\F\\F0") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\F\\F0" [0142.760] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\F\\F0\\*.*", lpFindFileData=0xae918 | out: lpFindFileData=0xae918) returned 0x5be3e0 [0142.760] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0142.760] FindNextFileA (in: hFindFile=0x5be3e0, lpFindFileData=0xae918 | out: lpFindFileData=0xae918) returned 1 [0142.760] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0142.760] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0142.760] FindNextFileA (in: hFindFile=0x5be3e0, lpFindFileData=0xae918 | out: lpFindFileData=0xae918) returned 1 [0142.760] PeekMessageA (in: lpMsg=0xae8f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xae8f4) returned 0 [0142.760] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="ECB2Dd01") returned -1 [0142.760] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ECB2Dd01") returned 1 [0142.760] lstrcmpiA (lpString1="", lpString2="ECB2Dd01") returned -1 [0142.760] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\F\\F0\\*.*") returned="*.*" [0142.760] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\F\\F0\\", lpString2="ECB2Dd01" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\F\\F0\\ECB2Dd01") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\F\\F0\\ECB2Dd01" [0142.760] FindNextFileA (in: hFindFile=0x5be3e0, lpFindFileData=0xae918 | out: lpFindFileData=0xae918) returned 0 [0142.760] FindClose (in: hFindFile=0x5be3e0 | out: hFindFile=0x5be3e0) returned 1 [0142.760] FindNextFileA (in: hFindFile=0x5be3a0, lpFindFileData=0xaea68 | out: lpFindFileData=0xaea68) returned 0 [0142.760] FindClose (in: hFindFile=0x5be3a0 | out: hFindFile=0x5be3a0) returned 1 [0142.761] FindNextFileA (in: hFindFile=0x5be360, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 1 [0142.761] PeekMessageA (in: lpMsg=0xaeb94, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaeb94) returned 0 [0142.761] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="_CACHE_001_") returned 1 [0142.761] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="_CACHE_001_") returned 1 [0142.761] lstrcmpiA (lpString1="", lpString2="_CACHE_001_") returned -1 [0142.761] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\*.*") returned="*.*" [0142.761] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\", lpString2="_CACHE_001_" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\_CACHE_001_") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\_CACHE_001_" [0142.761] FindNextFileA (in: hFindFile=0x5be360, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 1 [0142.761] PeekMessageA (in: lpMsg=0xaeb94, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaeb94) returned 0 [0142.761] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="_CACHE_002_") returned 1 [0142.761] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="_CACHE_002_") returned 1 [0142.761] lstrcmpiA (lpString1="", lpString2="_CACHE_002_") returned -1 [0142.761] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\_CACHE_001_") returned="_CACHE_001_" [0142.761] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\", lpString2="_CACHE_002_" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\_CACHE_002_") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\_CACHE_002_" [0142.761] FindNextFileA (in: hFindFile=0x5be360, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 1 [0142.761] PeekMessageA (in: lpMsg=0xaeb94, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaeb94) returned 0 [0142.761] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="_CACHE_003_") returned 1 [0142.761] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="_CACHE_003_") returned 1 [0142.761] lstrcmpiA (lpString1="", lpString2="_CACHE_003_") returned -1 [0142.761] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\_CACHE_002_") returned="_CACHE_002_" [0142.761] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\", lpString2="_CACHE_003_" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\_CACHE_003_") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\_CACHE_003_" [0142.761] FindNextFileA (in: hFindFile=0x5be360, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 1 [0142.761] PeekMessageA (in: lpMsg=0xaeb94, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaeb94) returned 0 [0142.761] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="_CACHE_MAP_") returned 1 [0142.761] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="_CACHE_MAP_") returned 1 [0142.761] lstrcmpiA (lpString1="", lpString2="_CACHE_MAP_") returned -1 [0142.761] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\_CACHE_003_") returned="_CACHE_003_" [0142.761] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\", lpString2="_CACHE_MAP_" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\_CACHE_MAP_") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\_CACHE_MAP_" [0142.761] FindNextFileA (in: hFindFile=0x5be360, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 0 [0142.761] FindClose (in: hFindFile=0x5be360 | out: hFindFile=0x5be360) returned 1 [0142.761] FindNextFileA (in: hFindFile=0x5be320, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0142.761] lstrcmpA (lpString1=".", lpString2="OfflineCache") returned -1 [0142.761] lstrcmpA (lpString1="..", lpString2="OfflineCache") returned -1 [0142.761] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\*.*") returned="*.*" [0142.761] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\", lpString2="OfflineCache" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\OfflineCache") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\OfflineCache" [0142.761] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\OfflineCache\\*.*", lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 0x5be360 [0142.762] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0142.762] FindNextFileA (in: hFindFile=0x5be360, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 1 [0142.762] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0142.762] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0142.762] FindNextFileA (in: hFindFile=0x5be360, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 1 [0142.762] PeekMessageA (in: lpMsg=0xaeb94, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaeb94) returned 0 [0142.762] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="index.sqlite") returned -1 [0142.762] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="index.sqlite") returned -1 [0142.762] lstrcmpiA (lpString1="", lpString2="index.sqlite") returned -1 [0142.762] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\OfflineCache\\*.*") returned="*.*" [0142.762] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\OfflineCache\\", lpString2="index.sqlite" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\OfflineCache\\index.sqlite") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\OfflineCache\\index.sqlite" [0142.762] FindNextFileA (in: hFindFile=0x5be360, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 0 [0142.762] FindClose (in: hFindFile=0x5be360 | out: hFindFile=0x5be360) returned 1 [0142.762] FindNextFileA (in: hFindFile=0x5be320, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0142.763] lstrcmpA (lpString1=".", lpString2="safebrowsing") returned -1 [0142.763] lstrcmpA (lpString1="..", lpString2="safebrowsing") returned -1 [0142.763] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\*.*") returned="*.*" [0142.763] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\", lpString2="safebrowsing" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\safebrowsing") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\safebrowsing" [0142.763] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\safebrowsing\\*.*", lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 0x5be360 [0142.764] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0142.764] FindNextFileA (in: hFindFile=0x5be360, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 1 [0142.764] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0142.764] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0142.764] FindNextFileA (in: hFindFile=0x5be360, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 1 [0142.764] PeekMessageA (in: lpMsg=0xaeb94, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaeb94) returned 0 [0142.764] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="test-malware-simple.cache") returned -1 [0142.764] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="test-malware-simple.cache") returned -1 [0142.764] lstrcmpiA (lpString1="", lpString2="test-malware-simple.cache") returned -1 [0142.764] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\safebrowsing\\*.*") returned="*.*" [0142.764] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\safebrowsing\\", lpString2="test-malware-simple.cache" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\safebrowsing\\test-malware-simple.cache") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\safebrowsing\\test-malware-simple.cache" [0142.764] FindNextFileA (in: hFindFile=0x5be360, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 1 [0142.764] PeekMessageA (in: lpMsg=0xaeb94, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaeb94) returned 0 [0142.764] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="test-malware-simple.pset") returned -1 [0142.764] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="test-malware-simple.pset") returned -1 [0142.764] lstrcmpiA (lpString1="", lpString2="test-malware-simple.pset") returned -1 [0142.764] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\safebrowsing\\test-malware-simple.cache") returned="test-malware-simple.cache" [0142.764] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\safebrowsing\\", lpString2="test-malware-simple.pset" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\safebrowsing\\test-malware-simple.pset") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\safebrowsing\\test-malware-simple.pset" [0142.765] FindNextFileA (in: hFindFile=0x5be360, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 1 [0142.765] PeekMessageA (in: lpMsg=0xaeb94, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaeb94) returned 0 [0142.765] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="test-malware-simple.sbstore") returned -1 [0142.765] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="test-malware-simple.sbstore") returned -1 [0142.765] lstrcmpiA (lpString1="", lpString2="test-malware-simple.sbstore") returned -1 [0142.765] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\safebrowsing\\test-malware-simple.pset") returned="test-malware-simple.pset" [0142.765] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\safebrowsing\\", lpString2="test-malware-simple.sbstore" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\safebrowsing\\test-malware-simple.sbstore") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\safebrowsing\\test-malware-simple.sbstore" [0142.765] FindNextFileA (in: hFindFile=0x5be360, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 1 [0142.765] PeekMessageA (in: lpMsg=0xaeb94, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaeb94) returned 0 [0142.765] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="test-phish-simple.cache") returned -1 [0142.765] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="test-phish-simple.cache") returned -1 [0142.765] lstrcmpiA (lpString1="", lpString2="test-phish-simple.cache") returned -1 [0142.765] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\safebrowsing\\test-malware-simple.sbstore") returned="test-malware-simple.sbstore" [0142.765] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\safebrowsing\\", lpString2="test-phish-simple.cache" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\safebrowsing\\test-phish-simple.cache") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\safebrowsing\\test-phish-simple.cache" [0142.765] FindNextFileA (in: hFindFile=0x5be360, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 1 [0142.765] PeekMessageA (in: lpMsg=0xaeb94, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaeb94) returned 0 [0142.765] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="test-phish-simple.pset") returned -1 [0142.765] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="test-phish-simple.pset") returned -1 [0142.765] lstrcmpiA (lpString1="", lpString2="test-phish-simple.pset") returned -1 [0142.765] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\safebrowsing\\test-phish-simple.cache") returned="test-phish-simple.cache" [0142.765] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\safebrowsing\\", lpString2="test-phish-simple.pset" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\safebrowsing\\test-phish-simple.pset") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\safebrowsing\\test-phish-simple.pset" [0142.765] FindNextFileA (in: hFindFile=0x5be360, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 1 [0142.765] PeekMessageA (in: lpMsg=0xaeb94, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaeb94) returned 0 [0142.765] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="test-phish-simple.sbstore") returned -1 [0142.765] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="test-phish-simple.sbstore") returned -1 [0142.765] lstrcmpiA (lpString1="", lpString2="test-phish-simple.sbstore") returned -1 [0142.765] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\safebrowsing\\test-phish-simple.pset") returned="test-phish-simple.pset" [0142.765] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\safebrowsing\\", lpString2="test-phish-simple.sbstore" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\safebrowsing\\test-phish-simple.sbstore") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\safebrowsing\\test-phish-simple.sbstore" [0142.765] FindNextFileA (in: hFindFile=0x5be360, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 0 [0142.765] FindClose (in: hFindFile=0x5be360 | out: hFindFile=0x5be360) returned 1 [0142.766] FindNextFileA (in: hFindFile=0x5be320, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0142.766] lstrcmpA (lpString1=".", lpString2="startupCache") returned -1 [0142.766] lstrcmpA (lpString1="..", lpString2="startupCache") returned -1 [0142.766] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\*.*") returned="*.*" [0142.766] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\", lpString2="startupCache" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\startupCache") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\startupCache" [0142.766] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\startupCache\\*.*", lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 0x5be360 [0142.767] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0142.767] FindNextFileA (in: hFindFile=0x5be360, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 1 [0142.767] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0142.767] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0142.767] FindNextFileA (in: hFindFile=0x5be360, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 1 [0142.767] PeekMessageA (in: lpMsg=0xaeb94, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaeb94) returned 0 [0142.767] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="startupCache.4.little") returned -1 [0142.767] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="startupCache.4.little") returned -1 [0142.767] lstrcmpiA (lpString1="", lpString2="startupCache.4.little") returned -1 [0142.767] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\startupCache\\*.*") returned="*.*" [0142.767] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\startupCache\\", lpString2="startupCache.4.little" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\startupCache\\startupCache.4.little") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\startupCache\\startupCache.4.little" [0142.767] FindNextFileA (in: hFindFile=0x5be360, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 0 [0142.767] FindClose (in: hFindFile=0x5be360 | out: hFindFile=0x5be360) returned 1 [0142.767] FindNextFileA (in: hFindFile=0x5be320, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0142.767] lstrcmpA (lpString1=".", lpString2="thumbnails") returned -1 [0142.767] lstrcmpA (lpString1="..", lpString2="thumbnails") returned -1 [0142.767] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\*.*") returned="*.*" [0142.767] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\", lpString2="thumbnails" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails" [0142.767] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\*.*", lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 0x5be360 [0142.768] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0142.768] FindNextFileA (in: hFindFile=0x5be360, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 1 [0142.768] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0142.768] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0142.769] FindNextFileA (in: hFindFile=0x5be360, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 1 [0142.769] PeekMessageA (in: lpMsg=0xaeb94, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaeb94) returned 0 [0142.769] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="4cc87c1409819bf06f42b782d4902b2f.png") returned 1 [0142.769] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="4cc87c1409819bf06f42b782d4902b2f.png") returned 1 [0142.769] lstrcmpiA (lpString1="", lpString2="4cc87c1409819bf06f42b782d4902b2f.png") returned -1 [0142.769] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\*.*") returned="*.*" [0142.769] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\", lpString2="4cc87c1409819bf06f42b782d4902b2f.png" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\4cc87c1409819bf06f42b782d4902b2f.png") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\4cc87c1409819bf06f42b782d4902b2f.png" [0142.769] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\4cc87c1409819bf06f42b782d4902b2f.png" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\4cc87c1409819bf06f42b782d4902b2f.png") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\4cc87c1409819bf06f42b782d4902b2f.png" [0142.769] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\4cc87c1409819bf06f42b782d4902b2f.png" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\4cc87c1409819bf06f42b782d4902b2f.png") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\4cc87c1409819bf06f42b782d4902b2f.png" [0142.769] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\4cc87c1409819bf06f42b782d4902b2f.png", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\4cc87c1409819bf06f42b782d4902b2f.png.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\4cc87c1409819bf06f42b782d4902b2f.png." [0142.769] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\4cc87c1409819bf06f42b782d4902b2f.png.", lpString2="\xa0" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\4cc87c1409819bf06f42b782d4902b2f.png. ") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\4cc87c1409819bf06f42b782d4902b2f.png. " [0142.769] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\4cc87c1409819bf06f42b782d4902b2f.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\thumbnails\\4cc87c1409819bf06f42b782d4902b2f.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0 [0142.770] GetFileSize (in: hFile=0xa0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x40b0 [0142.770] GetFileTime (in: hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x83cc0a50, dwHighDateTime=0x1d2e627), lpLastAccessTime=0x407536*(dwLowDateTime=0x83cc0a50, dwHighDateTime=0x1d2e627), lpLastWriteTime=0x40753e*(dwLowDateTime=0x83ce6bb0, dwHighDateTime=0x1d2e627)) returned 1 [0142.770] SetFilePointer (in: hFile=0xa0, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0142.770] ReadFile (in: hFile=0xa0, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x4056, lpOverlapped=0x0) returned 1 [0142.842] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\4cc87c1409819bf06f42b782d4902b2f.png") returned="4cc87c1409819bf06f42b782d4902b2f.png" [0142.842] SetFilePointer (in: hFile=0xa0, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0142.842] WriteFile (in: hFile=0xa0, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x4056, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x4056, lpOverlapped=0x0) returned 1 [0142.842] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0142.843] CloseHandle (hObject=0xa0) returned 1 [0142.843] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\4cc87c1409819bf06f42b782d4902b2f.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\thumbnails\\4cc87c1409819bf06f42b782d4902b2f.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\4cc87c1409819bf06f42b782d4902b2f.png. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\thumbnails\\4cc87c1409819bf06f42b782d4902b2f.png. ")) returned 1 [0142.843] FindNextFileA (in: hFindFile=0x5be360, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 1 [0142.843] PeekMessageA (in: lpMsg=0xaeb94, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaeb94) returned 0 [0142.843] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="ba182bcd131f1f3c6b6fbbb1ba078341.png") returned 1 [0142.843] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ba182bcd131f1f3c6b6fbbb1ba078341.png") returned 1 [0142.843] lstrcmpiA (lpString1="", lpString2="ba182bcd131f1f3c6b6fbbb1ba078341.png") returned -1 [0142.844] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\4cc87c1409819bf06f42b782d4902b2f.png") returned="4cc87c1409819bf06f42b782d4902b2f.png" [0142.844] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\", lpString2="ba182bcd131f1f3c6b6fbbb1ba078341.png" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\ba182bcd131f1f3c6b6fbbb1ba078341.png") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\ba182bcd131f1f3c6b6fbbb1ba078341.png" [0142.844] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\ba182bcd131f1f3c6b6fbbb1ba078341.png", pszSpec="*.zip") returned 0 [0142.844] lstrlenA (lpString="*.zip") returned 5 [0142.844] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\ba182bcd131f1f3c6b6fbbb1ba078341.png", pszSpec="*.rar") returned 0 [0142.844] lstrlenA (lpString="*.rar") returned 5 [0142.844] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\ba182bcd131f1f3c6b6fbbb1ba078341.png", pszSpec="*.7z") returned 0 [0142.844] lstrlenA (lpString="*.7z") returned 4 [0142.844] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\ba182bcd131f1f3c6b6fbbb1ba078341.png", pszSpec="*.tar") returned 0 [0142.844] lstrlenA (lpString="*.tar") returned 5 [0142.844] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\ba182bcd131f1f3c6b6fbbb1ba078341.png", pszSpec="*.gzip") returned 0 [0142.844] lstrlenA (lpString="*.gzip") returned 6 [0142.844] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\ba182bcd131f1f3c6b6fbbb1ba078341.png", pszSpec="*.jpg") returned 0 [0142.844] lstrlenA (lpString="*.jpg") returned 5 [0142.844] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\ba182bcd131f1f3c6b6fbbb1ba078341.png", pszSpec="*.jpeg") returned 0 [0142.844] lstrlenA (lpString="*.jpeg") returned 6 [0142.844] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\ba182bcd131f1f3c6b6fbbb1ba078341.png", pszSpec="*.psd") returned 0 [0142.844] lstrlenA (lpString="*.psd") returned 5 [0142.844] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\ba182bcd131f1f3c6b6fbbb1ba078341.png", pszSpec="*.cdr") returned 0 [0142.844] lstrlenA (lpString="*.cdr") returned 5 [0142.844] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\ba182bcd131f1f3c6b6fbbb1ba078341.png", pszSpec="*.dwg") returned 0 [0142.844] lstrlenA (lpString="*.dwg") returned 5 [0142.844] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\ba182bcd131f1f3c6b6fbbb1ba078341.png", pszSpec="*.max") returned 0 [0142.844] lstrlenA (lpString="*.max") returned 5 [0142.844] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\ba182bcd131f1f3c6b6fbbb1ba078341.png", pszSpec="*.bmp") returned 0 [0142.844] lstrlenA (lpString="*.bmp") returned 5 [0142.844] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\ba182bcd131f1f3c6b6fbbb1ba078341.png", pszSpec="*.gif") returned 0 [0142.844] lstrlenA (lpString="*.gif") returned 5 [0142.844] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\ba182bcd131f1f3c6b6fbbb1ba078341.png", pszSpec="*.png") returned 1 [0142.844] lstrlenA (lpString="*.png") returned 5 [0142.844] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\ba182bcd131f1f3c6b6fbbb1ba078341.png" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\ba182bcd131f1f3c6b6fbbb1ba078341.png") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\ba182bcd131f1f3c6b6fbbb1ba078341.png" [0142.844] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\ba182bcd131f1f3c6b6fbbb1ba078341.png" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\ba182bcd131f1f3c6b6fbbb1ba078341.png") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\ba182bcd131f1f3c6b6fbbb1ba078341.png" [0142.844] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\ba182bcd131f1f3c6b6fbbb1ba078341.png", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\ba182bcd131f1f3c6b6fbbb1ba078341.png.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\ba182bcd131f1f3c6b6fbbb1ba078341.png." [0142.844] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\ba182bcd131f1f3c6b6fbbb1ba078341.png.", lpString2="\xa0" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\ba182bcd131f1f3c6b6fbbb1ba078341.png. ") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\ba182bcd131f1f3c6b6fbbb1ba078341.png. " [0142.844] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\ba182bcd131f1f3c6b6fbbb1ba078341.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\thumbnails\\ba182bcd131f1f3c6b6fbbb1ba078341.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0 [0142.845] GetFileSize (in: hFile=0xa0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x40b0 [0142.845] GetFileTime (in: hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x83ce6bb0, dwHighDateTime=0x1d2e627), lpLastAccessTime=0x407536*(dwLowDateTime=0x83ce6bb0, dwHighDateTime=0x1d2e627), lpLastWriteTime=0x40753e*(dwLowDateTime=0x83ce6bb0, dwHighDateTime=0x1d2e627)) returned 1 [0142.845] SetFilePointer (in: hFile=0xa0, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0142.845] ReadFile (in: hFile=0xa0, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x4056, lpOverlapped=0x0) returned 1 [0142.867] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\ba182bcd131f1f3c6b6fbbb1ba078341.png") returned="ba182bcd131f1f3c6b6fbbb1ba078341.png" [0142.867] SetFilePointer (in: hFile=0xa0, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0142.868] WriteFile (in: hFile=0xa0, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x4056, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x4056, lpOverlapped=0x0) returned 1 [0142.868] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0142.868] CloseHandle (hObject=0xa0) returned 1 [0142.869] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\ba182bcd131f1f3c6b6fbbb1ba078341.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\thumbnails\\ba182bcd131f1f3c6b6fbbb1ba078341.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\ba182bcd131f1f3c6b6fbbb1ba078341.png. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\thumbnails\\ba182bcd131f1f3c6b6fbbb1ba078341.png. ")) returned 1 [0142.870] FindNextFileA (in: hFindFile=0x5be360, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 1 [0142.870] PeekMessageA (in: lpMsg=0xaeb94, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaeb94) returned 0 [0142.870] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="ce8c0453589216a67cddb50284fbfe8d.png") returned 1 [0142.870] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ce8c0453589216a67cddb50284fbfe8d.png") returned 1 [0142.870] lstrcmpiA (lpString1="", lpString2="ce8c0453589216a67cddb50284fbfe8d.png") returned -1 [0142.870] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\ba182bcd131f1f3c6b6fbbb1ba078341.png") returned="ba182bcd131f1f3c6b6fbbb1ba078341.png" [0142.870] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\", lpString2="ce8c0453589216a67cddb50284fbfe8d.png" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\ce8c0453589216a67cddb50284fbfe8d.png") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\ce8c0453589216a67cddb50284fbfe8d.png" [0142.870] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\ce8c0453589216a67cddb50284fbfe8d.png", pszSpec="*.zip") returned 0 [0142.870] lstrlenA (lpString="*.zip") returned 5 [0142.870] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\ce8c0453589216a67cddb50284fbfe8d.png", pszSpec="*.rar") returned 0 [0142.870] lstrlenA (lpString="*.rar") returned 5 [0142.870] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\ce8c0453589216a67cddb50284fbfe8d.png", pszSpec="*.7z") returned 0 [0142.870] lstrlenA (lpString="*.7z") returned 4 [0142.870] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\ce8c0453589216a67cddb50284fbfe8d.png", pszSpec="*.tar") returned 0 [0142.870] lstrlenA (lpString="*.tar") returned 5 [0142.870] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\ce8c0453589216a67cddb50284fbfe8d.png", pszSpec="*.gzip") returned 0 [0142.870] lstrlenA (lpString="*.gzip") returned 6 [0142.870] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\ce8c0453589216a67cddb50284fbfe8d.png", pszSpec="*.jpg") returned 0 [0142.870] lstrlenA (lpString="*.jpg") returned 5 [0142.870] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\ce8c0453589216a67cddb50284fbfe8d.png", pszSpec="*.jpeg") returned 0 [0142.870] lstrlenA (lpString="*.jpeg") returned 6 [0142.870] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\ce8c0453589216a67cddb50284fbfe8d.png", pszSpec="*.psd") returned 0 [0142.870] lstrlenA (lpString="*.psd") returned 5 [0142.870] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\ce8c0453589216a67cddb50284fbfe8d.png", pszSpec="*.cdr") returned 0 [0142.870] lstrlenA (lpString="*.cdr") returned 5 [0142.871] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\ce8c0453589216a67cddb50284fbfe8d.png", pszSpec="*.dwg") returned 0 [0142.871] lstrlenA (lpString="*.dwg") returned 5 [0142.871] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\ce8c0453589216a67cddb50284fbfe8d.png", pszSpec="*.max") returned 0 [0142.871] lstrlenA (lpString="*.max") returned 5 [0142.871] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\ce8c0453589216a67cddb50284fbfe8d.png", pszSpec="*.bmp") returned 0 [0142.871] lstrlenA (lpString="*.bmp") returned 5 [0142.871] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\ce8c0453589216a67cddb50284fbfe8d.png", pszSpec="*.gif") returned 0 [0142.871] lstrlenA (lpString="*.gif") returned 5 [0142.871] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\ce8c0453589216a67cddb50284fbfe8d.png", pszSpec="*.png") returned 1 [0142.871] lstrlenA (lpString="*.png") returned 5 [0142.871] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\ce8c0453589216a67cddb50284fbfe8d.png" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\ce8c0453589216a67cddb50284fbfe8d.png") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\ce8c0453589216a67cddb50284fbfe8d.png" [0142.871] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\ce8c0453589216a67cddb50284fbfe8d.png" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\ce8c0453589216a67cddb50284fbfe8d.png") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\ce8c0453589216a67cddb50284fbfe8d.png" [0142.871] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\ce8c0453589216a67cddb50284fbfe8d.png", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\ce8c0453589216a67cddb50284fbfe8d.png.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\ce8c0453589216a67cddb50284fbfe8d.png." [0142.871] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\ce8c0453589216a67cddb50284fbfe8d.png.", lpString2="\xa0" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\ce8c0453589216a67cddb50284fbfe8d.png. ") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\ce8c0453589216a67cddb50284fbfe8d.png. " [0142.871] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\ce8c0453589216a67cddb50284fbfe8d.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\thumbnails\\ce8c0453589216a67cddb50284fbfe8d.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa0 [0142.872] GetFileSize (in: hFile=0xa0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1c362 [0142.872] GetFileTime (in: hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xb97ade50, dwHighDateTime=0x1d2dda4), lpLastAccessTime=0x407536*(dwLowDateTime=0xb97ade50, dwHighDateTime=0x1d2dda4), lpLastWriteTime=0x40753e*(dwLowDateTime=0xb97ade50, dwHighDateTime=0x1d2dda4)) returned 1 [0142.872] SetFilePointer (in: hFile=0xa0, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0142.872] ReadFile (in: hFile=0xa0, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x1c308, lpOverlapped=0x0) returned 1 [0142.901] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\ce8c0453589216a67cddb50284fbfe8d.png") returned="ce8c0453589216a67cddb50284fbfe8d.png" [0142.902] SetFilePointer (in: hFile=0xa0, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0142.902] WriteFile (in: hFile=0xa0, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x1c308, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x1c308, lpOverlapped=0x0) returned 1 [0142.902] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0142.902] CloseHandle (hObject=0xa0) returned 1 [0142.902] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\ce8c0453589216a67cddb50284fbfe8d.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\thumbnails\\ce8c0453589216a67cddb50284fbfe8d.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\ce8c0453589216a67cddb50284fbfe8d.png. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\thumbnails\\ce8c0453589216a67cddb50284fbfe8d.png. ")) returned 1 [0142.903] FindNextFileA (in: hFindFile=0x5be360, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 0 [0142.903] FindClose (in: hFindFile=0x5be360 | out: hFindFile=0x5be360) returned 1 [0142.903] FindNextFileA (in: hFindFile=0x5be320, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0142.903] PeekMessageA (in: lpMsg=0xaece4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaece4) returned 0 [0142.903] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="_CACHE_CLEAN_") returned 1 [0142.903] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="_CACHE_CLEAN_") returned 1 [0142.903] lstrcmpiA (lpString1="", lpString2="_CACHE_CLEAN_") returned -1 [0142.903] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\*.*") returned="*.*" [0142.903] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\", lpString2="_CACHE_CLEAN_" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\_CACHE_CLEAN_") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\_CACHE_CLEAN_" [0142.903] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\_CACHE_CLEAN_", pszSpec="*.zip") returned 0 [0142.903] lstrlenA (lpString="*.zip") returned 5 [0142.903] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\_CACHE_CLEAN_", pszSpec="*.rar") returned 0 [0142.903] lstrlenA (lpString="*.rar") returned 5 [0142.903] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\_CACHE_CLEAN_", pszSpec="*.7z") returned 0 [0142.903] lstrlenA (lpString="*.7z") returned 4 [0142.903] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\_CACHE_CLEAN_", pszSpec="*.tar") returned 0 [0142.904] lstrlenA (lpString="*.tar") returned 5 [0142.904] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\_CACHE_CLEAN_", pszSpec="*.gzip") returned 0 [0142.904] lstrlenA (lpString="*.gzip") returned 6 [0142.904] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\_CACHE_CLEAN_", pszSpec="*.jpg") returned 0 [0142.904] lstrlenA (lpString="*.jpg") returned 5 [0142.904] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\_CACHE_CLEAN_", pszSpec="*.jpeg") returned 0 [0142.904] lstrlenA (lpString="*.jpeg") returned 6 [0142.904] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\_CACHE_CLEAN_", pszSpec="*.psd") returned 0 [0142.904] lstrlenA (lpString="*.psd") returned 5 [0142.904] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\_CACHE_CLEAN_", pszSpec="*.cdr") returned 0 [0142.904] lstrlenA (lpString="*.cdr") returned 5 [0142.904] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\_CACHE_CLEAN_", pszSpec="*.dwg") returned 0 [0142.904] lstrlenA (lpString="*.dwg") returned 5 [0142.904] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\_CACHE_CLEAN_", pszSpec="*.max") returned 0 [0142.904] lstrlenA (lpString="*.max") returned 5 [0142.904] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\_CACHE_CLEAN_", pszSpec="*.bmp") returned 0 [0142.904] lstrlenA (lpString="*.bmp") returned 5 [0142.904] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\_CACHE_CLEAN_", pszSpec="*.gif") returned 0 [0142.904] lstrlenA (lpString="*.gif") returned 5 [0142.904] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\_CACHE_CLEAN_", pszSpec="*.png") returned 0 [0142.904] lstrlenA (lpString="*.png") returned 5 [0142.904] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\_CACHE_CLEAN_", pszSpec="*.doc") returned 0 [0142.904] lstrlenA (lpString="*.doc") returned 5 [0142.904] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\_CACHE_CLEAN_", pszSpec="*.docx") returned 0 [0142.904] lstrlenA (lpString="*.docx") returned 6 [0142.904] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\_CACHE_CLEAN_", pszSpec="*.xls") returned 0 [0142.904] lstrlenA (lpString="*.xls") returned 5 [0142.904] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\_CACHE_CLEAN_", pszSpec="*.xlsx") returned 0 [0142.904] lstrlenA (lpString="*.xlsx") returned 6 [0142.904] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\_CACHE_CLEAN_", pszSpec="*.ppt") returned 0 [0142.904] lstrlenA (lpString="*.ppt") returned 5 [0142.904] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\_CACHE_CLEAN_", pszSpec="*.pptx") returned 0 [0142.904] lstrlenA (lpString="*.pptx") returned 6 [0142.904] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\_CACHE_CLEAN_", pszSpec="*.txt") returned 0 [0142.904] lstrlenA (lpString="*.txt") returned 5 [0142.904] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\_CACHE_CLEAN_", pszSpec="*.pdf") returned 0 [0142.904] lstrlenA (lpString="*.pdf") returned 5 [0142.904] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\_CACHE_CLEAN_", pszSpec="*.djvu") returned 0 [0142.904] lstrlenA (lpString="*.djvu") returned 6 [0142.904] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\_CACHE_CLEAN_", pszSpec="*.htm") returned 0 [0142.904] lstrlenA (lpString="*.htm") returned 5 [0142.904] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\_CACHE_CLEAN_", pszSpec="*.html") returned 0 [0142.904] lstrlenA (lpString="*.html") returned 6 [0142.904] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\_CACHE_CLEAN_", pszSpec="*.mdb") returned 0 [0142.904] lstrlenA (lpString="*.mdb") returned 5 [0142.904] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\_CACHE_CLEAN_", pszSpec="*.cer") returned 0 [0142.904] lstrlenA (lpString="*.cer") returned 5 [0142.904] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\_CACHE_CLEAN_", pszSpec="*.p12") returned 0 [0142.904] lstrlenA (lpString="*.p12") returned 5 [0142.904] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\_CACHE_CLEAN_", pszSpec="*.pfx") returned 0 [0142.904] lstrlenA (lpString="*.pfx") returned 5 [0142.905] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\_CACHE_CLEAN_", pszSpec="*.kwm") returned 0 [0142.905] lstrlenA (lpString="*.kwm") returned 5 [0142.905] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\_CACHE_CLEAN_", pszSpec="*.pwm") returned 0 [0142.905] lstrlenA (lpString="*.pwm") returned 5 [0142.905] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\_CACHE_CLEAN_", pszSpec="*.1cd") returned 0 [0142.905] lstrlenA (lpString="*.1cd") returned 5 [0142.905] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\_CACHE_CLEAN_", pszSpec="*.md") returned 0 [0142.905] lstrlenA (lpString="*.md") returned 4 [0142.905] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\_CACHE_CLEAN_", pszSpec="*.mdf") returned 0 [0142.905] lstrlenA (lpString="*.mdf") returned 5 [0142.905] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\_CACHE_CLEAN_", pszSpec="*.dbf") returned 0 [0142.905] lstrlenA (lpString="*.dbf") returned 5 [0142.905] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\_CACHE_CLEAN_", pszSpec="*.odt") returned 0 [0142.905] lstrlenA (lpString="*.odt") returned 5 [0142.905] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\_CACHE_CLEAN_", pszSpec="*.vob") returned 0 [0142.905] lstrlenA (lpString="*.vob") returned 5 [0142.905] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\_CACHE_CLEAN_", pszSpec="*.ifo") returned 0 [0142.905] lstrlenA (lpString="*.ifo") returned 5 [0142.905] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\_CACHE_CLEAN_", pszSpec="*.lnk") returned 0 [0142.905] lstrlenA (lpString="*.lnk") returned 5 [0142.905] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\_CACHE_CLEAN_", pszSpec="*.torrent") returned 0 [0142.905] lstrlenA (lpString="*.torrent") returned 9 [0142.905] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\_CACHE_CLEAN_", pszSpec="*.mov") returned 0 [0142.905] lstrlenA (lpString="*.mov") returned 5 [0142.905] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\_CACHE_CLEAN_", pszSpec="*.m2v") returned 0 [0142.905] lstrlenA (lpString="*.m2v") returned 5 [0142.905] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\_CACHE_CLEAN_", pszSpec="*.3gp") returned 0 [0142.905] lstrlenA (lpString="*.3gp") returned 5 [0142.905] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\_CACHE_CLEAN_", pszSpec="*.mpeg") returned 0 [0142.905] lstrlenA (lpString="*.mpeg") returned 6 [0142.905] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\_CACHE_CLEAN_", pszSpec="*.mpg") returned 0 [0142.905] lstrlenA (lpString="*.mpg") returned 5 [0142.905] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\_CACHE_CLEAN_", pszSpec="*.flv") returned 0 [0142.905] lstrlenA (lpString="*.flv") returned 5 [0142.905] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\_CACHE_CLEAN_", pszSpec="*.avi") returned 0 [0142.905] lstrlenA (lpString="*.avi") returned 5 [0142.905] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\_CACHE_CLEAN_", pszSpec="*.mp4") returned 0 [0142.905] lstrlenA (lpString="*.mp4") returned 5 [0142.905] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\_CACHE_CLEAN_", pszSpec="*.wmv") returned 0 [0142.905] lstrlenA (lpString="*.wmv") returned 5 [0142.905] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\_CACHE_CLEAN_", pszSpec="*.divx") returned 0 [0142.905] lstrlenA (lpString="*.divx") returned 6 [0142.905] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\_CACHE_CLEAN_", pszSpec="*.mkv") returned 0 [0142.905] lstrlenA (lpString="*.mkv") returned 5 [0142.905] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\_CACHE_CLEAN_", pszSpec="*.mp3") returned 0 [0142.905] lstrlenA (lpString="*.mp3") returned 5 [0142.905] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\_CACHE_CLEAN_", pszSpec="*.wav") returned 0 [0142.905] lstrlenA (lpString="*.wav") returned 5 [0142.905] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\_CACHE_CLEAN_", pszSpec="*.flac") returned 0 [0142.905] lstrlenA (lpString="*.flac") returned 6 [0142.906] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\_CACHE_CLEAN_", pszSpec="*.ape") returned 0 [0142.906] lstrlenA (lpString="*.ape") returned 5 [0142.906] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\_CACHE_CLEAN_", pszSpec="*.wma") returned 0 [0142.906] lstrlenA (lpString="*.wma") returned 5 [0142.906] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\_CACHE_CLEAN_", pszSpec="*.ac3") returned 0 [0142.906] lstrlenA (lpString="*.ac3") returned 5 [0142.906] FindNextFileA (in: hFindFile=0x5be320, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 0 [0142.906] FindClose (in: hFindFile=0x5be320 | out: hFindFile=0x5be320) returned 1 [0142.906] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 0 [0142.906] FindClose (in: hFindFile=0x5be2e0 | out: hFindFile=0x5be2e0) returned 1 [0142.906] FindNextFileA (in: hFindFile=0x5be2a0, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0 [0142.906] FindClose (in: hFindFile=0x5be2a0 | out: hFindFile=0x5be2a0) returned 1 [0142.906] FindNextFileA (in: hFindFile=0x5be260, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0142.906] lstrcmpA (lpString1=".", lpString2="updates") returned -1 [0142.906] lstrcmpA (lpString1="..", lpString2="updates") returned -1 [0142.906] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\*.*") returned="*.*" [0142.906] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\", lpString2="updates" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates" [0142.906] lstrlenA (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates") returned 59 [0142.906] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0142.906] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0142.906] FindNextFileA (in: hFindFile=0x5be2a0, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0142.906] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0142.906] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0142.906] FindNextFileA (in: hFindFile=0x5be2a0, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0142.906] lstrcmpA (lpString1=".", lpString2="E7CF176E110C211B") returned -1 [0142.906] lstrcmpA (lpString1="..", lpString2="E7CF176E110C211B") returned -1 [0142.906] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\*.*") returned="*.*" [0142.906] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\", lpString2="E7CF176E110C211B" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B" [0142.906] lstrlenA (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B") returned 76 [0142.906] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\*.*", lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 0x5be2e0 [0142.908] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0142.908] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0142.908] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0142.908] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0142.908] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0142.908] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0142.908] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="active-update.xml") returned 1 [0142.908] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="active-update.xml") returned 1 [0142.908] lstrcmpiA (lpString1="", lpString2="active-update.xml") returned -1 [0142.908] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\*.*") returned="*.*" [0142.908] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\", lpString2="active-update.xml" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\active-update.xml") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\active-update.xml" [0142.908] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\active-update.xml", pszSpec="*.zip") returned 0 [0142.908] lstrlenA (lpString="*.zip") returned 5 [0142.908] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\active-update.xml", pszSpec="*.rar") returned 0 [0142.908] lstrlenA (lpString="*.rar") returned 5 [0142.908] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\active-update.xml", pszSpec="*.7z") returned 0 [0142.908] lstrlenA (lpString="*.7z") returned 4 [0142.908] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\active-update.xml", pszSpec="*.tar") returned 0 [0142.908] lstrlenA (lpString="*.tar") returned 5 [0142.908] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\active-update.xml", pszSpec="*.gzip") returned 0 [0142.908] lstrlenA (lpString="*.gzip") returned 6 [0142.908] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\active-update.xml", pszSpec="*.jpg") returned 0 [0142.908] lstrlenA (lpString="*.jpg") returned 5 [0142.908] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\active-update.xml", pszSpec="*.jpeg") returned 0 [0142.908] lstrlenA (lpString="*.jpeg") returned 6 [0142.909] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\active-update.xml", pszSpec="*.psd") returned 0 [0142.909] lstrlenA (lpString="*.psd") returned 5 [0142.909] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\active-update.xml", pszSpec="*.cdr") returned 0 [0142.909] lstrlenA (lpString="*.cdr") returned 5 [0142.909] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\active-update.xml", pszSpec="*.dwg") returned 0 [0142.909] lstrlenA (lpString="*.dwg") returned 5 [0142.909] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\active-update.xml", pszSpec="*.max") returned 0 [0142.909] lstrlenA (lpString="*.max") returned 5 [0142.909] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\active-update.xml", pszSpec="*.bmp") returned 0 [0142.909] lstrlenA (lpString="*.bmp") returned 5 [0142.909] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\active-update.xml", pszSpec="*.gif") returned 0 [0142.909] lstrlenA (lpString="*.gif") returned 5 [0142.909] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\active-update.xml", pszSpec="*.png") returned 0 [0142.909] lstrlenA (lpString="*.png") returned 5 [0142.909] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\active-update.xml", pszSpec="*.doc") returned 0 [0142.909] lstrlenA (lpString="*.doc") returned 5 [0142.909] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\active-update.xml", pszSpec="*.docx") returned 0 [0142.909] lstrlenA (lpString="*.docx") returned 6 [0142.909] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\active-update.xml", pszSpec="*.xls") returned 0 [0142.909] lstrlenA (lpString="*.xls") returned 5 [0142.909] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\active-update.xml", pszSpec="*.xlsx") returned 0 [0142.909] lstrlenA (lpString="*.xlsx") returned 6 [0142.909] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\active-update.xml", pszSpec="*.ppt") returned 0 [0142.909] lstrlenA (lpString="*.ppt") returned 5 [0142.909] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\active-update.xml", pszSpec="*.pptx") returned 0 [0142.909] lstrlenA (lpString="*.pptx") returned 6 [0142.909] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\active-update.xml", pszSpec="*.txt") returned 0 [0142.909] lstrlenA (lpString="*.txt") returned 5 [0142.909] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\active-update.xml", pszSpec="*.pdf") returned 0 [0142.909] lstrlenA (lpString="*.pdf") returned 5 [0142.909] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\active-update.xml", pszSpec="*.djvu") returned 0 [0142.909] lstrlenA (lpString="*.djvu") returned 6 [0142.909] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\active-update.xml", pszSpec="*.htm") returned 0 [0142.909] lstrlenA (lpString="*.htm") returned 5 [0142.909] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\active-update.xml", pszSpec="*.html") returned 0 [0142.909] lstrlenA (lpString="*.html") returned 6 [0142.909] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\active-update.xml", pszSpec="*.mdb") returned 0 [0142.909] lstrlenA (lpString="*.mdb") returned 5 [0142.909] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\active-update.xml", pszSpec="*.cer") returned 0 [0142.909] lstrlenA (lpString="*.cer") returned 5 [0142.909] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\active-update.xml", pszSpec="*.p12") returned 0 [0142.909] lstrlenA (lpString="*.p12") returned 5 [0142.909] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\active-update.xml", pszSpec="*.pfx") returned 0 [0142.909] lstrlenA (lpString="*.pfx") returned 5 [0142.909] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\active-update.xml", pszSpec="*.kwm") returned 0 [0142.909] lstrlenA (lpString="*.kwm") returned 5 [0142.909] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\active-update.xml", pszSpec="*.pwm") returned 0 [0142.909] lstrlenA (lpString="*.pwm") returned 5 [0142.909] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\active-update.xml", pszSpec="*.1cd") returned 0 [0142.909] lstrlenA (lpString="*.1cd") returned 5 [0142.910] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\active-update.xml", pszSpec="*.md") returned 0 [0142.910] lstrlenA (lpString="*.md") returned 4 [0142.910] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\active-update.xml", pszSpec="*.mdf") returned 0 [0142.910] lstrlenA (lpString="*.mdf") returned 5 [0142.910] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\active-update.xml", pszSpec="*.dbf") returned 0 [0142.910] lstrlenA (lpString="*.dbf") returned 5 [0142.910] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\active-update.xml", pszSpec="*.odt") returned 0 [0142.910] lstrlenA (lpString="*.odt") returned 5 [0142.910] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\active-update.xml", pszSpec="*.vob") returned 0 [0142.910] lstrlenA (lpString="*.vob") returned 5 [0142.910] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\active-update.xml", pszSpec="*.ifo") returned 0 [0142.910] lstrlenA (lpString="*.ifo") returned 5 [0142.910] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\active-update.xml", pszSpec="*.lnk") returned 0 [0142.910] lstrlenA (lpString="*.lnk") returned 5 [0142.910] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\active-update.xml", pszSpec="*.torrent") returned 0 [0142.910] lstrlenA (lpString="*.torrent") returned 9 [0142.910] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\active-update.xml", pszSpec="*.mov") returned 0 [0142.910] lstrlenA (lpString="*.mov") returned 5 [0142.910] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\active-update.xml", pszSpec="*.m2v") returned 0 [0142.910] lstrlenA (lpString="*.m2v") returned 5 [0142.910] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\active-update.xml", pszSpec="*.3gp") returned 0 [0142.910] lstrlenA (lpString="*.3gp") returned 5 [0142.910] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\active-update.xml", pszSpec="*.mpeg") returned 0 [0142.910] lstrlenA (lpString="*.mpeg") returned 6 [0142.910] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\active-update.xml", pszSpec="*.mpg") returned 0 [0142.910] lstrlenA (lpString="*.mpg") returned 5 [0142.910] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\active-update.xml", pszSpec="*.flv") returned 0 [0142.910] lstrlenA (lpString="*.flv") returned 5 [0142.910] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\active-update.xml", pszSpec="*.avi") returned 0 [0142.910] lstrlenA (lpString="*.avi") returned 5 [0142.910] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\active-update.xml", pszSpec="*.mp4") returned 0 [0142.910] lstrlenA (lpString="*.mp4") returned 5 [0142.910] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\active-update.xml", pszSpec="*.wmv") returned 0 [0142.910] lstrlenA (lpString="*.wmv") returned 5 [0142.910] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\active-update.xml", pszSpec="*.divx") returned 0 [0142.910] lstrlenA (lpString="*.divx") returned 6 [0142.910] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\active-update.xml", pszSpec="*.mkv") returned 0 [0142.910] lstrlenA (lpString="*.mkv") returned 5 [0142.910] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\active-update.xml", pszSpec="*.mp3") returned 0 [0142.910] lstrlenA (lpString="*.mp3") returned 5 [0142.910] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\active-update.xml", pszSpec="*.wav") returned 0 [0142.910] lstrlenA (lpString="*.wav") returned 5 [0142.910] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\active-update.xml", pszSpec="*.flac") returned 0 [0142.910] lstrlenA (lpString="*.flac") returned 6 [0142.910] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\active-update.xml", pszSpec="*.ape") returned 0 [0142.910] lstrlenA (lpString="*.ape") returned 5 [0142.910] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\active-update.xml", pszSpec="*.wma") returned 0 [0142.910] lstrlenA (lpString="*.wma") returned 5 [0142.910] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\active-update.xml", pszSpec="*.ac3") returned 0 [0142.910] lstrlenA (lpString="*.ac3") returned 5 [0142.910] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0142.911] lstrcmpA (lpString1=".", lpString2="updates") returned -1 [0142.911] lstrcmpA (lpString1="..", lpString2="updates") returned -1 [0142.911] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\active-update.xml") returned="active-update.xml" [0142.911] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\", lpString2="updates" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates" [0142.911] lstrlenA (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates") returned 84 [0142.911] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\*.*", lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 0x5be320 [0142.913] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0142.913] FindNextFileA (in: hFindFile=0x5be320, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0142.913] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0142.913] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0142.913] FindNextFileA (in: hFindFile=0x5be320, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0142.913] lstrcmpA (lpString1=".", lpString2="0") returned -1 [0142.913] lstrcmpA (lpString1="..", lpString2="0") returned -1 [0142.913] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\*.*") returned="*.*" [0142.913] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\", lpString2="0" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0" [0142.913] lstrlenA (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0") returned 86 [0142.913] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\*.*", lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 0x5be360 [0142.913] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0142.913] FindNextFileA (in: hFindFile=0x5be360, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 1 [0142.913] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0142.913] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0142.913] FindNextFileA (in: hFindFile=0x5be360, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 1 [0142.913] PeekMessageA (in: lpMsg=0xaeb94, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaeb94) returned 0 [0142.913] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="update.mar") returned -1 [0142.913] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="update.mar") returned -1 [0142.913] lstrcmpiA (lpString1="", lpString2="update.mar") returned -1 [0142.913] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\*.*") returned="*.*" [0142.913] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\", lpString2="update.mar" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\update.mar") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\update.mar" [0142.913] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\update.mar", pszSpec="*.zip") returned 0 [0142.913] lstrlenA (lpString="*.zip") returned 5 [0142.913] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\update.mar", pszSpec="*.rar") returned 0 [0142.913] lstrlenA (lpString="*.rar") returned 5 [0142.913] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\update.mar", pszSpec="*.7z") returned 0 [0142.913] lstrlenA (lpString="*.7z") returned 4 [0142.913] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\update.mar", pszSpec="*.tar") returned 0 [0142.913] lstrlenA (lpString="*.tar") returned 5 [0142.913] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\update.mar", pszSpec="*.gzip") returned 0 [0142.913] lstrlenA (lpString="*.gzip") returned 6 [0142.913] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\update.mar", pszSpec="*.jpg") returned 0 [0142.913] lstrlenA (lpString="*.jpg") returned 5 [0142.913] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\update.mar", pszSpec="*.jpeg") returned 0 [0142.913] lstrlenA (lpString="*.jpeg") returned 6 [0142.913] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\update.mar", pszSpec="*.psd") returned 0 [0142.914] lstrlenA (lpString="*.psd") returned 5 [0142.914] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\update.mar", pszSpec="*.cdr") returned 0 [0142.914] lstrlenA (lpString="*.cdr") returned 5 [0142.914] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\update.mar", pszSpec="*.dwg") returned 0 [0142.914] lstrlenA (lpString="*.dwg") returned 5 [0142.914] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\update.mar", pszSpec="*.max") returned 0 [0142.914] lstrlenA (lpString="*.max") returned 5 [0142.914] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\update.mar", pszSpec="*.bmp") returned 0 [0142.914] lstrlenA (lpString="*.bmp") returned 5 [0142.914] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\update.mar", pszSpec="*.gif") returned 0 [0142.914] lstrlenA (lpString="*.gif") returned 5 [0142.914] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\update.mar", pszSpec="*.png") returned 0 [0142.914] lstrlenA (lpString="*.png") returned 5 [0142.914] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\update.mar", pszSpec="*.doc") returned 0 [0142.914] lstrlenA (lpString="*.doc") returned 5 [0142.914] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\update.mar", pszSpec="*.docx") returned 0 [0142.914] lstrlenA (lpString="*.docx") returned 6 [0142.914] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\update.mar", pszSpec="*.xls") returned 0 [0142.914] lstrlenA (lpString="*.xls") returned 5 [0142.914] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\update.mar", pszSpec="*.xlsx") returned 0 [0142.914] lstrlenA (lpString="*.xlsx") returned 6 [0142.914] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\update.mar", pszSpec="*.ppt") returned 0 [0142.914] lstrlenA (lpString="*.ppt") returned 5 [0142.914] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\update.mar", pszSpec="*.pptx") returned 0 [0142.914] lstrlenA (lpString="*.pptx") returned 6 [0142.914] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\update.mar", pszSpec="*.txt") returned 0 [0142.914] lstrlenA (lpString="*.txt") returned 5 [0142.914] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\update.mar", pszSpec="*.pdf") returned 0 [0142.914] lstrlenA (lpString="*.pdf") returned 5 [0142.914] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\update.mar", pszSpec="*.djvu") returned 0 [0142.914] lstrlenA (lpString="*.djvu") returned 6 [0142.914] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\update.mar", pszSpec="*.htm") returned 0 [0142.914] lstrlenA (lpString="*.htm") returned 5 [0142.914] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\update.mar", pszSpec="*.html") returned 0 [0142.914] lstrlenA (lpString="*.html") returned 6 [0142.914] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\update.mar", pszSpec="*.mdb") returned 0 [0142.914] lstrlenA (lpString="*.mdb") returned 5 [0142.914] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\update.mar", pszSpec="*.cer") returned 0 [0142.914] lstrlenA (lpString="*.cer") returned 5 [0142.914] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\update.mar", pszSpec="*.p12") returned 0 [0142.914] lstrlenA (lpString="*.p12") returned 5 [0142.914] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\update.mar", pszSpec="*.pfx") returned 0 [0142.914] lstrlenA (lpString="*.pfx") returned 5 [0142.914] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\update.mar", pszSpec="*.kwm") returned 0 [0142.914] lstrlenA (lpString="*.kwm") returned 5 [0142.914] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\update.mar", pszSpec="*.pwm") returned 0 [0142.914] lstrlenA (lpString="*.pwm") returned 5 [0142.914] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\update.mar", pszSpec="*.1cd") returned 0 [0142.914] lstrlenA (lpString="*.1cd") returned 5 [0142.914] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\update.mar", pszSpec="*.md") returned 0 [0142.915] lstrlenA (lpString="*.md") returned 4 [0142.915] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\update.mar", pszSpec="*.mdf") returned 0 [0142.915] lstrlenA (lpString="*.mdf") returned 5 [0142.915] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\update.mar", pszSpec="*.dbf") returned 0 [0142.915] lstrlenA (lpString="*.dbf") returned 5 [0142.915] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\update.mar", pszSpec="*.odt") returned 0 [0142.915] lstrlenA (lpString="*.odt") returned 5 [0142.915] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\update.mar", pszSpec="*.vob") returned 0 [0142.915] lstrlenA (lpString="*.vob") returned 5 [0142.915] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\update.mar", pszSpec="*.ifo") returned 0 [0142.915] lstrlenA (lpString="*.ifo") returned 5 [0142.915] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\update.mar", pszSpec="*.lnk") returned 0 [0142.915] lstrlenA (lpString="*.lnk") returned 5 [0142.915] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\update.mar", pszSpec="*.torrent") returned 0 [0142.915] lstrlenA (lpString="*.torrent") returned 9 [0142.915] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\update.mar", pszSpec="*.mov") returned 0 [0142.915] lstrlenA (lpString="*.mov") returned 5 [0142.915] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\update.mar", pszSpec="*.m2v") returned 0 [0142.915] lstrlenA (lpString="*.m2v") returned 5 [0142.915] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\update.mar", pszSpec="*.3gp") returned 0 [0142.915] lstrlenA (lpString="*.3gp") returned 5 [0142.915] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\update.mar", pszSpec="*.mpeg") returned 0 [0142.915] lstrlenA (lpString="*.mpeg") returned 6 [0142.915] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\update.mar", pszSpec="*.mpg") returned 0 [0142.915] lstrlenA (lpString="*.mpg") returned 5 [0142.915] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\update.mar", pszSpec="*.flv") returned 0 [0142.915] lstrlenA (lpString="*.flv") returned 5 [0142.915] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\update.mar", pszSpec="*.avi") returned 0 [0142.915] lstrlenA (lpString="*.avi") returned 5 [0142.915] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\update.mar", pszSpec="*.mp4") returned 0 [0142.915] lstrlenA (lpString="*.mp4") returned 5 [0142.915] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\update.mar", pszSpec="*.wmv") returned 0 [0142.915] lstrlenA (lpString="*.wmv") returned 5 [0142.915] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\update.mar", pszSpec="*.divx") returned 0 [0142.915] lstrlenA (lpString="*.divx") returned 6 [0142.915] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\update.mar", pszSpec="*.mkv") returned 0 [0142.915] lstrlenA (lpString="*.mkv") returned 5 [0142.915] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\update.mar", pszSpec="*.mp3") returned 0 [0142.915] lstrlenA (lpString="*.mp3") returned 5 [0142.915] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\update.mar", pszSpec="*.wav") returned 0 [0142.915] lstrlenA (lpString="*.wav") returned 5 [0142.915] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\update.mar", pszSpec="*.flac") returned 0 [0142.915] lstrlenA (lpString="*.flac") returned 6 [0142.915] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\update.mar", pszSpec="*.ape") returned 0 [0142.915] lstrlenA (lpString="*.ape") returned 5 [0142.915] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\update.mar", pszSpec="*.wma") returned 0 [0142.915] lstrlenA (lpString="*.wma") returned 5 [0142.915] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\update.mar", pszSpec="*.ac3") returned 0 [0142.915] lstrlenA (lpString="*.ac3") returned 5 [0142.915] FindNextFileA (in: hFindFile=0x5be360, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 1 [0142.916] PeekMessageA (in: lpMsg=0xaeb94, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaeb94) returned 0 [0142.916] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="update.status") returned -1 [0142.916] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="update.status") returned -1 [0142.916] lstrcmpiA (lpString1="", lpString2="update.status") returned -1 [0142.916] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\update.mar") returned="update.mar" [0142.916] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\", lpString2="update.status" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\update.status") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\update.status" [0142.916] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\update.status", pszSpec="*.zip") returned 0 [0142.916] lstrlenA (lpString="*.zip") returned 5 [0142.916] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\update.status", pszSpec="*.rar") returned 0 [0142.916] lstrlenA (lpString="*.rar") returned 5 [0142.916] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\update.status", pszSpec="*.7z") returned 0 [0142.916] lstrlenA (lpString="*.7z") returned 4 [0142.916] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\update.status", pszSpec="*.tar") returned 0 [0142.916] lstrlenA (lpString="*.tar") returned 5 [0142.916] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\update.status", pszSpec="*.gzip") returned 0 [0142.916] lstrlenA (lpString="*.gzip") returned 6 [0142.916] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\update.status", pszSpec="*.jpg") returned 0 [0142.916] lstrlenA (lpString="*.jpg") returned 5 [0142.916] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\update.status", pszSpec="*.jpeg") returned 0 [0142.916] lstrlenA (lpString="*.jpeg") returned 6 [0142.916] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\update.status", pszSpec="*.psd") returned 0 [0142.916] lstrlenA (lpString="*.psd") returned 5 [0142.916] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\update.status", pszSpec="*.cdr") returned 0 [0142.916] lstrlenA (lpString="*.cdr") returned 5 [0142.916] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\update.status", pszSpec="*.dwg") returned 0 [0142.916] lstrlenA (lpString="*.dwg") returned 5 [0142.916] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\update.status", pszSpec="*.max") returned 0 [0142.916] lstrlenA (lpString="*.max") returned 5 [0142.916] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\update.status", pszSpec="*.bmp") returned 0 [0142.916] lstrlenA (lpString="*.bmp") returned 5 [0142.916] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\update.status", pszSpec="*.gif") returned 0 [0142.916] lstrlenA (lpString="*.gif") returned 5 [0142.916] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\update.status", pszSpec="*.png") returned 0 [0142.916] lstrlenA (lpString="*.png") returned 5 [0142.916] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\update.status", pszSpec="*.doc") returned 0 [0142.916] lstrlenA (lpString="*.doc") returned 5 [0142.916] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\update.status", pszSpec="*.docx") returned 0 [0142.916] lstrlenA (lpString="*.docx") returned 6 [0142.916] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\update.status", pszSpec="*.xls") returned 0 [0142.916] lstrlenA (lpString="*.xls") returned 5 [0142.916] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\update.status", pszSpec="*.xlsx") returned 0 [0142.916] lstrlenA (lpString="*.xlsx") returned 6 [0142.916] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\update.status", pszSpec="*.ppt") returned 0 [0142.916] lstrlenA (lpString="*.ppt") returned 5 [0142.916] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\update.status", pszSpec="*.pptx") returned 0 [0142.916] lstrlenA (lpString="*.pptx") returned 6 [0142.916] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\update.status", pszSpec="*.txt") returned 0 [0142.916] lstrlenA (lpString="*.txt") returned 5 [0142.916] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\update.status", pszSpec="*.pdf") returned 0 [0142.916] lstrlenA (lpString="*.pdf") returned 5 [0142.917] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\update.status", pszSpec="*.djvu") returned 0 [0142.917] lstrlenA (lpString="*.djvu") returned 6 [0142.917] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\update.status", pszSpec="*.htm") returned 0 [0142.917] lstrlenA (lpString="*.htm") returned 5 [0142.917] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\update.status", pszSpec="*.html") returned 0 [0142.917] lstrlenA (lpString="*.html") returned 6 [0142.917] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\update.status", pszSpec="*.mdb") returned 0 [0142.917] lstrlenA (lpString="*.mdb") returned 5 [0142.917] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\update.status", pszSpec="*.cer") returned 0 [0142.917] lstrlenA (lpString="*.cer") returned 5 [0142.917] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\update.status", pszSpec="*.p12") returned 0 [0142.917] lstrlenA (lpString="*.p12") returned 5 [0142.917] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\update.status", pszSpec="*.pfx") returned 0 [0142.917] lstrlenA (lpString="*.pfx") returned 5 [0142.917] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\update.status", pszSpec="*.kwm") returned 0 [0142.917] lstrlenA (lpString="*.kwm") returned 5 [0142.917] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\update.status", pszSpec="*.pwm") returned 0 [0142.917] lstrlenA (lpString="*.pwm") returned 5 [0142.917] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\update.status", pszSpec="*.1cd") returned 0 [0142.917] lstrlenA (lpString="*.1cd") returned 5 [0142.917] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\update.status", pszSpec="*.md") returned 0 [0142.917] lstrlenA (lpString="*.md") returned 4 [0142.917] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\update.status", pszSpec="*.mdf") returned 0 [0142.917] lstrlenA (lpString="*.mdf") returned 5 [0142.917] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\update.status", pszSpec="*.dbf") returned 0 [0142.917] lstrlenA (lpString="*.dbf") returned 5 [0142.917] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\update.status", pszSpec="*.odt") returned 0 [0142.917] lstrlenA (lpString="*.odt") returned 5 [0142.917] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\update.status", pszSpec="*.vob") returned 0 [0142.917] lstrlenA (lpString="*.vob") returned 5 [0142.917] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\update.status", pszSpec="*.ifo") returned 0 [0142.917] lstrlenA (lpString="*.ifo") returned 5 [0142.917] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\update.status", pszSpec="*.lnk") returned 0 [0142.917] lstrlenA (lpString="*.lnk") returned 5 [0142.917] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\update.status", pszSpec="*.torrent") returned 0 [0142.917] lstrlenA (lpString="*.torrent") returned 9 [0142.917] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\update.status", pszSpec="*.mov") returned 0 [0142.917] lstrlenA (lpString="*.mov") returned 5 [0142.917] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\update.status", pszSpec="*.m2v") returned 0 [0142.917] lstrlenA (lpString="*.m2v") returned 5 [0142.917] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\update.status", pszSpec="*.3gp") returned 0 [0142.917] lstrlenA (lpString="*.3gp") returned 5 [0142.917] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\update.status", pszSpec="*.mpeg") returned 0 [0142.917] lstrlenA (lpString="*.mpeg") returned 6 [0142.917] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\update.status", pszSpec="*.mpg") returned 0 [0142.917] lstrlenA (lpString="*.mpg") returned 5 [0142.917] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\update.status", pszSpec="*.flv") returned 0 [0142.917] lstrlenA (lpString="*.flv") returned 5 [0142.917] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\update.status", pszSpec="*.avi") returned 0 [0142.917] lstrlenA (lpString="*.avi") returned 5 [0142.918] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\update.status", pszSpec="*.mp4") returned 0 [0142.918] lstrlenA (lpString="*.mp4") returned 5 [0142.918] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\update.status", pszSpec="*.wmv") returned 0 [0142.918] lstrlenA (lpString="*.wmv") returned 5 [0142.918] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\update.status", pszSpec="*.divx") returned 0 [0142.918] lstrlenA (lpString="*.divx") returned 6 [0142.918] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\update.status", pszSpec="*.mkv") returned 0 [0142.918] lstrlenA (lpString="*.mkv") returned 5 [0142.918] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\update.status", pszSpec="*.mp3") returned 0 [0142.918] lstrlenA (lpString="*.mp3") returned 5 [0142.918] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\update.status", pszSpec="*.wav") returned 0 [0142.918] lstrlenA (lpString="*.wav") returned 5 [0142.918] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\update.status", pszSpec="*.flac") returned 0 [0142.918] lstrlenA (lpString="*.flac") returned 6 [0142.918] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\update.status", pszSpec="*.ape") returned 0 [0142.918] lstrlenA (lpString="*.ape") returned 5 [0142.918] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\update.status", pszSpec="*.wma") returned 0 [0142.918] lstrlenA (lpString="*.wma") returned 5 [0142.918] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\update.status", pszSpec="*.ac3") returned 0 [0142.918] lstrlenA (lpString="*.ac3") returned 5 [0142.918] FindNextFileA (in: hFindFile=0x5be360, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 0 [0142.918] FindClose (in: hFindFile=0x5be360 | out: hFindFile=0x5be360) returned 1 [0142.918] FindNextFileA (in: hFindFile=0x5be320, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 0 [0142.918] FindClose (in: hFindFile=0x5be320 | out: hFindFile=0x5be320) returned 1 [0142.918] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0142.918] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0142.918] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="updates.xml") returned -1 [0142.918] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="updates.xml") returned -1 [0142.918] lstrcmpiA (lpString1="", lpString2="updates.xml") returned -1 [0142.918] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\*.*") returned="*.*" [0142.918] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\", lpString2="updates.xml" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates.xml") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates.xml" [0142.918] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates.xml", pszSpec="*.zip") returned 0 [0142.918] lstrlenA (lpString="*.zip") returned 5 [0142.918] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates.xml", pszSpec="*.rar") returned 0 [0142.918] lstrlenA (lpString="*.rar") returned 5 [0142.918] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates.xml", pszSpec="*.7z") returned 0 [0142.918] lstrlenA (lpString="*.7z") returned 4 [0142.918] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates.xml", pszSpec="*.tar") returned 0 [0142.918] lstrlenA (lpString="*.tar") returned 5 [0142.918] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates.xml", pszSpec="*.gzip") returned 0 [0142.918] lstrlenA (lpString="*.gzip") returned 6 [0142.918] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates.xml", pszSpec="*.jpg") returned 0 [0142.918] lstrlenA (lpString="*.jpg") returned 5 [0142.918] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates.xml", pszSpec="*.jpeg") returned 0 [0142.918] lstrlenA (lpString="*.jpeg") returned 6 [0142.918] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates.xml", pszSpec="*.psd") returned 0 [0142.919] lstrlenA (lpString="*.psd") returned 5 [0142.919] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates.xml", pszSpec="*.cdr") returned 0 [0142.919] lstrlenA (lpString="*.cdr") returned 5 [0142.919] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates.xml", pszSpec="*.dwg") returned 0 [0142.919] lstrlenA (lpString="*.dwg") returned 5 [0142.919] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates.xml", pszSpec="*.max") returned 0 [0142.919] lstrlenA (lpString="*.max") returned 5 [0142.919] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates.xml", pszSpec="*.bmp") returned 0 [0142.919] lstrlenA (lpString="*.bmp") returned 5 [0142.919] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates.xml", pszSpec="*.gif") returned 0 [0142.919] lstrlenA (lpString="*.gif") returned 5 [0142.919] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates.xml", pszSpec="*.png") returned 0 [0142.919] lstrlenA (lpString="*.png") returned 5 [0142.919] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates.xml", pszSpec="*.doc") returned 0 [0142.919] lstrlenA (lpString="*.doc") returned 5 [0142.919] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates.xml", pszSpec="*.docx") returned 0 [0142.919] lstrlenA (lpString="*.docx") returned 6 [0142.919] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates.xml", pszSpec="*.xls") returned 0 [0142.919] lstrlenA (lpString="*.xls") returned 5 [0142.919] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates.xml", pszSpec="*.xlsx") returned 0 [0142.919] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates.xml", pszSpec="*.ppt") returned 0 [0142.919] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates.xml", pszSpec="*.pptx") returned 0 [0142.919] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates.xml", pszSpec="*.txt") returned 0 [0142.919] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 0 [0142.919] FindClose (in: hFindFile=0x5be2e0 | out: hFindFile=0x5be2e0) returned 1 [0142.919] FindNextFileA (in: hFindFile=0x5be2a0, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0 [0142.919] FindClose (in: hFindFile=0x5be2a0 | out: hFindFile=0x5be2a0) returned 1 [0142.919] FindNextFileA (in: hFindFile=0x5be260, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0 [0142.919] FindClose (in: hFindFile=0x5be260 | out: hFindFile=0x5be260) returned 1 [0142.919] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0142.919] lstrcmpA (lpString1=".", lpString2="Temp") returned -1 [0142.919] lstrcmpA (lpString1="..", lpString2="Temp") returned -1 [0142.919] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\*.*") returned="*.*" [0142.919] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\", lpString2="Temp" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp" [0142.920] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0142.920] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0142.920] FindNextFileA (in: hFindFile=0x5be260, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0142.920] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0142.920] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0142.920] FindNextFileA (in: hFindFile=0x5be260, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0142.920] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0142.920] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="0IFg.wav") returned 1 [0142.920] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="0IFg.wav") returned 1 [0142.920] lstrcmpiA (lpString1="", lpString2="0IFg.wav") returned -1 [0142.920] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\*.*") returned="*.*" [0142.920] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\", lpString2="0IFg.wav" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\0IFg.wav") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\0IFg.wav" [0142.920] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\0IFg.wav" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\0IFg.wav") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\0IFg.wav" [0142.920] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\0IFg.wav" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\0IFg.wav") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\0IFg.wav" [0142.920] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\0IFg.wav", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\0IFg.wav.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\0IFg.wav." [0142.920] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\0IFg.wav.", lpString2="\xa0" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\0IFg.wav. ") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\0IFg.wav. " [0142.920] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\0IFg.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\0ifg.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0142.921] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x12112 [0142.921] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xe342d460, dwHighDateTime=0x1d4a907), lpLastAccessTime=0x407536*(dwLowDateTime=0x3f971790, dwHighDateTime=0x1d4aa4c), lpLastWriteTime=0x40753e*(dwLowDateTime=0x3f971790, dwHighDateTime=0x1d4aa4c)) returned 1 [0142.921] SetFilePointer (in: hFile=0x90, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0142.921] ReadFile (in: hFile=0x90, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x120b8, lpOverlapped=0x0) returned 1 [0142.921] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\0IFg.wav") returned="0IFg.wav" [0142.922] SetFilePointer (in: hFile=0x90, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0142.922] WriteFile (in: hFile=0x90, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x120b8, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x120b8, lpOverlapped=0x0) returned 1 [0142.922] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0142.922] CloseHandle (hObject=0x90) returned 1 [0142.922] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\0IFg.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\0ifg.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\0IFg.wav. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\0ifg.wav. ")) returned 1 [0142.923] FindNextFileA (in: hFindFile=0x5be260, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0142.923] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0142.923] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="0Uocyxv8V4p4rX9.exe") returned 1 [0142.923] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="0Uocyxv8V4p4rX9.exe") returned 1 [0142.923] lstrcmpiA (lpString1="", lpString2="0Uocyxv8V4p4rX9.exe") returned -1 [0142.923] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\0IFg.wav") returned="0IFg.wav" [0142.923] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\", lpString2="0Uocyxv8V4p4rX9.exe" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\0Uocyxv8V4p4rX9.exe") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\0Uocyxv8V4p4rX9.exe" [0142.923] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\0Uocyxv8V4p4rX9.exe", pszSpec="*.zip") returned 0 [0142.923] lstrlenA (lpString="*.zip") returned 5 [0142.923] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\0Uocyxv8V4p4rX9.exe", pszSpec="*.rar") returned 0 [0142.923] lstrlenA (lpString="*.rar") returned 5 [0142.923] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\0Uocyxv8V4p4rX9.exe", pszSpec="*.7z") returned 0 [0142.923] lstrlenA (lpString="*.7z") returned 4 [0142.923] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\0Uocyxv8V4p4rX9.exe", pszSpec="*.tar") returned 0 [0142.923] lstrlenA (lpString="*.tar") returned 5 [0142.923] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\0Uocyxv8V4p4rX9.exe", pszSpec="*.gzip") returned 0 [0142.923] lstrlenA (lpString="*.gzip") returned 6 [0142.923] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\0Uocyxv8V4p4rX9.exe", pszSpec="*.jpg") returned 0 [0142.923] lstrlenA (lpString="*.jpg") returned 5 [0142.923] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\0Uocyxv8V4p4rX9.exe", pszSpec="*.jpeg") returned 0 [0142.923] lstrlenA (lpString="*.jpeg") returned 6 [0142.923] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\0Uocyxv8V4p4rX9.exe", pszSpec="*.psd") returned 0 [0142.923] lstrlenA (lpString="*.psd") returned 5 [0142.923] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\0Uocyxv8V4p4rX9.exe", pszSpec="*.cdr") returned 0 [0142.923] lstrlenA (lpString="*.cdr") returned 5 [0142.923] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\0Uocyxv8V4p4rX9.exe", pszSpec="*.dwg") returned 0 [0142.923] lstrlenA (lpString="*.dwg") returned 5 [0142.923] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\0Uocyxv8V4p4rX9.exe", pszSpec="*.max") returned 0 [0142.923] lstrlenA (lpString="*.max") returned 5 [0142.923] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\0Uocyxv8V4p4rX9.exe", pszSpec="*.bmp") returned 0 [0142.923] lstrlenA (lpString="*.bmp") returned 5 [0142.924] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\0Uocyxv8V4p4rX9.exe", pszSpec="*.gif") returned 0 [0142.924] lstrlenA (lpString="*.gif") returned 5 [0142.924] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\0Uocyxv8V4p4rX9.exe", pszSpec="*.png") returned 0 [0142.924] lstrlenA (lpString="*.png") returned 5 [0142.924] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\0Uocyxv8V4p4rX9.exe", pszSpec="*.doc") returned 0 [0142.924] lstrlenA (lpString="*.doc") returned 5 [0142.924] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\0Uocyxv8V4p4rX9.exe", pszSpec="*.docx") returned 0 [0142.924] lstrlenA (lpString="*.docx") returned 6 [0142.924] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\0Uocyxv8V4p4rX9.exe", pszSpec="*.xls") returned 0 [0142.924] lstrlenA (lpString="*.xls") returned 5 [0142.924] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\0Uocyxv8V4p4rX9.exe", pszSpec="*.xlsx") returned 0 [0142.924] lstrlenA (lpString="*.xlsx") returned 6 [0142.924] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\0Uocyxv8V4p4rX9.exe", pszSpec="*.ppt") returned 0 [0142.924] lstrlenA (lpString="*.ppt") returned 5 [0142.924] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\0Uocyxv8V4p4rX9.exe", pszSpec="*.pptx") returned 0 [0142.924] lstrlenA (lpString="*.pptx") returned 6 [0142.924] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\0Uocyxv8V4p4rX9.exe", pszSpec="*.txt") returned 0 [0142.924] lstrlenA (lpString="*.txt") returned 5 [0142.924] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\0Uocyxv8V4p4rX9.exe", pszSpec="*.pdf") returned 0 [0142.924] lstrlenA (lpString="*.pdf") returned 5 [0142.924] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\0Uocyxv8V4p4rX9.exe", pszSpec="*.djvu") returned 0 [0142.924] lstrlenA (lpString="*.djvu") returned 6 [0142.924] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\0Uocyxv8V4p4rX9.exe", pszSpec="*.htm") returned 0 [0142.924] lstrlenA (lpString="*.htm") returned 5 [0142.924] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\0Uocyxv8V4p4rX9.exe", pszSpec="*.html") returned 0 [0142.924] lstrlenA (lpString="*.html") returned 6 [0142.924] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\0Uocyxv8V4p4rX9.exe", pszSpec="*.mdb") returned 0 [0142.924] lstrlenA (lpString="*.mdb") returned 5 [0142.924] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\0Uocyxv8V4p4rX9.exe", pszSpec="*.cer") returned 0 [0142.924] lstrlenA (lpString="*.cer") returned 5 [0142.924] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\0Uocyxv8V4p4rX9.exe", pszSpec="*.p12") returned 0 [0142.924] lstrlenA (lpString="*.p12") returned 5 [0142.924] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\0Uocyxv8V4p4rX9.exe", pszSpec="*.pfx") returned 0 [0142.924] lstrlenA (lpString="*.pfx") returned 5 [0142.924] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\0Uocyxv8V4p4rX9.exe", pszSpec="*.kwm") returned 0 [0142.924] lstrlenA (lpString="*.kwm") returned 5 [0142.924] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\0Uocyxv8V4p4rX9.exe", pszSpec="*.pwm") returned 0 [0142.924] lstrlenA (lpString="*.pwm") returned 5 [0142.924] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\0Uocyxv8V4p4rX9.exe", pszSpec="*.1cd") returned 0 [0142.924] lstrlenA (lpString="*.1cd") returned 5 [0142.924] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\0Uocyxv8V4p4rX9.exe", pszSpec="*.md") returned 0 [0142.924] lstrlenA (lpString="*.md") returned 4 [0142.924] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\0Uocyxv8V4p4rX9.exe", pszSpec="*.mdf") returned 0 [0142.924] lstrlenA (lpString="*.mdf") returned 5 [0142.924] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\0Uocyxv8V4p4rX9.exe", pszSpec="*.dbf") returned 0 [0142.924] lstrlenA (lpString="*.dbf") returned 5 [0142.924] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\0Uocyxv8V4p4rX9.exe", pszSpec="*.odt") returned 0 [0142.924] lstrlenA (lpString="*.odt") returned 5 [0142.924] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\0Uocyxv8V4p4rX9.exe", pszSpec="*.vob") returned 0 [0142.924] lstrlenA (lpString="*.vob") returned 5 [0142.924] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\0Uocyxv8V4p4rX9.exe", pszSpec="*.ifo") returned 0 [0142.925] lstrlenA (lpString="*.ifo") returned 5 [0142.925] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\0Uocyxv8V4p4rX9.exe", pszSpec="*.lnk") returned 0 [0142.925] lstrlenA (lpString="*.lnk") returned 5 [0142.925] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\0Uocyxv8V4p4rX9.exe", pszSpec="*.torrent") returned 0 [0142.925] lstrlenA (lpString="*.torrent") returned 9 [0142.925] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\0Uocyxv8V4p4rX9.exe", pszSpec="*.mov") returned 0 [0142.925] lstrlenA (lpString="*.mov") returned 5 [0142.925] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\0Uocyxv8V4p4rX9.exe", pszSpec="*.m2v") returned 0 [0142.925] lstrlenA (lpString="*.m2v") returned 5 [0142.925] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\0Uocyxv8V4p4rX9.exe", pszSpec="*.3gp") returned 0 [0142.925] lstrlenA (lpString="*.3gp") returned 5 [0142.925] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\0Uocyxv8V4p4rX9.exe", pszSpec="*.mpeg") returned 0 [0142.925] lstrlenA (lpString="*.mpeg") returned 6 [0142.925] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\0Uocyxv8V4p4rX9.exe", pszSpec="*.mpg") returned 0 [0142.925] lstrlenA (lpString="*.mpg") returned 5 [0142.925] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\0Uocyxv8V4p4rX9.exe", pszSpec="*.flv") returned 0 [0142.925] lstrlenA (lpString="*.flv") returned 5 [0142.925] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\0Uocyxv8V4p4rX9.exe", pszSpec="*.avi") returned 0 [0142.925] lstrlenA (lpString="*.avi") returned 5 [0142.925] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\0Uocyxv8V4p4rX9.exe", pszSpec="*.mp4") returned 0 [0142.925] lstrlenA (lpString="*.mp4") returned 5 [0142.925] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\0Uocyxv8V4p4rX9.exe", pszSpec="*.wmv") returned 0 [0142.925] lstrlenA (lpString="*.wmv") returned 5 [0142.925] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\0Uocyxv8V4p4rX9.exe", pszSpec="*.divx") returned 0 [0142.925] lstrlenA (lpString="*.divx") returned 6 [0142.925] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\0Uocyxv8V4p4rX9.exe", pszSpec="*.mkv") returned 0 [0142.925] lstrlenA (lpString="*.mkv") returned 5 [0142.925] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\0Uocyxv8V4p4rX9.exe", pszSpec="*.mp3") returned 0 [0142.925] lstrlenA (lpString="*.mp3") returned 5 [0142.925] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\0Uocyxv8V4p4rX9.exe", pszSpec="*.wav") returned 0 [0142.925] lstrlenA (lpString="*.wav") returned 5 [0142.925] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\0Uocyxv8V4p4rX9.exe", pszSpec="*.flac") returned 0 [0142.925] lstrlenA (lpString="*.flac") returned 6 [0142.925] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\0Uocyxv8V4p4rX9.exe", pszSpec="*.ape") returned 0 [0142.925] lstrlenA (lpString="*.ape") returned 5 [0142.925] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\0Uocyxv8V4p4rX9.exe", pszSpec="*.wma") returned 0 [0142.925] lstrlenA (lpString="*.wma") returned 5 [0142.925] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\0Uocyxv8V4p4rX9.exe", pszSpec="*.ac3") returned 0 [0142.925] lstrlenA (lpString="*.ac3") returned 5 [0142.925] FindNextFileA (in: hFindFile=0x5be260, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0142.925] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0142.925] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="1A_lN-lDHXL.gif") returned 1 [0142.925] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="1A_lN-lDHXL.gif") returned 1 [0142.925] lstrcmpiA (lpString1="", lpString2="1A_lN-lDHXL.gif") returned -1 [0142.925] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\0Uocyxv8V4p4rX9.exe") returned="0Uocyxv8V4p4rX9.exe" [0142.925] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\", lpString2="1A_lN-lDHXL.gif" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\1A_lN-lDHXL.gif") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\1A_lN-lDHXL.gif" [0142.925] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\1A_lN-lDHXL.gif", pszSpec="*.zip") returned 0 [0142.925] lstrlenA (lpString="*.zip") returned 5 [0142.925] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\1A_lN-lDHXL.gif", pszSpec="*.rar") returned 0 [0142.926] lstrlenA (lpString="*.rar") returned 5 [0142.926] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\1A_lN-lDHXL.gif", pszSpec="*.7z") returned 0 [0142.926] lstrlenA (lpString="*.7z") returned 4 [0142.926] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\1A_lN-lDHXL.gif", pszSpec="*.tar") returned 0 [0142.926] lstrlenA (lpString="*.tar") returned 5 [0142.926] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\1A_lN-lDHXL.gif", pszSpec="*.gzip") returned 0 [0142.926] lstrlenA (lpString="*.gzip") returned 6 [0142.926] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\1A_lN-lDHXL.gif", pszSpec="*.jpg") returned 0 [0142.926] lstrlenA (lpString="*.jpg") returned 5 [0142.926] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\1A_lN-lDHXL.gif", pszSpec="*.jpeg") returned 0 [0142.926] lstrlenA (lpString="*.jpeg") returned 6 [0142.926] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\1A_lN-lDHXL.gif", pszSpec="*.psd") returned 0 [0142.926] lstrlenA (lpString="*.psd") returned 5 [0142.926] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\1A_lN-lDHXL.gif", pszSpec="*.cdr") returned 0 [0142.926] lstrlenA (lpString="*.cdr") returned 5 [0142.926] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\1A_lN-lDHXL.gif", pszSpec="*.dwg") returned 0 [0142.926] lstrlenA (lpString="*.dwg") returned 5 [0142.926] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\1A_lN-lDHXL.gif", pszSpec="*.max") returned 0 [0142.926] lstrlenA (lpString="*.max") returned 5 [0142.926] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\1A_lN-lDHXL.gif", pszSpec="*.bmp") returned 0 [0142.926] lstrlenA (lpString="*.bmp") returned 5 [0142.926] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\1A_lN-lDHXL.gif", pszSpec="*.gif") returned 1 [0142.926] lstrlenA (lpString="*.gif") returned 5 [0142.926] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\1A_lN-lDHXL.gif" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\1A_lN-lDHXL.gif") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\1A_lN-lDHXL.gif" [0142.926] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\1A_lN-lDHXL.gif" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\1A_lN-lDHXL.gif") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\1A_lN-lDHXL.gif" [0142.926] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\1A_lN-lDHXL.gif", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\1A_lN-lDHXL.gif.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\1A_lN-lDHXL.gif." [0142.926] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\1A_lN-lDHXL.gif.", lpString2="\xa0" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\1A_lN-lDHXL.gif. ") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\1A_lN-lDHXL.gif. " [0142.926] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\1A_lN-lDHXL.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\1a_ln-ldhxl.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0142.926] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x179ff [0142.927] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x78945fd0, dwHighDateTime=0x1d4a137), lpLastAccessTime=0x407536*(dwLowDateTime=0x6b0a8410, dwHighDateTime=0x1d4ac41), lpLastWriteTime=0x40753e*(dwLowDateTime=0x6b0a8410, dwHighDateTime=0x1d4ac41)) returned 1 [0142.927] SetFilePointer (in: hFile=0x90, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0142.927] ReadFile (in: hFile=0x90, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x179a5, lpOverlapped=0x0) returned 1 [0142.927] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\1A_lN-lDHXL.gif") returned="1A_lN-lDHXL.gif" [0142.928] SetFilePointer (in: hFile=0x90, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0142.928] WriteFile (in: hFile=0x90, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x179a5, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x179a5, lpOverlapped=0x0) returned 1 [0142.928] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0142.928] CloseHandle (hObject=0x90) returned 1 [0142.928] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\1A_lN-lDHXL.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\1a_ln-ldhxl.gif"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\1A_lN-lDHXL.gif. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\1a_ln-ldhxl.gif. ")) returned 1 [0142.929] FindNextFileA (in: hFindFile=0x5be260, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0142.929] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0142.929] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="4ijsdl-uWakYY0ukdOP.m4a") returned 1 [0142.929] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="4ijsdl-uWakYY0ukdOP.m4a") returned 1 [0142.929] lstrcmpiA (lpString1="", lpString2="4ijsdl-uWakYY0ukdOP.m4a") returned -1 [0142.929] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\1A_lN-lDHXL.gif") returned="1A_lN-lDHXL.gif" [0142.929] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\", lpString2="4ijsdl-uWakYY0ukdOP.m4a" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4ijsdl-uWakYY0ukdOP.m4a") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4ijsdl-uWakYY0ukdOP.m4a" [0142.929] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4ijsdl-uWakYY0ukdOP.m4a", pszSpec="*.zip") returned 0 [0142.929] lstrlenA (lpString="*.zip") returned 5 [0142.929] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4ijsdl-uWakYY0ukdOP.m4a", pszSpec="*.rar") returned 0 [0142.929] lstrlenA (lpString="*.rar") returned 5 [0142.929] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4ijsdl-uWakYY0ukdOP.m4a", pszSpec="*.7z") returned 0 [0142.929] lstrlenA (lpString="*.7z") returned 4 [0142.929] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4ijsdl-uWakYY0ukdOP.m4a", pszSpec="*.tar") returned 0 [0142.929] lstrlenA (lpString="*.tar") returned 5 [0142.929] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4ijsdl-uWakYY0ukdOP.m4a", pszSpec="*.gzip") returned 0 [0142.929] lstrlenA (lpString="*.gzip") returned 6 [0142.929] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4ijsdl-uWakYY0ukdOP.m4a", pszSpec="*.jpg") returned 0 [0142.929] lstrlenA (lpString="*.jpg") returned 5 [0142.929] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4ijsdl-uWakYY0ukdOP.m4a", pszSpec="*.jpeg") returned 0 [0142.929] lstrlenA (lpString="*.jpeg") returned 6 [0142.929] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4ijsdl-uWakYY0ukdOP.m4a", pszSpec="*.psd") returned 0 [0142.929] lstrlenA (lpString="*.psd") returned 5 [0142.929] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4ijsdl-uWakYY0ukdOP.m4a", pszSpec="*.cdr") returned 0 [0142.930] lstrlenA (lpString="*.cdr") returned 5 [0142.930] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4ijsdl-uWakYY0ukdOP.m4a", pszSpec="*.dwg") returned 0 [0142.930] lstrlenA (lpString="*.dwg") returned 5 [0142.930] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4ijsdl-uWakYY0ukdOP.m4a", pszSpec="*.max") returned 0 [0142.930] lstrlenA (lpString="*.max") returned 5 [0142.930] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4ijsdl-uWakYY0ukdOP.m4a", pszSpec="*.bmp") returned 0 [0142.930] lstrlenA (lpString="*.bmp") returned 5 [0142.930] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4ijsdl-uWakYY0ukdOP.m4a", pszSpec="*.gif") returned 0 [0142.930] lstrlenA (lpString="*.gif") returned 5 [0142.930] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4ijsdl-uWakYY0ukdOP.m4a", pszSpec="*.png") returned 0 [0142.930] lstrlenA (lpString="*.png") returned 5 [0142.930] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4ijsdl-uWakYY0ukdOP.m4a", pszSpec="*.doc") returned 0 [0142.930] lstrlenA (lpString="*.doc") returned 5 [0142.930] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4ijsdl-uWakYY0ukdOP.m4a", pszSpec="*.docx") returned 0 [0142.930] lstrlenA (lpString="*.docx") returned 6 [0142.930] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4ijsdl-uWakYY0ukdOP.m4a", pszSpec="*.xls") returned 0 [0142.930] lstrlenA (lpString="*.xls") returned 5 [0142.930] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4ijsdl-uWakYY0ukdOP.m4a", pszSpec="*.xlsx") returned 0 [0142.930] lstrlenA (lpString="*.xlsx") returned 6 [0142.930] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4ijsdl-uWakYY0ukdOP.m4a", pszSpec="*.ppt") returned 0 [0142.930] lstrlenA (lpString="*.ppt") returned 5 [0142.930] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4ijsdl-uWakYY0ukdOP.m4a", pszSpec="*.pptx") returned 0 [0142.930] lstrlenA (lpString="*.pptx") returned 6 [0142.930] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4ijsdl-uWakYY0ukdOP.m4a", pszSpec="*.txt") returned 0 [0142.930] lstrlenA (lpString="*.txt") returned 5 [0142.930] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4ijsdl-uWakYY0ukdOP.m4a", pszSpec="*.pdf") returned 0 [0142.930] lstrlenA (lpString="*.pdf") returned 5 [0142.930] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4ijsdl-uWakYY0ukdOP.m4a", pszSpec="*.djvu") returned 0 [0142.930] lstrlenA (lpString="*.djvu") returned 6 [0142.930] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4ijsdl-uWakYY0ukdOP.m4a", pszSpec="*.htm") returned 0 [0142.930] lstrlenA (lpString="*.htm") returned 5 [0142.930] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4ijsdl-uWakYY0ukdOP.m4a", pszSpec="*.html") returned 0 [0142.930] lstrlenA (lpString="*.html") returned 6 [0142.930] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4ijsdl-uWakYY0ukdOP.m4a", pszSpec="*.mdb") returned 0 [0142.930] lstrlenA (lpString="*.mdb") returned 5 [0142.930] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4ijsdl-uWakYY0ukdOP.m4a", pszSpec="*.cer") returned 0 [0142.930] lstrlenA (lpString="*.cer") returned 5 [0142.930] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4ijsdl-uWakYY0ukdOP.m4a", pszSpec="*.p12") returned 0 [0142.930] lstrlenA (lpString="*.p12") returned 5 [0142.930] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4ijsdl-uWakYY0ukdOP.m4a", pszSpec="*.pfx") returned 0 [0142.930] lstrlenA (lpString="*.pfx") returned 5 [0142.930] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4ijsdl-uWakYY0ukdOP.m4a", pszSpec="*.kwm") returned 0 [0142.930] lstrlenA (lpString="*.kwm") returned 5 [0142.930] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4ijsdl-uWakYY0ukdOP.m4a", pszSpec="*.pwm") returned 0 [0142.930] lstrlenA (lpString="*.pwm") returned 5 [0142.930] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4ijsdl-uWakYY0ukdOP.m4a", pszSpec="*.1cd") returned 0 [0142.930] lstrlenA (lpString="*.1cd") returned 5 [0142.930] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4ijsdl-uWakYY0ukdOP.m4a", pszSpec="*.md") returned 0 [0142.930] lstrlenA (lpString="*.md") returned 4 [0142.930] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4ijsdl-uWakYY0ukdOP.m4a", pszSpec="*.mdf") returned 0 [0142.931] lstrlenA (lpString="*.mdf") returned 5 [0142.931] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4ijsdl-uWakYY0ukdOP.m4a", pszSpec="*.dbf") returned 0 [0142.931] lstrlenA (lpString="*.dbf") returned 5 [0142.931] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4ijsdl-uWakYY0ukdOP.m4a", pszSpec="*.odt") returned 0 [0142.931] lstrlenA (lpString="*.odt") returned 5 [0142.931] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4ijsdl-uWakYY0ukdOP.m4a", pszSpec="*.vob") returned 0 [0142.931] lstrlenA (lpString="*.vob") returned 5 [0142.931] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4ijsdl-uWakYY0ukdOP.m4a", pszSpec="*.ifo") returned 0 [0142.931] lstrlenA (lpString="*.ifo") returned 5 [0142.931] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4ijsdl-uWakYY0ukdOP.m4a", pszSpec="*.lnk") returned 0 [0142.931] lstrlenA (lpString="*.lnk") returned 5 [0142.931] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4ijsdl-uWakYY0ukdOP.m4a", pszSpec="*.torrent") returned 0 [0142.931] lstrlenA (lpString="*.torrent") returned 9 [0142.931] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4ijsdl-uWakYY0ukdOP.m4a", pszSpec="*.mov") returned 0 [0142.931] lstrlenA (lpString="*.mov") returned 5 [0142.931] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4ijsdl-uWakYY0ukdOP.m4a", pszSpec="*.m2v") returned 0 [0142.931] lstrlenA (lpString="*.m2v") returned 5 [0142.931] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4ijsdl-uWakYY0ukdOP.m4a", pszSpec="*.3gp") returned 0 [0142.931] lstrlenA (lpString="*.3gp") returned 5 [0142.931] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4ijsdl-uWakYY0ukdOP.m4a", pszSpec="*.mpeg") returned 0 [0142.931] lstrlenA (lpString="*.mpeg") returned 6 [0142.931] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4ijsdl-uWakYY0ukdOP.m4a", pszSpec="*.mpg") returned 0 [0142.931] lstrlenA (lpString="*.mpg") returned 5 [0142.931] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4ijsdl-uWakYY0ukdOP.m4a", pszSpec="*.flv") returned 0 [0142.931] lstrlenA (lpString="*.flv") returned 5 [0142.931] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4ijsdl-uWakYY0ukdOP.m4a", pszSpec="*.avi") returned 0 [0142.931] lstrlenA (lpString="*.avi") returned 5 [0142.931] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4ijsdl-uWakYY0ukdOP.m4a", pszSpec="*.mp4") returned 0 [0142.931] lstrlenA (lpString="*.mp4") returned 5 [0142.931] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4ijsdl-uWakYY0ukdOP.m4a", pszSpec="*.wmv") returned 0 [0142.931] lstrlenA (lpString="*.wmv") returned 5 [0142.931] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4ijsdl-uWakYY0ukdOP.m4a", pszSpec="*.divx") returned 0 [0142.931] lstrlenA (lpString="*.divx") returned 6 [0142.931] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4ijsdl-uWakYY0ukdOP.m4a", pszSpec="*.mkv") returned 0 [0142.931] lstrlenA (lpString="*.mkv") returned 5 [0142.931] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4ijsdl-uWakYY0ukdOP.m4a", pszSpec="*.mp3") returned 0 [0142.931] lstrlenA (lpString="*.mp3") returned 5 [0142.931] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4ijsdl-uWakYY0ukdOP.m4a", pszSpec="*.wav") returned 0 [0142.931] lstrlenA (lpString="*.wav") returned 5 [0142.931] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4ijsdl-uWakYY0ukdOP.m4a", pszSpec="*.flac") returned 0 [0142.931] lstrlenA (lpString="*.flac") returned 6 [0142.931] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4ijsdl-uWakYY0ukdOP.m4a", pszSpec="*.ape") returned 0 [0142.931] lstrlenA (lpString="*.ape") returned 5 [0142.931] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4ijsdl-uWakYY0ukdOP.m4a", pszSpec="*.wma") returned 0 [0142.931] lstrlenA (lpString="*.wma") returned 5 [0142.931] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4ijsdl-uWakYY0ukdOP.m4a", pszSpec="*.ac3") returned 0 [0142.931] lstrlenA (lpString="*.ac3") returned 5 [0142.931] FindNextFileA (in: hFindFile=0x5be260, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0142.931] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0142.931] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="4uIb Rf0nk.odp") returned 1 [0142.931] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="4uIb Rf0nk.odp") returned 1 [0142.932] lstrcmpiA (lpString1="", lpString2="4uIb Rf0nk.odp") returned -1 [0142.932] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4ijsdl-uWakYY0ukdOP.m4a") returned="4ijsdl-uWakYY0ukdOP.m4a" [0142.932] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\", lpString2="4uIb Rf0nk.odp" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4uIb Rf0nk.odp") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4uIb Rf0nk.odp" [0142.932] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4uIb Rf0nk.odp", pszSpec="*.zip") returned 0 [0142.932] lstrlenA (lpString="*.zip") returned 5 [0142.932] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4uIb Rf0nk.odp", pszSpec="*.rar") returned 0 [0142.932] lstrlenA (lpString="*.rar") returned 5 [0142.932] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4uIb Rf0nk.odp", pszSpec="*.7z") returned 0 [0142.932] lstrlenA (lpString="*.7z") returned 4 [0142.932] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4uIb Rf0nk.odp", pszSpec="*.tar") returned 0 [0142.932] lstrlenA (lpString="*.tar") returned 5 [0142.932] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4uIb Rf0nk.odp", pszSpec="*.gzip") returned 0 [0142.932] lstrlenA (lpString="*.gzip") returned 6 [0142.932] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4uIb Rf0nk.odp", pszSpec="*.jpg") returned 0 [0142.932] lstrlenA (lpString="*.jpg") returned 5 [0142.932] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4uIb Rf0nk.odp", pszSpec="*.jpeg") returned 0 [0142.932] lstrlenA (lpString="*.jpeg") returned 6 [0142.932] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4uIb Rf0nk.odp", pszSpec="*.psd") returned 0 [0142.932] lstrlenA (lpString="*.psd") returned 5 [0142.932] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4uIb Rf0nk.odp", pszSpec="*.cdr") returned 0 [0142.932] lstrlenA (lpString="*.cdr") returned 5 [0142.932] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4uIb Rf0nk.odp", pszSpec="*.dwg") returned 0 [0142.932] lstrlenA (lpString="*.dwg") returned 5 [0142.932] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4uIb Rf0nk.odp", pszSpec="*.max") returned 0 [0142.932] lstrlenA (lpString="*.max") returned 5 [0142.932] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4uIb Rf0nk.odp", pszSpec="*.bmp") returned 0 [0142.932] lstrlenA (lpString="*.bmp") returned 5 [0142.932] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4uIb Rf0nk.odp", pszSpec="*.gif") returned 0 [0142.932] lstrlenA (lpString="*.gif") returned 5 [0142.932] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4uIb Rf0nk.odp", pszSpec="*.png") returned 0 [0142.932] lstrlenA (lpString="*.png") returned 5 [0142.932] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4uIb Rf0nk.odp", pszSpec="*.doc") returned 0 [0142.932] lstrlenA (lpString="*.doc") returned 5 [0142.932] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4uIb Rf0nk.odp", pszSpec="*.docx") returned 0 [0142.932] lstrlenA (lpString="*.docx") returned 6 [0142.932] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4uIb Rf0nk.odp", pszSpec="*.xls") returned 0 [0142.932] lstrlenA (lpString="*.xls") returned 5 [0142.932] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4uIb Rf0nk.odp", pszSpec="*.xlsx") returned 0 [0142.932] lstrlenA (lpString="*.xlsx") returned 6 [0142.932] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4uIb Rf0nk.odp", pszSpec="*.ppt") returned 0 [0142.932] lstrlenA (lpString="*.ppt") returned 5 [0142.932] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4uIb Rf0nk.odp", pszSpec="*.pptx") returned 0 [0142.932] lstrlenA (lpString="*.pptx") returned 6 [0142.932] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4uIb Rf0nk.odp", pszSpec="*.txt") returned 0 [0142.932] lstrlenA (lpString="*.txt") returned 5 [0142.932] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4uIb Rf0nk.odp", pszSpec="*.pdf") returned 0 [0142.932] lstrlenA (lpString="*.pdf") returned 5 [0142.932] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4uIb Rf0nk.odp", pszSpec="*.djvu") returned 0 [0142.932] lstrlenA (lpString="*.djvu") returned 6 [0142.932] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4uIb Rf0nk.odp", pszSpec="*.htm") returned 0 [0142.933] lstrlenA (lpString="*.htm") returned 5 [0142.933] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4uIb Rf0nk.odp", pszSpec="*.html") returned 0 [0142.933] lstrlenA (lpString="*.html") returned 6 [0142.933] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4uIb Rf0nk.odp", pszSpec="*.mdb") returned 0 [0142.933] lstrlenA (lpString="*.mdb") returned 5 [0142.933] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4uIb Rf0nk.odp", pszSpec="*.cer") returned 0 [0142.933] lstrlenA (lpString="*.cer") returned 5 [0142.933] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4uIb Rf0nk.odp", pszSpec="*.p12") returned 0 [0142.933] lstrlenA (lpString="*.p12") returned 5 [0142.933] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4uIb Rf0nk.odp", pszSpec="*.pfx") returned 0 [0142.933] lstrlenA (lpString="*.pfx") returned 5 [0142.933] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4uIb Rf0nk.odp", pszSpec="*.kwm") returned 0 [0142.933] lstrlenA (lpString="*.kwm") returned 5 [0142.933] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4uIb Rf0nk.odp", pszSpec="*.pwm") returned 0 [0142.933] lstrlenA (lpString="*.pwm") returned 5 [0142.933] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4uIb Rf0nk.odp", pszSpec="*.1cd") returned 0 [0142.933] lstrlenA (lpString="*.1cd") returned 5 [0142.933] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4uIb Rf0nk.odp", pszSpec="*.md") returned 0 [0142.933] lstrlenA (lpString="*.md") returned 4 [0142.933] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4uIb Rf0nk.odp", pszSpec="*.mdf") returned 0 [0142.933] lstrlenA (lpString="*.mdf") returned 5 [0142.933] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4uIb Rf0nk.odp", pszSpec="*.dbf") returned 0 [0142.933] lstrlenA (lpString="*.dbf") returned 5 [0142.933] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4uIb Rf0nk.odp", pszSpec="*.odt") returned 0 [0142.933] lstrlenA (lpString="*.odt") returned 5 [0142.933] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4uIb Rf0nk.odp", pszSpec="*.vob") returned 0 [0142.933] lstrlenA (lpString="*.vob") returned 5 [0142.933] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4uIb Rf0nk.odp", pszSpec="*.ifo") returned 0 [0142.933] lstrlenA (lpString="*.ifo") returned 5 [0142.933] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4uIb Rf0nk.odp", pszSpec="*.lnk") returned 0 [0142.933] lstrlenA (lpString="*.lnk") returned 5 [0142.933] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4uIb Rf0nk.odp", pszSpec="*.torrent") returned 0 [0142.933] lstrlenA (lpString="*.torrent") returned 9 [0142.933] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4uIb Rf0nk.odp", pszSpec="*.mov") returned 0 [0142.933] lstrlenA (lpString="*.mov") returned 5 [0142.933] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4uIb Rf0nk.odp", pszSpec="*.m2v") returned 0 [0142.933] lstrlenA (lpString="*.m2v") returned 5 [0142.933] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4uIb Rf0nk.odp", pszSpec="*.3gp") returned 0 [0142.933] lstrlenA (lpString="*.3gp") returned 5 [0142.933] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4uIb Rf0nk.odp", pszSpec="*.mpeg") returned 0 [0142.933] lstrlenA (lpString="*.mpeg") returned 6 [0142.933] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4uIb Rf0nk.odp", pszSpec="*.mpg") returned 0 [0142.933] lstrlenA (lpString="*.mpg") returned 5 [0142.933] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4uIb Rf0nk.odp", pszSpec="*.flv") returned 0 [0142.933] lstrlenA (lpString="*.flv") returned 5 [0142.933] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4uIb Rf0nk.odp", pszSpec="*.avi") returned 0 [0142.933] lstrlenA (lpString="*.avi") returned 5 [0142.933] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4uIb Rf0nk.odp", pszSpec="*.mp4") returned 0 [0142.933] lstrlenA (lpString="*.mp4") returned 5 [0142.934] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4uIb Rf0nk.odp", pszSpec="*.wmv") returned 0 [0142.934] lstrlenA (lpString="*.wmv") returned 5 [0142.934] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4uIb Rf0nk.odp", pszSpec="*.divx") returned 0 [0142.934] lstrlenA (lpString="*.divx") returned 6 [0142.934] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4uIb Rf0nk.odp", pszSpec="*.mkv") returned 0 [0142.934] lstrlenA (lpString="*.mkv") returned 5 [0142.934] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4uIb Rf0nk.odp", pszSpec="*.mp3") returned 0 [0142.934] lstrlenA (lpString="*.mp3") returned 5 [0142.934] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4uIb Rf0nk.odp", pszSpec="*.wav") returned 0 [0142.934] lstrlenA (lpString="*.wav") returned 5 [0142.934] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4uIb Rf0nk.odp", pszSpec="*.flac") returned 0 [0142.934] lstrlenA (lpString="*.flac") returned 6 [0142.934] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4uIb Rf0nk.odp", pszSpec="*.ape") returned 0 [0142.934] lstrlenA (lpString="*.ape") returned 5 [0142.934] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4uIb Rf0nk.odp", pszSpec="*.wma") returned 0 [0142.934] lstrlenA (lpString="*.wma") returned 5 [0142.934] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4uIb Rf0nk.odp", pszSpec="*.ac3") returned 0 [0142.934] lstrlenA (lpString="*.ac3") returned 5 [0142.934] FindNextFileA (in: hFindFile=0x5be260, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0142.934] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0142.934] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="4VzP7DNt_E2qI.swf") returned 1 [0142.934] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="4VzP7DNt_E2qI.swf") returned 1 [0142.934] lstrcmpiA (lpString1="", lpString2="4VzP7DNt_E2qI.swf") returned -1 [0142.934] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4uIb Rf0nk.odp") returned="4uIb Rf0nk.odp" [0142.934] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\", lpString2="4VzP7DNt_E2qI.swf" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4VzP7DNt_E2qI.swf") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4VzP7DNt_E2qI.swf" [0142.934] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4VzP7DNt_E2qI.swf", pszSpec="*.zip") returned 0 [0142.934] lstrlenA (lpString="*.zip") returned 5 [0142.934] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4VzP7DNt_E2qI.swf", pszSpec="*.rar") returned 0 [0142.934] lstrlenA (lpString="*.rar") returned 5 [0142.934] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4VzP7DNt_E2qI.swf", pszSpec="*.7z") returned 0 [0142.934] lstrlenA (lpString="*.7z") returned 4 [0142.934] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4VzP7DNt_E2qI.swf", pszSpec="*.tar") returned 0 [0142.934] lstrlenA (lpString="*.tar") returned 5 [0142.934] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4VzP7DNt_E2qI.swf", pszSpec="*.gzip") returned 0 [0142.934] lstrlenA (lpString="*.gzip") returned 6 [0142.934] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4VzP7DNt_E2qI.swf", pszSpec="*.jpg") returned 0 [0142.934] lstrlenA (lpString="*.jpg") returned 5 [0142.934] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4VzP7DNt_E2qI.swf", pszSpec="*.jpeg") returned 0 [0142.934] lstrlenA (lpString="*.jpeg") returned 6 [0142.934] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4VzP7DNt_E2qI.swf", pszSpec="*.psd") returned 0 [0142.934] lstrlenA (lpString="*.psd") returned 5 [0142.934] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4VzP7DNt_E2qI.swf", pszSpec="*.cdr") returned 0 [0142.934] lstrlenA (lpString="*.cdr") returned 5 [0142.934] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4VzP7DNt_E2qI.swf", pszSpec="*.dwg") returned 0 [0142.934] lstrlenA (lpString="*.dwg") returned 5 [0142.934] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4VzP7DNt_E2qI.swf", pszSpec="*.max") returned 0 [0142.934] lstrlenA (lpString="*.max") returned 5 [0142.934] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4VzP7DNt_E2qI.swf", pszSpec="*.bmp") returned 0 [0142.934] lstrlenA (lpString="*.bmp") returned 5 [0142.934] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4VzP7DNt_E2qI.swf", pszSpec="*.gif") returned 0 [0142.935] lstrlenA (lpString="*.gif") returned 5 [0142.935] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4VzP7DNt_E2qI.swf", pszSpec="*.png") returned 0 [0142.935] lstrlenA (lpString="*.png") returned 5 [0142.935] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4VzP7DNt_E2qI.swf", pszSpec="*.doc") returned 0 [0142.935] lstrlenA (lpString="*.doc") returned 5 [0142.935] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4VzP7DNt_E2qI.swf", pszSpec="*.docx") returned 0 [0142.935] lstrlenA (lpString="*.docx") returned 6 [0142.935] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4VzP7DNt_E2qI.swf", pszSpec="*.xls") returned 0 [0142.935] lstrlenA (lpString="*.xls") returned 5 [0142.935] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4VzP7DNt_E2qI.swf", pszSpec="*.xlsx") returned 0 [0142.935] lstrlenA (lpString="*.xlsx") returned 6 [0142.935] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4VzP7DNt_E2qI.swf", pszSpec="*.ppt") returned 0 [0142.935] lstrlenA (lpString="*.ppt") returned 5 [0142.935] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4VzP7DNt_E2qI.swf", pszSpec="*.pptx") returned 0 [0142.935] lstrlenA (lpString="*.pptx") returned 6 [0142.935] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4VzP7DNt_E2qI.swf", pszSpec="*.txt") returned 0 [0142.935] lstrlenA (lpString="*.txt") returned 5 [0142.935] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4VzP7DNt_E2qI.swf", pszSpec="*.pdf") returned 0 [0142.935] lstrlenA (lpString="*.pdf") returned 5 [0142.935] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4VzP7DNt_E2qI.swf", pszSpec="*.djvu") returned 0 [0142.935] lstrlenA (lpString="*.djvu") returned 6 [0142.935] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4VzP7DNt_E2qI.swf", pszSpec="*.htm") returned 0 [0142.935] lstrlenA (lpString="*.htm") returned 5 [0142.935] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4VzP7DNt_E2qI.swf", pszSpec="*.html") returned 0 [0142.935] lstrlenA (lpString="*.html") returned 6 [0142.935] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4VzP7DNt_E2qI.swf", pszSpec="*.mdb") returned 0 [0142.935] lstrlenA (lpString="*.mdb") returned 5 [0142.935] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4VzP7DNt_E2qI.swf", pszSpec="*.cer") returned 0 [0142.935] lstrlenA (lpString="*.cer") returned 5 [0142.935] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4VzP7DNt_E2qI.swf", pszSpec="*.p12") returned 0 [0142.935] lstrlenA (lpString="*.p12") returned 5 [0142.935] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4VzP7DNt_E2qI.swf", pszSpec="*.pfx") returned 0 [0142.935] lstrlenA (lpString="*.pfx") returned 5 [0142.935] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4VzP7DNt_E2qI.swf", pszSpec="*.kwm") returned 0 [0142.935] lstrlenA (lpString="*.kwm") returned 5 [0142.935] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4VzP7DNt_E2qI.swf", pszSpec="*.pwm") returned 0 [0142.935] lstrlenA (lpString="*.pwm") returned 5 [0142.935] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4VzP7DNt_E2qI.swf", pszSpec="*.1cd") returned 0 [0142.935] lstrlenA (lpString="*.1cd") returned 5 [0142.935] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4VzP7DNt_E2qI.swf", pszSpec="*.md") returned 0 [0142.935] lstrlenA (lpString="*.md") returned 4 [0142.935] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4VzP7DNt_E2qI.swf", pszSpec="*.mdf") returned 0 [0142.935] lstrlenA (lpString="*.mdf") returned 5 [0142.935] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4VzP7DNt_E2qI.swf", pszSpec="*.dbf") returned 0 [0142.935] lstrlenA (lpString="*.dbf") returned 5 [0142.935] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4VzP7DNt_E2qI.swf", pszSpec="*.odt") returned 0 [0142.935] lstrlenA (lpString="*.odt") returned 5 [0142.935] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4VzP7DNt_E2qI.swf", pszSpec="*.vob") returned 0 [0142.935] lstrlenA (lpString="*.vob") returned 5 [0142.935] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4VzP7DNt_E2qI.swf", pszSpec="*.ifo") returned 0 [0142.936] lstrlenA (lpString="*.ifo") returned 5 [0142.936] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4VzP7DNt_E2qI.swf", pszSpec="*.lnk") returned 0 [0142.936] lstrlenA (lpString="*.lnk") returned 5 [0142.936] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4VzP7DNt_E2qI.swf", pszSpec="*.torrent") returned 0 [0142.936] lstrlenA (lpString="*.torrent") returned 9 [0142.936] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4VzP7DNt_E2qI.swf", pszSpec="*.mov") returned 0 [0142.936] lstrlenA (lpString="*.mov") returned 5 [0142.936] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4VzP7DNt_E2qI.swf", pszSpec="*.m2v") returned 0 [0142.936] lstrlenA (lpString="*.m2v") returned 5 [0142.936] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4VzP7DNt_E2qI.swf", pszSpec="*.3gp") returned 0 [0142.936] lstrlenA (lpString="*.3gp") returned 5 [0142.936] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4VzP7DNt_E2qI.swf", pszSpec="*.mpeg") returned 0 [0142.936] lstrlenA (lpString="*.mpeg") returned 6 [0142.936] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4VzP7DNt_E2qI.swf", pszSpec="*.mpg") returned 0 [0142.936] lstrlenA (lpString="*.mpg") returned 5 [0142.936] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4VzP7DNt_E2qI.swf", pszSpec="*.flv") returned 0 [0142.936] lstrlenA (lpString="*.flv") returned 5 [0142.936] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4VzP7DNt_E2qI.swf", pszSpec="*.avi") returned 0 [0142.936] lstrlenA (lpString="*.avi") returned 5 [0142.936] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4VzP7DNt_E2qI.swf", pszSpec="*.mp4") returned 0 [0142.936] lstrlenA (lpString="*.mp4") returned 5 [0142.936] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4VzP7DNt_E2qI.swf", pszSpec="*.wmv") returned 0 [0142.936] lstrlenA (lpString="*.wmv") returned 5 [0142.936] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4VzP7DNt_E2qI.swf", pszSpec="*.divx") returned 0 [0142.936] lstrlenA (lpString="*.divx") returned 6 [0142.936] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4VzP7DNt_E2qI.swf", pszSpec="*.mkv") returned 0 [0142.936] lstrlenA (lpString="*.mkv") returned 5 [0142.936] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4VzP7DNt_E2qI.swf", pszSpec="*.mp3") returned 0 [0142.936] lstrlenA (lpString="*.mp3") returned 5 [0142.936] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4VzP7DNt_E2qI.swf", pszSpec="*.wav") returned 0 [0142.936] lstrlenA (lpString="*.wav") returned 5 [0142.936] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4VzP7DNt_E2qI.swf", pszSpec="*.flac") returned 0 [0142.936] lstrlenA (lpString="*.flac") returned 6 [0142.936] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4VzP7DNt_E2qI.swf", pszSpec="*.ape") returned 0 [0142.936] lstrlenA (lpString="*.ape") returned 5 [0142.936] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4VzP7DNt_E2qI.swf", pszSpec="*.wma") returned 0 [0142.936] lstrlenA (lpString="*.wma") returned 5 [0142.936] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4VzP7DNt_E2qI.swf", pszSpec="*.ac3") returned 0 [0142.936] lstrlenA (lpString="*.ac3") returned 5 [0142.936] FindNextFileA (in: hFindFile=0x5be260, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0142.936] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0142.936] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="8R7q.mp3") returned 1 [0142.936] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="8R7q.mp3") returned 1 [0142.936] lstrcmpiA (lpString1="", lpString2="8R7q.mp3") returned -1 [0142.936] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\4VzP7DNt_E2qI.swf") returned="4VzP7DNt_E2qI.swf" [0142.936] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\", lpString2="8R7q.mp3" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\8R7q.mp3") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\8R7q.mp3" [0142.936] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\8R7q.mp3", pszSpec="*.zip") returned 0 [0142.936] lstrlenA (lpString="*.zip") returned 5 [0142.936] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\8R7q.mp3", pszSpec="*.rar") returned 0 [0142.936] lstrlenA (lpString="*.rar") returned 5 [0142.937] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\8R7q.mp3", pszSpec="*.7z") returned 0 [0142.937] lstrlenA (lpString="*.7z") returned 4 [0142.937] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\8R7q.mp3", pszSpec="*.tar") returned 0 [0142.937] lstrlenA (lpString="*.tar") returned 5 [0142.937] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\8R7q.mp3", pszSpec="*.gzip") returned 0 [0142.937] lstrlenA (lpString="*.gzip") returned 6 [0142.937] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\8R7q.mp3", pszSpec="*.jpg") returned 0 [0142.937] lstrlenA (lpString="*.jpg") returned 5 [0142.937] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\8R7q.mp3", pszSpec="*.jpeg") returned 0 [0142.937] lstrlenA (lpString="*.jpeg") returned 6 [0142.937] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\8R7q.mp3", pszSpec="*.psd") returned 0 [0142.937] lstrlenA (lpString="*.psd") returned 5 [0142.937] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\8R7q.mp3", pszSpec="*.cdr") returned 0 [0142.937] lstrlenA (lpString="*.cdr") returned 5 [0142.937] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\8R7q.mp3", pszSpec="*.dwg") returned 0 [0142.937] lstrlenA (lpString="*.dwg") returned 5 [0142.937] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\8R7q.mp3", pszSpec="*.max") returned 0 [0142.937] lstrlenA (lpString="*.max") returned 5 [0142.937] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\8R7q.mp3", pszSpec="*.bmp") returned 0 [0142.937] lstrlenA (lpString="*.bmp") returned 5 [0142.937] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\8R7q.mp3", pszSpec="*.gif") returned 0 [0142.937] lstrlenA (lpString="*.gif") returned 5 [0142.937] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\8R7q.mp3", pszSpec="*.png") returned 0 [0142.937] lstrlenA (lpString="*.png") returned 5 [0142.937] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\8R7q.mp3", pszSpec="*.doc") returned 0 [0142.937] lstrlenA (lpString="*.doc") returned 5 [0142.937] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\8R7q.mp3", pszSpec="*.docx") returned 0 [0142.937] lstrlenA (lpString="*.docx") returned 6 [0142.937] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\8R7q.mp3", pszSpec="*.xls") returned 0 [0142.937] lstrlenA (lpString="*.xls") returned 5 [0142.937] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\8R7q.mp3", pszSpec="*.xlsx") returned 0 [0142.937] lstrlenA (lpString="*.xlsx") returned 6 [0142.937] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\8R7q.mp3", pszSpec="*.ppt") returned 0 [0142.937] lstrlenA (lpString="*.ppt") returned 5 [0142.937] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\8R7q.mp3", pszSpec="*.pptx") returned 0 [0142.937] lstrlenA (lpString="*.pptx") returned 6 [0142.937] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\8R7q.mp3", pszSpec="*.txt") returned 0 [0142.937] lstrlenA (lpString="*.txt") returned 5 [0142.937] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\8R7q.mp3", pszSpec="*.pdf") returned 0 [0142.937] lstrlenA (lpString="*.pdf") returned 5 [0142.937] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\8R7q.mp3", pszSpec="*.djvu") returned 0 [0142.937] lstrlenA (lpString="*.djvu") returned 6 [0142.937] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\8R7q.mp3", pszSpec="*.htm") returned 0 [0142.937] lstrlenA (lpString="*.htm") returned 5 [0142.937] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\8R7q.mp3", pszSpec="*.html") returned 0 [0142.937] lstrlenA (lpString="*.html") returned 6 [0142.937] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\8R7q.mp3", pszSpec="*.mdb") returned 0 [0142.938] lstrlenA (lpString="*.mdb") returned 5 [0142.938] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\8R7q.mp3", pszSpec="*.cer") returned 0 [0142.938] lstrlenA (lpString="*.cer") returned 5 [0142.938] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\8R7q.mp3", pszSpec="*.p12") returned 0 [0142.938] lstrlenA (lpString="*.p12") returned 5 [0142.938] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\8R7q.mp3", pszSpec="*.pfx") returned 0 [0142.938] lstrlenA (lpString="*.pfx") returned 5 [0142.938] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\8R7q.mp3", pszSpec="*.kwm") returned 0 [0142.938] lstrlenA (lpString="*.kwm") returned 5 [0142.938] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\8R7q.mp3", pszSpec="*.pwm") returned 0 [0142.938] lstrlenA (lpString="*.pwm") returned 5 [0142.938] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\8R7q.mp3", pszSpec="*.1cd") returned 0 [0142.938] lstrlenA (lpString="*.1cd") returned 5 [0142.938] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\8R7q.mp3", pszSpec="*.md") returned 0 [0142.938] lstrlenA (lpString="*.md") returned 4 [0142.938] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\8R7q.mp3", pszSpec="*.mdf") returned 0 [0142.938] lstrlenA (lpString="*.mdf") returned 5 [0142.938] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\8R7q.mp3", pszSpec="*.dbf") returned 0 [0142.938] lstrlenA (lpString="*.dbf") returned 5 [0142.938] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\8R7q.mp3", pszSpec="*.odt") returned 0 [0142.938] lstrlenA (lpString="*.odt") returned 5 [0142.938] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\8R7q.mp3", pszSpec="*.vob") returned 0 [0142.938] lstrlenA (lpString="*.vob") returned 5 [0142.938] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\8R7q.mp3", pszSpec="*.ifo") returned 0 [0142.938] lstrlenA (lpString="*.ifo") returned 5 [0142.938] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\8R7q.mp3", pszSpec="*.lnk") returned 0 [0142.938] lstrlenA (lpString="*.lnk") returned 5 [0142.938] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\8R7q.mp3", pszSpec="*.torrent") returned 0 [0142.938] lstrlenA (lpString="*.torrent") returned 9 [0142.938] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\8R7q.mp3", pszSpec="*.mov") returned 0 [0142.938] lstrlenA (lpString="*.mov") returned 5 [0142.938] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\8R7q.mp3", pszSpec="*.m2v") returned 0 [0142.938] lstrlenA (lpString="*.m2v") returned 5 [0142.938] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\8R7q.mp3", pszSpec="*.3gp") returned 0 [0142.938] lstrlenA (lpString="*.3gp") returned 5 [0142.939] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\8R7q.mp3", pszSpec="*.mpeg") returned 0 [0142.939] lstrlenA (lpString="*.mpeg") returned 6 [0142.939] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\8R7q.mp3", pszSpec="*.mpg") returned 0 [0142.939] lstrlenA (lpString="*.mpg") returned 5 [0142.939] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\8R7q.mp3", pszSpec="*.flv") returned 0 [0142.939] lstrlenA (lpString="*.flv") returned 5 [0142.939] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\8R7q.mp3", pszSpec="*.avi") returned 0 [0142.939] lstrlenA (lpString="*.avi") returned 5 [0142.939] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\8R7q.mp3", pszSpec="*.mp4") returned 0 [0142.939] lstrlenA (lpString="*.mp4") returned 5 [0142.939] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\8R7q.mp3", pszSpec="*.wmv") returned 0 [0142.939] lstrlenA (lpString="*.wmv") returned 5 [0142.939] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\8R7q.mp3", pszSpec="*.divx") returned 0 [0142.939] lstrlenA (lpString="*.divx") returned 6 [0142.939] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\8R7q.mp3", pszSpec="*.mkv") returned 0 [0142.939] lstrlenA (lpString="*.mkv") returned 5 [0142.939] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\8R7q.mp3", pszSpec="*.mp3") returned 1 [0142.939] lstrlenA (lpString="*.mp3") returned 5 [0142.939] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\8R7q.mp3" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\8R7q.mp3") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\8R7q.mp3" [0142.939] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\8R7q.mp3" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\8R7q.mp3") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\8R7q.mp3" [0142.939] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\8R7q.mp3", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\8R7q.mp3.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\8R7q.mp3." [0142.939] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\8R7q.mp3.", lpString2="\xa0" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\8R7q.mp3. ") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\8R7q.mp3. " [0142.939] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\8R7q.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\8r7q.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0142.940] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x6b12 [0142.940] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x2d0a47a0, dwHighDateTime=0x1d4ac95), lpLastAccessTime=0x407536*(dwLowDateTime=0xa9b68540, dwHighDateTime=0x1d4aa4a), lpLastWriteTime=0x40753e*(dwLowDateTime=0xa9b68540, dwHighDateTime=0x1d4aa4a)) returned 1 [0142.940] SetFilePointer (in: hFile=0x90, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0142.940] ReadFile (in: hFile=0x90, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x6ab8, lpOverlapped=0x0) returned 1 [0142.941] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\8R7q.mp3") returned="8R7q.mp3" [0142.941] SetFilePointer (in: hFile=0x90, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0142.941] WriteFile (in: hFile=0x90, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x6ab8, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x6ab8, lpOverlapped=0x0) returned 1 [0142.941] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0142.941] CloseHandle (hObject=0x90) returned 1 [0142.941] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\8R7q.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\8r7q.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\8R7q.mp3. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\8r7q.mp3. ")) returned 1 [0142.942] FindNextFileA (in: hFindFile=0x5be260, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0142.943] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0142.943] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="AdobeARM.log") returned 1 [0142.943] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="AdobeARM.log") returned 1 [0142.943] lstrcmpiA (lpString1="", lpString2="AdobeARM.log") returned -1 [0142.943] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\8R7q.mp3") returned="8R7q.mp3" [0142.943] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\", lpString2="AdobeARM.log" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\AdobeARM.log") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\AdobeARM.log" [0142.943] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\AdobeARM.log", pszSpec="*.zip") returned 0 [0142.943] lstrlenA (lpString="*.zip") returned 5 [0142.943] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\AdobeARM.log", pszSpec="*.rar") returned 0 [0142.943] lstrlenA (lpString="*.rar") returned 5 [0142.943] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\AdobeARM.log", pszSpec="*.7z") returned 0 [0142.943] lstrlenA (lpString="*.7z") returned 4 [0142.943] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\AdobeARM.log", pszSpec="*.tar") returned 0 [0142.943] lstrlenA (lpString="*.tar") returned 5 [0142.943] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\AdobeARM.log", pszSpec="*.gzip") returned 0 [0142.943] lstrlenA (lpString="*.gzip") returned 6 [0142.943] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\AdobeARM.log", pszSpec="*.jpg") returned 0 [0142.943] lstrlenA (lpString="*.jpg") returned 5 [0142.943] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\AdobeARM.log", pszSpec="*.jpeg") returned 0 [0142.943] lstrlenA (lpString="*.jpeg") returned 6 [0142.943] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\AdobeARM.log", pszSpec="*.psd") returned 0 [0142.943] lstrlenA (lpString="*.psd") returned 5 [0142.943] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\AdobeARM.log", pszSpec="*.cdr") returned 0 [0142.943] lstrlenA (lpString="*.cdr") returned 5 [0142.943] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\AdobeARM.log", pszSpec="*.dwg") returned 0 [0142.943] lstrlenA (lpString="*.dwg") returned 5 [0142.943] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\AdobeARM.log", pszSpec="*.max") returned 0 [0142.943] lstrlenA (lpString="*.max") returned 5 [0142.943] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\AdobeARM.log", pszSpec="*.bmp") returned 0 [0142.943] lstrlenA (lpString="*.bmp") returned 5 [0142.943] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\AdobeARM.log", pszSpec="*.gif") returned 0 [0142.943] lstrlenA (lpString="*.gif") returned 5 [0142.943] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\AdobeARM.log", pszSpec="*.png") returned 0 [0142.943] lstrlenA (lpString="*.png") returned 5 [0142.943] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\AdobeARM.log", pszSpec="*.doc") returned 0 [0142.945] lstrlenA (lpString="*.doc") returned 5 [0142.945] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\AdobeARM.log", pszSpec="*.docx") returned 0 [0142.945] lstrlenA (lpString="*.docx") returned 6 [0142.945] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\AdobeARM.log", pszSpec="*.xls") returned 0 [0142.945] lstrlenA (lpString="*.xls") returned 5 [0142.945] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\AdobeARM.log", pszSpec="*.xlsx") returned 0 [0142.945] lstrlenA (lpString="*.xlsx") returned 6 [0142.945] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\AdobeARM.log", pszSpec="*.ppt") returned 0 [0142.945] lstrlenA (lpString="*.ppt") returned 5 [0142.945] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\AdobeARM.log", pszSpec="*.pptx") returned 0 [0142.945] lstrlenA (lpString="*.pptx") returned 6 [0142.945] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\AdobeARM.log", pszSpec="*.txt") returned 0 [0142.945] lstrlenA (lpString="*.txt") returned 5 [0142.946] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\AdobeARM.log", pszSpec="*.pdf") returned 0 [0142.946] lstrlenA (lpString="*.pdf") returned 5 [0142.946] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\AdobeARM.log", pszSpec="*.djvu") returned 0 [0142.946] lstrlenA (lpString="*.djvu") returned 6 [0142.946] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\AdobeARM.log", pszSpec="*.htm") returned 0 [0142.946] lstrlenA (lpString="*.htm") returned 5 [0142.946] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\AdobeARM.log", pszSpec="*.html") returned 0 [0142.946] lstrlenA (lpString="*.html") returned 6 [0142.946] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\AdobeARM.log", pszSpec="*.mdb") returned 0 [0142.946] lstrlenA (lpString="*.mdb") returned 5 [0142.946] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\AdobeARM.log", pszSpec="*.cer") returned 0 [0142.946] lstrlenA (lpString="*.cer") returned 5 [0142.946] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\AdobeARM.log", pszSpec="*.p12") returned 0 [0142.946] lstrlenA (lpString="*.p12") returned 5 [0142.946] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\AdobeARM.log", pszSpec="*.pfx") returned 0 [0142.946] lstrlenA (lpString="*.pfx") returned 5 [0142.946] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\AdobeARM.log", pszSpec="*.kwm") returned 0 [0142.946] lstrlenA (lpString="*.kwm") returned 5 [0142.946] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\AdobeARM.log", pszSpec="*.pwm") returned 0 [0142.946] lstrlenA (lpString="*.pwm") returned 5 [0142.946] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\AdobeARM.log", pszSpec="*.1cd") returned 0 [0142.946] lstrlenA (lpString="*.1cd") returned 5 [0142.946] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\AdobeARM.log", pszSpec="*.md") returned 0 [0142.946] lstrlenA (lpString="*.md") returned 4 [0142.946] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\AdobeARM.log", pszSpec="*.mdf") returned 0 [0142.946] lstrlenA (lpString="*.mdf") returned 5 [0142.946] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\AdobeARM.log", pszSpec="*.dbf") returned 0 [0142.946] lstrlenA (lpString="*.dbf") returned 5 [0142.946] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\AdobeARM.log", pszSpec="*.odt") returned 0 [0142.946] lstrlenA (lpString="*.odt") returned 5 [0142.946] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\AdobeARM.log", pszSpec="*.vob") returned 0 [0142.946] lstrlenA (lpString="*.vob") returned 5 [0142.946] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\AdobeARM.log", pszSpec="*.ifo") returned 0 [0142.946] lstrlenA (lpString="*.ifo") returned 5 [0142.946] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\AdobeARM.log", pszSpec="*.lnk") returned 0 [0142.947] lstrlenA (lpString="*.lnk") returned 5 [0142.947] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\AdobeARM.log", pszSpec="*.torrent") returned 0 [0142.947] lstrlenA (lpString="*.torrent") returned 9 [0142.947] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\AdobeARM.log", pszSpec="*.mov") returned 0 [0142.947] lstrlenA (lpString="*.mov") returned 5 [0142.947] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\AdobeARM.log", pszSpec="*.m2v") returned 0 [0142.947] lstrlenA (lpString="*.m2v") returned 5 [0142.947] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\AdobeARM.log", pszSpec="*.3gp") returned 0 [0142.947] lstrlenA (lpString="*.3gp") returned 5 [0142.947] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\AdobeARM.log", pszSpec="*.mpeg") returned 0 [0142.947] lstrlenA (lpString="*.mpeg") returned 6 [0142.947] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\AdobeARM.log", pszSpec="*.mpg") returned 0 [0142.947] lstrlenA (lpString="*.mpg") returned 5 [0142.947] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\AdobeARM.log", pszSpec="*.flv") returned 0 [0142.947] lstrlenA (lpString="*.flv") returned 5 [0142.947] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\AdobeARM.log", pszSpec="*.avi") returned 0 [0142.947] lstrlenA (lpString="*.avi") returned 5 [0142.947] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\AdobeARM.log", pszSpec="*.mp4") returned 0 [0142.947] lstrlenA (lpString="*.mp4") returned 5 [0142.947] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\AdobeARM.log", pszSpec="*.wmv") returned 0 [0142.947] lstrlenA (lpString="*.wmv") returned 5 [0142.947] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\AdobeARM.log", pszSpec="*.divx") returned 0 [0142.947] lstrlenA (lpString="*.divx") returned 6 [0142.947] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\AdobeARM.log", pszSpec="*.mkv") returned 0 [0142.947] lstrlenA (lpString="*.mkv") returned 5 [0142.947] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\AdobeARM.log", pszSpec="*.mp3") returned 0 [0142.947] lstrlenA (lpString="*.mp3") returned 5 [0142.947] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\AdobeARM.log", pszSpec="*.wav") returned 0 [0142.947] lstrlenA (lpString="*.wav") returned 5 [0142.947] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\AdobeARM.log", pszSpec="*.flac") returned 0 [0142.947] lstrlenA (lpString="*.flac") returned 6 [0142.947] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\AdobeARM.log", pszSpec="*.ape") returned 0 [0142.947] lstrlenA (lpString="*.ape") returned 5 [0142.947] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\AdobeARM.log", pszSpec="*.wma") returned 0 [0142.947] lstrlenA (lpString="*.wma") returned 5 [0142.947] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\AdobeARM.log", pszSpec="*.ac3") returned 0 [0142.948] lstrlenA (lpString="*.ac3") returned 5 [0142.948] FindNextFileA (in: hFindFile=0x5be260, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0142.948] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0142.948] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="aVxm2av8XZH.csv") returned 1 [0142.948] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="aVxm2av8XZH.csv") returned 1 [0142.948] lstrcmpiA (lpString1="", lpString2="aVxm2av8XZH.csv") returned -1 [0142.948] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\AdobeARM.log") returned="AdobeARM.log" [0142.948] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\", lpString2="aVxm2av8XZH.csv" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\aVxm2av8XZH.csv") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\aVxm2av8XZH.csv" [0142.948] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\aVxm2av8XZH.csv", pszSpec="*.zip") returned 0 [0142.948] lstrlenA (lpString="*.zip") returned 5 [0142.948] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\aVxm2av8XZH.csv", pszSpec="*.rar") returned 0 [0142.948] lstrlenA (lpString="*.rar") returned 5 [0142.948] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\aVxm2av8XZH.csv", pszSpec="*.7z") returned 0 [0142.948] lstrlenA (lpString="*.7z") returned 4 [0142.948] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\aVxm2av8XZH.csv", pszSpec="*.tar") returned 0 [0142.948] lstrlenA (lpString="*.tar") returned 5 [0142.948] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\aVxm2av8XZH.csv", pszSpec="*.gzip") returned 0 [0142.948] lstrlenA (lpString="*.gzip") returned 6 [0142.948] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\aVxm2av8XZH.csv", pszSpec="*.jpg") returned 0 [0142.948] lstrlenA (lpString="*.jpg") returned 5 [0142.948] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\aVxm2av8XZH.csv", pszSpec="*.jpeg") returned 0 [0142.948] lstrlenA (lpString="*.jpeg") returned 6 [0142.948] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\aVxm2av8XZH.csv", pszSpec="*.psd") returned 0 [0142.948] lstrlenA (lpString="*.psd") returned 5 [0142.948] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\aVxm2av8XZH.csv", pszSpec="*.cdr") returned 0 [0142.948] lstrlenA (lpString="*.cdr") returned 5 [0142.948] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\aVxm2av8XZH.csv", pszSpec="*.dwg") returned 0 [0142.948] lstrlenA (lpString="*.dwg") returned 5 [0142.948] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\aVxm2av8XZH.csv", pszSpec="*.max") returned 0 [0142.948] lstrlenA (lpString="*.max") returned 5 [0142.948] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\aVxm2av8XZH.csv", pszSpec="*.bmp") returned 0 [0142.948] lstrlenA (lpString="*.bmp") returned 5 [0142.948] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\aVxm2av8XZH.csv", pszSpec="*.gif") returned 0 [0142.948] lstrlenA (lpString="*.gif") returned 5 [0142.948] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\aVxm2av8XZH.csv", pszSpec="*.png") returned 0 [0142.949] lstrlenA (lpString="*.png") returned 5 [0142.949] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\aVxm2av8XZH.csv", pszSpec="*.doc") returned 0 [0142.949] lstrlenA (lpString="*.doc") returned 5 [0142.949] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\aVxm2av8XZH.csv", pszSpec="*.docx") returned 0 [0142.949] lstrlenA (lpString="*.docx") returned 6 [0142.949] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\aVxm2av8XZH.csv", pszSpec="*.xls") returned 0 [0142.949] lstrlenA (lpString="*.xls") returned 5 [0142.949] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\aVxm2av8XZH.csv", pszSpec="*.xlsx") returned 0 [0142.949] lstrlenA (lpString="*.xlsx") returned 6 [0142.949] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\aVxm2av8XZH.csv", pszSpec="*.ppt") returned 0 [0142.949] lstrlenA (lpString="*.ppt") returned 5 [0142.949] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\aVxm2av8XZH.csv", pszSpec="*.pptx") returned 0 [0142.949] lstrlenA (lpString="*.pptx") returned 6 [0142.949] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\aVxm2av8XZH.csv", pszSpec="*.txt") returned 0 [0142.949] lstrlenA (lpString="*.txt") returned 5 [0142.949] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\aVxm2av8XZH.csv", pszSpec="*.pdf") returned 0 [0142.949] lstrlenA (lpString="*.pdf") returned 5 [0142.949] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\aVxm2av8XZH.csv", pszSpec="*.djvu") returned 0 [0142.949] lstrlenA (lpString="*.djvu") returned 6 [0142.949] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\aVxm2av8XZH.csv", pszSpec="*.htm") returned 0 [0142.949] lstrlenA (lpString="*.htm") returned 5 [0142.949] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\aVxm2av8XZH.csv", pszSpec="*.html") returned 0 [0142.949] lstrlenA (lpString="*.html") returned 6 [0142.949] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\aVxm2av8XZH.csv", pszSpec="*.mdb") returned 0 [0142.949] lstrlenA (lpString="*.mdb") returned 5 [0142.949] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\aVxm2av8XZH.csv", pszSpec="*.cer") returned 0 [0142.949] lstrlenA (lpString="*.cer") returned 5 [0142.949] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\aVxm2av8XZH.csv", pszSpec="*.p12") returned 0 [0142.949] lstrlenA (lpString="*.p12") returned 5 [0142.949] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\aVxm2av8XZH.csv", pszSpec="*.pfx") returned 0 [0142.949] lstrlenA (lpString="*.pfx") returned 5 [0142.949] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\aVxm2av8XZH.csv", pszSpec="*.kwm") returned 0 [0142.949] lstrlenA (lpString="*.kwm") returned 5 [0142.949] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\aVxm2av8XZH.csv", pszSpec="*.pwm") returned 0 [0142.949] lstrlenA (lpString="*.pwm") returned 5 [0142.949] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\aVxm2av8XZH.csv", pszSpec="*.1cd") returned 0 [0142.950] lstrlenA (lpString="*.1cd") returned 5 [0142.950] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\aVxm2av8XZH.csv", pszSpec="*.md") returned 0 [0142.950] lstrlenA (lpString="*.md") returned 4 [0142.950] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\aVxm2av8XZH.csv", pszSpec="*.mdf") returned 0 [0142.950] lstrlenA (lpString="*.mdf") returned 5 [0142.950] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\aVxm2av8XZH.csv", pszSpec="*.dbf") returned 0 [0142.950] lstrlenA (lpString="*.dbf") returned 5 [0142.950] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\aVxm2av8XZH.csv", pszSpec="*.odt") returned 0 [0142.950] lstrlenA (lpString="*.odt") returned 5 [0142.950] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\aVxm2av8XZH.csv", pszSpec="*.vob") returned 0 [0142.950] lstrlenA (lpString="*.vob") returned 5 [0142.950] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\aVxm2av8XZH.csv", pszSpec="*.ifo") returned 0 [0142.950] lstrlenA (lpString="*.ifo") returned 5 [0142.950] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\aVxm2av8XZH.csv", pszSpec="*.lnk") returned 0 [0142.950] lstrlenA (lpString="*.lnk") returned 5 [0142.950] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\aVxm2av8XZH.csv", pszSpec="*.torrent") returned 0 [0142.950] lstrlenA (lpString="*.torrent") returned 9 [0142.950] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\aVxm2av8XZH.csv", pszSpec="*.mov") returned 0 [0142.950] lstrlenA (lpString="*.mov") returned 5 [0142.950] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\aVxm2av8XZH.csv", pszSpec="*.m2v") returned 0 [0142.950] lstrlenA (lpString="*.m2v") returned 5 [0142.950] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\aVxm2av8XZH.csv", pszSpec="*.3gp") returned 0 [0142.950] lstrlenA (lpString="*.3gp") returned 5 [0142.950] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\aVxm2av8XZH.csv", pszSpec="*.mpeg") returned 0 [0142.950] lstrlenA (lpString="*.mpeg") returned 6 [0142.950] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\aVxm2av8XZH.csv", pszSpec="*.mpg") returned 0 [0142.950] lstrlenA (lpString="*.mpg") returned 5 [0142.950] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\aVxm2av8XZH.csv", pszSpec="*.flv") returned 0 [0142.950] lstrlenA (lpString="*.flv") returned 5 [0142.950] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\aVxm2av8XZH.csv", pszSpec="*.avi") returned 0 [0142.950] lstrlenA (lpString="*.avi") returned 5 [0142.950] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\aVxm2av8XZH.csv", pszSpec="*.mp4") returned 0 [0142.950] lstrlenA (lpString="*.mp4") returned 5 [0142.950] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\aVxm2av8XZH.csv", pszSpec="*.wmv") returned 0 [0142.950] lstrlenA (lpString="*.wmv") returned 5 [0142.950] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\aVxm2av8XZH.csv", pszSpec="*.divx") returned 0 [0142.951] lstrlenA (lpString="*.divx") returned 6 [0142.951] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\aVxm2av8XZH.csv", pszSpec="*.mkv") returned 0 [0142.951] lstrlenA (lpString="*.mkv") returned 5 [0142.951] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\aVxm2av8XZH.csv", pszSpec="*.mp3") returned 0 [0142.951] lstrlenA (lpString="*.mp3") returned 5 [0142.951] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\aVxm2av8XZH.csv", pszSpec="*.wav") returned 0 [0142.951] lstrlenA (lpString="*.wav") returned 5 [0142.951] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\aVxm2av8XZH.csv", pszSpec="*.flac") returned 0 [0142.951] lstrlenA (lpString="*.flac") returned 6 [0142.951] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\aVxm2av8XZH.csv", pszSpec="*.ape") returned 0 [0142.951] lstrlenA (lpString="*.ape") returned 5 [0142.951] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\aVxm2av8XZH.csv", pszSpec="*.wma") returned 0 [0142.951] lstrlenA (lpString="*.wma") returned 5 [0142.951] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\aVxm2av8XZH.csv", pszSpec="*.ac3") returned 0 [0142.951] lstrlenA (lpString="*.ac3") returned 5 [0142.951] FindNextFileA (in: hFindFile=0x5be260, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0142.951] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0142.951] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BfIF-NZW2gwVPq3xm-8.bmp") returned 1 [0142.951] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BfIF-NZW2gwVPq3xm-8.bmp") returned 1 [0142.951] lstrcmpiA (lpString1="", lpString2="BfIF-NZW2gwVPq3xm-8.bmp") returned -1 [0142.951] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\aVxm2av8XZH.csv") returned="aVxm2av8XZH.csv" [0142.951] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\", lpString2="BfIF-NZW2gwVPq3xm-8.bmp" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\BfIF-NZW2gwVPq3xm-8.bmp") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\BfIF-NZW2gwVPq3xm-8.bmp" [0142.951] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\BfIF-NZW2gwVPq3xm-8.bmp", pszSpec="*.zip") returned 0 [0142.951] lstrlenA (lpString="*.zip") returned 5 [0142.951] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\BfIF-NZW2gwVPq3xm-8.bmp", pszSpec="*.rar") returned 0 [0142.951] lstrlenA (lpString="*.rar") returned 5 [0142.951] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\BfIF-NZW2gwVPq3xm-8.bmp", pszSpec="*.7z") returned 0 [0142.951] lstrlenA (lpString="*.7z") returned 4 [0142.951] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\BfIF-NZW2gwVPq3xm-8.bmp", pszSpec="*.tar") returned 0 [0142.951] lstrlenA (lpString="*.tar") returned 5 [0142.951] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\BfIF-NZW2gwVPq3xm-8.bmp", pszSpec="*.gzip") returned 0 [0142.951] lstrlenA (lpString="*.gzip") returned 6 [0142.951] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\BfIF-NZW2gwVPq3xm-8.bmp", pszSpec="*.jpg") returned 0 [0142.951] lstrlenA (lpString="*.jpg") returned 5 [0142.951] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\BfIF-NZW2gwVPq3xm-8.bmp", pszSpec="*.jpeg") returned 0 [0142.952] lstrlenA (lpString="*.jpeg") returned 6 [0142.952] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\BfIF-NZW2gwVPq3xm-8.bmp", pszSpec="*.psd") returned 0 [0142.952] lstrlenA (lpString="*.psd") returned 5 [0142.952] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\BfIF-NZW2gwVPq3xm-8.bmp", pszSpec="*.cdr") returned 0 [0142.952] lstrlenA (lpString="*.cdr") returned 5 [0142.952] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\BfIF-NZW2gwVPq3xm-8.bmp", pszSpec="*.dwg") returned 0 [0142.952] lstrlenA (lpString="*.dwg") returned 5 [0142.952] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\BfIF-NZW2gwVPq3xm-8.bmp", pszSpec="*.max") returned 0 [0142.952] lstrlenA (lpString="*.max") returned 5 [0142.952] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\BfIF-NZW2gwVPq3xm-8.bmp", pszSpec="*.bmp") returned 1 [0142.952] lstrlenA (lpString="*.bmp") returned 5 [0142.952] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\BfIF-NZW2gwVPq3xm-8.bmp" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\BfIF-NZW2gwVPq3xm-8.bmp") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\BfIF-NZW2gwVPq3xm-8.bmp" [0142.952] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\BfIF-NZW2gwVPq3xm-8.bmp" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\BfIF-NZW2gwVPq3xm-8.bmp") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\BfIF-NZW2gwVPq3xm-8.bmp" [0142.952] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\BfIF-NZW2gwVPq3xm-8.bmp", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\BfIF-NZW2gwVPq3xm-8.bmp.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\BfIF-NZW2gwVPq3xm-8.bmp." [0142.952] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\BfIF-NZW2gwVPq3xm-8.bmp.", lpString2="\xa0" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\BfIF-NZW2gwVPq3xm-8.bmp. ") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\BfIF-NZW2gwVPq3xm-8.bmp. " [0142.952] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\BfIF-NZW2gwVPq3xm-8.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\bfif-nzw2gwvpq3xm-8.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0142.953] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x17da4 [0142.953] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x7569bfc0, dwHighDateTime=0x1d49df5), lpLastAccessTime=0x407536*(dwLowDateTime=0x9f38c4b0, dwHighDateTime=0x1d49fe2), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9f38c4b0, dwHighDateTime=0x1d49fe2)) returned 1 [0142.953] SetFilePointer (in: hFile=0x90, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0142.953] ReadFile (in: hFile=0x90, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x17d4a, lpOverlapped=0x0) returned 1 [0142.954] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\BfIF-NZW2gwVPq3xm-8.bmp") returned="BfIF-NZW2gwVPq3xm-8.bmp" [0142.954] SetFilePointer (in: hFile=0x90, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0142.954] WriteFile (in: hFile=0x90, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x17d4a, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x17d4a, lpOverlapped=0x0) returned 1 [0142.955] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0142.955] CloseHandle (hObject=0x90) returned 1 [0142.955] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\BfIF-NZW2gwVPq3xm-8.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\bfif-nzw2gwvpq3xm-8.bmp"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\BfIF-NZW2gwVPq3xm-8.bmp. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\bfif-nzw2gwvpq3xm-8.bmp. ")) returned 1 [0142.956] FindNextFileA (in: hFindFile=0x5be260, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0142.956] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0142.956] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BQZYfjQQRTpm3YUAWywC.csv") returned 1 [0142.956] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BQZYfjQQRTpm3YUAWywC.csv") returned 1 [0142.956] lstrcmpiA (lpString1="", lpString2="BQZYfjQQRTpm3YUAWywC.csv") returned -1 [0142.956] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\BfIF-NZW2gwVPq3xm-8.bmp") returned="BfIF-NZW2gwVPq3xm-8.bmp" [0142.956] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\", lpString2="BQZYfjQQRTpm3YUAWywC.csv" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\BQZYfjQQRTpm3YUAWywC.csv") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\BQZYfjQQRTpm3YUAWywC.csv" [0142.956] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\BQZYfjQQRTpm3YUAWywC.csv", pszSpec="*.zip") returned 0 [0142.956] lstrlenA (lpString="*.zip") returned 5 [0142.956] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\BQZYfjQQRTpm3YUAWywC.csv", pszSpec="*.rar") returned 0 [0142.956] lstrlenA (lpString="*.rar") returned 5 [0142.956] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\BQZYfjQQRTpm3YUAWywC.csv", pszSpec="*.7z") returned 0 [0142.957] lstrlenA (lpString="*.7z") returned 4 [0142.957] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\BQZYfjQQRTpm3YUAWywC.csv", pszSpec="*.tar") returned 0 [0142.957] lstrlenA (lpString="*.tar") returned 5 [0142.957] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\BQZYfjQQRTpm3YUAWywC.csv", pszSpec="*.gzip") returned 0 [0142.957] lstrlenA (lpString="*.gzip") returned 6 [0142.957] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\BQZYfjQQRTpm3YUAWywC.csv", pszSpec="*.jpg") returned 0 [0142.957] lstrlenA (lpString="*.jpg") returned 5 [0142.957] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\BQZYfjQQRTpm3YUAWywC.csv", pszSpec="*.jpeg") returned 0 [0142.957] lstrlenA (lpString="*.jpeg") returned 6 [0142.957] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\BQZYfjQQRTpm3YUAWywC.csv", pszSpec="*.psd") returned 0 [0142.957] lstrlenA (lpString="*.psd") returned 5 [0142.957] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\BQZYfjQQRTpm3YUAWywC.csv", pszSpec="*.cdr") returned 0 [0142.957] lstrlenA (lpString="*.cdr") returned 5 [0142.957] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\BQZYfjQQRTpm3YUAWywC.csv", pszSpec="*.dwg") returned 0 [0142.957] lstrlenA (lpString="*.dwg") returned 5 [0142.957] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\BQZYfjQQRTpm3YUAWywC.csv", pszSpec="*.max") returned 0 [0142.957] lstrlenA (lpString="*.max") returned 5 [0142.957] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\BQZYfjQQRTpm3YUAWywC.csv", pszSpec="*.bmp") returned 0 [0142.957] lstrlenA (lpString="*.bmp") returned 5 [0142.957] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\BQZYfjQQRTpm3YUAWywC.csv", pszSpec="*.gif") returned 0 [0142.957] lstrlenA (lpString="*.gif") returned 5 [0142.957] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\BQZYfjQQRTpm3YUAWywC.csv", pszSpec="*.png") returned 0 [0142.957] lstrlenA (lpString="*.png") returned 5 [0142.957] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\BQZYfjQQRTpm3YUAWywC.csv", pszSpec="*.doc") returned 0 [0142.957] lstrlenA (lpString="*.doc") returned 5 [0142.957] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\BQZYfjQQRTpm3YUAWywC.csv", pszSpec="*.docx") returned 0 [0142.957] lstrlenA (lpString="*.docx") returned 6 [0142.957] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\BQZYfjQQRTpm3YUAWywC.csv", pszSpec="*.xls") returned 0 [0142.957] lstrlenA (lpString="*.xls") returned 5 [0142.957] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\BQZYfjQQRTpm3YUAWywC.csv", pszSpec="*.xlsx") returned 0 [0142.957] lstrlenA (lpString="*.xlsx") returned 6 [0142.957] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\BQZYfjQQRTpm3YUAWywC.csv", pszSpec="*.ppt") returned 0 [0142.957] lstrlenA (lpString="*.ppt") returned 5 [0142.957] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\BQZYfjQQRTpm3YUAWywC.csv", pszSpec="*.pptx") returned 0 [0142.957] lstrlenA (lpString="*.pptx") returned 6 [0142.957] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\BQZYfjQQRTpm3YUAWywC.csv", pszSpec="*.txt") returned 0 [0142.957] lstrlenA (lpString="*.txt") returned 5 [0142.958] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\BQZYfjQQRTpm3YUAWywC.csv", pszSpec="*.pdf") returned 0 [0142.958] lstrlenA (lpString="*.pdf") returned 5 [0142.958] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\BQZYfjQQRTpm3YUAWywC.csv", pszSpec="*.djvu") returned 0 [0142.958] lstrlenA (lpString="*.djvu") returned 6 [0142.958] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\BQZYfjQQRTpm3YUAWywC.csv", pszSpec="*.htm") returned 0 [0142.958] lstrlenA (lpString="*.htm") returned 5 [0142.958] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\BQZYfjQQRTpm3YUAWywC.csv", pszSpec="*.html") returned 0 [0142.958] lstrlenA (lpString="*.html") returned 6 [0142.958] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\BQZYfjQQRTpm3YUAWywC.csv", pszSpec="*.mdb") returned 0 [0142.958] lstrlenA (lpString="*.mdb") returned 5 [0142.958] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\BQZYfjQQRTpm3YUAWywC.csv", pszSpec="*.cer") returned 0 [0142.958] lstrlenA (lpString="*.cer") returned 5 [0142.958] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\BQZYfjQQRTpm3YUAWywC.csv", pszSpec="*.p12") returned 0 [0142.958] lstrlenA (lpString="*.p12") returned 5 [0142.958] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\BQZYfjQQRTpm3YUAWywC.csv", pszSpec="*.pfx") returned 0 [0142.958] lstrlenA (lpString="*.pfx") returned 5 [0142.958] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\BQZYfjQQRTpm3YUAWywC.csv", pszSpec="*.kwm") returned 0 [0142.958] lstrlenA (lpString="*.kwm") returned 5 [0142.958] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\BQZYfjQQRTpm3YUAWywC.csv", pszSpec="*.pwm") returned 0 [0142.958] lstrlenA (lpString="*.pwm") returned 5 [0142.958] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\BQZYfjQQRTpm3YUAWywC.csv", pszSpec="*.1cd") returned 0 [0142.958] lstrlenA (lpString="*.1cd") returned 5 [0142.958] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\BQZYfjQQRTpm3YUAWywC.csv", pszSpec="*.md") returned 0 [0142.958] lstrlenA (lpString="*.md") returned 4 [0142.958] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\BQZYfjQQRTpm3YUAWywC.csv", pszSpec="*.mdf") returned 0 [0142.958] lstrlenA (lpString="*.mdf") returned 5 [0142.958] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\BQZYfjQQRTpm3YUAWywC.csv", pszSpec="*.dbf") returned 0 [0142.958] lstrlenA (lpString="*.dbf") returned 5 [0142.958] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\BQZYfjQQRTpm3YUAWywC.csv", pszSpec="*.odt") returned 0 [0142.958] lstrlenA (lpString="*.odt") returned 5 [0142.958] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\BQZYfjQQRTpm3YUAWywC.csv", pszSpec="*.vob") returned 0 [0142.958] lstrlenA (lpString="*.vob") returned 5 [0142.958] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\BQZYfjQQRTpm3YUAWywC.csv", pszSpec="*.ifo") returned 0 [0142.958] lstrlenA (lpString="*.ifo") returned 5 [0142.958] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\BQZYfjQQRTpm3YUAWywC.csv", pszSpec="*.lnk") returned 0 [0142.958] lstrlenA (lpString="*.lnk") returned 5 [0142.958] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\BQZYfjQQRTpm3YUAWywC.csv", pszSpec="*.torrent") returned 0 [0142.959] lstrlenA (lpString="*.torrent") returned 9 [0142.959] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\BQZYfjQQRTpm3YUAWywC.csv", pszSpec="*.mov") returned 0 [0142.959] lstrlenA (lpString="*.mov") returned 5 [0142.959] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\BQZYfjQQRTpm3YUAWywC.csv", pszSpec="*.m2v") returned 0 [0142.959] lstrlenA (lpString="*.m2v") returned 5 [0142.959] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\BQZYfjQQRTpm3YUAWywC.csv", pszSpec="*.3gp") returned 0 [0142.959] lstrlenA (lpString="*.3gp") returned 5 [0142.959] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\BQZYfjQQRTpm3YUAWywC.csv", pszSpec="*.mpeg") returned 0 [0142.959] lstrlenA (lpString="*.mpeg") returned 6 [0142.959] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\BQZYfjQQRTpm3YUAWywC.csv", pszSpec="*.mpg") returned 0 [0142.959] lstrlenA (lpString="*.mpg") returned 5 [0142.959] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\BQZYfjQQRTpm3YUAWywC.csv", pszSpec="*.flv") returned 0 [0142.959] lstrlenA (lpString="*.flv") returned 5 [0142.959] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\BQZYfjQQRTpm3YUAWywC.csv", pszSpec="*.avi") returned 0 [0142.959] lstrlenA (lpString="*.avi") returned 5 [0142.959] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\BQZYfjQQRTpm3YUAWywC.csv", pszSpec="*.mp4") returned 0 [0142.959] lstrlenA (lpString="*.mp4") returned 5 [0142.959] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\BQZYfjQQRTpm3YUAWywC.csv", pszSpec="*.wmv") returned 0 [0142.959] lstrlenA (lpString="*.wmv") returned 5 [0142.959] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\BQZYfjQQRTpm3YUAWywC.csv", pszSpec="*.divx") returned 0 [0142.959] lstrlenA (lpString="*.divx") returned 6 [0142.959] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\BQZYfjQQRTpm3YUAWywC.csv", pszSpec="*.mkv") returned 0 [0142.959] lstrlenA (lpString="*.mkv") returned 5 [0142.959] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\BQZYfjQQRTpm3YUAWywC.csv", pszSpec="*.mp3") returned 0 [0142.959] lstrlenA (lpString="*.mp3") returned 5 [0142.959] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\BQZYfjQQRTpm3YUAWywC.csv", pszSpec="*.wav") returned 0 [0142.959] lstrlenA (lpString="*.wav") returned 5 [0142.959] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\BQZYfjQQRTpm3YUAWywC.csv", pszSpec="*.flac") returned 0 [0142.960] lstrlenA (lpString="*.flac") returned 6 [0142.960] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\BQZYfjQQRTpm3YUAWywC.csv", pszSpec="*.ape") returned 0 [0142.960] lstrlenA (lpString="*.ape") returned 5 [0142.960] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\BQZYfjQQRTpm3YUAWywC.csv", pszSpec="*.wma") returned 0 [0142.960] lstrlenA (lpString="*.wma") returned 5 [0142.960] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\BQZYfjQQRTpm3YUAWywC.csv", pszSpec="*.ac3") returned 0 [0142.960] lstrlenA (lpString="*.ac3") returned 5 [0142.960] FindNextFileA (in: hFindFile=0x5be260, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0142.960] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0142.960] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="cdubcOgHbFDaHV3FcFw.mkv") returned 1 [0142.960] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="cdubcOgHbFDaHV3FcFw.mkv") returned 1 [0142.960] lstrcmpiA (lpString1="", lpString2="cdubcOgHbFDaHV3FcFw.mkv") returned -1 [0142.960] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\BQZYfjQQRTpm3YUAWywC.csv") returned="BQZYfjQQRTpm3YUAWywC.csv" [0142.960] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\", lpString2="cdubcOgHbFDaHV3FcFw.mkv" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\cdubcOgHbFDaHV3FcFw.mkv") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\cdubcOgHbFDaHV3FcFw.mkv" [0142.960] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\cdubcOgHbFDaHV3FcFw.mkv", pszSpec="*.zip") returned 0 [0142.960] lstrlenA (lpString="*.zip") returned 5 [0142.960] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\cdubcOgHbFDaHV3FcFw.mkv", pszSpec="*.rar") returned 0 [0142.960] lstrlenA (lpString="*.rar") returned 5 [0142.960] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\cdubcOgHbFDaHV3FcFw.mkv", pszSpec="*.7z") returned 0 [0142.960] lstrlenA (lpString="*.7z") returned 4 [0142.960] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\cdubcOgHbFDaHV3FcFw.mkv", pszSpec="*.tar") returned 0 [0142.960] lstrlenA (lpString="*.tar") returned 5 [0142.960] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\cdubcOgHbFDaHV3FcFw.mkv", pszSpec="*.gzip") returned 0 [0142.960] lstrlenA (lpString="*.gzip") returned 6 [0142.960] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\cdubcOgHbFDaHV3FcFw.mkv", pszSpec="*.jpg") returned 0 [0142.960] lstrlenA (lpString="*.jpg") returned 5 [0142.960] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\cdubcOgHbFDaHV3FcFw.mkv", pszSpec="*.jpeg") returned 0 [0142.960] lstrlenA (lpString="*.jpeg") returned 6 [0142.960] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\cdubcOgHbFDaHV3FcFw.mkv", pszSpec="*.psd") returned 0 [0142.960] lstrlenA (lpString="*.psd") returned 5 [0142.960] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\cdubcOgHbFDaHV3FcFw.mkv", pszSpec="*.cdr") returned 0 [0142.960] lstrlenA (lpString="*.cdr") returned 5 [0142.960] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\cdubcOgHbFDaHV3FcFw.mkv", pszSpec="*.dwg") returned 0 [0142.960] lstrlenA (lpString="*.dwg") returned 5 [0142.960] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\cdubcOgHbFDaHV3FcFw.mkv", pszSpec="*.max") returned 0 [0142.960] lstrlenA (lpString="*.max") returned 5 [0142.961] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\cdubcOgHbFDaHV3FcFw.mkv", pszSpec="*.bmp") returned 0 [0142.961] lstrlenA (lpString="*.bmp") returned 5 [0142.961] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\cdubcOgHbFDaHV3FcFw.mkv", pszSpec="*.gif") returned 0 [0142.961] lstrlenA (lpString="*.gif") returned 5 [0142.961] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\cdubcOgHbFDaHV3FcFw.mkv", pszSpec="*.png") returned 0 [0142.961] lstrlenA (lpString="*.png") returned 5 [0142.961] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\cdubcOgHbFDaHV3FcFw.mkv", pszSpec="*.doc") returned 0 [0142.961] lstrlenA (lpString="*.doc") returned 5 [0142.961] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\cdubcOgHbFDaHV3FcFw.mkv", pszSpec="*.docx") returned 0 [0142.961] lstrlenA (lpString="*.docx") returned 6 [0142.961] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\cdubcOgHbFDaHV3FcFw.mkv", pszSpec="*.xls") returned 0 [0142.961] lstrlenA (lpString="*.xls") returned 5 [0142.961] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\cdubcOgHbFDaHV3FcFw.mkv", pszSpec="*.xlsx") returned 0 [0142.961] lstrlenA (lpString="*.xlsx") returned 6 [0142.961] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\cdubcOgHbFDaHV3FcFw.mkv", pszSpec="*.ppt") returned 0 [0142.961] lstrlenA (lpString="*.ppt") returned 5 [0142.961] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\cdubcOgHbFDaHV3FcFw.mkv", pszSpec="*.pptx") returned 0 [0142.961] lstrlenA (lpString="*.pptx") returned 6 [0142.961] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\cdubcOgHbFDaHV3FcFw.mkv", pszSpec="*.txt") returned 0 [0142.961] lstrlenA (lpString="*.txt") returned 5 [0142.961] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\cdubcOgHbFDaHV3FcFw.mkv", pszSpec="*.pdf") returned 0 [0142.961] lstrlenA (lpString="*.pdf") returned 5 [0142.961] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\cdubcOgHbFDaHV3FcFw.mkv", pszSpec="*.djvu") returned 0 [0142.961] lstrlenA (lpString="*.djvu") returned 6 [0142.961] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\cdubcOgHbFDaHV3FcFw.mkv", pszSpec="*.htm") returned 0 [0142.961] lstrlenA (lpString="*.htm") returned 5 [0142.961] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\cdubcOgHbFDaHV3FcFw.mkv", pszSpec="*.html") returned 0 [0142.961] lstrlenA (lpString="*.html") returned 6 [0142.961] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\cdubcOgHbFDaHV3FcFw.mkv", pszSpec="*.mdb") returned 0 [0142.961] lstrlenA (lpString="*.mdb") returned 5 [0142.961] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\cdubcOgHbFDaHV3FcFw.mkv", pszSpec="*.cer") returned 0 [0142.961] lstrlenA (lpString="*.cer") returned 5 [0142.961] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\cdubcOgHbFDaHV3FcFw.mkv", pszSpec="*.p12") returned 0 [0142.961] lstrlenA (lpString="*.p12") returned 5 [0142.961] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\cdubcOgHbFDaHV3FcFw.mkv", pszSpec="*.pfx") returned 0 [0142.961] lstrlenA (lpString="*.pfx") returned 5 [0142.962] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\cdubcOgHbFDaHV3FcFw.mkv", pszSpec="*.kwm") returned 0 [0142.962] lstrlenA (lpString="*.kwm") returned 5 [0142.962] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\cdubcOgHbFDaHV3FcFw.mkv", pszSpec="*.pwm") returned 0 [0142.962] lstrlenA (lpString="*.pwm") returned 5 [0142.962] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\cdubcOgHbFDaHV3FcFw.mkv", pszSpec="*.1cd") returned 0 [0142.962] lstrlenA (lpString="*.1cd") returned 5 [0142.962] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\cdubcOgHbFDaHV3FcFw.mkv", pszSpec="*.md") returned 0 [0142.962] lstrlenA (lpString="*.md") returned 4 [0142.962] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\cdubcOgHbFDaHV3FcFw.mkv", pszSpec="*.mdf") returned 0 [0142.962] lstrlenA (lpString="*.mdf") returned 5 [0142.962] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\cdubcOgHbFDaHV3FcFw.mkv", pszSpec="*.dbf") returned 0 [0142.962] lstrlenA (lpString="*.dbf") returned 5 [0142.962] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\cdubcOgHbFDaHV3FcFw.mkv", pszSpec="*.odt") returned 0 [0142.962] lstrlenA (lpString="*.odt") returned 5 [0142.962] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\cdubcOgHbFDaHV3FcFw.mkv", pszSpec="*.vob") returned 0 [0142.962] lstrlenA (lpString="*.vob") returned 5 [0142.962] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\cdubcOgHbFDaHV3FcFw.mkv", pszSpec="*.ifo") returned 0 [0142.962] lstrlenA (lpString="*.ifo") returned 5 [0142.962] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\cdubcOgHbFDaHV3FcFw.mkv", pszSpec="*.lnk") returned 0 [0142.962] lstrlenA (lpString="*.lnk") returned 5 [0142.962] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\cdubcOgHbFDaHV3FcFw.mkv", pszSpec="*.torrent") returned 0 [0142.962] lstrlenA (lpString="*.torrent") returned 9 [0142.962] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\cdubcOgHbFDaHV3FcFw.mkv", pszSpec="*.mov") returned 0 [0142.962] lstrlenA (lpString="*.mov") returned 5 [0142.962] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\cdubcOgHbFDaHV3FcFw.mkv", pszSpec="*.m2v") returned 0 [0142.962] lstrlenA (lpString="*.m2v") returned 5 [0142.962] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\cdubcOgHbFDaHV3FcFw.mkv", pszSpec="*.3gp") returned 0 [0142.962] lstrlenA (lpString="*.3gp") returned 5 [0142.962] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\cdubcOgHbFDaHV3FcFw.mkv", pszSpec="*.mpeg") returned 0 [0142.962] lstrlenA (lpString="*.mpeg") returned 6 [0142.962] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\cdubcOgHbFDaHV3FcFw.mkv", pszSpec="*.mpg") returned 0 [0142.962] lstrlenA (lpString="*.mpg") returned 5 [0142.962] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\cdubcOgHbFDaHV3FcFw.mkv", pszSpec="*.flv") returned 0 [0142.962] lstrlenA (lpString="*.flv") returned 5 [0142.962] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\cdubcOgHbFDaHV3FcFw.mkv", pszSpec="*.avi") returned 0 [0142.962] lstrlenA (lpString="*.avi") returned 5 [0142.962] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\cdubcOgHbFDaHV3FcFw.mkv", pszSpec="*.mp4") returned 0 [0142.962] lstrlenA (lpString="*.mp4") returned 5 [0142.962] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\cdubcOgHbFDaHV3FcFw.mkv", pszSpec="*.wmv") returned 0 [0142.963] lstrlenA (lpString="*.wmv") returned 5 [0142.963] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\cdubcOgHbFDaHV3FcFw.mkv", pszSpec="*.divx") returned 0 [0142.963] lstrlenA (lpString="*.divx") returned 6 [0142.963] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\cdubcOgHbFDaHV3FcFw.mkv", pszSpec="*.mkv") returned 1 [0142.963] lstrlenA (lpString="*.mkv") returned 5 [0142.963] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\cdubcOgHbFDaHV3FcFw.mkv" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\cdubcOgHbFDaHV3FcFw.mkv") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\cdubcOgHbFDaHV3FcFw.mkv" [0142.963] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\cdubcOgHbFDaHV3FcFw.mkv" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\cdubcOgHbFDaHV3FcFw.mkv") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\cdubcOgHbFDaHV3FcFw.mkv" [0142.963] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\cdubcOgHbFDaHV3FcFw.mkv", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\cdubcOgHbFDaHV3FcFw.mkv.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\cdubcOgHbFDaHV3FcFw.mkv." [0142.963] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\cdubcOgHbFDaHV3FcFw.mkv.", lpString2="\xa0" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\cdubcOgHbFDaHV3FcFw.mkv. ") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\cdubcOgHbFDaHV3FcFw.mkv. " [0142.963] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\cdubcOgHbFDaHV3FcFw.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\cdubcoghbfdahv3fcfw.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0142.963] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x17c79 [0142.963] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x58dc9600, dwHighDateTime=0x1d4a2a2), lpLastAccessTime=0x407536*(dwLowDateTime=0x32f21c60, dwHighDateTime=0x1d4a696), lpLastWriteTime=0x40753e*(dwLowDateTime=0x32f21c60, dwHighDateTime=0x1d4a696)) returned 1 [0142.963] SetFilePointer (in: hFile=0x90, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0142.964] ReadFile (in: hFile=0x90, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x17c1f, lpOverlapped=0x0) returned 1 [0142.965] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\cdubcOgHbFDaHV3FcFw.mkv") returned="cdubcOgHbFDaHV3FcFw.mkv" [0142.965] SetFilePointer (in: hFile=0x90, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0142.965] WriteFile (in: hFile=0x90, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x17c1f, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x17c1f, lpOverlapped=0x0) returned 1 [0142.965] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0142.965] CloseHandle (hObject=0x90) returned 1 [0142.966] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\cdubcOgHbFDaHV3FcFw.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\cdubcoghbfdahv3fcfw.mkv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\cdubcOgHbFDaHV3FcFw.mkv. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\cdubcoghbfdahv3fcfw.mkv. ")) returned 1 [0142.967] FindNextFileA (in: hFindFile=0x5be260, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0142.967] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0142.967] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="cm5kctCGrkcl2QDY5DR.pptx") returned 1 [0142.967] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="cm5kctCGrkcl2QDY5DR.pptx") returned 1 [0142.967] lstrcmpiA (lpString1="", lpString2="cm5kctCGrkcl2QDY5DR.pptx") returned -1 [0142.967] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\cdubcOgHbFDaHV3FcFw.mkv") returned="cdubcOgHbFDaHV3FcFw.mkv" [0142.967] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\", lpString2="cm5kctCGrkcl2QDY5DR.pptx" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\cm5kctCGrkcl2QDY5DR.pptx") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\cm5kctCGrkcl2QDY5DR.pptx" [0142.967] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\cm5kctCGrkcl2QDY5DR.pptx", pszSpec="*.zip") returned 0 [0142.967] lstrlenA (lpString="*.zip") returned 5 [0142.967] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\cm5kctCGrkcl2QDY5DR.pptx", pszSpec="*.rar") returned 0 [0142.967] lstrlenA (lpString="*.rar") returned 5 [0142.967] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\cm5kctCGrkcl2QDY5DR.pptx", pszSpec="*.7z") returned 0 [0142.967] lstrlenA (lpString="*.7z") returned 4 [0142.967] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\cm5kctCGrkcl2QDY5DR.pptx", pszSpec="*.tar") returned 0 [0142.967] lstrlenA (lpString="*.tar") returned 5 [0142.967] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\cm5kctCGrkcl2QDY5DR.pptx", pszSpec="*.gzip") returned 0 [0142.967] lstrlenA (lpString="*.gzip") returned 6 [0142.967] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\cm5kctCGrkcl2QDY5DR.pptx", pszSpec="*.jpg") returned 0 [0142.967] lstrlenA (lpString="*.jpg") returned 5 [0142.967] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\cm5kctCGrkcl2QDY5DR.pptx", pszSpec="*.jpeg") returned 0 [0142.967] lstrlenA (lpString="*.jpeg") returned 6 [0142.968] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\cm5kctCGrkcl2QDY5DR.pptx", pszSpec="*.psd") returned 0 [0142.968] lstrlenA (lpString="*.psd") returned 5 [0142.968] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\cm5kctCGrkcl2QDY5DR.pptx", pszSpec="*.cdr") returned 0 [0142.968] lstrlenA (lpString="*.cdr") returned 5 [0142.968] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\cm5kctCGrkcl2QDY5DR.pptx", pszSpec="*.dwg") returned 0 [0142.968] lstrlenA (lpString="*.dwg") returned 5 [0142.968] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\cm5kctCGrkcl2QDY5DR.pptx", pszSpec="*.max") returned 0 [0142.968] lstrlenA (lpString="*.max") returned 5 [0142.968] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\cm5kctCGrkcl2QDY5DR.pptx", pszSpec="*.bmp") returned 0 [0142.968] lstrlenA (lpString="*.bmp") returned 5 [0142.968] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\cm5kctCGrkcl2QDY5DR.pptx", pszSpec="*.gif") returned 0 [0142.968] lstrlenA (lpString="*.gif") returned 5 [0142.968] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\cm5kctCGrkcl2QDY5DR.pptx", pszSpec="*.png") returned 0 [0142.968] lstrlenA (lpString="*.png") returned 5 [0142.968] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\cm5kctCGrkcl2QDY5DR.pptx", pszSpec="*.doc") returned 0 [0142.968] lstrlenA (lpString="*.doc") returned 5 [0142.968] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\cm5kctCGrkcl2QDY5DR.pptx", pszSpec="*.docx") returned 0 [0142.968] lstrlenA (lpString="*.docx") returned 6 [0142.968] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\cm5kctCGrkcl2QDY5DR.pptx", pszSpec="*.xls") returned 0 [0142.968] lstrlenA (lpString="*.xls") returned 5 [0142.968] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\cm5kctCGrkcl2QDY5DR.pptx", pszSpec="*.xlsx") returned 0 [0142.968] lstrlenA (lpString="*.xlsx") returned 6 [0142.968] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\cm5kctCGrkcl2QDY5DR.pptx", pszSpec="*.ppt") returned 0 [0142.968] lstrlenA (lpString="*.ppt") returned 5 [0142.968] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\cm5kctCGrkcl2QDY5DR.pptx", pszSpec="*.pptx") returned 1 [0142.968] lstrlenA (lpString="*.pptx") returned 6 [0142.968] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\cm5kctCGrkcl2QDY5DR.pptx" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\cm5kctCGrkcl2QDY5DR.pptx") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\cm5kctCGrkcl2QDY5DR.pptx" [0142.968] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\cm5kctCGrkcl2QDY5DR.pptx" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\cm5kctCGrkcl2QDY5DR.pptx") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\cm5kctCGrkcl2QDY5DR.pptx" [0142.968] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\cm5kctCGrkcl2QDY5DR.pptx", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\cm5kctCGrkcl2QDY5DR.pptx.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\cm5kctCGrkcl2QDY5DR.pptx." [0142.968] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\cm5kctCGrkcl2QDY5DR.pptx.", lpString2="\xa0" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\cm5kctCGrkcl2QDY5DR.pptx. ") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\cm5kctCGrkcl2QDY5DR.pptx. " [0142.968] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\cm5kctCGrkcl2QDY5DR.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\cm5kctcgrkcl2qdy5dr.pptx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0142.969] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x158a6 [0142.969] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xf2f1aaa0, dwHighDateTime=0x1d4a55e), lpLastAccessTime=0x407536*(dwLowDateTime=0x863d39a0, dwHighDateTime=0x1d4a280), lpLastWriteTime=0x40753e*(dwLowDateTime=0x863d39a0, dwHighDateTime=0x1d4a280)) returned 1 [0142.969] SetFilePointer (in: hFile=0x90, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0142.969] ReadFile (in: hFile=0x90, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x1584c, lpOverlapped=0x0) returned 1 [0142.970] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\cm5kctCGrkcl2QDY5DR.pptx") returned="cm5kctCGrkcl2QDY5DR.pptx" [0142.970] SetFilePointer (in: hFile=0x90, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0142.970] WriteFile (in: hFile=0x90, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x1584c, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x1584c, lpOverlapped=0x0) returned 1 [0142.971] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0142.971] CloseHandle (hObject=0x90) returned 1 [0142.971] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\cm5kctCGrkcl2QDY5DR.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\cm5kctcgrkcl2qdy5dr.pptx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\cm5kctCGrkcl2QDY5DR.pptx. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\cm5kctcgrkcl2qdy5dr.pptx. ")) returned 1 [0142.972] FindNextFileA (in: hFindFile=0x5be260, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0142.972] lstrcmpA (lpString1=".", lpString2="Cookies") returned -1 [0142.972] lstrcmpA (lpString1="..", lpString2="Cookies") returned -1 [0142.972] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\cm5kctCGrkcl2QDY5DR.pptx") returned="cm5kctCGrkcl2QDY5DR.pptx" [0142.972] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\", lpString2="Cookies" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Cookies") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Cookies" [0142.972] lstrlenA (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Cookies") returned 56 [0142.972] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Cookies\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0142.973] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0142.973] FindNextFileA (in: hFindFile=0x5be2a0, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0142.974] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0142.974] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0142.974] FindNextFileA (in: hFindFile=0x5be2a0, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0142.974] PeekMessageA (in: lpMsg=0xaef84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaef84) returned 0 [0142.974] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="index.dat") returned -1 [0142.974] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="index.dat") returned -1 [0142.974] lstrcmpiA (lpString1="", lpString2="index.dat") returned -1 [0142.974] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Cookies\\*.*") returned="*.*" [0142.974] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Cookies\\", lpString2="index.dat" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Cookies\\index.dat") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Cookies\\index.dat" [0142.974] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Cookies\\index.dat", pszSpec="*.zip") returned 0 [0142.974] lstrlenA (lpString="*.zip") returned 5 [0142.974] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Cookies\\index.dat", pszSpec="*.rar") returned 0 [0142.974] lstrlenA (lpString="*.rar") returned 5 [0142.974] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Cookies\\index.dat", pszSpec="*.7z") returned 0 [0142.974] lstrlenA (lpString="*.7z") returned 4 [0142.974] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Cookies\\index.dat", pszSpec="*.tar") returned 0 [0142.974] lstrlenA (lpString="*.tar") returned 5 [0142.974] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Cookies\\index.dat", pszSpec="*.gzip") returned 0 [0142.974] lstrlenA (lpString="*.gzip") returned 6 [0142.974] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Cookies\\index.dat", pszSpec="*.jpg") returned 0 [0142.974] lstrlenA (lpString="*.jpg") returned 5 [0142.974] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Cookies\\index.dat", pszSpec="*.jpeg") returned 0 [0142.974] lstrlenA (lpString="*.jpeg") returned 6 [0142.974] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Cookies\\index.dat", pszSpec="*.psd") returned 0 [0142.974] lstrlenA (lpString="*.psd") returned 5 [0142.974] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Cookies\\index.dat", pszSpec="*.cdr") returned 0 [0142.974] lstrlenA (lpString="*.cdr") returned 5 [0142.974] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Cookies\\index.dat", pszSpec="*.dwg") returned 0 [0142.974] lstrlenA (lpString="*.dwg") returned 5 [0142.974] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Cookies\\index.dat", pszSpec="*.max") returned 0 [0142.974] lstrlenA (lpString="*.max") returned 5 [0142.974] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Cookies\\index.dat", pszSpec="*.bmp") returned 0 [0142.974] lstrlenA (lpString="*.bmp") returned 5 [0142.974] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Cookies\\index.dat", pszSpec="*.gif") returned 0 [0142.974] lstrlenA (lpString="*.gif") returned 5 [0142.975] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Cookies\\index.dat", pszSpec="*.png") returned 0 [0142.975] lstrlenA (lpString="*.png") returned 5 [0142.975] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Cookies\\index.dat", pszSpec="*.doc") returned 0 [0142.975] lstrlenA (lpString="*.doc") returned 5 [0142.975] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Cookies\\index.dat", pszSpec="*.docx") returned 0 [0142.975] lstrlenA (lpString="*.docx") returned 6 [0142.975] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Cookies\\index.dat", pszSpec="*.xls") returned 0 [0142.975] lstrlenA (lpString="*.xls") returned 5 [0142.975] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Cookies\\index.dat", pszSpec="*.xlsx") returned 0 [0142.975] lstrlenA (lpString="*.xlsx") returned 6 [0142.975] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Cookies\\index.dat", pszSpec="*.ppt") returned 0 [0142.975] lstrlenA (lpString="*.ppt") returned 5 [0142.975] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Cookies\\index.dat", pszSpec="*.pptx") returned 0 [0142.975] lstrlenA (lpString="*.pptx") returned 6 [0142.975] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Cookies\\index.dat", pszSpec="*.txt") returned 0 [0142.975] lstrlenA (lpString="*.txt") returned 5 [0142.975] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Cookies\\index.dat", pszSpec="*.pdf") returned 0 [0142.975] lstrlenA (lpString="*.pdf") returned 5 [0142.975] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Cookies\\index.dat", pszSpec="*.djvu") returned 0 [0142.975] lstrlenA (lpString="*.djvu") returned 6 [0142.975] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Cookies\\index.dat", pszSpec="*.htm") returned 0 [0142.975] lstrlenA (lpString="*.htm") returned 5 [0142.975] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Cookies\\index.dat", pszSpec="*.html") returned 0 [0142.975] lstrlenA (lpString="*.html") returned 6 [0142.975] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Cookies\\index.dat", pszSpec="*.mdb") returned 0 [0142.975] lstrlenA (lpString="*.mdb") returned 5 [0142.975] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Cookies\\index.dat", pszSpec="*.cer") returned 0 [0142.975] lstrlenA (lpString="*.cer") returned 5 [0142.975] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Cookies\\index.dat", pszSpec="*.p12") returned 0 [0142.975] lstrlenA (lpString="*.p12") returned 5 [0142.975] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Cookies\\index.dat", pszSpec="*.pfx") returned 0 [0142.975] lstrlenA (lpString="*.pfx") returned 5 [0142.975] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Cookies\\index.dat", pszSpec="*.kwm") returned 0 [0142.975] lstrlenA (lpString="*.kwm") returned 5 [0142.975] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Cookies\\index.dat", pszSpec="*.pwm") returned 0 [0142.975] lstrlenA (lpString="*.pwm") returned 5 [0142.975] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Cookies\\index.dat", pszSpec="*.1cd") returned 0 [0142.975] lstrlenA (lpString="*.1cd") returned 5 [0142.976] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Cookies\\index.dat", pszSpec="*.md") returned 0 [0142.976] lstrlenA (lpString="*.md") returned 4 [0142.976] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Cookies\\index.dat", pszSpec="*.mdf") returned 0 [0142.976] lstrlenA (lpString="*.mdf") returned 5 [0142.976] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Cookies\\index.dat", pszSpec="*.dbf") returned 0 [0142.976] lstrlenA (lpString="*.dbf") returned 5 [0142.976] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Cookies\\index.dat", pszSpec="*.odt") returned 0 [0142.976] lstrlenA (lpString="*.odt") returned 5 [0142.976] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Cookies\\index.dat", pszSpec="*.vob") returned 0 [0142.976] lstrlenA (lpString="*.vob") returned 5 [0142.976] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Cookies\\index.dat", pszSpec="*.ifo") returned 0 [0142.976] lstrlenA (lpString="*.ifo") returned 5 [0142.976] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Cookies\\index.dat", pszSpec="*.lnk") returned 0 [0142.976] lstrlenA (lpString="*.lnk") returned 5 [0142.976] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Cookies\\index.dat", pszSpec="*.torrent") returned 0 [0142.976] lstrlenA (lpString="*.torrent") returned 9 [0142.976] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Cookies\\index.dat", pszSpec="*.mov") returned 0 [0142.976] lstrlenA (lpString="*.mov") returned 5 [0142.976] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Cookies\\index.dat", pszSpec="*.m2v") returned 0 [0142.976] lstrlenA (lpString="*.m2v") returned 5 [0142.976] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Cookies\\index.dat", pszSpec="*.3gp") returned 0 [0142.976] lstrlenA (lpString="*.3gp") returned 5 [0142.976] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Cookies\\index.dat", pszSpec="*.mpeg") returned 0 [0142.976] lstrlenA (lpString="*.mpeg") returned 6 [0142.976] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Cookies\\index.dat", pszSpec="*.mpg") returned 0 [0142.976] lstrlenA (lpString="*.mpg") returned 5 [0142.976] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Cookies\\index.dat", pszSpec="*.flv") returned 0 [0142.976] lstrlenA (lpString="*.flv") returned 5 [0142.976] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Cookies\\index.dat", pszSpec="*.avi") returned 0 [0142.976] lstrlenA (lpString="*.avi") returned 5 [0142.976] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Cookies\\index.dat", pszSpec="*.mp4") returned 0 [0142.976] lstrlenA (lpString="*.mp4") returned 5 [0142.976] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Cookies\\index.dat", pszSpec="*.wmv") returned 0 [0142.976] lstrlenA (lpString="*.wmv") returned 5 [0142.976] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Cookies\\index.dat", pszSpec="*.divx") returned 0 [0142.976] lstrlenA (lpString="*.divx") returned 6 [0142.976] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Cookies\\index.dat", pszSpec="*.mkv") returned 0 [0142.976] lstrlenA (lpString="*.mkv") returned 5 [0142.977] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Cookies\\index.dat", pszSpec="*.mp3") returned 0 [0142.977] lstrlenA (lpString="*.mp3") returned 5 [0142.977] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Cookies\\index.dat", pszSpec="*.wav") returned 0 [0142.977] lstrlenA (lpString="*.wav") returned 5 [0142.977] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Cookies\\index.dat", pszSpec="*.flac") returned 0 [0142.977] lstrlenA (lpString="*.flac") returned 6 [0142.977] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Cookies\\index.dat", pszSpec="*.ape") returned 0 [0142.977] lstrlenA (lpString="*.ape") returned 5 [0142.977] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Cookies\\index.dat", pszSpec="*.wma") returned 0 [0142.977] lstrlenA (lpString="*.wma") returned 5 [0142.977] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Cookies\\index.dat", pszSpec="*.ac3") returned 0 [0142.977] lstrlenA (lpString="*.ac3") returned 5 [0142.977] FindNextFileA (in: hFindFile=0x5be2a0, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0 [0142.978] FindClose (in: hFindFile=0x5be2a0 | out: hFindFile=0x5be2a0) returned 1 [0142.978] FindNextFileA (in: hFindFile=0x5be260, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0142.978] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0142.978] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="FQmxp-0i-YSSUc.avi") returned -1 [0142.978] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FQmxp-0i-YSSUc.avi") returned 1 [0142.978] lstrcmpiA (lpString1="", lpString2="FQmxp-0i-YSSUc.avi") returned -1 [0142.978] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\*.*") returned="*.*" [0142.978] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\", lpString2="FQmxp-0i-YSSUc.avi" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\FQmxp-0i-YSSUc.avi") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\FQmxp-0i-YSSUc.avi" [0142.978] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\FQmxp-0i-YSSUc.avi", pszSpec="*.zip") returned 0 [0142.978] lstrlenA (lpString="*.zip") returned 5 [0142.978] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\FQmxp-0i-YSSUc.avi", pszSpec="*.rar") returned 0 [0142.978] lstrlenA (lpString="*.rar") returned 5 [0142.978] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\FQmxp-0i-YSSUc.avi", pszSpec="*.7z") returned 0 [0142.978] lstrlenA (lpString="*.7z") returned 4 [0142.978] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\FQmxp-0i-YSSUc.avi", pszSpec="*.tar") returned 0 [0142.978] lstrlenA (lpString="*.tar") returned 5 [0142.978] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\FQmxp-0i-YSSUc.avi", pszSpec="*.gzip") returned 0 [0142.978] lstrlenA (lpString="*.gzip") returned 6 [0142.978] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\FQmxp-0i-YSSUc.avi", pszSpec="*.jpg") returned 0 [0142.978] lstrlenA (lpString="*.jpg") returned 5 [0142.978] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\FQmxp-0i-YSSUc.avi", pszSpec="*.jpeg") returned 0 [0142.978] lstrlenA (lpString="*.jpeg") returned 6 [0142.978] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\FQmxp-0i-YSSUc.avi", pszSpec="*.psd") returned 0 [0142.978] lstrlenA (lpString="*.psd") returned 5 [0142.978] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\FQmxp-0i-YSSUc.avi", pszSpec="*.cdr") returned 0 [0142.978] lstrlenA (lpString="*.cdr") returned 5 [0142.978] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\FQmxp-0i-YSSUc.avi", pszSpec="*.dwg") returned 0 [0142.978] lstrlenA (lpString="*.dwg") returned 5 [0142.978] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\FQmxp-0i-YSSUc.avi", pszSpec="*.max") returned 0 [0142.978] lstrlenA (lpString="*.max") returned 5 [0142.978] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\FQmxp-0i-YSSUc.avi", pszSpec="*.bmp") returned 0 [0142.978] lstrlenA (lpString="*.bmp") returned 5 [0142.978] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\FQmxp-0i-YSSUc.avi", pszSpec="*.gif") returned 0 [0142.979] lstrlenA (lpString="*.gif") returned 5 [0142.979] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\FQmxp-0i-YSSUc.avi", pszSpec="*.png") returned 0 [0142.979] lstrlenA (lpString="*.png") returned 5 [0142.979] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\FQmxp-0i-YSSUc.avi", pszSpec="*.doc") returned 0 [0142.979] lstrlenA (lpString="*.doc") returned 5 [0142.979] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\FQmxp-0i-YSSUc.avi", pszSpec="*.docx") returned 0 [0142.979] lstrlenA (lpString="*.docx") returned 6 [0142.979] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\FQmxp-0i-YSSUc.avi", pszSpec="*.xls") returned 0 [0142.979] lstrlenA (lpString="*.xls") returned 5 [0142.979] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\FQmxp-0i-YSSUc.avi", pszSpec="*.xlsx") returned 0 [0142.979] lstrlenA (lpString="*.xlsx") returned 6 [0142.979] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\FQmxp-0i-YSSUc.avi", pszSpec="*.ppt") returned 0 [0142.979] lstrlenA (lpString="*.ppt") returned 5 [0142.979] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\FQmxp-0i-YSSUc.avi", pszSpec="*.pptx") returned 0 [0142.979] lstrlenA (lpString="*.pptx") returned 6 [0142.979] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\FQmxp-0i-YSSUc.avi", pszSpec="*.txt") returned 0 [0142.979] lstrlenA (lpString="*.txt") returned 5 [0142.979] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\FQmxp-0i-YSSUc.avi", pszSpec="*.pdf") returned 0 [0142.979] lstrlenA (lpString="*.pdf") returned 5 [0142.979] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\FQmxp-0i-YSSUc.avi", pszSpec="*.djvu") returned 0 [0142.979] lstrlenA (lpString="*.djvu") returned 6 [0142.979] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\FQmxp-0i-YSSUc.avi", pszSpec="*.htm") returned 0 [0142.979] lstrlenA (lpString="*.htm") returned 5 [0142.979] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\FQmxp-0i-YSSUc.avi", pszSpec="*.html") returned 0 [0142.979] lstrlenA (lpString="*.html") returned 6 [0142.979] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\FQmxp-0i-YSSUc.avi", pszSpec="*.mdb") returned 0 [0142.979] lstrlenA (lpString="*.mdb") returned 5 [0142.979] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\FQmxp-0i-YSSUc.avi", pszSpec="*.cer") returned 0 [0142.979] lstrlenA (lpString="*.cer") returned 5 [0142.979] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\FQmxp-0i-YSSUc.avi", pszSpec="*.p12") returned 0 [0142.979] lstrlenA (lpString="*.p12") returned 5 [0142.979] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\FQmxp-0i-YSSUc.avi", pszSpec="*.pfx") returned 0 [0142.979] lstrlenA (lpString="*.pfx") returned 5 [0142.979] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\FQmxp-0i-YSSUc.avi", pszSpec="*.kwm") returned 0 [0142.979] lstrlenA (lpString="*.kwm") returned 5 [0142.979] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\FQmxp-0i-YSSUc.avi", pszSpec="*.pwm") returned 0 [0142.979] lstrlenA (lpString="*.pwm") returned 5 [0142.980] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\FQmxp-0i-YSSUc.avi", pszSpec="*.1cd") returned 0 [0142.980] lstrlenA (lpString="*.1cd") returned 5 [0142.980] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\FQmxp-0i-YSSUc.avi", pszSpec="*.md") returned 0 [0142.980] lstrlenA (lpString="*.md") returned 4 [0142.980] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\FQmxp-0i-YSSUc.avi", pszSpec="*.mdf") returned 0 [0142.980] lstrlenA (lpString="*.mdf") returned 5 [0142.980] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\FQmxp-0i-YSSUc.avi", pszSpec="*.dbf") returned 0 [0142.980] lstrlenA (lpString="*.dbf") returned 5 [0142.980] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\FQmxp-0i-YSSUc.avi", pszSpec="*.odt") returned 0 [0142.980] lstrlenA (lpString="*.odt") returned 5 [0142.980] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\FQmxp-0i-YSSUc.avi", pszSpec="*.vob") returned 0 [0142.980] lstrlenA (lpString="*.vob") returned 5 [0142.980] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\FQmxp-0i-YSSUc.avi", pszSpec="*.ifo") returned 0 [0142.980] lstrlenA (lpString="*.ifo") returned 5 [0142.980] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\FQmxp-0i-YSSUc.avi", pszSpec="*.lnk") returned 0 [0142.980] lstrlenA (lpString="*.lnk") returned 5 [0142.980] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\FQmxp-0i-YSSUc.avi", pszSpec="*.torrent") returned 0 [0142.980] lstrlenA (lpString="*.torrent") returned 9 [0142.980] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\FQmxp-0i-YSSUc.avi", pszSpec="*.mov") returned 0 [0142.980] lstrlenA (lpString="*.mov") returned 5 [0142.980] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\FQmxp-0i-YSSUc.avi", pszSpec="*.m2v") returned 0 [0142.980] lstrlenA (lpString="*.m2v") returned 5 [0142.980] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\FQmxp-0i-YSSUc.avi", pszSpec="*.3gp") returned 0 [0142.980] lstrlenA (lpString="*.3gp") returned 5 [0142.980] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\FQmxp-0i-YSSUc.avi", pszSpec="*.mpeg") returned 0 [0142.980] lstrlenA (lpString="*.mpeg") returned 6 [0142.980] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\FQmxp-0i-YSSUc.avi", pszSpec="*.mpg") returned 0 [0142.980] lstrlenA (lpString="*.mpg") returned 5 [0142.980] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\FQmxp-0i-YSSUc.avi", pszSpec="*.flv") returned 0 [0142.980] lstrlenA (lpString="*.flv") returned 5 [0142.980] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\FQmxp-0i-YSSUc.avi", pszSpec="*.avi") returned 1 [0142.980] lstrlenA (lpString="*.avi") returned 5 [0142.980] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\FQmxp-0i-YSSUc.avi" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\FQmxp-0i-YSSUc.avi") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\FQmxp-0i-YSSUc.avi" [0142.980] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\FQmxp-0i-YSSUc.avi" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\FQmxp-0i-YSSUc.avi") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\FQmxp-0i-YSSUc.avi" [0142.980] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\FQmxp-0i-YSSUc.avi", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\FQmxp-0i-YSSUc.avi.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\FQmxp-0i-YSSUc.avi." [0142.981] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\FQmxp-0i-YSSUc.avi.", lpString2="\xa0" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\FQmxp-0i-YSSUc.avi. ") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\FQmxp-0i-YSSUc.avi. " [0142.981] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\FQmxp-0i-YSSUc.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\fqmxp-0i-yssuc.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0142.981] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x94d3 [0142.981] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xb6f751b0, dwHighDateTime=0x1d4aad3), lpLastAccessTime=0x407536*(dwLowDateTime=0x431a2dc0, dwHighDateTime=0x1d4a34f), lpLastWriteTime=0x40753e*(dwLowDateTime=0x431a2dc0, dwHighDateTime=0x1d4a34f)) returned 1 [0142.981] SetFilePointer (in: hFile=0x90, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0142.981] ReadFile (in: hFile=0x90, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x9479, lpOverlapped=0x0) returned 1 [0142.982] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\FQmxp-0i-YSSUc.avi") returned="FQmxp-0i-YSSUc.avi" [0142.982] SetFilePointer (in: hFile=0x90, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0142.982] WriteFile (in: hFile=0x90, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x9479, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x9479, lpOverlapped=0x0) returned 1 [0142.983] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0142.983] CloseHandle (hObject=0x90) returned 1 [0142.983] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\FQmxp-0i-YSSUc.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\fqmxp-0i-yssuc.avi"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\FQmxp-0i-YSSUc.avi. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\fqmxp-0i-yssuc.avi. ")) returned 1 [0142.984] FindNextFileA (in: hFindFile=0x5be260, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0142.984] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0142.984] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="FXSAPIDebugLogFile.txt") returned -1 [0142.984] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="FXSAPIDebugLogFile.txt") returned 1 [0142.984] lstrcmpiA (lpString1="", lpString2="FXSAPIDebugLogFile.txt") returned -1 [0142.984] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\FQmxp-0i-YSSUc.avi") returned="FQmxp-0i-YSSUc.avi" [0142.984] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\", lpString2="FXSAPIDebugLogFile.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\FXSAPIDebugLogFile.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\FXSAPIDebugLogFile.txt" [0142.984] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\FXSAPIDebugLogFile.txt", pszSpec="*.zip") returned 0 [0142.984] lstrlenA (lpString="*.zip") returned 5 [0142.984] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\FXSAPIDebugLogFile.txt", pszSpec="*.rar") returned 0 [0142.984] lstrlenA (lpString="*.rar") returned 5 [0142.984] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\FXSAPIDebugLogFile.txt", pszSpec="*.7z") returned 0 [0142.984] lstrlenA (lpString="*.7z") returned 4 [0142.984] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\FXSAPIDebugLogFile.txt", pszSpec="*.tar") returned 0 [0142.984] lstrlenA (lpString="*.tar") returned 5 [0142.984] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\FXSAPIDebugLogFile.txt", pszSpec="*.gzip") returned 0 [0142.984] lstrlenA (lpString="*.gzip") returned 6 [0142.984] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\FXSAPIDebugLogFile.txt", pszSpec="*.jpg") returned 0 [0142.984] lstrlenA (lpString="*.jpg") returned 5 [0142.984] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\FXSAPIDebugLogFile.txt", pszSpec="*.jpeg") returned 0 [0142.984] lstrlenA (lpString="*.jpeg") returned 6 [0142.984] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\FXSAPIDebugLogFile.txt", pszSpec="*.psd") returned 0 [0142.984] lstrlenA (lpString="*.psd") returned 5 [0142.985] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\FXSAPIDebugLogFile.txt", pszSpec="*.cdr") returned 0 [0142.985] lstrlenA (lpString="*.cdr") returned 5 [0142.985] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\FXSAPIDebugLogFile.txt", pszSpec="*.dwg") returned 0 [0142.985] lstrlenA (lpString="*.dwg") returned 5 [0142.985] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\FXSAPIDebugLogFile.txt", pszSpec="*.max") returned 0 [0142.985] lstrlenA (lpString="*.max") returned 5 [0142.985] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\FXSAPIDebugLogFile.txt", pszSpec="*.bmp") returned 0 [0142.985] lstrlenA (lpString="*.bmp") returned 5 [0142.985] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\FXSAPIDebugLogFile.txt", pszSpec="*.gif") returned 0 [0142.985] lstrlenA (lpString="*.gif") returned 5 [0142.985] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\FXSAPIDebugLogFile.txt", pszSpec="*.png") returned 0 [0142.985] lstrlenA (lpString="*.png") returned 5 [0142.985] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\FXSAPIDebugLogFile.txt", pszSpec="*.doc") returned 0 [0142.985] lstrlenA (lpString="*.doc") returned 5 [0142.985] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\FXSAPIDebugLogFile.txt", pszSpec="*.docx") returned 0 [0142.985] lstrlenA (lpString="*.docx") returned 6 [0142.985] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\FXSAPIDebugLogFile.txt", pszSpec="*.xls") returned 0 [0142.985] lstrlenA (lpString="*.xls") returned 5 [0142.985] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\FXSAPIDebugLogFile.txt", pszSpec="*.xlsx") returned 0 [0142.985] lstrlenA (lpString="*.xlsx") returned 6 [0142.985] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\FXSAPIDebugLogFile.txt", pszSpec="*.ppt") returned 0 [0142.985] lstrlenA (lpString="*.ppt") returned 5 [0142.985] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\FXSAPIDebugLogFile.txt", pszSpec="*.pptx") returned 0 [0142.985] lstrlenA (lpString="*.pptx") returned 6 [0142.985] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\FXSAPIDebugLogFile.txt", pszSpec="*.txt") returned 1 [0142.985] lstrlenA (lpString="*.txt") returned 5 [0142.985] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\FXSAPIDebugLogFile.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\FXSAPIDebugLogFile.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\FXSAPIDebugLogFile.txt" [0142.985] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\FXSAPIDebugLogFile.txt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\FXSAPIDebugLogFile.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\FXSAPIDebugLogFile.txt" [0142.985] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\FXSAPIDebugLogFile.txt", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\FXSAPIDebugLogFile.txt.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\FXSAPIDebugLogFile.txt." [0142.985] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\FXSAPIDebugLogFile.txt.", lpString2="\xa0" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\FXSAPIDebugLogFile.txt. ") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\FXSAPIDebugLogFile.txt. " [0142.985] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\FXSAPIDebugLogFile.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\fxsapidebuglogfile.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0142.986] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x0 [0142.986] CloseHandle (hObject=0x90) returned 1 [0142.986] FindNextFileA (in: hFindFile=0x5be260, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0142.986] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0142.986] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="GU7v 3dL.mkv") returned -1 [0142.986] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="GU7v 3dL.mkv") returned 1 [0142.986] lstrcmpiA (lpString1="", lpString2="GU7v 3dL.mkv") returned -1 [0142.986] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\FXSAPIDebugLogFile.txt") returned="FXSAPIDebugLogFile.txt" [0142.986] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\", lpString2="GU7v 3dL.mkv" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\GU7v 3dL.mkv") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\GU7v 3dL.mkv" [0142.986] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\GU7v 3dL.mkv", pszSpec="*.zip") returned 0 [0142.986] lstrlenA (lpString="*.zip") returned 5 [0142.986] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\GU7v 3dL.mkv", pszSpec="*.rar") returned 0 [0142.986] lstrlenA (lpString="*.rar") returned 5 [0142.986] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\GU7v 3dL.mkv", pszSpec="*.7z") returned 0 [0142.986] lstrlenA (lpString="*.7z") returned 4 [0142.986] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\GU7v 3dL.mkv", pszSpec="*.tar") returned 0 [0142.986] lstrlenA (lpString="*.tar") returned 5 [0142.986] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\GU7v 3dL.mkv", pszSpec="*.gzip") returned 0 [0142.986] lstrlenA (lpString="*.gzip") returned 6 [0142.986] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\GU7v 3dL.mkv", pszSpec="*.jpg") returned 0 [0142.986] lstrlenA (lpString="*.jpg") returned 5 [0142.986] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\GU7v 3dL.mkv", pszSpec="*.jpeg") returned 0 [0142.986] lstrlenA (lpString="*.jpeg") returned 6 [0142.986] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\GU7v 3dL.mkv", pszSpec="*.psd") returned 0 [0142.986] lstrlenA (lpString="*.psd") returned 5 [0142.987] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\GU7v 3dL.mkv", pszSpec="*.cdr") returned 0 [0142.987] lstrlenA (lpString="*.cdr") returned 5 [0142.987] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\GU7v 3dL.mkv", pszSpec="*.dwg") returned 0 [0142.987] lstrlenA (lpString="*.dwg") returned 5 [0142.987] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\GU7v 3dL.mkv", pszSpec="*.max") returned 0 [0142.987] lstrlenA (lpString="*.max") returned 5 [0142.987] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\GU7v 3dL.mkv", pszSpec="*.bmp") returned 0 [0142.987] lstrlenA (lpString="*.bmp") returned 5 [0142.987] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\GU7v 3dL.mkv", pszSpec="*.gif") returned 0 [0142.987] lstrlenA (lpString="*.gif") returned 5 [0142.987] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\GU7v 3dL.mkv", pszSpec="*.png") returned 0 [0142.987] lstrlenA (lpString="*.png") returned 5 [0142.987] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\GU7v 3dL.mkv", pszSpec="*.doc") returned 0 [0142.987] lstrlenA (lpString="*.doc") returned 5 [0142.987] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\GU7v 3dL.mkv", pszSpec="*.docx") returned 0 [0142.987] lstrlenA (lpString="*.docx") returned 6 [0142.987] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\GU7v 3dL.mkv", pszSpec="*.xls") returned 0 [0142.987] lstrlenA (lpString="*.xls") returned 5 [0142.987] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\GU7v 3dL.mkv", pszSpec="*.xlsx") returned 0 [0142.987] lstrlenA (lpString="*.xlsx") returned 6 [0142.987] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\GU7v 3dL.mkv", pszSpec="*.ppt") returned 0 [0142.987] lstrlenA (lpString="*.ppt") returned 5 [0142.987] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\GU7v 3dL.mkv", pszSpec="*.pptx") returned 0 [0142.987] lstrlenA (lpString="*.pptx") returned 6 [0142.987] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\GU7v 3dL.mkv", pszSpec="*.txt") returned 0 [0142.987] lstrlenA (lpString="*.txt") returned 5 [0142.987] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\GU7v 3dL.mkv", pszSpec="*.pdf") returned 0 [0142.987] lstrlenA (lpString="*.pdf") returned 5 [0142.987] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\GU7v 3dL.mkv", pszSpec="*.djvu") returned 0 [0142.987] lstrlenA (lpString="*.djvu") returned 6 [0142.987] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\GU7v 3dL.mkv", pszSpec="*.htm") returned 0 [0142.987] lstrlenA (lpString="*.htm") returned 5 [0142.987] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\GU7v 3dL.mkv", pszSpec="*.html") returned 0 [0142.987] lstrlenA (lpString="*.html") returned 6 [0142.987] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\GU7v 3dL.mkv", pszSpec="*.mdb") returned 0 [0142.987] lstrlenA (lpString="*.mdb") returned 5 [0142.987] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\GU7v 3dL.mkv", pszSpec="*.cer") returned 0 [0142.988] lstrlenA (lpString="*.cer") returned 5 [0142.988] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\GU7v 3dL.mkv", pszSpec="*.p12") returned 0 [0142.988] lstrlenA (lpString="*.p12") returned 5 [0142.988] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\GU7v 3dL.mkv", pszSpec="*.pfx") returned 0 [0142.988] lstrlenA (lpString="*.pfx") returned 5 [0142.988] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\GU7v 3dL.mkv", pszSpec="*.kwm") returned 0 [0142.988] lstrlenA (lpString="*.kwm") returned 5 [0142.988] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\GU7v 3dL.mkv", pszSpec="*.pwm") returned 0 [0142.988] lstrlenA (lpString="*.pwm") returned 5 [0142.988] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\GU7v 3dL.mkv", pszSpec="*.1cd") returned 0 [0142.988] lstrlenA (lpString="*.1cd") returned 5 [0142.988] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\GU7v 3dL.mkv", pszSpec="*.md") returned 0 [0142.988] lstrlenA (lpString="*.md") returned 4 [0142.988] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\GU7v 3dL.mkv", pszSpec="*.mdf") returned 0 [0142.988] lstrlenA (lpString="*.mdf") returned 5 [0142.988] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\GU7v 3dL.mkv", pszSpec="*.dbf") returned 0 [0142.988] lstrlenA (lpString="*.dbf") returned 5 [0142.988] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\GU7v 3dL.mkv", pszSpec="*.odt") returned 0 [0142.988] lstrlenA (lpString="*.odt") returned 5 [0142.988] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\GU7v 3dL.mkv", pszSpec="*.vob") returned 0 [0142.988] lstrlenA (lpString="*.vob") returned 5 [0142.988] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\GU7v 3dL.mkv", pszSpec="*.ifo") returned 0 [0142.988] lstrlenA (lpString="*.ifo") returned 5 [0142.988] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\GU7v 3dL.mkv", pszSpec="*.lnk") returned 0 [0142.988] lstrlenA (lpString="*.lnk") returned 5 [0142.988] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\GU7v 3dL.mkv", pszSpec="*.torrent") returned 0 [0142.988] lstrlenA (lpString="*.torrent") returned 9 [0142.988] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\GU7v 3dL.mkv", pszSpec="*.mov") returned 0 [0142.988] lstrlenA (lpString="*.mov") returned 5 [0142.988] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\GU7v 3dL.mkv", pszSpec="*.m2v") returned 0 [0142.988] lstrlenA (lpString="*.m2v") returned 5 [0142.988] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\GU7v 3dL.mkv", pszSpec="*.3gp") returned 0 [0142.988] lstrlenA (lpString="*.3gp") returned 5 [0142.988] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\GU7v 3dL.mkv", pszSpec="*.mpeg") returned 0 [0142.988] lstrlenA (lpString="*.mpeg") returned 6 [0142.988] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\GU7v 3dL.mkv", pszSpec="*.mpg") returned 0 [0142.988] lstrlenA (lpString="*.mpg") returned 5 [0142.989] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\GU7v 3dL.mkv", pszSpec="*.flv") returned 0 [0142.989] lstrlenA (lpString="*.flv") returned 5 [0142.989] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\GU7v 3dL.mkv", pszSpec="*.avi") returned 0 [0142.989] lstrlenA (lpString="*.avi") returned 5 [0142.989] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\GU7v 3dL.mkv", pszSpec="*.mp4") returned 0 [0142.989] lstrlenA (lpString="*.mp4") returned 5 [0142.989] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\GU7v 3dL.mkv", pszSpec="*.wmv") returned 0 [0142.989] lstrlenA (lpString="*.wmv") returned 5 [0142.989] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\GU7v 3dL.mkv", pszSpec="*.divx") returned 0 [0142.989] lstrlenA (lpString="*.divx") returned 6 [0142.989] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\GU7v 3dL.mkv", pszSpec="*.mkv") returned 1 [0142.989] lstrlenA (lpString="*.mkv") returned 5 [0142.989] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\GU7v 3dL.mkv" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\GU7v 3dL.mkv") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\GU7v 3dL.mkv" [0142.989] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\GU7v 3dL.mkv" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\GU7v 3dL.mkv") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\GU7v 3dL.mkv" [0142.989] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\GU7v 3dL.mkv", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\GU7v 3dL.mkv.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\GU7v 3dL.mkv." [0142.989] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\GU7v 3dL.mkv.", lpString2="\xa0" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\GU7v 3dL.mkv. ") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\GU7v 3dL.mkv. " [0142.989] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\GU7v 3dL.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\gu7v 3dl.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0142.989] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4850 [0142.989] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xbe08c120, dwHighDateTime=0x1d4adce), lpLastAccessTime=0x407536*(dwLowDateTime=0xcd09e670, dwHighDateTime=0x1d4ad3f), lpLastWriteTime=0x40753e*(dwLowDateTime=0xcd09e670, dwHighDateTime=0x1d4ad3f)) returned 1 [0142.989] SetFilePointer (in: hFile=0x90, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0142.990] ReadFile (in: hFile=0x90, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x47f6, lpOverlapped=0x0) returned 1 [0142.990] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\GU7v 3dL.mkv") returned="GU7v 3dL.mkv" [0142.991] SetFilePointer (in: hFile=0x90, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0142.991] WriteFile (in: hFile=0x90, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x47f6, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x47f6, lpOverlapped=0x0) returned 1 [0142.991] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0142.991] CloseHandle (hObject=0x90) returned 1 [0142.991] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\GU7v 3dL.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\gu7v 3dl.mkv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\GU7v 3dL.mkv. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\gu7v 3dl.mkv. ")) returned 1 [0142.992] FindNextFileA (in: hFindFile=0x5be260, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0142.992] lstrcmpA (lpString1=".", lpString2="History") returned -1 [0142.992] lstrcmpA (lpString1="..", lpString2="History") returned -1 [0142.992] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\GU7v 3dL.mkv") returned="GU7v 3dL.mkv" [0142.992] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\", lpString2="History" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History" [0142.992] lstrlenA (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History") returned 56 [0142.992] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0142.993] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0142.993] FindNextFileA (in: hFindFile=0x5be2a0, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0142.993] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0142.993] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0142.993] FindNextFileA (in: hFindFile=0x5be2a0, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0142.994] lstrcmpA (lpString1=".", lpString2="History.IE5") returned -1 [0142.994] lstrcmpA (lpString1="..", lpString2="History.IE5") returned -1 [0142.994] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\*.*") returned="*.*" [0142.994] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\", lpString2="History.IE5" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5" [0142.994] lstrlenA (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5") returned 68 [0142.994] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\*.*", lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 0x5be2e0 [0142.994] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0142.994] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0142.994] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0142.994] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0142.994] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0142.994] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0142.994] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="desktop.ini") returned 1 [0142.994] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="desktop.ini") returned 1 [0142.994] lstrcmpiA (lpString1="", lpString2="desktop.ini") returned -1 [0142.994] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\*.*") returned="*.*" [0142.994] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\", lpString2="desktop.ini" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\desktop.ini") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\desktop.ini" [0142.994] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\desktop.ini", pszSpec="*.zip") returned 0 [0142.994] lstrlenA (lpString="*.zip") returned 5 [0142.994] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\desktop.ini", pszSpec="*.rar") returned 0 [0142.994] lstrlenA (lpString="*.rar") returned 5 [0142.994] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\desktop.ini", pszSpec="*.7z") returned 0 [0142.994] lstrlenA (lpString="*.7z") returned 4 [0142.994] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\desktop.ini", pszSpec="*.tar") returned 0 [0142.994] lstrlenA (lpString="*.tar") returned 5 [0142.994] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\desktop.ini", pszSpec="*.gzip") returned 0 [0142.994] lstrlenA (lpString="*.gzip") returned 6 [0142.994] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\desktop.ini", pszSpec="*.jpg") returned 0 [0142.994] lstrlenA (lpString="*.jpg") returned 5 [0142.994] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\desktop.ini", pszSpec="*.jpeg") returned 0 [0142.995] lstrlenA (lpString="*.jpeg") returned 6 [0142.995] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\desktop.ini", pszSpec="*.psd") returned 0 [0142.995] lstrlenA (lpString="*.psd") returned 5 [0142.995] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\desktop.ini", pszSpec="*.cdr") returned 0 [0142.995] lstrlenA (lpString="*.cdr") returned 5 [0142.995] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\desktop.ini", pszSpec="*.dwg") returned 0 [0142.995] lstrlenA (lpString="*.dwg") returned 5 [0142.995] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\desktop.ini", pszSpec="*.max") returned 0 [0142.995] lstrlenA (lpString="*.max") returned 5 [0142.995] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\desktop.ini", pszSpec="*.bmp") returned 0 [0142.995] lstrlenA (lpString="*.bmp") returned 5 [0142.995] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\desktop.ini", pszSpec="*.gif") returned 0 [0142.995] lstrlenA (lpString="*.gif") returned 5 [0142.995] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\desktop.ini", pszSpec="*.png") returned 0 [0142.995] lstrlenA (lpString="*.png") returned 5 [0142.995] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\desktop.ini", pszSpec="*.doc") returned 0 [0142.995] lstrlenA (lpString="*.doc") returned 5 [0142.995] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\desktop.ini", pszSpec="*.docx") returned 0 [0142.995] lstrlenA (lpString="*.docx") returned 6 [0142.995] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\desktop.ini", pszSpec="*.xls") returned 0 [0142.995] lstrlenA (lpString="*.xls") returned 5 [0142.995] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\desktop.ini", pszSpec="*.xlsx") returned 0 [0142.995] lstrlenA (lpString="*.xlsx") returned 6 [0142.995] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\desktop.ini", pszSpec="*.ppt") returned 0 [0142.995] lstrlenA (lpString="*.ppt") returned 5 [0142.995] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\desktop.ini", pszSpec="*.pptx") returned 0 [0142.995] lstrlenA (lpString="*.pptx") returned 6 [0142.995] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\desktop.ini", pszSpec="*.txt") returned 0 [0142.995] lstrlenA (lpString="*.txt") returned 5 [0142.995] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\desktop.ini", pszSpec="*.pdf") returned 0 [0142.995] lstrlenA (lpString="*.pdf") returned 5 [0142.995] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\desktop.ini", pszSpec="*.djvu") returned 0 [0142.995] lstrlenA (lpString="*.djvu") returned 6 [0142.995] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\desktop.ini", pszSpec="*.htm") returned 0 [0142.995] lstrlenA (lpString="*.htm") returned 5 [0142.995] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\desktop.ini", pszSpec="*.html") returned 0 [0142.995] lstrlenA (lpString="*.html") returned 6 [0142.996] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\desktop.ini", pszSpec="*.mdb") returned 0 [0142.996] lstrlenA (lpString="*.mdb") returned 5 [0142.996] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\desktop.ini", pszSpec="*.cer") returned 0 [0142.996] lstrlenA (lpString="*.cer") returned 5 [0142.996] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\desktop.ini", pszSpec="*.p12") returned 0 [0142.996] lstrlenA (lpString="*.p12") returned 5 [0142.996] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\desktop.ini", pszSpec="*.pfx") returned 0 [0142.996] lstrlenA (lpString="*.pfx") returned 5 [0142.996] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\desktop.ini", pszSpec="*.kwm") returned 0 [0142.996] lstrlenA (lpString="*.kwm") returned 5 [0142.996] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\desktop.ini", pszSpec="*.pwm") returned 0 [0142.996] lstrlenA (lpString="*.pwm") returned 5 [0142.996] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\desktop.ini", pszSpec="*.1cd") returned 0 [0142.996] lstrlenA (lpString="*.1cd") returned 5 [0142.996] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\desktop.ini", pszSpec="*.md") returned 0 [0142.996] lstrlenA (lpString="*.md") returned 4 [0142.996] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\desktop.ini", pszSpec="*.mdf") returned 0 [0142.996] lstrlenA (lpString="*.mdf") returned 5 [0142.996] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\desktop.ini", pszSpec="*.dbf") returned 0 [0142.996] lstrlenA (lpString="*.dbf") returned 5 [0142.996] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\desktop.ini", pszSpec="*.odt") returned 0 [0142.996] lstrlenA (lpString="*.odt") returned 5 [0142.996] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\desktop.ini", pszSpec="*.vob") returned 0 [0142.996] lstrlenA (lpString="*.vob") returned 5 [0142.996] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\desktop.ini", pszSpec="*.ifo") returned 0 [0142.996] lstrlenA (lpString="*.ifo") returned 5 [0142.996] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\desktop.ini", pszSpec="*.lnk") returned 0 [0142.996] lstrlenA (lpString="*.lnk") returned 5 [0142.996] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\desktop.ini", pszSpec="*.torrent") returned 0 [0142.996] lstrlenA (lpString="*.torrent") returned 9 [0142.996] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\desktop.ini", pszSpec="*.mov") returned 0 [0142.996] lstrlenA (lpString="*.mov") returned 5 [0142.996] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\desktop.ini", pszSpec="*.m2v") returned 0 [0142.996] lstrlenA (lpString="*.m2v") returned 5 [0142.996] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\desktop.ini", pszSpec="*.3gp") returned 0 [0142.996] lstrlenA (lpString="*.3gp") returned 5 [0142.996] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\desktop.ini", pszSpec="*.mpeg") returned 0 [0142.997] lstrlenA (lpString="*.mpeg") returned 6 [0142.997] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\desktop.ini", pszSpec="*.mpg") returned 0 [0142.997] lstrlenA (lpString="*.mpg") returned 5 [0142.997] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\desktop.ini", pszSpec="*.flv") returned 0 [0142.997] lstrlenA (lpString="*.flv") returned 5 [0142.997] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\desktop.ini", pszSpec="*.avi") returned 0 [0142.997] lstrlenA (lpString="*.avi") returned 5 [0142.997] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\desktop.ini", pszSpec="*.mp4") returned 0 [0142.997] lstrlenA (lpString="*.mp4") returned 5 [0142.997] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\desktop.ini", pszSpec="*.wmv") returned 0 [0142.997] lstrlenA (lpString="*.wmv") returned 5 [0142.997] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\desktop.ini", pszSpec="*.divx") returned 0 [0142.997] lstrlenA (lpString="*.divx") returned 6 [0142.997] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\desktop.ini", pszSpec="*.mkv") returned 0 [0142.997] lstrlenA (lpString="*.mkv") returned 5 [0142.997] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\desktop.ini", pszSpec="*.mp3") returned 0 [0142.997] lstrlenA (lpString="*.mp3") returned 5 [0142.997] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\desktop.ini", pszSpec="*.wav") returned 0 [0142.997] lstrlenA (lpString="*.wav") returned 5 [0142.997] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\desktop.ini", pszSpec="*.flac") returned 0 [0142.997] lstrlenA (lpString="*.flac") returned 6 [0142.997] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\desktop.ini", pszSpec="*.ape") returned 0 [0142.997] lstrlenA (lpString="*.ape") returned 5 [0142.997] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\desktop.ini", pszSpec="*.wma") returned 0 [0142.997] lstrlenA (lpString="*.wma") returned 5 [0142.997] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\desktop.ini", pszSpec="*.ac3") returned 0 [0142.997] lstrlenA (lpString="*.ac3") returned 5 [0142.997] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0142.997] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0142.997] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="index.dat") returned -1 [0142.997] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="index.dat") returned -1 [0142.997] lstrcmpiA (lpString1="", lpString2="index.dat") returned -1 [0142.997] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\desktop.ini") returned="desktop.ini" [0142.997] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\", lpString2="index.dat" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\index.dat") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\index.dat" [0142.998] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\index.dat", pszSpec="*.zip") returned 0 [0142.998] lstrlenA (lpString="*.zip") returned 5 [0142.998] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\index.dat", pszSpec="*.rar") returned 0 [0142.998] lstrlenA (lpString="*.rar") returned 5 [0142.998] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\index.dat", pszSpec="*.7z") returned 0 [0142.998] lstrlenA (lpString="*.7z") returned 4 [0142.998] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\index.dat", pszSpec="*.tar") returned 0 [0142.998] lstrlenA (lpString="*.tar") returned 5 [0142.998] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\index.dat", pszSpec="*.gzip") returned 0 [0142.998] lstrlenA (lpString="*.gzip") returned 6 [0142.998] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\index.dat", pszSpec="*.jpg") returned 0 [0142.998] lstrlenA (lpString="*.jpg") returned 5 [0142.998] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\index.dat", pszSpec="*.jpeg") returned 0 [0142.998] lstrlenA (lpString="*.jpeg") returned 6 [0142.998] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\index.dat", pszSpec="*.psd") returned 0 [0142.998] lstrlenA (lpString="*.psd") returned 5 [0142.998] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\index.dat", pszSpec="*.cdr") returned 0 [0142.998] lstrlenA (lpString="*.cdr") returned 5 [0142.998] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\index.dat", pszSpec="*.dwg") returned 0 [0142.998] lstrlenA (lpString="*.dwg") returned 5 [0142.998] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\index.dat", pszSpec="*.max") returned 0 [0142.998] lstrlenA (lpString="*.max") returned 5 [0142.998] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\index.dat", pszSpec="*.bmp") returned 0 [0142.998] lstrlenA (lpString="*.bmp") returned 5 [0142.998] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\index.dat", pszSpec="*.gif") returned 0 [0142.998] lstrlenA (lpString="*.gif") returned 5 [0142.998] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\index.dat", pszSpec="*.png") returned 0 [0142.998] lstrlenA (lpString="*.png") returned 5 [0142.998] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\index.dat", pszSpec="*.doc") returned 0 [0142.998] lstrlenA (lpString="*.doc") returned 5 [0142.998] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\index.dat", pszSpec="*.docx") returned 0 [0142.998] lstrlenA (lpString="*.docx") returned 6 [0142.998] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\index.dat", pszSpec="*.xls") returned 0 [0142.998] lstrlenA (lpString="*.xls") returned 5 [0142.998] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\index.dat", pszSpec="*.xlsx") returned 0 [0142.998] lstrlenA (lpString="*.xlsx") returned 6 [0142.999] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\index.dat", pszSpec="*.ppt") returned 0 [0142.999] lstrlenA (lpString="*.ppt") returned 5 [0142.999] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\index.dat", pszSpec="*.pptx") returned 0 [0142.999] lstrlenA (lpString="*.pptx") returned 6 [0142.999] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\index.dat", pszSpec="*.txt") returned 0 [0142.999] lstrlenA (lpString="*.txt") returned 5 [0142.999] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\index.dat", pszSpec="*.pdf") returned 0 [0142.999] lstrlenA (lpString="*.pdf") returned 5 [0142.999] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\index.dat", pszSpec="*.djvu") returned 0 [0142.999] lstrlenA (lpString="*.djvu") returned 6 [0142.999] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\index.dat", pszSpec="*.htm") returned 0 [0142.999] lstrlenA (lpString="*.htm") returned 5 [0142.999] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\index.dat", pszSpec="*.html") returned 0 [0142.999] lstrlenA (lpString="*.html") returned 6 [0142.999] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\index.dat", pszSpec="*.mdb") returned 0 [0142.999] lstrlenA (lpString="*.mdb") returned 5 [0142.999] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\index.dat", pszSpec="*.cer") returned 0 [0142.999] lstrlenA (lpString="*.cer") returned 5 [0142.999] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\index.dat", pszSpec="*.p12") returned 0 [0142.999] lstrlenA (lpString="*.p12") returned 5 [0142.999] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\index.dat", pszSpec="*.pfx") returned 0 [0142.999] lstrlenA (lpString="*.pfx") returned 5 [0142.999] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\index.dat", pszSpec="*.kwm") returned 0 [0142.999] lstrlenA (lpString="*.kwm") returned 5 [0142.999] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\index.dat", pszSpec="*.pwm") returned 0 [0142.999] lstrlenA (lpString="*.pwm") returned 5 [0142.999] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\index.dat", pszSpec="*.1cd") returned 0 [0142.999] lstrlenA (lpString="*.1cd") returned 5 [0142.999] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\index.dat", pszSpec="*.md") returned 0 [0142.999] lstrlenA (lpString="*.md") returned 4 [0142.999] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\index.dat", pszSpec="*.mdf") returned 0 [0142.999] lstrlenA (lpString="*.mdf") returned 5 [0142.999] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\index.dat", pszSpec="*.dbf") returned 0 [0142.999] lstrlenA (lpString="*.dbf") returned 5 [0142.999] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\index.dat", pszSpec="*.odt") returned 0 [0142.999] lstrlenA (lpString="*.odt") returned 5 [0142.999] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\index.dat", pszSpec="*.vob") returned 0 [0143.000] lstrlenA (lpString="*.vob") returned 5 [0143.000] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\index.dat", pszSpec="*.ifo") returned 0 [0143.000] lstrlenA (lpString="*.ifo") returned 5 [0143.000] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\index.dat", pszSpec="*.lnk") returned 0 [0143.000] lstrlenA (lpString="*.lnk") returned 5 [0143.000] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\index.dat", pszSpec="*.torrent") returned 0 [0143.000] lstrlenA (lpString="*.torrent") returned 9 [0143.000] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\index.dat", pszSpec="*.mov") returned 0 [0143.000] lstrlenA (lpString="*.mov") returned 5 [0143.000] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\index.dat", pszSpec="*.m2v") returned 0 [0143.000] lstrlenA (lpString="*.m2v") returned 5 [0143.000] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\index.dat", pszSpec="*.3gp") returned 0 [0143.000] lstrlenA (lpString="*.3gp") returned 5 [0143.000] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\index.dat", pszSpec="*.mpeg") returned 0 [0143.000] lstrlenA (lpString="*.mpeg") returned 6 [0143.000] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\index.dat", pszSpec="*.mpg") returned 0 [0143.000] lstrlenA (lpString="*.mpg") returned 5 [0143.000] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\index.dat", pszSpec="*.flv") returned 0 [0143.000] lstrlenA (lpString="*.flv") returned 5 [0143.000] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\index.dat", pszSpec="*.avi") returned 0 [0143.000] lstrlenA (lpString="*.avi") returned 5 [0143.000] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\index.dat", pszSpec="*.mp4") returned 0 [0143.000] lstrlenA (lpString="*.mp4") returned 5 [0143.000] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\index.dat", pszSpec="*.wmv") returned 0 [0143.000] lstrlenA (lpString="*.wmv") returned 5 [0143.000] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\index.dat", pszSpec="*.divx") returned 0 [0143.000] lstrlenA (lpString="*.divx") returned 6 [0143.000] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\index.dat", pszSpec="*.mkv") returned 0 [0143.000] lstrlenA (lpString="*.mkv") returned 5 [0143.000] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\index.dat", pszSpec="*.mp3") returned 0 [0143.000] lstrlenA (lpString="*.mp3") returned 5 [0143.000] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\index.dat", pszSpec="*.wav") returned 0 [0143.000] lstrlenA (lpString="*.wav") returned 5 [0143.000] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\index.dat", pszSpec="*.flac") returned 0 [0143.000] lstrlenA (lpString="*.flac") returned 6 [0143.000] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\index.dat", pszSpec="*.ape") returned 0 [0143.001] lstrlenA (lpString="*.ape") returned 5 [0143.001] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\index.dat", pszSpec="*.wma") returned 0 [0143.001] lstrlenA (lpString="*.wma") returned 5 [0143.001] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\index.dat", pszSpec="*.ac3") returned 0 [0143.001] lstrlenA (lpString="*.ac3") returned 5 [0143.001] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 0 [0143.001] FindClose (in: hFindFile=0x5be2e0 | out: hFindFile=0x5be2e0) returned 1 [0143.001] FindNextFileA (in: hFindFile=0x5be2a0, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0 [0143.001] FindClose (in: hFindFile=0x5be2a0 | out: hFindFile=0x5be2a0) returned 1 [0143.001] FindNextFileA (in: hFindFile=0x5be260, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0143.001] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0143.001] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="IahK7Fmb.mp3") returned -1 [0143.001] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="IahK7Fmb.mp3") returned -1 [0143.001] lstrcmpiA (lpString1="", lpString2="IahK7Fmb.mp3") returned -1 [0143.001] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\*.*") returned="*.*" [0143.001] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\", lpString2="IahK7Fmb.mp3" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\IahK7Fmb.mp3") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\IahK7Fmb.mp3" [0143.001] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\IahK7Fmb.mp3", pszSpec="*.zip") returned 0 [0143.001] lstrlenA (lpString="*.zip") returned 5 [0143.001] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\IahK7Fmb.mp3", pszSpec="*.rar") returned 0 [0143.001] lstrlenA (lpString="*.rar") returned 5 [0143.001] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\IahK7Fmb.mp3", pszSpec="*.7z") returned 0 [0143.001] lstrlenA (lpString="*.7z") returned 4 [0143.001] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\IahK7Fmb.mp3", pszSpec="*.tar") returned 0 [0143.001] lstrlenA (lpString="*.tar") returned 5 [0143.001] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\IahK7Fmb.mp3", pszSpec="*.gzip") returned 0 [0143.001] lstrlenA (lpString="*.gzip") returned 6 [0143.001] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\IahK7Fmb.mp3", pszSpec="*.jpg") returned 0 [0143.001] lstrlenA (lpString="*.jpg") returned 5 [0143.001] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\IahK7Fmb.mp3", pszSpec="*.jpeg") returned 0 [0143.001] lstrlenA (lpString="*.jpeg") returned 6 [0143.001] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\IahK7Fmb.mp3", pszSpec="*.psd") returned 0 [0143.002] lstrlenA (lpString="*.psd") returned 5 [0143.002] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\IahK7Fmb.mp3", pszSpec="*.cdr") returned 0 [0143.002] lstrlenA (lpString="*.cdr") returned 5 [0143.002] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\IahK7Fmb.mp3", pszSpec="*.dwg") returned 0 [0143.002] lstrlenA (lpString="*.dwg") returned 5 [0143.002] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\IahK7Fmb.mp3", pszSpec="*.max") returned 0 [0143.002] lstrlenA (lpString="*.max") returned 5 [0143.002] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\IahK7Fmb.mp3", pszSpec="*.bmp") returned 0 [0143.002] lstrlenA (lpString="*.bmp") returned 5 [0143.002] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\IahK7Fmb.mp3", pszSpec="*.gif") returned 0 [0143.002] lstrlenA (lpString="*.gif") returned 5 [0143.002] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\IahK7Fmb.mp3", pszSpec="*.png") returned 0 [0143.002] lstrlenA (lpString="*.png") returned 5 [0143.002] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\IahK7Fmb.mp3", pszSpec="*.doc") returned 0 [0143.002] lstrlenA (lpString="*.doc") returned 5 [0143.002] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\IahK7Fmb.mp3", pszSpec="*.docx") returned 0 [0143.002] lstrlenA (lpString="*.docx") returned 6 [0143.002] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\IahK7Fmb.mp3", pszSpec="*.xls") returned 0 [0143.002] lstrlenA (lpString="*.xls") returned 5 [0143.002] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\IahK7Fmb.mp3", pszSpec="*.xlsx") returned 0 [0143.002] lstrlenA (lpString="*.xlsx") returned 6 [0143.002] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\IahK7Fmb.mp3", pszSpec="*.ppt") returned 0 [0143.002] lstrlenA (lpString="*.ppt") returned 5 [0143.002] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\IahK7Fmb.mp3", pszSpec="*.pptx") returned 0 [0143.002] lstrlenA (lpString="*.pptx") returned 6 [0143.002] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\IahK7Fmb.mp3", pszSpec="*.txt") returned 0 [0143.002] lstrlenA (lpString="*.txt") returned 5 [0143.002] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\IahK7Fmb.mp3", pszSpec="*.pdf") returned 0 [0143.002] lstrlenA (lpString="*.pdf") returned 5 [0143.002] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\IahK7Fmb.mp3", pszSpec="*.djvu") returned 0 [0143.002] lstrlenA (lpString="*.djvu") returned 6 [0143.002] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\IahK7Fmb.mp3", pszSpec="*.htm") returned 0 [0143.002] lstrlenA (lpString="*.htm") returned 5 [0143.002] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\IahK7Fmb.mp3", pszSpec="*.html") returned 0 [0143.002] lstrlenA (lpString="*.html") returned 6 [0143.002] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\IahK7Fmb.mp3", pszSpec="*.mdb") returned 0 [0143.003] lstrlenA (lpString="*.mdb") returned 5 [0143.003] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\IahK7Fmb.mp3", pszSpec="*.cer") returned 0 [0143.003] lstrlenA (lpString="*.cer") returned 5 [0143.003] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\IahK7Fmb.mp3", pszSpec="*.p12") returned 0 [0143.003] lstrlenA (lpString="*.p12") returned 5 [0143.003] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\IahK7Fmb.mp3", pszSpec="*.pfx") returned 0 [0143.003] lstrlenA (lpString="*.pfx") returned 5 [0143.003] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\IahK7Fmb.mp3", pszSpec="*.kwm") returned 0 [0143.003] lstrlenA (lpString="*.kwm") returned 5 [0143.003] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\IahK7Fmb.mp3", pszSpec="*.pwm") returned 0 [0143.003] lstrlenA (lpString="*.pwm") returned 5 [0143.003] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\IahK7Fmb.mp3", pszSpec="*.1cd") returned 0 [0143.003] lstrlenA (lpString="*.1cd") returned 5 [0143.003] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\IahK7Fmb.mp3", pszSpec="*.md") returned 0 [0143.003] lstrlenA (lpString="*.md") returned 4 [0143.003] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\IahK7Fmb.mp3", pszSpec="*.mdf") returned 0 [0143.003] lstrlenA (lpString="*.mdf") returned 5 [0143.003] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\IahK7Fmb.mp3", pszSpec="*.dbf") returned 0 [0143.003] lstrlenA (lpString="*.dbf") returned 5 [0143.003] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\IahK7Fmb.mp3", pszSpec="*.odt") returned 0 [0143.003] lstrlenA (lpString="*.odt") returned 5 [0143.003] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\IahK7Fmb.mp3", pszSpec="*.vob") returned 0 [0143.003] lstrlenA (lpString="*.vob") returned 5 [0143.003] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\IahK7Fmb.mp3", pszSpec="*.ifo") returned 0 [0143.003] lstrlenA (lpString="*.ifo") returned 5 [0143.003] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\IahK7Fmb.mp3", pszSpec="*.lnk") returned 0 [0143.003] lstrlenA (lpString="*.lnk") returned 5 [0143.003] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\IahK7Fmb.mp3", pszSpec="*.torrent") returned 0 [0143.003] lstrlenA (lpString="*.torrent") returned 9 [0143.003] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\IahK7Fmb.mp3", pszSpec="*.mov") returned 0 [0143.003] lstrlenA (lpString="*.mov") returned 5 [0143.003] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\IahK7Fmb.mp3", pszSpec="*.m2v") returned 0 [0143.003] lstrlenA (lpString="*.m2v") returned 5 [0143.003] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\IahK7Fmb.mp3", pszSpec="*.3gp") returned 0 [0143.003] lstrlenA (lpString="*.3gp") returned 5 [0143.003] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\IahK7Fmb.mp3", pszSpec="*.mpeg") returned 0 [0143.003] lstrlenA (lpString="*.mpeg") returned 6 [0143.004] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\IahK7Fmb.mp3", pszSpec="*.mpg") returned 0 [0143.004] lstrlenA (lpString="*.mpg") returned 5 [0143.004] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\IahK7Fmb.mp3", pszSpec="*.flv") returned 0 [0143.004] lstrlenA (lpString="*.flv") returned 5 [0143.004] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\IahK7Fmb.mp3", pszSpec="*.avi") returned 0 [0143.004] lstrlenA (lpString="*.avi") returned 5 [0143.004] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\IahK7Fmb.mp3", pszSpec="*.mp4") returned 0 [0143.004] lstrlenA (lpString="*.mp4") returned 5 [0143.004] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\IahK7Fmb.mp3", pszSpec="*.wmv") returned 0 [0143.004] lstrlenA (lpString="*.wmv") returned 5 [0143.004] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\IahK7Fmb.mp3", pszSpec="*.divx") returned 0 [0143.004] lstrlenA (lpString="*.divx") returned 6 [0143.004] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\IahK7Fmb.mp3", pszSpec="*.mkv") returned 0 [0143.004] lstrlenA (lpString="*.mkv") returned 5 [0143.004] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\IahK7Fmb.mp3", pszSpec="*.mp3") returned 1 [0143.004] lstrlenA (lpString="*.mp3") returned 5 [0143.004] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\IahK7Fmb.mp3" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\IahK7Fmb.mp3") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\IahK7Fmb.mp3" [0143.004] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\IahK7Fmb.mp3" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\IahK7Fmb.mp3") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\IahK7Fmb.mp3" [0143.004] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\IahK7Fmb.mp3", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\IahK7Fmb.mp3.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\IahK7Fmb.mp3." [0143.004] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\IahK7Fmb.mp3.", lpString2="\xa0" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\IahK7Fmb.mp3. ") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\IahK7Fmb.mp3. " [0143.004] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\IahK7Fmb.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\iahk7fmb.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0143.005] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x994e [0143.005] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xe37a2120, dwHighDateTime=0x1d4abb1), lpLastAccessTime=0x407536*(dwLowDateTime=0xce31a90, dwHighDateTime=0x1d4a968), lpLastWriteTime=0x40753e*(dwLowDateTime=0xce31a90, dwHighDateTime=0x1d4a968)) returned 1 [0143.005] SetFilePointer (in: hFile=0x90, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0143.005] ReadFile (in: hFile=0x90, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x98f4, lpOverlapped=0x0) returned 1 [0143.006] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\IahK7Fmb.mp3") returned="IahK7Fmb.mp3" [0143.006] SetFilePointer (in: hFile=0x90, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0143.006] WriteFile (in: hFile=0x90, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x98f4, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x98f4, lpOverlapped=0x0) returned 1 [0143.006] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0143.006] CloseHandle (hObject=0x90) returned 1 [0143.006] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\IahK7Fmb.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\iahk7fmb.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\IahK7Fmb.mp3. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\iahk7fmb.mp3. ")) returned 1 [0143.007] FindNextFileA (in: hFindFile=0x5be260, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0143.007] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0143.008] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="iNbvpxtyC8_tbe.jpg") returned -1 [0143.008] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="iNbvpxtyC8_tbe.jpg") returned -1 [0143.008] lstrcmpiA (lpString1="", lpString2="iNbvpxtyC8_tbe.jpg") returned -1 [0143.008] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\IahK7Fmb.mp3") returned="IahK7Fmb.mp3" [0143.008] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\", lpString2="iNbvpxtyC8_tbe.jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\iNbvpxtyC8_tbe.jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\iNbvpxtyC8_tbe.jpg" [0143.008] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\iNbvpxtyC8_tbe.jpg", pszSpec="*.zip") returned 0 [0143.008] lstrlenA (lpString="*.zip") returned 5 [0143.008] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\iNbvpxtyC8_tbe.jpg", pszSpec="*.rar") returned 0 [0143.008] lstrlenA (lpString="*.rar") returned 5 [0143.008] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\iNbvpxtyC8_tbe.jpg", pszSpec="*.7z") returned 0 [0143.008] lstrlenA (lpString="*.7z") returned 4 [0143.008] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\iNbvpxtyC8_tbe.jpg", pszSpec="*.tar") returned 0 [0143.008] lstrlenA (lpString="*.tar") returned 5 [0143.008] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\iNbvpxtyC8_tbe.jpg", pszSpec="*.gzip") returned 0 [0143.008] lstrlenA (lpString="*.gzip") returned 6 [0143.008] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\iNbvpxtyC8_tbe.jpg", pszSpec="*.jpg") returned 1 [0143.008] lstrlenA (lpString="*.jpg") returned 5 [0143.008] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\iNbvpxtyC8_tbe.jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\iNbvpxtyC8_tbe.jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\iNbvpxtyC8_tbe.jpg" [0143.008] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\iNbvpxtyC8_tbe.jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\iNbvpxtyC8_tbe.jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\iNbvpxtyC8_tbe.jpg" [0143.008] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\iNbvpxtyC8_tbe.jpg", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\iNbvpxtyC8_tbe.jpg.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\iNbvpxtyC8_tbe.jpg." [0143.008] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\iNbvpxtyC8_tbe.jpg.", lpString2="\xa0" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\iNbvpxtyC8_tbe.jpg. ") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\iNbvpxtyC8_tbe.jpg. " [0143.008] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\iNbvpxtyC8_tbe.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\inbvpxtyc8_tbe.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0143.009] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1139d [0143.009] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xd31478e0, dwHighDateTime=0x1d4a273), lpLastAccessTime=0x407536*(dwLowDateTime=0x4f128dd0, dwHighDateTime=0x1d4a079), lpLastWriteTime=0x40753e*(dwLowDateTime=0x4f128dd0, dwHighDateTime=0x1d4a079)) returned 1 [0143.009] SetFilePointer (in: hFile=0x90, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0143.009] ReadFile (in: hFile=0x90, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x11343, lpOverlapped=0x0) returned 1 [0143.010] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\iNbvpxtyC8_tbe.jpg") returned="iNbvpxtyC8_tbe.jpg" [0143.010] SetFilePointer (in: hFile=0x90, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0143.010] WriteFile (in: hFile=0x90, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x11343, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x11343, lpOverlapped=0x0) returned 1 [0143.010] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0143.010] CloseHandle (hObject=0x90) returned 1 [0143.010] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\iNbvpxtyC8_tbe.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\inbvpxtyc8_tbe.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\iNbvpxtyC8_tbe.jpg. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\inbvpxtyc8_tbe.jpg. ")) returned 1 [0143.011] FindNextFileA (in: hFindFile=0x5be260, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0143.011] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0143.011] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="jGpWgaePPvX.doc") returned -1 [0143.011] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="jGpWgaePPvX.doc") returned -1 [0143.011] lstrcmpiA (lpString1="", lpString2="jGpWgaePPvX.doc") returned -1 [0143.011] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\iNbvpxtyC8_tbe.jpg") returned="iNbvpxtyC8_tbe.jpg" [0143.011] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\", lpString2="jGpWgaePPvX.doc" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\jGpWgaePPvX.doc") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\jGpWgaePPvX.doc" [0143.012] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\jGpWgaePPvX.doc", pszSpec="*.zip") returned 0 [0143.012] lstrlenA (lpString="*.zip") returned 5 [0143.012] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\jGpWgaePPvX.doc", pszSpec="*.rar") returned 0 [0143.012] lstrlenA (lpString="*.rar") returned 5 [0143.012] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\jGpWgaePPvX.doc", pszSpec="*.7z") returned 0 [0143.012] lstrlenA (lpString="*.7z") returned 4 [0143.012] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\jGpWgaePPvX.doc", pszSpec="*.tar") returned 0 [0143.012] lstrlenA (lpString="*.tar") returned 5 [0143.012] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\jGpWgaePPvX.doc", pszSpec="*.gzip") returned 0 [0143.012] lstrlenA (lpString="*.gzip") returned 6 [0143.012] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\jGpWgaePPvX.doc", pszSpec="*.jpg") returned 0 [0143.012] lstrlenA (lpString="*.jpg") returned 5 [0143.012] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\jGpWgaePPvX.doc", pszSpec="*.jpeg") returned 0 [0143.012] lstrlenA (lpString="*.jpeg") returned 6 [0143.012] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\jGpWgaePPvX.doc", pszSpec="*.psd") returned 0 [0143.012] lstrlenA (lpString="*.psd") returned 5 [0143.012] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\jGpWgaePPvX.doc", pszSpec="*.cdr") returned 0 [0143.012] lstrlenA (lpString="*.cdr") returned 5 [0143.012] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\jGpWgaePPvX.doc", pszSpec="*.dwg") returned 0 [0143.012] lstrlenA (lpString="*.dwg") returned 5 [0143.012] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\jGpWgaePPvX.doc", pszSpec="*.max") returned 0 [0143.012] lstrlenA (lpString="*.max") returned 5 [0143.012] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\jGpWgaePPvX.doc", pszSpec="*.bmp") returned 0 [0143.012] lstrlenA (lpString="*.bmp") returned 5 [0143.012] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\jGpWgaePPvX.doc", pszSpec="*.gif") returned 0 [0143.012] lstrlenA (lpString="*.gif") returned 5 [0143.012] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\jGpWgaePPvX.doc", pszSpec="*.png") returned 0 [0143.012] lstrlenA (lpString="*.png") returned 5 [0143.012] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\jGpWgaePPvX.doc", pszSpec="*.doc") returned 1 [0143.012] lstrlenA (lpString="*.doc") returned 5 [0143.012] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\jGpWgaePPvX.doc" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\jGpWgaePPvX.doc") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\jGpWgaePPvX.doc" [0143.012] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\jGpWgaePPvX.doc" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\jGpWgaePPvX.doc") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\jGpWgaePPvX.doc" [0143.012] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\jGpWgaePPvX.doc", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\jGpWgaePPvX.doc.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\jGpWgaePPvX.doc." [0143.012] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\jGpWgaePPvX.doc.", lpString2="\xa0" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\jGpWgaePPvX.doc. ") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\jGpWgaePPvX.doc. " [0143.012] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\jGpWgaePPvX.doc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\jgpwgaeppvx.doc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0143.013] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x12cd8 [0143.013] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x94404300, dwHighDateTime=0x1d4a0f8), lpLastAccessTime=0x407536*(dwLowDateTime=0x14beeda0, dwHighDateTime=0x1d49db7), lpLastWriteTime=0x40753e*(dwLowDateTime=0x14beeda0, dwHighDateTime=0x1d49db7)) returned 1 [0143.013] SetFilePointer (in: hFile=0x90, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0143.013] ReadFile (in: hFile=0x90, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x12c7e, lpOverlapped=0x0) returned 1 [0143.014] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\jGpWgaePPvX.doc") returned="jGpWgaePPvX.doc" [0143.014] SetFilePointer (in: hFile=0x90, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0143.014] WriteFile (in: hFile=0x90, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x12c7e, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x12c7e, lpOverlapped=0x0) returned 1 [0143.015] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0143.015] CloseHandle (hObject=0x90) returned 1 [0143.015] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\jGpWgaePPvX.doc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\jgpwgaeppvx.doc"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\jGpWgaePPvX.doc. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\jgpwgaeppvx.doc. ")) returned 1 [0143.016] FindNextFileA (in: hFindFile=0x5be260, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0143.016] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0143.016] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="jqDNnuD3rjqW13vr.jpg") returned -1 [0143.016] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="jqDNnuD3rjqW13vr.jpg") returned -1 [0143.016] lstrcmpiA (lpString1="", lpString2="jqDNnuD3rjqW13vr.jpg") returned -1 [0143.016] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\jGpWgaePPvX.doc") returned="jGpWgaePPvX.doc" [0143.016] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\", lpString2="jqDNnuD3rjqW13vr.jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\jqDNnuD3rjqW13vr.jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\jqDNnuD3rjqW13vr.jpg" [0143.016] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\jqDNnuD3rjqW13vr.jpg", pszSpec="*.zip") returned 0 [0143.016] lstrlenA (lpString="*.zip") returned 5 [0143.016] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\jqDNnuD3rjqW13vr.jpg", pszSpec="*.rar") returned 0 [0143.016] lstrlenA (lpString="*.rar") returned 5 [0143.016] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\jqDNnuD3rjqW13vr.jpg", pszSpec="*.7z") returned 0 [0143.016] lstrlenA (lpString="*.7z") returned 4 [0143.016] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\jqDNnuD3rjqW13vr.jpg", pszSpec="*.tar") returned 0 [0143.016] lstrlenA (lpString="*.tar") returned 5 [0143.016] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\jqDNnuD3rjqW13vr.jpg", pszSpec="*.gzip") returned 0 [0143.016] lstrlenA (lpString="*.gzip") returned 6 [0143.016] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\jqDNnuD3rjqW13vr.jpg", pszSpec="*.jpg") returned 1 [0143.016] lstrlenA (lpString="*.jpg") returned 5 [0143.016] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\jqDNnuD3rjqW13vr.jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\jqDNnuD3rjqW13vr.jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\jqDNnuD3rjqW13vr.jpg" [0143.016] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\jqDNnuD3rjqW13vr.jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\jqDNnuD3rjqW13vr.jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\jqDNnuD3rjqW13vr.jpg" [0143.016] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\jqDNnuD3rjqW13vr.jpg", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\jqDNnuD3rjqW13vr.jpg.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\jqDNnuD3rjqW13vr.jpg." [0143.016] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\jqDNnuD3rjqW13vr.jpg.", lpString2="\xa0" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\jqDNnuD3rjqW13vr.jpg. ") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\jqDNnuD3rjqW13vr.jpg. " [0143.016] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\jqDNnuD3rjqW13vr.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\jqdnnud3rjqw13vr.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0143.017] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x115ee [0143.017] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x6db5f290, dwHighDateTime=0x1d4a30d), lpLastAccessTime=0x407536*(dwLowDateTime=0x7bc94af0, dwHighDateTime=0x1d4a2ca), lpLastWriteTime=0x40753e*(dwLowDateTime=0x7bc94af0, dwHighDateTime=0x1d4a2ca)) returned 1 [0143.017] SetFilePointer (in: hFile=0x90, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0143.017] ReadFile (in: hFile=0x90, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x11594, lpOverlapped=0x0) returned 1 [0143.018] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\jqDNnuD3rjqW13vr.jpg") returned="jqDNnuD3rjqW13vr.jpg" [0143.018] SetFilePointer (in: hFile=0x90, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0143.018] WriteFile (in: hFile=0x90, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x11594, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x11594, lpOverlapped=0x0) returned 1 [0143.018] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0143.018] CloseHandle (hObject=0x90) returned 1 [0143.019] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\jqDNnuD3rjqW13vr.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\jqdnnud3rjqw13vr.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\jqDNnuD3rjqW13vr.jpg. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\jqdnnud3rjqw13vr.jpg. ")) returned 1 [0143.020] FindNextFileA (in: hFindFile=0x5be260, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0143.020] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0143.020] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="jT4uKLWkht4.odt") returned -1 [0143.020] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="jT4uKLWkht4.odt") returned -1 [0143.020] lstrcmpiA (lpString1="", lpString2="jT4uKLWkht4.odt") returned -1 [0143.020] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\jqDNnuD3rjqW13vr.jpg") returned="jqDNnuD3rjqW13vr.jpg" [0143.020] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\", lpString2="jT4uKLWkht4.odt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\jT4uKLWkht4.odt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\jT4uKLWkht4.odt" [0143.020] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\jT4uKLWkht4.odt", pszSpec="*.zip") returned 0 [0143.020] lstrlenA (lpString="*.zip") returned 5 [0143.020] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\jT4uKLWkht4.odt", pszSpec="*.rar") returned 0 [0143.020] lstrlenA (lpString="*.rar") returned 5 [0143.020] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\jT4uKLWkht4.odt", pszSpec="*.7z") returned 0 [0143.020] lstrlenA (lpString="*.7z") returned 4 [0143.020] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\jT4uKLWkht4.odt", pszSpec="*.tar") returned 0 [0143.020] lstrlenA (lpString="*.tar") returned 5 [0143.020] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\jT4uKLWkht4.odt", pszSpec="*.gzip") returned 0 [0143.020] lstrlenA (lpString="*.gzip") returned 6 [0143.020] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\jT4uKLWkht4.odt", pszSpec="*.jpg") returned 0 [0143.020] lstrlenA (lpString="*.jpg") returned 5 [0143.020] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\jT4uKLWkht4.odt", pszSpec="*.jpeg") returned 0 [0143.020] lstrlenA (lpString="*.jpeg") returned 6 [0143.020] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\jT4uKLWkht4.odt", pszSpec="*.psd") returned 0 [0143.020] lstrlenA (lpString="*.psd") returned 5 [0143.020] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\jT4uKLWkht4.odt", pszSpec="*.cdr") returned 0 [0143.020] lstrlenA (lpString="*.cdr") returned 5 [0143.020] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\jT4uKLWkht4.odt", pszSpec="*.dwg") returned 0 [0143.020] lstrlenA (lpString="*.dwg") returned 5 [0143.020] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\jT4uKLWkht4.odt", pszSpec="*.max") returned 0 [0143.020] lstrlenA (lpString="*.max") returned 5 [0143.021] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\jT4uKLWkht4.odt", pszSpec="*.bmp") returned 0 [0143.021] lstrlenA (lpString="*.bmp") returned 5 [0143.021] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\jT4uKLWkht4.odt", pszSpec="*.gif") returned 0 [0143.021] lstrlenA (lpString="*.gif") returned 5 [0143.021] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\jT4uKLWkht4.odt", pszSpec="*.png") returned 0 [0143.021] lstrlenA (lpString="*.png") returned 5 [0143.021] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\jT4uKLWkht4.odt", pszSpec="*.doc") returned 0 [0143.021] lstrlenA (lpString="*.doc") returned 5 [0143.021] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\jT4uKLWkht4.odt", pszSpec="*.docx") returned 0 [0143.021] lstrlenA (lpString="*.docx") returned 6 [0143.021] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\jT4uKLWkht4.odt", pszSpec="*.xls") returned 0 [0143.021] lstrlenA (lpString="*.xls") returned 5 [0143.021] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\jT4uKLWkht4.odt", pszSpec="*.xlsx") returned 0 [0143.021] lstrlenA (lpString="*.xlsx") returned 6 [0143.021] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\jT4uKLWkht4.odt", pszSpec="*.ppt") returned 0 [0143.021] lstrlenA (lpString="*.ppt") returned 5 [0143.021] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\jT4uKLWkht4.odt", pszSpec="*.pptx") returned 0 [0143.021] lstrlenA (lpString="*.pptx") returned 6 [0143.021] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\jT4uKLWkht4.odt", pszSpec="*.txt") returned 0 [0143.021] lstrlenA (lpString="*.txt") returned 5 [0143.021] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\jT4uKLWkht4.odt", pszSpec="*.pdf") returned 0 [0143.021] lstrlenA (lpString="*.pdf") returned 5 [0143.021] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\jT4uKLWkht4.odt", pszSpec="*.djvu") returned 0 [0143.021] lstrlenA (lpString="*.djvu") returned 6 [0143.021] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\jT4uKLWkht4.odt", pszSpec="*.htm") returned 0 [0143.021] lstrlenA (lpString="*.htm") returned 5 [0143.021] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\jT4uKLWkht4.odt", pszSpec="*.html") returned 0 [0143.021] lstrlenA (lpString="*.html") returned 6 [0143.021] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\jT4uKLWkht4.odt", pszSpec="*.mdb") returned 0 [0143.021] lstrlenA (lpString="*.mdb") returned 5 [0143.021] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\jT4uKLWkht4.odt", pszSpec="*.cer") returned 0 [0143.021] lstrlenA (lpString="*.cer") returned 5 [0143.021] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\jT4uKLWkht4.odt", pszSpec="*.p12") returned 0 [0143.021] lstrlenA (lpString="*.p12") returned 5 [0143.021] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\jT4uKLWkht4.odt", pszSpec="*.pfx") returned 0 [0143.021] lstrlenA (lpString="*.pfx") returned 5 [0143.022] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\jT4uKLWkht4.odt", pszSpec="*.kwm") returned 0 [0143.022] lstrlenA (lpString="*.kwm") returned 5 [0143.022] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\jT4uKLWkht4.odt", pszSpec="*.pwm") returned 0 [0143.022] lstrlenA (lpString="*.pwm") returned 5 [0143.022] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\jT4uKLWkht4.odt", pszSpec="*.1cd") returned 0 [0143.022] lstrlenA (lpString="*.1cd") returned 5 [0143.022] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\jT4uKLWkht4.odt", pszSpec="*.md") returned 0 [0143.022] lstrlenA (lpString="*.md") returned 4 [0143.022] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\jT4uKLWkht4.odt", pszSpec="*.mdf") returned 0 [0143.022] lstrlenA (lpString="*.mdf") returned 5 [0143.022] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\jT4uKLWkht4.odt", pszSpec="*.dbf") returned 0 [0143.022] lstrlenA (lpString="*.dbf") returned 5 [0143.022] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\jT4uKLWkht4.odt", pszSpec="*.odt") returned 1 [0143.022] lstrlenA (lpString="*.odt") returned 5 [0143.022] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\jT4uKLWkht4.odt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\jT4uKLWkht4.odt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\jT4uKLWkht4.odt" [0143.022] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\jT4uKLWkht4.odt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\jT4uKLWkht4.odt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\jT4uKLWkht4.odt" [0143.022] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\jT4uKLWkht4.odt", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\jT4uKLWkht4.odt.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\jT4uKLWkht4.odt." [0143.022] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\jT4uKLWkht4.odt.", lpString2="\xa0" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\jT4uKLWkht4.odt. ") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\jT4uKLWkht4.odt. " [0143.022] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\jT4uKLWkht4.odt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\jt4uklwkht4.odt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0143.023] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x187e3 [0143.023] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xe2479d40, dwHighDateTime=0x1d4a55e), lpLastAccessTime=0x407536*(dwLowDateTime=0x3dbdc5b0, dwHighDateTime=0x1d4a2e3), lpLastWriteTime=0x40753e*(dwLowDateTime=0x3dbdc5b0, dwHighDateTime=0x1d4a2e3)) returned 1 [0143.023] SetFilePointer (in: hFile=0x90, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0143.023] ReadFile (in: hFile=0x90, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x18789, lpOverlapped=0x0) returned 1 [0143.024] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\jT4uKLWkht4.odt") returned="jT4uKLWkht4.odt" [0143.025] SetFilePointer (in: hFile=0x90, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0143.025] WriteFile (in: hFile=0x90, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x18789, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x18789, lpOverlapped=0x0) returned 1 [0143.025] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0143.025] CloseHandle (hObject=0x90) returned 1 [0143.025] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\jT4uKLWkht4.odt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\jt4uklwkht4.odt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\jT4uKLWkht4.odt. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\jt4uklwkht4.odt. ")) returned 1 [0143.026] FindNextFileA (in: hFindFile=0x5be260, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0143.026] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0143.027] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="kBj-dZ-crsOi0tp.csv") returned -1 [0143.027] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="kBj-dZ-crsOi0tp.csv") returned -1 [0143.027] lstrcmpiA (lpString1="", lpString2="kBj-dZ-crsOi0tp.csv") returned -1 [0143.027] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\jT4uKLWkht4.odt") returned="jT4uKLWkht4.odt" [0143.027] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\", lpString2="kBj-dZ-crsOi0tp.csv" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\kBj-dZ-crsOi0tp.csv") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\kBj-dZ-crsOi0tp.csv" [0143.027] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\kBj-dZ-crsOi0tp.csv", pszSpec="*.zip") returned 0 [0143.027] lstrlenA (lpString="*.zip") returned 5 [0143.027] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\kBj-dZ-crsOi0tp.csv", pszSpec="*.rar") returned 0 [0143.027] lstrlenA (lpString="*.rar") returned 5 [0143.027] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\kBj-dZ-crsOi0tp.csv", pszSpec="*.7z") returned 0 [0143.027] lstrlenA (lpString="*.7z") returned 4 [0143.027] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\kBj-dZ-crsOi0tp.csv", pszSpec="*.tar") returned 0 [0143.027] lstrlenA (lpString="*.tar") returned 5 [0143.027] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\kBj-dZ-crsOi0tp.csv", pszSpec="*.gzip") returned 0 [0143.027] lstrlenA (lpString="*.gzip") returned 6 [0143.027] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\kBj-dZ-crsOi0tp.csv", pszSpec="*.jpg") returned 0 [0143.027] lstrlenA (lpString="*.jpg") returned 5 [0143.027] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\kBj-dZ-crsOi0tp.csv", pszSpec="*.jpeg") returned 0 [0143.027] lstrlenA (lpString="*.jpeg") returned 6 [0143.027] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\kBj-dZ-crsOi0tp.csv", pszSpec="*.psd") returned 0 [0143.027] lstrlenA (lpString="*.psd") returned 5 [0143.027] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\kBj-dZ-crsOi0tp.csv", pszSpec="*.cdr") returned 0 [0143.027] lstrlenA (lpString="*.cdr") returned 5 [0143.027] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\kBj-dZ-crsOi0tp.csv", pszSpec="*.dwg") returned 0 [0143.027] lstrlenA (lpString="*.dwg") returned 5 [0143.027] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\kBj-dZ-crsOi0tp.csv", pszSpec="*.max") returned 0 [0143.027] lstrlenA (lpString="*.max") returned 5 [0143.027] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\kBj-dZ-crsOi0tp.csv", pszSpec="*.bmp") returned 0 [0143.027] lstrlenA (lpString="*.bmp") returned 5 [0143.027] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\kBj-dZ-crsOi0tp.csv", pszSpec="*.gif") returned 0 [0143.027] lstrlenA (lpString="*.gif") returned 5 [0143.027] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\kBj-dZ-crsOi0tp.csv", pszSpec="*.png") returned 0 [0143.027] lstrlenA (lpString="*.png") returned 5 [0143.027] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\kBj-dZ-crsOi0tp.csv", pszSpec="*.doc") returned 0 [0143.027] lstrlenA (lpString="*.doc") returned 5 [0143.028] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\kBj-dZ-crsOi0tp.csv", pszSpec="*.docx") returned 0 [0143.028] lstrlenA (lpString="*.docx") returned 6 [0143.028] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\kBj-dZ-crsOi0tp.csv", pszSpec="*.xls") returned 0 [0143.028] lstrlenA (lpString="*.xls") returned 5 [0143.028] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\kBj-dZ-crsOi0tp.csv", pszSpec="*.xlsx") returned 0 [0143.028] lstrlenA (lpString="*.xlsx") returned 6 [0143.028] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\kBj-dZ-crsOi0tp.csv", pszSpec="*.ppt") returned 0 [0143.028] lstrlenA (lpString="*.ppt") returned 5 [0143.028] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\kBj-dZ-crsOi0tp.csv", pszSpec="*.pptx") returned 0 [0143.028] lstrlenA (lpString="*.pptx") returned 6 [0143.028] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\kBj-dZ-crsOi0tp.csv", pszSpec="*.txt") returned 0 [0143.028] lstrlenA (lpString="*.txt") returned 5 [0143.028] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\kBj-dZ-crsOi0tp.csv", pszSpec="*.pdf") returned 0 [0143.028] lstrlenA (lpString="*.pdf") returned 5 [0143.028] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\kBj-dZ-crsOi0tp.csv", pszSpec="*.djvu") returned 0 [0143.028] lstrlenA (lpString="*.djvu") returned 6 [0143.028] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\kBj-dZ-crsOi0tp.csv", pszSpec="*.htm") returned 0 [0143.028] lstrlenA (lpString="*.htm") returned 5 [0143.028] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\kBj-dZ-crsOi0tp.csv", pszSpec="*.html") returned 0 [0143.028] lstrlenA (lpString="*.html") returned 6 [0143.028] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\kBj-dZ-crsOi0tp.csv", pszSpec="*.mdb") returned 0 [0143.028] lstrlenA (lpString="*.mdb") returned 5 [0143.028] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\kBj-dZ-crsOi0tp.csv", pszSpec="*.cer") returned 0 [0143.028] lstrlenA (lpString="*.cer") returned 5 [0143.028] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\kBj-dZ-crsOi0tp.csv", pszSpec="*.p12") returned 0 [0143.028] lstrlenA (lpString="*.p12") returned 5 [0143.028] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\kBj-dZ-crsOi0tp.csv", pszSpec="*.pfx") returned 0 [0143.028] lstrlenA (lpString="*.pfx") returned 5 [0143.028] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\kBj-dZ-crsOi0tp.csv", pszSpec="*.kwm") returned 0 [0143.028] lstrlenA (lpString="*.kwm") returned 5 [0143.028] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\kBj-dZ-crsOi0tp.csv", pszSpec="*.pwm") returned 0 [0143.028] lstrlenA (lpString="*.pwm") returned 5 [0143.028] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\kBj-dZ-crsOi0tp.csv", pszSpec="*.1cd") returned 0 [0143.028] lstrlenA (lpString="*.1cd") returned 5 [0143.029] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\kBj-dZ-crsOi0tp.csv", pszSpec="*.md") returned 0 [0143.029] lstrlenA (lpString="*.md") returned 4 [0143.029] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\kBj-dZ-crsOi0tp.csv", pszSpec="*.mdf") returned 0 [0143.029] lstrlenA (lpString="*.mdf") returned 5 [0143.029] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\kBj-dZ-crsOi0tp.csv", pszSpec="*.dbf") returned 0 [0143.029] lstrlenA (lpString="*.dbf") returned 5 [0143.029] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\kBj-dZ-crsOi0tp.csv", pszSpec="*.odt") returned 0 [0143.029] lstrlenA (lpString="*.odt") returned 5 [0143.029] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\kBj-dZ-crsOi0tp.csv", pszSpec="*.vob") returned 0 [0143.029] lstrlenA (lpString="*.vob") returned 5 [0143.029] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\kBj-dZ-crsOi0tp.csv", pszSpec="*.ifo") returned 0 [0143.029] lstrlenA (lpString="*.ifo") returned 5 [0143.029] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\kBj-dZ-crsOi0tp.csv", pszSpec="*.lnk") returned 0 [0143.029] lstrlenA (lpString="*.lnk") returned 5 [0143.029] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\kBj-dZ-crsOi0tp.csv", pszSpec="*.torrent") returned 0 [0143.029] lstrlenA (lpString="*.torrent") returned 9 [0143.029] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\kBj-dZ-crsOi0tp.csv", pszSpec="*.mov") returned 0 [0143.029] lstrlenA (lpString="*.mov") returned 5 [0143.029] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\kBj-dZ-crsOi0tp.csv", pszSpec="*.m2v") returned 0 [0143.029] lstrlenA (lpString="*.m2v") returned 5 [0143.029] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\kBj-dZ-crsOi0tp.csv", pszSpec="*.3gp") returned 0 [0143.029] lstrlenA (lpString="*.3gp") returned 5 [0143.029] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\kBj-dZ-crsOi0tp.csv", pszSpec="*.mpeg") returned 0 [0143.029] lstrlenA (lpString="*.mpeg") returned 6 [0143.029] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\kBj-dZ-crsOi0tp.csv", pszSpec="*.mpg") returned 0 [0143.029] lstrlenA (lpString="*.mpg") returned 5 [0143.029] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\kBj-dZ-crsOi0tp.csv", pszSpec="*.flv") returned 0 [0143.029] lstrlenA (lpString="*.flv") returned 5 [0143.029] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\kBj-dZ-crsOi0tp.csv", pszSpec="*.avi") returned 0 [0143.029] lstrlenA (lpString="*.avi") returned 5 [0143.029] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\kBj-dZ-crsOi0tp.csv", pszSpec="*.mp4") returned 0 [0143.029] lstrlenA (lpString="*.mp4") returned 5 [0143.029] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\kBj-dZ-crsOi0tp.csv", pszSpec="*.wmv") returned 0 [0143.029] lstrlenA (lpString="*.wmv") returned 5 [0143.029] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\kBj-dZ-crsOi0tp.csv", pszSpec="*.divx") returned 0 [0143.029] lstrlenA (lpString="*.divx") returned 6 [0143.029] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\kBj-dZ-crsOi0tp.csv", pszSpec="*.mkv") returned 0 [0143.030] lstrlenA (lpString="*.mkv") returned 5 [0143.030] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\kBj-dZ-crsOi0tp.csv", pszSpec="*.mp3") returned 0 [0143.030] lstrlenA (lpString="*.mp3") returned 5 [0143.030] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\kBj-dZ-crsOi0tp.csv", pszSpec="*.wav") returned 0 [0143.030] lstrlenA (lpString="*.wav") returned 5 [0143.030] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\kBj-dZ-crsOi0tp.csv", pszSpec="*.flac") returned 0 [0143.030] lstrlenA (lpString="*.flac") returned 6 [0143.030] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\kBj-dZ-crsOi0tp.csv", pszSpec="*.ape") returned 0 [0143.030] lstrlenA (lpString="*.ape") returned 5 [0143.030] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\kBj-dZ-crsOi0tp.csv", pszSpec="*.wma") returned 0 [0143.030] lstrlenA (lpString="*.wma") returned 5 [0143.030] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\kBj-dZ-crsOi0tp.csv", pszSpec="*.ac3") returned 0 [0143.030] lstrlenA (lpString="*.ac3") returned 5 [0143.030] FindNextFileA (in: hFindFile=0x5be260, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0143.030] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0143.030] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="lpc_6 4vss XzQsL.pps") returned -1 [0143.030] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="lpc_6 4vss XzQsL.pps") returned -1 [0143.030] lstrcmpiA (lpString1="", lpString2="lpc_6 4vss XzQsL.pps") returned -1 [0143.030] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\kBj-dZ-crsOi0tp.csv") returned="kBj-dZ-crsOi0tp.csv" [0143.030] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\", lpString2="lpc_6 4vss XzQsL.pps" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\lpc_6 4vss XzQsL.pps") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\lpc_6 4vss XzQsL.pps" [0143.030] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\lpc_6 4vss XzQsL.pps", pszSpec="*.zip") returned 0 [0143.030] lstrlenA (lpString="*.zip") returned 5 [0143.030] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\lpc_6 4vss XzQsL.pps", pszSpec="*.rar") returned 0 [0143.030] lstrlenA (lpString="*.rar") returned 5 [0143.030] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\lpc_6 4vss XzQsL.pps", pszSpec="*.7z") returned 0 [0143.030] lstrlenA (lpString="*.7z") returned 4 [0143.030] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\lpc_6 4vss XzQsL.pps", pszSpec="*.tar") returned 0 [0143.030] lstrlenA (lpString="*.tar") returned 5 [0143.030] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\lpc_6 4vss XzQsL.pps", pszSpec="*.gzip") returned 0 [0143.030] lstrlenA (lpString="*.gzip") returned 6 [0143.030] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\lpc_6 4vss XzQsL.pps", pszSpec="*.jpg") returned 0 [0143.030] lstrlenA (lpString="*.jpg") returned 5 [0143.030] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\lpc_6 4vss XzQsL.pps", pszSpec="*.jpeg") returned 0 [0143.030] lstrlenA (lpString="*.jpeg") returned 6 [0143.030] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\lpc_6 4vss XzQsL.pps", pszSpec="*.psd") returned 0 [0143.030] lstrlenA (lpString="*.psd") returned 5 [0143.030] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\lpc_6 4vss XzQsL.pps", pszSpec="*.cdr") returned 0 [0143.030] lstrlenA (lpString="*.cdr") returned 5 [0143.031] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\lpc_6 4vss XzQsL.pps", pszSpec="*.dwg") returned 0 [0143.031] lstrlenA (lpString="*.dwg") returned 5 [0143.031] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\lpc_6 4vss XzQsL.pps", pszSpec="*.max") returned 0 [0143.031] lstrlenA (lpString="*.max") returned 5 [0143.031] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\lpc_6 4vss XzQsL.pps", pszSpec="*.bmp") returned 0 [0143.031] lstrlenA (lpString="*.bmp") returned 5 [0143.031] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\lpc_6 4vss XzQsL.pps", pszSpec="*.gif") returned 0 [0143.031] lstrlenA (lpString="*.gif") returned 5 [0143.031] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\lpc_6 4vss XzQsL.pps", pszSpec="*.png") returned 0 [0143.031] lstrlenA (lpString="*.png") returned 5 [0143.031] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\lpc_6 4vss XzQsL.pps", pszSpec="*.doc") returned 0 [0143.031] lstrlenA (lpString="*.doc") returned 5 [0143.031] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\lpc_6 4vss XzQsL.pps", pszSpec="*.docx") returned 0 [0143.031] lstrlenA (lpString="*.docx") returned 6 [0143.031] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\lpc_6 4vss XzQsL.pps", pszSpec="*.xls") returned 0 [0143.031] lstrlenA (lpString="*.xls") returned 5 [0143.031] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\lpc_6 4vss XzQsL.pps", pszSpec="*.xlsx") returned 0 [0143.031] lstrlenA (lpString="*.xlsx") returned 6 [0143.031] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\lpc_6 4vss XzQsL.pps", pszSpec="*.ppt") returned 0 [0143.031] lstrlenA (lpString="*.ppt") returned 5 [0143.031] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\lpc_6 4vss XzQsL.pps", pszSpec="*.pptx") returned 0 [0143.031] lstrlenA (lpString="*.pptx") returned 6 [0143.031] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\lpc_6 4vss XzQsL.pps", pszSpec="*.txt") returned 0 [0143.031] lstrlenA (lpString="*.txt") returned 5 [0143.031] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\lpc_6 4vss XzQsL.pps", pszSpec="*.pdf") returned 0 [0143.031] lstrlenA (lpString="*.pdf") returned 5 [0143.031] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\lpc_6 4vss XzQsL.pps", pszSpec="*.djvu") returned 0 [0143.031] lstrlenA (lpString="*.djvu") returned 6 [0143.031] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\lpc_6 4vss XzQsL.pps", pszSpec="*.htm") returned 0 [0143.031] lstrlenA (lpString="*.htm") returned 5 [0143.031] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\lpc_6 4vss XzQsL.pps", pszSpec="*.html") returned 0 [0143.031] lstrlenA (lpString="*.html") returned 6 [0143.031] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\lpc_6 4vss XzQsL.pps", pszSpec="*.mdb") returned 0 [0143.031] lstrlenA (lpString="*.mdb") returned 5 [0143.031] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\lpc_6 4vss XzQsL.pps", pszSpec="*.cer") returned 0 [0143.031] lstrlenA (lpString="*.cer") returned 5 [0143.031] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\lpc_6 4vss XzQsL.pps", pszSpec="*.p12") returned 0 [0143.032] lstrlenA (lpString="*.p12") returned 5 [0143.032] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\lpc_6 4vss XzQsL.pps", pszSpec="*.pfx") returned 0 [0143.032] lstrlenA (lpString="*.pfx") returned 5 [0143.032] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\lpc_6 4vss XzQsL.pps", pszSpec="*.kwm") returned 0 [0143.032] lstrlenA (lpString="*.kwm") returned 5 [0143.032] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\lpc_6 4vss XzQsL.pps", pszSpec="*.pwm") returned 0 [0143.032] lstrlenA (lpString="*.pwm") returned 5 [0143.032] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\lpc_6 4vss XzQsL.pps", pszSpec="*.1cd") returned 0 [0143.032] lstrlenA (lpString="*.1cd") returned 5 [0143.032] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\lpc_6 4vss XzQsL.pps", pszSpec="*.md") returned 0 [0143.032] lstrlenA (lpString="*.md") returned 4 [0143.032] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\lpc_6 4vss XzQsL.pps", pszSpec="*.mdf") returned 0 [0143.032] lstrlenA (lpString="*.mdf") returned 5 [0143.032] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\lpc_6 4vss XzQsL.pps", pszSpec="*.dbf") returned 0 [0143.032] lstrlenA (lpString="*.dbf") returned 5 [0143.032] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\lpc_6 4vss XzQsL.pps", pszSpec="*.odt") returned 0 [0143.032] lstrlenA (lpString="*.odt") returned 5 [0143.032] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\lpc_6 4vss XzQsL.pps", pszSpec="*.vob") returned 0 [0143.032] lstrlenA (lpString="*.vob") returned 5 [0143.032] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\lpc_6 4vss XzQsL.pps", pszSpec="*.ifo") returned 0 [0143.032] lstrlenA (lpString="*.ifo") returned 5 [0143.032] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\lpc_6 4vss XzQsL.pps", pszSpec="*.lnk") returned 0 [0143.032] lstrlenA (lpString="*.lnk") returned 5 [0143.032] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\lpc_6 4vss XzQsL.pps", pszSpec="*.torrent") returned 0 [0143.032] lstrlenA (lpString="*.torrent") returned 9 [0143.032] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\lpc_6 4vss XzQsL.pps", pszSpec="*.mov") returned 0 [0143.032] lstrlenA (lpString="*.mov") returned 5 [0143.032] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\lpc_6 4vss XzQsL.pps", pszSpec="*.m2v") returned 0 [0143.032] lstrlenA (lpString="*.m2v") returned 5 [0143.032] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\lpc_6 4vss XzQsL.pps", pszSpec="*.3gp") returned 0 [0143.032] lstrlenA (lpString="*.3gp") returned 5 [0143.032] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\lpc_6 4vss XzQsL.pps", pszSpec="*.mpeg") returned 0 [0143.032] lstrlenA (lpString="*.mpeg") returned 6 [0143.032] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\lpc_6 4vss XzQsL.pps", pszSpec="*.mpg") returned 0 [0143.032] lstrlenA (lpString="*.mpg") returned 5 [0143.032] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\lpc_6 4vss XzQsL.pps", pszSpec="*.flv") returned 0 [0143.032] lstrlenA (lpString="*.flv") returned 5 [0143.032] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\lpc_6 4vss XzQsL.pps", pszSpec="*.avi") returned 0 [0143.032] lstrlenA (lpString="*.avi") returned 5 [0143.033] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\lpc_6 4vss XzQsL.pps", pszSpec="*.mp4") returned 0 [0143.033] lstrlenA (lpString="*.mp4") returned 5 [0143.033] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\lpc_6 4vss XzQsL.pps", pszSpec="*.wmv") returned 0 [0143.033] lstrlenA (lpString="*.wmv") returned 5 [0143.033] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\lpc_6 4vss XzQsL.pps", pszSpec="*.divx") returned 0 [0143.033] lstrlenA (lpString="*.divx") returned 6 [0143.033] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\lpc_6 4vss XzQsL.pps", pszSpec="*.mkv") returned 0 [0143.033] lstrlenA (lpString="*.mkv") returned 5 [0143.033] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\lpc_6 4vss XzQsL.pps", pszSpec="*.mp3") returned 0 [0143.033] lstrlenA (lpString="*.mp3") returned 5 [0143.033] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\lpc_6 4vss XzQsL.pps", pszSpec="*.wav") returned 0 [0143.033] lstrlenA (lpString="*.wav") returned 5 [0143.033] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\lpc_6 4vss XzQsL.pps", pszSpec="*.flac") returned 0 [0143.033] lstrlenA (lpString="*.flac") returned 6 [0143.033] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\lpc_6 4vss XzQsL.pps", pszSpec="*.ape") returned 0 [0143.033] lstrlenA (lpString="*.ape") returned 5 [0143.033] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\lpc_6 4vss XzQsL.pps", pszSpec="*.wma") returned 0 [0143.033] lstrlenA (lpString="*.wma") returned 5 [0143.033] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\lpc_6 4vss XzQsL.pps", pszSpec="*.ac3") returned 0 [0143.033] lstrlenA (lpString="*.ac3") returned 5 [0143.033] FindNextFileA (in: hFindFile=0x5be260, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0143.033] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0143.033] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="mDZ_GctD.avi") returned -1 [0143.033] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="mDZ_GctD.avi") returned -1 [0143.033] lstrcmpiA (lpString1="", lpString2="mDZ_GctD.avi") returned -1 [0143.033] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\lpc_6 4vss XzQsL.pps") returned="lpc_6 4vss XzQsL.pps" [0143.033] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\", lpString2="mDZ_GctD.avi" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\mDZ_GctD.avi") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\mDZ_GctD.avi" [0143.033] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\mDZ_GctD.avi", pszSpec="*.zip") returned 0 [0143.033] lstrlenA (lpString="*.zip") returned 5 [0143.033] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\mDZ_GctD.avi", pszSpec="*.rar") returned 0 [0143.033] lstrlenA (lpString="*.rar") returned 5 [0143.033] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\mDZ_GctD.avi", pszSpec="*.7z") returned 0 [0143.033] lstrlenA (lpString="*.7z") returned 4 [0143.033] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\mDZ_GctD.avi", pszSpec="*.tar") returned 0 [0143.034] lstrlenA (lpString="*.tar") returned 5 [0143.034] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\mDZ_GctD.avi", pszSpec="*.gzip") returned 0 [0143.034] lstrlenA (lpString="*.gzip") returned 6 [0143.034] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\mDZ_GctD.avi", pszSpec="*.jpg") returned 0 [0143.034] lstrlenA (lpString="*.jpg") returned 5 [0143.034] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\mDZ_GctD.avi", pszSpec="*.jpeg") returned 0 [0143.034] lstrlenA (lpString="*.jpeg") returned 6 [0143.034] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\mDZ_GctD.avi", pszSpec="*.psd") returned 0 [0143.034] lstrlenA (lpString="*.psd") returned 5 [0143.034] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\mDZ_GctD.avi", pszSpec="*.cdr") returned 0 [0143.034] lstrlenA (lpString="*.cdr") returned 5 [0143.034] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\mDZ_GctD.avi", pszSpec="*.dwg") returned 0 [0143.034] lstrlenA (lpString="*.dwg") returned 5 [0143.034] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\mDZ_GctD.avi", pszSpec="*.max") returned 0 [0143.034] lstrlenA (lpString="*.max") returned 5 [0143.034] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\mDZ_GctD.avi", pszSpec="*.bmp") returned 0 [0143.034] lstrlenA (lpString="*.bmp") returned 5 [0143.034] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\mDZ_GctD.avi", pszSpec="*.gif") returned 0 [0143.034] lstrlenA (lpString="*.gif") returned 5 [0143.034] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\mDZ_GctD.avi", pszSpec="*.png") returned 0 [0143.034] lstrlenA (lpString="*.png") returned 5 [0143.034] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\mDZ_GctD.avi", pszSpec="*.doc") returned 0 [0143.034] lstrlenA (lpString="*.doc") returned 5 [0143.034] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\mDZ_GctD.avi", pszSpec="*.docx") returned 0 [0143.034] lstrlenA (lpString="*.docx") returned 6 [0143.034] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\mDZ_GctD.avi", pszSpec="*.xls") returned 0 [0143.034] lstrlenA (lpString="*.xls") returned 5 [0143.034] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\mDZ_GctD.avi", pszSpec="*.xlsx") returned 0 [0143.034] lstrlenA (lpString="*.xlsx") returned 6 [0143.034] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\mDZ_GctD.avi", pszSpec="*.ppt") returned 0 [0143.034] lstrlenA (lpString="*.ppt") returned 5 [0143.034] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\mDZ_GctD.avi", pszSpec="*.pptx") returned 0 [0143.034] lstrlenA (lpString="*.pptx") returned 6 [0143.034] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\mDZ_GctD.avi", pszSpec="*.txt") returned 0 [0143.034] lstrlenA (lpString="*.txt") returned 5 [0143.034] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\mDZ_GctD.avi", pszSpec="*.pdf") returned 0 [0143.034] lstrlenA (lpString="*.pdf") returned 5 [0143.035] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\mDZ_GctD.avi", pszSpec="*.djvu") returned 0 [0143.035] lstrlenA (lpString="*.djvu") returned 6 [0143.035] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\mDZ_GctD.avi", pszSpec="*.htm") returned 0 [0143.035] lstrlenA (lpString="*.htm") returned 5 [0143.035] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\mDZ_GctD.avi", pszSpec="*.html") returned 0 [0143.035] lstrlenA (lpString="*.html") returned 6 [0143.035] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\mDZ_GctD.avi", pszSpec="*.mdb") returned 0 [0143.035] lstrlenA (lpString="*.mdb") returned 5 [0143.035] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\mDZ_GctD.avi", pszSpec="*.cer") returned 0 [0143.035] lstrlenA (lpString="*.cer") returned 5 [0143.035] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\mDZ_GctD.avi", pszSpec="*.p12") returned 0 [0143.035] lstrlenA (lpString="*.p12") returned 5 [0143.035] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\mDZ_GctD.avi", pszSpec="*.pfx") returned 0 [0143.035] lstrlenA (lpString="*.pfx") returned 5 [0143.035] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\mDZ_GctD.avi", pszSpec="*.kwm") returned 0 [0143.035] lstrlenA (lpString="*.kwm") returned 5 [0143.035] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\mDZ_GctD.avi", pszSpec="*.pwm") returned 0 [0143.035] lstrlenA (lpString="*.pwm") returned 5 [0143.035] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\mDZ_GctD.avi", pszSpec="*.1cd") returned 0 [0143.035] lstrlenA (lpString="*.1cd") returned 5 [0143.035] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\mDZ_GctD.avi", pszSpec="*.md") returned 0 [0143.035] lstrlenA (lpString="*.md") returned 4 [0143.035] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\mDZ_GctD.avi", pszSpec="*.mdf") returned 0 [0143.035] lstrlenA (lpString="*.mdf") returned 5 [0143.035] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\mDZ_GctD.avi", pszSpec="*.dbf") returned 0 [0143.035] lstrlenA (lpString="*.dbf") returned 5 [0143.035] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\mDZ_GctD.avi", pszSpec="*.odt") returned 0 [0143.035] lstrlenA (lpString="*.odt") returned 5 [0143.035] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\mDZ_GctD.avi", pszSpec="*.vob") returned 0 [0143.035] lstrlenA (lpString="*.vob") returned 5 [0143.035] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\mDZ_GctD.avi", pszSpec="*.ifo") returned 0 [0143.035] lstrlenA (lpString="*.ifo") returned 5 [0143.035] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\mDZ_GctD.avi", pszSpec="*.lnk") returned 0 [0143.035] lstrlenA (lpString="*.lnk") returned 5 [0143.035] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\mDZ_GctD.avi", pszSpec="*.torrent") returned 0 [0143.035] lstrlenA (lpString="*.torrent") returned 9 [0143.035] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\mDZ_GctD.avi", pszSpec="*.mov") returned 0 [0143.035] lstrlenA (lpString="*.mov") returned 5 [0143.035] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\mDZ_GctD.avi", pszSpec="*.m2v") returned 0 [0143.036] lstrlenA (lpString="*.m2v") returned 5 [0143.036] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\mDZ_GctD.avi", pszSpec="*.3gp") returned 0 [0143.036] lstrlenA (lpString="*.3gp") returned 5 [0143.036] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\mDZ_GctD.avi", pszSpec="*.mpeg") returned 0 [0143.036] lstrlenA (lpString="*.mpeg") returned 6 [0143.036] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\mDZ_GctD.avi", pszSpec="*.mpg") returned 0 [0143.036] lstrlenA (lpString="*.mpg") returned 5 [0143.036] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\mDZ_GctD.avi", pszSpec="*.flv") returned 0 [0143.036] lstrlenA (lpString="*.flv") returned 5 [0143.036] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\mDZ_GctD.avi", pszSpec="*.avi") returned 1 [0143.036] lstrlenA (lpString="*.avi") returned 5 [0143.036] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\mDZ_GctD.avi" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\mDZ_GctD.avi") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\mDZ_GctD.avi" [0143.036] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\mDZ_GctD.avi" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\mDZ_GctD.avi") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\mDZ_GctD.avi" [0143.036] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\mDZ_GctD.avi", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\mDZ_GctD.avi.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\mDZ_GctD.avi." [0143.036] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\mDZ_GctD.avi.", lpString2="\xa0" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\mDZ_GctD.avi. ") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\mDZ_GctD.avi. " [0143.036] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\mDZ_GctD.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\mdz_gctd.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0143.037] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb003 [0143.037] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xf860df20, dwHighDateTime=0x1d4a3a0), lpLastAccessTime=0x407536*(dwLowDateTime=0x9ab6a8d0, dwHighDateTime=0x1d4a0af), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9ab6a8d0, dwHighDateTime=0x1d4a0af)) returned 1 [0143.037] SetFilePointer (in: hFile=0x90, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0143.037] ReadFile (in: hFile=0x90, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0xafa9, lpOverlapped=0x0) returned 1 [0143.038] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\mDZ_GctD.avi") returned="mDZ_GctD.avi" [0143.038] SetFilePointer (in: hFile=0x90, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0143.038] WriteFile (in: hFile=0x90, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0xafa9, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0xafa9, lpOverlapped=0x0) returned 1 [0143.038] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0143.038] CloseHandle (hObject=0x90) returned 1 [0143.038] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\mDZ_GctD.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\mdz_gctd.avi"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\mDZ_GctD.avi. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\mdz_gctd.avi. ")) returned 1 [0143.039] FindNextFileA (in: hFindFile=0x5be260, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0143.039] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0143.040] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="O2YN3.m4a") returned -1 [0143.040] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="O2YN3.m4a") returned -1 [0143.040] lstrcmpiA (lpString1="", lpString2="O2YN3.m4a") returned -1 [0143.040] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\mDZ_GctD.avi") returned="mDZ_GctD.avi" [0143.040] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\", lpString2="O2YN3.m4a" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\O2YN3.m4a") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\O2YN3.m4a" [0143.040] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\O2YN3.m4a", pszSpec="*.zip") returned 0 [0143.040] lstrlenA (lpString="*.zip") returned 5 [0143.040] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\O2YN3.m4a", pszSpec="*.rar") returned 0 [0143.040] lstrlenA (lpString="*.rar") returned 5 [0143.040] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\O2YN3.m4a", pszSpec="*.7z") returned 0 [0143.040] lstrlenA (lpString="*.7z") returned 4 [0143.040] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\O2YN3.m4a", pszSpec="*.tar") returned 0 [0143.040] lstrlenA (lpString="*.tar") returned 5 [0143.040] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\O2YN3.m4a", pszSpec="*.gzip") returned 0 [0143.040] lstrlenA (lpString="*.gzip") returned 6 [0143.040] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\O2YN3.m4a", pszSpec="*.jpg") returned 0 [0143.040] lstrlenA (lpString="*.jpg") returned 5 [0143.040] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\O2YN3.m4a", pszSpec="*.jpeg") returned 0 [0143.040] lstrlenA (lpString="*.jpeg") returned 6 [0143.040] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\O2YN3.m4a", pszSpec="*.psd") returned 0 [0143.040] lstrlenA (lpString="*.psd") returned 5 [0143.040] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\O2YN3.m4a", pszSpec="*.cdr") returned 0 [0143.040] lstrlenA (lpString="*.cdr") returned 5 [0143.040] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\O2YN3.m4a", pszSpec="*.dwg") returned 0 [0143.040] lstrlenA (lpString="*.dwg") returned 5 [0143.040] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\O2YN3.m4a", pszSpec="*.max") returned 0 [0143.040] lstrlenA (lpString="*.max") returned 5 [0143.040] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\O2YN3.m4a", pszSpec="*.bmp") returned 0 [0143.040] lstrlenA (lpString="*.bmp") returned 5 [0143.040] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\O2YN3.m4a", pszSpec="*.gif") returned 0 [0143.040] lstrlenA (lpString="*.gif") returned 5 [0143.040] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\O2YN3.m4a", pszSpec="*.png") returned 0 [0143.040] lstrlenA (lpString="*.png") returned 5 [0143.040] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\O2YN3.m4a", pszSpec="*.doc") returned 0 [0143.041] lstrlenA (lpString="*.doc") returned 5 [0143.041] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\O2YN3.m4a", pszSpec="*.docx") returned 0 [0143.041] lstrlenA (lpString="*.docx") returned 6 [0143.041] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\O2YN3.m4a", pszSpec="*.xls") returned 0 [0143.041] lstrlenA (lpString="*.xls") returned 5 [0143.041] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\O2YN3.m4a", pszSpec="*.xlsx") returned 0 [0143.041] lstrlenA (lpString="*.xlsx") returned 6 [0143.041] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\O2YN3.m4a", pszSpec="*.ppt") returned 0 [0143.041] lstrlenA (lpString="*.ppt") returned 5 [0143.041] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\O2YN3.m4a", pszSpec="*.pptx") returned 0 [0143.041] lstrlenA (lpString="*.pptx") returned 6 [0143.041] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\O2YN3.m4a", pszSpec="*.txt") returned 0 [0143.041] lstrlenA (lpString="*.txt") returned 5 [0143.041] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\O2YN3.m4a", pszSpec="*.pdf") returned 0 [0143.041] lstrlenA (lpString="*.pdf") returned 5 [0143.041] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\O2YN3.m4a", pszSpec="*.djvu") returned 0 [0143.041] lstrlenA (lpString="*.djvu") returned 6 [0143.041] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\O2YN3.m4a", pszSpec="*.htm") returned 0 [0143.041] lstrlenA (lpString="*.htm") returned 5 [0143.041] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\O2YN3.m4a", pszSpec="*.html") returned 0 [0143.041] lstrlenA (lpString="*.html") returned 6 [0143.041] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\O2YN3.m4a", pszSpec="*.mdb") returned 0 [0143.041] lstrlenA (lpString="*.mdb") returned 5 [0143.041] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\O2YN3.m4a", pszSpec="*.cer") returned 0 [0143.041] lstrlenA (lpString="*.cer") returned 5 [0143.041] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\O2YN3.m4a", pszSpec="*.p12") returned 0 [0143.041] lstrlenA (lpString="*.p12") returned 5 [0143.041] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\O2YN3.m4a", pszSpec="*.pfx") returned 0 [0143.041] lstrlenA (lpString="*.pfx") returned 5 [0143.041] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\O2YN3.m4a", pszSpec="*.kwm") returned 0 [0143.041] lstrlenA (lpString="*.kwm") returned 5 [0143.041] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\O2YN3.m4a", pszSpec="*.pwm") returned 0 [0143.041] lstrlenA (lpString="*.pwm") returned 5 [0143.041] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\O2YN3.m4a", pszSpec="*.1cd") returned 0 [0143.041] lstrlenA (lpString="*.1cd") returned 5 [0143.041] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\O2YN3.m4a", pszSpec="*.md") returned 0 [0143.041] lstrlenA (lpString="*.md") returned 4 [0143.042] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\O2YN3.m4a", pszSpec="*.mdf") returned 0 [0143.042] lstrlenA (lpString="*.mdf") returned 5 [0143.042] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\O2YN3.m4a", pszSpec="*.dbf") returned 0 [0143.042] lstrlenA (lpString="*.dbf") returned 5 [0143.042] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\O2YN3.m4a", pszSpec="*.odt") returned 0 [0143.042] lstrlenA (lpString="*.odt") returned 5 [0143.042] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\O2YN3.m4a", pszSpec="*.vob") returned 0 [0143.042] lstrlenA (lpString="*.vob") returned 5 [0143.042] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\O2YN3.m4a", pszSpec="*.ifo") returned 0 [0143.042] lstrlenA (lpString="*.ifo") returned 5 [0143.042] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\O2YN3.m4a", pszSpec="*.lnk") returned 0 [0143.042] lstrlenA (lpString="*.lnk") returned 5 [0143.042] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\O2YN3.m4a", pszSpec="*.torrent") returned 0 [0143.042] lstrlenA (lpString="*.torrent") returned 9 [0143.042] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\O2YN3.m4a", pszSpec="*.mov") returned 0 [0143.042] lstrlenA (lpString="*.mov") returned 5 [0143.042] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\O2YN3.m4a", pszSpec="*.m2v") returned 0 [0143.042] lstrlenA (lpString="*.m2v") returned 5 [0143.042] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\O2YN3.m4a", pszSpec="*.3gp") returned 0 [0143.042] lstrlenA (lpString="*.3gp") returned 5 [0143.042] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\O2YN3.m4a", pszSpec="*.mpeg") returned 0 [0143.042] lstrlenA (lpString="*.mpeg") returned 6 [0143.042] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\O2YN3.m4a", pszSpec="*.mpg") returned 0 [0143.042] lstrlenA (lpString="*.mpg") returned 5 [0143.042] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\O2YN3.m4a", pszSpec="*.flv") returned 0 [0143.042] lstrlenA (lpString="*.flv") returned 5 [0143.042] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\O2YN3.m4a", pszSpec="*.avi") returned 0 [0143.042] lstrlenA (lpString="*.avi") returned 5 [0143.042] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\O2YN3.m4a", pszSpec="*.mp4") returned 0 [0143.042] lstrlenA (lpString="*.mp4") returned 5 [0143.042] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\O2YN3.m4a", pszSpec="*.wmv") returned 0 [0143.042] lstrlenA (lpString="*.wmv") returned 5 [0143.042] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\O2YN3.m4a", pszSpec="*.divx") returned 0 [0143.042] lstrlenA (lpString="*.divx") returned 6 [0143.043] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\O2YN3.m4a", pszSpec="*.mkv") returned 0 [0143.043] lstrlenA (lpString="*.mkv") returned 5 [0143.043] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\O2YN3.m4a", pszSpec="*.mp3") returned 0 [0143.043] lstrlenA (lpString="*.mp3") returned 5 [0143.043] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\O2YN3.m4a", pszSpec="*.wav") returned 0 [0143.043] lstrlenA (lpString="*.wav") returned 5 [0143.043] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\O2YN3.m4a", pszSpec="*.flac") returned 0 [0143.043] lstrlenA (lpString="*.flac") returned 6 [0143.043] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\O2YN3.m4a", pszSpec="*.ape") returned 0 [0143.043] lstrlenA (lpString="*.ape") returned 5 [0143.043] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\O2YN3.m4a", pszSpec="*.wma") returned 0 [0143.043] lstrlenA (lpString="*.wma") returned 5 [0143.043] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\O2YN3.m4a", pszSpec="*.ac3") returned 0 [0143.043] lstrlenA (lpString="*.ac3") returned 5 [0143.043] FindNextFileA (in: hFindFile=0x5be260, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0143.043] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0143.043] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="O4tMIF7YhXoEhsEByI.mkv") returned -1 [0143.043] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="O4tMIF7YhXoEhsEByI.mkv") returned -1 [0143.043] lstrcmpiA (lpString1="", lpString2="O4tMIF7YhXoEhsEByI.mkv") returned -1 [0143.043] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\O2YN3.m4a") returned="O2YN3.m4a" [0143.043] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\", lpString2="O4tMIF7YhXoEhsEByI.mkv" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\O4tMIF7YhXoEhsEByI.mkv") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\O4tMIF7YhXoEhsEByI.mkv" [0143.043] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\O4tMIF7YhXoEhsEByI.mkv", pszSpec="*.zip") returned 0 [0143.043] lstrlenA (lpString="*.zip") returned 5 [0143.043] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\O4tMIF7YhXoEhsEByI.mkv", pszSpec="*.rar") returned 0 [0143.043] lstrlenA (lpString="*.rar") returned 5 [0143.043] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\O4tMIF7YhXoEhsEByI.mkv", pszSpec="*.7z") returned 0 [0143.043] lstrlenA (lpString="*.7z") returned 4 [0143.043] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\O4tMIF7YhXoEhsEByI.mkv", pszSpec="*.tar") returned 0 [0143.043] lstrlenA (lpString="*.tar") returned 5 [0143.043] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\O4tMIF7YhXoEhsEByI.mkv", pszSpec="*.gzip") returned 0 [0143.043] lstrlenA (lpString="*.gzip") returned 6 [0143.043] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\O4tMIF7YhXoEhsEByI.mkv", pszSpec="*.jpg") returned 0 [0143.043] lstrlenA (lpString="*.jpg") returned 5 [0143.043] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\O4tMIF7YhXoEhsEByI.mkv", pszSpec="*.jpeg") returned 0 [0143.043] lstrlenA (lpString="*.jpeg") returned 6 [0143.043] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\O4tMIF7YhXoEhsEByI.mkv", pszSpec="*.psd") returned 0 [0143.043] lstrlenA (lpString="*.psd") returned 5 [0143.043] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\O4tMIF7YhXoEhsEByI.mkv", pszSpec="*.cdr") returned 0 [0143.043] lstrlenA (lpString="*.cdr") returned 5 [0143.043] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\O4tMIF7YhXoEhsEByI.mkv", pszSpec="*.dwg") returned 0 [0143.043] lstrlenA (lpString="*.dwg") returned 5 [0143.043] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\O4tMIF7YhXoEhsEByI.mkv", pszSpec="*.max") returned 0 [0143.043] lstrlenA (lpString="*.max") returned 5 [0143.043] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\O4tMIF7YhXoEhsEByI.mkv", pszSpec="*.bmp") returned 0 [0143.043] lstrlenA (lpString="*.bmp") returned 5 [0143.044] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\O4tMIF7YhXoEhsEByI.mkv", pszSpec="*.gif") returned 0 [0143.044] lstrlenA (lpString="*.gif") returned 5 [0143.044] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\O4tMIF7YhXoEhsEByI.mkv", pszSpec="*.png") returned 0 [0143.044] lstrlenA (lpString="*.png") returned 5 [0143.044] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\O4tMIF7YhXoEhsEByI.mkv", pszSpec="*.doc") returned 0 [0143.044] lstrlenA (lpString="*.doc") returned 5 [0143.044] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\O4tMIF7YhXoEhsEByI.mkv", pszSpec="*.docx") returned 0 [0143.044] lstrlenA (lpString="*.docx") returned 6 [0143.044] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\O4tMIF7YhXoEhsEByI.mkv", pszSpec="*.xls") returned 0 [0143.044] lstrlenA (lpString="*.xls") returned 5 [0143.044] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\O4tMIF7YhXoEhsEByI.mkv", pszSpec="*.xlsx") returned 0 [0143.044] lstrlenA (lpString="*.xlsx") returned 6 [0143.044] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\O4tMIF7YhXoEhsEByI.mkv", pszSpec="*.ppt") returned 0 [0143.044] lstrlenA (lpString="*.ppt") returned 5 [0143.044] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\O4tMIF7YhXoEhsEByI.mkv", pszSpec="*.pptx") returned 0 [0143.044] lstrlenA (lpString="*.pptx") returned 6 [0143.044] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\O4tMIF7YhXoEhsEByI.mkv", pszSpec="*.txt") returned 0 [0143.044] lstrlenA (lpString="*.txt") returned 5 [0143.044] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\O4tMIF7YhXoEhsEByI.mkv", pszSpec="*.pdf") returned 0 [0143.044] lstrlenA (lpString="*.pdf") returned 5 [0143.044] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\O4tMIF7YhXoEhsEByI.mkv", pszSpec="*.djvu") returned 0 [0143.044] lstrlenA (lpString="*.djvu") returned 6 [0143.044] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\O4tMIF7YhXoEhsEByI.mkv", pszSpec="*.htm") returned 0 [0143.044] lstrlenA (lpString="*.htm") returned 5 [0143.044] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\O4tMIF7YhXoEhsEByI.mkv", pszSpec="*.html") returned 0 [0143.044] lstrlenA (lpString="*.html") returned 6 [0143.044] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\O4tMIF7YhXoEhsEByI.mkv", pszSpec="*.mdb") returned 0 [0143.044] lstrlenA (lpString="*.mdb") returned 5 [0143.044] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\O4tMIF7YhXoEhsEByI.mkv", pszSpec="*.cer") returned 0 [0143.044] lstrlenA (lpString="*.cer") returned 5 [0143.044] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\O4tMIF7YhXoEhsEByI.mkv", pszSpec="*.p12") returned 0 [0143.044] lstrlenA (lpString="*.p12") returned 5 [0143.044] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\O4tMIF7YhXoEhsEByI.mkv", pszSpec="*.pfx") returned 0 [0143.044] lstrlenA (lpString="*.pfx") returned 5 [0143.044] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\O4tMIF7YhXoEhsEByI.mkv", pszSpec="*.kwm") returned 0 [0143.044] lstrlenA (lpString="*.kwm") returned 5 [0143.044] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\O4tMIF7YhXoEhsEByI.mkv", pszSpec="*.pwm") returned 0 [0143.044] lstrlenA (lpString="*.pwm") returned 5 [0143.044] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\O4tMIF7YhXoEhsEByI.mkv", pszSpec="*.1cd") returned 0 [0143.044] lstrlenA (lpString="*.1cd") returned 5 [0143.044] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\O4tMIF7YhXoEhsEByI.mkv", pszSpec="*.md") returned 0 [0143.044] lstrlenA (lpString="*.md") returned 4 [0143.044] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\O4tMIF7YhXoEhsEByI.mkv", pszSpec="*.mdf") returned 0 [0143.044] lstrlenA (lpString="*.mdf") returned 5 [0143.044] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\O4tMIF7YhXoEhsEByI.mkv", pszSpec="*.dbf") returned 0 [0143.044] lstrlenA (lpString="*.dbf") returned 5 [0143.044] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\O4tMIF7YhXoEhsEByI.mkv", pszSpec="*.odt") returned 0 [0143.044] lstrlenA (lpString="*.odt") returned 5 [0143.044] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\O4tMIF7YhXoEhsEByI.mkv", pszSpec="*.vob") returned 0 [0143.044] lstrlenA (lpString="*.vob") returned 5 [0143.044] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\O4tMIF7YhXoEhsEByI.mkv", pszSpec="*.ifo") returned 0 [0143.045] lstrlenA (lpString="*.ifo") returned 5 [0143.045] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\O4tMIF7YhXoEhsEByI.mkv", pszSpec="*.lnk") returned 0 [0143.045] lstrlenA (lpString="*.lnk") returned 5 [0143.045] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\O4tMIF7YhXoEhsEByI.mkv", pszSpec="*.torrent") returned 0 [0143.045] lstrlenA (lpString="*.torrent") returned 9 [0143.045] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\O4tMIF7YhXoEhsEByI.mkv", pszSpec="*.mov") returned 0 [0143.045] lstrlenA (lpString="*.mov") returned 5 [0143.045] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\O4tMIF7YhXoEhsEByI.mkv", pszSpec="*.m2v") returned 0 [0143.045] lstrlenA (lpString="*.m2v") returned 5 [0143.045] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\O4tMIF7YhXoEhsEByI.mkv", pszSpec="*.3gp") returned 0 [0143.045] lstrlenA (lpString="*.3gp") returned 5 [0143.045] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\O4tMIF7YhXoEhsEByI.mkv", pszSpec="*.mpeg") returned 0 [0143.045] lstrlenA (lpString="*.mpeg") returned 6 [0143.045] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\O4tMIF7YhXoEhsEByI.mkv", pszSpec="*.mpg") returned 0 [0143.045] lstrlenA (lpString="*.mpg") returned 5 [0143.045] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\O4tMIF7YhXoEhsEByI.mkv", pszSpec="*.flv") returned 0 [0143.045] lstrlenA (lpString="*.flv") returned 5 [0143.045] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\O4tMIF7YhXoEhsEByI.mkv", pszSpec="*.avi") returned 0 [0143.045] lstrlenA (lpString="*.avi") returned 5 [0143.045] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\O4tMIF7YhXoEhsEByI.mkv", pszSpec="*.mp4") returned 0 [0143.045] lstrlenA (lpString="*.mp4") returned 5 [0143.045] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\O4tMIF7YhXoEhsEByI.mkv", pszSpec="*.wmv") returned 0 [0143.045] lstrlenA (lpString="*.wmv") returned 5 [0143.045] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\O4tMIF7YhXoEhsEByI.mkv", pszSpec="*.divx") returned 0 [0143.045] lstrlenA (lpString="*.divx") returned 6 [0143.045] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\O4tMIF7YhXoEhsEByI.mkv", pszSpec="*.mkv") returned 1 [0143.045] lstrlenA (lpString="*.mkv") returned 5 [0143.045] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\O4tMIF7YhXoEhsEByI.mkv" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\O4tMIF7YhXoEhsEByI.mkv") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\O4tMIF7YhXoEhsEByI.mkv" [0143.045] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\O4tMIF7YhXoEhsEByI.mkv" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\O4tMIF7YhXoEhsEByI.mkv") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\O4tMIF7YhXoEhsEByI.mkv" [0143.045] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\O4tMIF7YhXoEhsEByI.mkv", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\O4tMIF7YhXoEhsEByI.mkv.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\O4tMIF7YhXoEhsEByI.mkv." [0143.045] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\O4tMIF7YhXoEhsEByI.mkv.", lpString2="\xa0" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\O4tMIF7YhXoEhsEByI.mkv. ") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\O4tMIF7YhXoEhsEByI.mkv. " [0143.045] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\O4tMIF7YhXoEhsEByI.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\o4tmif7yhxoehsebyi.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0143.046] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb1de [0143.046] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x3dca45c0, dwHighDateTime=0x1d4ab1b), lpLastAccessTime=0x407536*(dwLowDateTime=0x9879c5a0, dwHighDateTime=0x1d4aaca), lpLastWriteTime=0x40753e*(dwLowDateTime=0x9879c5a0, dwHighDateTime=0x1d4aaca)) returned 1 [0143.046] SetFilePointer (in: hFile=0x90, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0143.046] ReadFile (in: hFile=0x90, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0xb184, lpOverlapped=0x0) returned 1 [0143.047] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\O4tMIF7YhXoEhsEByI.mkv") returned="O4tMIF7YhXoEhsEByI.mkv" [0143.047] SetFilePointer (in: hFile=0x90, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0143.047] WriteFile (in: hFile=0x90, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0xb184, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0xb184, lpOverlapped=0x0) returned 1 [0143.047] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0143.047] CloseHandle (hObject=0x90) returned 1 [0143.047] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\O4tMIF7YhXoEhsEByI.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\o4tmif7yhxoehsebyi.mkv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\O4tMIF7YhXoEhsEByI.mkv. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\o4tmif7yhxoehsebyi.mkv. ")) returned 1 [0143.048] FindNextFileA (in: hFindFile=0x5be260, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0143.048] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0143.048] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="oY7l2tc.avi") returned -1 [0143.048] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="oY7l2tc.avi") returned -1 [0143.048] lstrcmpiA (lpString1="", lpString2="oY7l2tc.avi") returned -1 [0143.048] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\O4tMIF7YhXoEhsEByI.mkv") returned="O4tMIF7YhXoEhsEByI.mkv" [0143.048] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\", lpString2="oY7l2tc.avi" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\oY7l2tc.avi") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\oY7l2tc.avi" [0143.048] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\oY7l2tc.avi", pszSpec="*.zip") returned 0 [0143.049] lstrlenA (lpString="*.zip") returned 5 [0143.049] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\oY7l2tc.avi", pszSpec="*.rar") returned 0 [0143.049] lstrlenA (lpString="*.rar") returned 5 [0143.049] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\oY7l2tc.avi", pszSpec="*.7z") returned 0 [0143.049] lstrlenA (lpString="*.7z") returned 4 [0143.049] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\oY7l2tc.avi", pszSpec="*.tar") returned 0 [0143.049] lstrlenA (lpString="*.tar") returned 5 [0143.049] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\oY7l2tc.avi", pszSpec="*.gzip") returned 0 [0143.049] lstrlenA (lpString="*.gzip") returned 6 [0143.049] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\oY7l2tc.avi", pszSpec="*.jpg") returned 0 [0143.049] lstrlenA (lpString="*.jpg") returned 5 [0143.049] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\oY7l2tc.avi", pszSpec="*.jpeg") returned 0 [0143.049] lstrlenA (lpString="*.jpeg") returned 6 [0143.049] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\oY7l2tc.avi", pszSpec="*.psd") returned 0 [0143.049] lstrlenA (lpString="*.psd") returned 5 [0143.049] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\oY7l2tc.avi", pszSpec="*.cdr") returned 0 [0143.049] lstrlenA (lpString="*.cdr") returned 5 [0143.049] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\oY7l2tc.avi", pszSpec="*.dwg") returned 0 [0143.049] lstrlenA (lpString="*.dwg") returned 5 [0143.049] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\oY7l2tc.avi", pszSpec="*.max") returned 0 [0143.049] lstrlenA (lpString="*.max") returned 5 [0143.049] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\oY7l2tc.avi", pszSpec="*.bmp") returned 0 [0143.049] lstrlenA (lpString="*.bmp") returned 5 [0143.049] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\oY7l2tc.avi", pszSpec="*.gif") returned 0 [0143.049] lstrlenA (lpString="*.gif") returned 5 [0143.049] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\oY7l2tc.avi", pszSpec="*.png") returned 0 [0143.049] lstrlenA (lpString="*.png") returned 5 [0143.049] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\oY7l2tc.avi", pszSpec="*.doc") returned 0 [0143.049] lstrlenA (lpString="*.doc") returned 5 [0143.049] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\oY7l2tc.avi", pszSpec="*.docx") returned 0 [0143.049] lstrlenA (lpString="*.docx") returned 6 [0143.049] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\oY7l2tc.avi", pszSpec="*.xls") returned 0 [0143.049] lstrlenA (lpString="*.xls") returned 5 [0143.049] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\oY7l2tc.avi", pszSpec="*.xlsx") returned 0 [0143.049] lstrlenA (lpString="*.xlsx") returned 6 [0143.049] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\oY7l2tc.avi", pszSpec="*.ppt") returned 0 [0143.049] lstrlenA (lpString="*.ppt") returned 5 [0143.049] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\oY7l2tc.avi", pszSpec="*.pptx") returned 0 [0143.049] lstrlenA (lpString="*.pptx") returned 6 [0143.049] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\oY7l2tc.avi", pszSpec="*.txt") returned 0 [0143.049] lstrlenA (lpString="*.txt") returned 5 [0143.049] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\oY7l2tc.avi", pszSpec="*.pdf") returned 0 [0143.049] lstrlenA (lpString="*.pdf") returned 5 [0143.049] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\oY7l2tc.avi", pszSpec="*.djvu") returned 0 [0143.049] lstrlenA (lpString="*.djvu") returned 6 [0143.049] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\oY7l2tc.avi", pszSpec="*.htm") returned 0 [0143.049] lstrlenA (lpString="*.htm") returned 5 [0143.049] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\oY7l2tc.avi", pszSpec="*.html") returned 0 [0143.050] lstrlenA (lpString="*.html") returned 6 [0143.050] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\oY7l2tc.avi", pszSpec="*.mdb") returned 0 [0143.050] lstrlenA (lpString="*.mdb") returned 5 [0143.050] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\oY7l2tc.avi", pszSpec="*.cer") returned 0 [0143.050] lstrlenA (lpString="*.cer") returned 5 [0143.050] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\oY7l2tc.avi", pszSpec="*.p12") returned 0 [0143.050] lstrlenA (lpString="*.p12") returned 5 [0143.050] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\oY7l2tc.avi", pszSpec="*.pfx") returned 0 [0143.050] lstrlenA (lpString="*.pfx") returned 5 [0143.050] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\oY7l2tc.avi", pszSpec="*.kwm") returned 0 [0143.050] lstrlenA (lpString="*.kwm") returned 5 [0143.050] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\oY7l2tc.avi", pszSpec="*.pwm") returned 0 [0143.050] lstrlenA (lpString="*.pwm") returned 5 [0143.050] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\oY7l2tc.avi", pszSpec="*.1cd") returned 0 [0143.050] lstrlenA (lpString="*.1cd") returned 5 [0143.050] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\oY7l2tc.avi", pszSpec="*.md") returned 0 [0143.050] lstrlenA (lpString="*.md") returned 4 [0143.050] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\oY7l2tc.avi", pszSpec="*.mdf") returned 0 [0143.050] lstrlenA (lpString="*.mdf") returned 5 [0143.050] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\oY7l2tc.avi", pszSpec="*.dbf") returned 0 [0143.050] lstrlenA (lpString="*.dbf") returned 5 [0143.050] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\oY7l2tc.avi", pszSpec="*.odt") returned 0 [0143.050] lstrlenA (lpString="*.odt") returned 5 [0143.050] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\oY7l2tc.avi", pszSpec="*.vob") returned 0 [0143.050] lstrlenA (lpString="*.vob") returned 5 [0143.050] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\oY7l2tc.avi", pszSpec="*.ifo") returned 0 [0143.050] lstrlenA (lpString="*.ifo") returned 5 [0143.050] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\oY7l2tc.avi", pszSpec="*.lnk") returned 0 [0143.050] lstrlenA (lpString="*.lnk") returned 5 [0143.050] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\oY7l2tc.avi", pszSpec="*.torrent") returned 0 [0143.050] lstrlenA (lpString="*.torrent") returned 9 [0143.050] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\oY7l2tc.avi", pszSpec="*.mov") returned 0 [0143.050] lstrlenA (lpString="*.mov") returned 5 [0143.050] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\oY7l2tc.avi", pszSpec="*.m2v") returned 0 [0143.050] lstrlenA (lpString="*.m2v") returned 5 [0143.050] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\oY7l2tc.avi", pszSpec="*.3gp") returned 0 [0143.050] lstrlenA (lpString="*.3gp") returned 5 [0143.050] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\oY7l2tc.avi", pszSpec="*.mpeg") returned 0 [0143.050] lstrlenA (lpString="*.mpeg") returned 6 [0143.050] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\oY7l2tc.avi", pszSpec="*.mpg") returned 0 [0143.050] lstrlenA (lpString="*.mpg") returned 5 [0143.050] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\oY7l2tc.avi", pszSpec="*.flv") returned 0 [0143.050] lstrlenA (lpString="*.flv") returned 5 [0143.050] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\oY7l2tc.avi", pszSpec="*.avi") returned 1 [0143.050] lstrlenA (lpString="*.avi") returned 5 [0143.050] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\oY7l2tc.avi" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\oY7l2tc.avi") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\oY7l2tc.avi" [0143.050] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\oY7l2tc.avi" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\oY7l2tc.avi") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\oY7l2tc.avi" [0143.050] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\oY7l2tc.avi", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\oY7l2tc.avi.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\oY7l2tc.avi." [0143.051] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\oY7l2tc.avi.", lpString2="\xa0" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\oY7l2tc.avi. ") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\oY7l2tc.avi. " [0143.051] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\oY7l2tc.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\oy7l2tc.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0143.051] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x17441 [0143.051] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xd31372c0, dwHighDateTime=0x1d4a308), lpLastAccessTime=0x407536*(dwLowDateTime=0xa1b2ddc0, dwHighDateTime=0x1d4ab59), lpLastWriteTime=0x40753e*(dwLowDateTime=0xa1b2ddc0, dwHighDateTime=0x1d4ab59)) returned 1 [0143.051] SetFilePointer (in: hFile=0x90, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0143.051] ReadFile (in: hFile=0x90, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x173e7, lpOverlapped=0x0) returned 1 [0143.052] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\oY7l2tc.avi") returned="oY7l2tc.avi" [0143.052] SetFilePointer (in: hFile=0x90, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0143.052] WriteFile (in: hFile=0x90, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x173e7, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x173e7, lpOverlapped=0x0) returned 1 [0143.053] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0143.053] CloseHandle (hObject=0x90) returned 1 [0143.053] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\oY7l2tc.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\oy7l2tc.avi"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\oY7l2tc.avi. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\oy7l2tc.avi. ")) returned 1 [0143.054] FindNextFileA (in: hFindFile=0x5be260, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0143.054] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0143.054] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="qrJZnMliWf2YHXBi4z.swf") returned -1 [0143.054] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="qrJZnMliWf2YHXBi4z.swf") returned -1 [0143.054] lstrcmpiA (lpString1="", lpString2="qrJZnMliWf2YHXBi4z.swf") returned -1 [0143.054] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\oY7l2tc.avi") returned="oY7l2tc.avi" [0143.054] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\", lpString2="qrJZnMliWf2YHXBi4z.swf" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\qrJZnMliWf2YHXBi4z.swf") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\qrJZnMliWf2YHXBi4z.swf" [0143.054] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\qrJZnMliWf2YHXBi4z.swf", pszSpec="*.zip") returned 0 [0143.054] lstrlenA (lpString="*.zip") returned 5 [0143.054] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\qrJZnMliWf2YHXBi4z.swf", pszSpec="*.rar") returned 0 [0143.054] lstrlenA (lpString="*.rar") returned 5 [0143.054] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\qrJZnMliWf2YHXBi4z.swf", pszSpec="*.7z") returned 0 [0143.054] lstrlenA (lpString="*.7z") returned 4 [0143.054] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\qrJZnMliWf2YHXBi4z.swf", pszSpec="*.tar") returned 0 [0143.054] lstrlenA (lpString="*.tar") returned 5 [0143.054] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\qrJZnMliWf2YHXBi4z.swf", pszSpec="*.gzip") returned 0 [0143.054] lstrlenA (lpString="*.gzip") returned 6 [0143.054] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\qrJZnMliWf2YHXBi4z.swf", pszSpec="*.jpg") returned 0 [0143.054] lstrlenA (lpString="*.jpg") returned 5 [0143.054] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\qrJZnMliWf2YHXBi4z.swf", pszSpec="*.jpeg") returned 0 [0143.054] lstrlenA (lpString="*.jpeg") returned 6 [0143.054] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\qrJZnMliWf2YHXBi4z.swf", pszSpec="*.psd") returned 0 [0143.054] lstrlenA (lpString="*.psd") returned 5 [0143.054] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\qrJZnMliWf2YHXBi4z.swf", pszSpec="*.cdr") returned 0 [0143.054] lstrlenA (lpString="*.cdr") returned 5 [0143.054] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\qrJZnMliWf2YHXBi4z.swf", pszSpec="*.dwg") returned 0 [0143.054] lstrlenA (lpString="*.dwg") returned 5 [0143.054] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\qrJZnMliWf2YHXBi4z.swf", pszSpec="*.max") returned 0 [0143.054] lstrlenA (lpString="*.max") returned 5 [0143.054] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\qrJZnMliWf2YHXBi4z.swf", pszSpec="*.bmp") returned 0 [0143.055] lstrlenA (lpString="*.bmp") returned 5 [0143.055] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\qrJZnMliWf2YHXBi4z.swf", pszSpec="*.gif") returned 0 [0143.055] lstrlenA (lpString="*.gif") returned 5 [0143.055] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\qrJZnMliWf2YHXBi4z.swf", pszSpec="*.png") returned 0 [0143.055] lstrlenA (lpString="*.png") returned 5 [0143.055] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\qrJZnMliWf2YHXBi4z.swf", pszSpec="*.doc") returned 0 [0143.055] lstrlenA (lpString="*.doc") returned 5 [0143.055] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\qrJZnMliWf2YHXBi4z.swf", pszSpec="*.docx") returned 0 [0143.055] lstrlenA (lpString="*.docx") returned 6 [0143.055] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\qrJZnMliWf2YHXBi4z.swf", pszSpec="*.xls") returned 0 [0143.055] lstrlenA (lpString="*.xls") returned 5 [0143.055] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\qrJZnMliWf2YHXBi4z.swf", pszSpec="*.xlsx") returned 0 [0143.055] lstrlenA (lpString="*.xlsx") returned 6 [0143.055] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\qrJZnMliWf2YHXBi4z.swf", pszSpec="*.ppt") returned 0 [0143.055] lstrlenA (lpString="*.ppt") returned 5 [0143.055] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\qrJZnMliWf2YHXBi4z.swf", pszSpec="*.pptx") returned 0 [0143.055] lstrlenA (lpString="*.pptx") returned 6 [0143.055] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\qrJZnMliWf2YHXBi4z.swf", pszSpec="*.txt") returned 0 [0143.055] lstrlenA (lpString="*.txt") returned 5 [0143.055] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\qrJZnMliWf2YHXBi4z.swf", pszSpec="*.pdf") returned 0 [0143.055] lstrlenA (lpString="*.pdf") returned 5 [0143.055] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\qrJZnMliWf2YHXBi4z.swf", pszSpec="*.djvu") returned 0 [0143.055] lstrlenA (lpString="*.djvu") returned 6 [0143.055] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\qrJZnMliWf2YHXBi4z.swf", pszSpec="*.htm") returned 0 [0143.055] lstrlenA (lpString="*.htm") returned 5 [0143.055] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\qrJZnMliWf2YHXBi4z.swf", pszSpec="*.html") returned 0 [0143.055] lstrlenA (lpString="*.html") returned 6 [0143.055] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\qrJZnMliWf2YHXBi4z.swf", pszSpec="*.mdb") returned 0 [0143.055] lstrlenA (lpString="*.mdb") returned 5 [0143.055] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\qrJZnMliWf2YHXBi4z.swf", pszSpec="*.cer") returned 0 [0143.055] lstrlenA (lpString="*.cer") returned 5 [0143.055] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\qrJZnMliWf2YHXBi4z.swf", pszSpec="*.p12") returned 0 [0143.055] lstrlenA (lpString="*.p12") returned 5 [0143.055] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\qrJZnMliWf2YHXBi4z.swf", pszSpec="*.pfx") returned 0 [0143.055] lstrlenA (lpString="*.pfx") returned 5 [0143.055] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\qrJZnMliWf2YHXBi4z.swf", pszSpec="*.kwm") returned 0 [0143.055] lstrlenA (lpString="*.kwm") returned 5 [0143.055] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\qrJZnMliWf2YHXBi4z.swf", pszSpec="*.pwm") returned 0 [0143.055] lstrlenA (lpString="*.pwm") returned 5 [0143.055] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\qrJZnMliWf2YHXBi4z.swf", pszSpec="*.1cd") returned 0 [0143.055] lstrlenA (lpString="*.1cd") returned 5 [0143.055] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\qrJZnMliWf2YHXBi4z.swf", pszSpec="*.md") returned 0 [0143.055] lstrlenA (lpString="*.md") returned 4 [0143.055] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\qrJZnMliWf2YHXBi4z.swf", pszSpec="*.mdf") returned 0 [0143.055] lstrlenA (lpString="*.mdf") returned 5 [0143.055] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\qrJZnMliWf2YHXBi4z.swf", pszSpec="*.dbf") returned 0 [0143.055] lstrlenA (lpString="*.dbf") returned 5 [0143.055] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\qrJZnMliWf2YHXBi4z.swf", pszSpec="*.odt") returned 0 [0143.055] lstrlenA (lpString="*.odt") returned 5 [0143.055] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\qrJZnMliWf2YHXBi4z.swf", pszSpec="*.vob") returned 0 [0143.055] lstrlenA (lpString="*.vob") returned 5 [0143.056] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\qrJZnMliWf2YHXBi4z.swf", pszSpec="*.ifo") returned 0 [0143.056] lstrlenA (lpString="*.ifo") returned 5 [0143.056] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\qrJZnMliWf2YHXBi4z.swf", pszSpec="*.lnk") returned 0 [0143.056] lstrlenA (lpString="*.lnk") returned 5 [0143.056] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\qrJZnMliWf2YHXBi4z.swf", pszSpec="*.torrent") returned 0 [0143.056] lstrlenA (lpString="*.torrent") returned 9 [0143.056] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\qrJZnMliWf2YHXBi4z.swf", pszSpec="*.mov") returned 0 [0143.056] lstrlenA (lpString="*.mov") returned 5 [0143.056] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\qrJZnMliWf2YHXBi4z.swf", pszSpec="*.m2v") returned 0 [0143.056] lstrlenA (lpString="*.m2v") returned 5 [0143.056] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\qrJZnMliWf2YHXBi4z.swf", pszSpec="*.3gp") returned 0 [0143.056] lstrlenA (lpString="*.3gp") returned 5 [0143.056] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\qrJZnMliWf2YHXBi4z.swf", pszSpec="*.mpeg") returned 0 [0143.056] lstrlenA (lpString="*.mpeg") returned 6 [0143.056] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\qrJZnMliWf2YHXBi4z.swf", pszSpec="*.mpg") returned 0 [0143.056] lstrlenA (lpString="*.mpg") returned 5 [0143.056] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\qrJZnMliWf2YHXBi4z.swf", pszSpec="*.flv") returned 0 [0143.056] lstrlenA (lpString="*.flv") returned 5 [0143.056] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\qrJZnMliWf2YHXBi4z.swf", pszSpec="*.avi") returned 0 [0143.056] lstrlenA (lpString="*.avi") returned 5 [0143.056] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\qrJZnMliWf2YHXBi4z.swf", pszSpec="*.mp4") returned 0 [0143.056] lstrlenA (lpString="*.mp4") returned 5 [0143.056] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\qrJZnMliWf2YHXBi4z.swf", pszSpec="*.wmv") returned 0 [0143.056] lstrlenA (lpString="*.wmv") returned 5 [0143.056] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\qrJZnMliWf2YHXBi4z.swf", pszSpec="*.divx") returned 0 [0143.056] lstrlenA (lpString="*.divx") returned 6 [0143.056] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\qrJZnMliWf2YHXBi4z.swf", pszSpec="*.mkv") returned 0 [0143.056] lstrlenA (lpString="*.mkv") returned 5 [0143.056] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\qrJZnMliWf2YHXBi4z.swf", pszSpec="*.mp3") returned 0 [0143.056] lstrlenA (lpString="*.mp3") returned 5 [0143.056] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\qrJZnMliWf2YHXBi4z.swf", pszSpec="*.wav") returned 0 [0143.056] lstrlenA (lpString="*.wav") returned 5 [0143.056] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\qrJZnMliWf2YHXBi4z.swf", pszSpec="*.flac") returned 0 [0143.056] lstrlenA (lpString="*.flac") returned 6 [0143.056] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\qrJZnMliWf2YHXBi4z.swf", pszSpec="*.ape") returned 0 [0143.056] lstrlenA (lpString="*.ape") returned 5 [0143.056] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\qrJZnMliWf2YHXBi4z.swf", pszSpec="*.wma") returned 0 [0143.056] lstrlenA (lpString="*.wma") returned 5 [0143.056] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\qrJZnMliWf2YHXBi4z.swf", pszSpec="*.ac3") returned 0 [0143.056] lstrlenA (lpString="*.ac3") returned 5 [0143.056] FindNextFileA (in: hFindFile=0x5be260, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0143.056] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0143.056] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="RZw2R-WI.flv") returned -1 [0143.056] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="RZw2R-WI.flv") returned -1 [0143.056] lstrcmpiA (lpString1="", lpString2="RZw2R-WI.flv") returned -1 [0143.056] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\qrJZnMliWf2YHXBi4z.swf") returned="qrJZnMliWf2YHXBi4z.swf" [0143.056] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\", lpString2="RZw2R-WI.flv" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\RZw2R-WI.flv") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\RZw2R-WI.flv" [0143.056] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\RZw2R-WI.flv", pszSpec="*.zip") returned 0 [0143.056] lstrlenA (lpString="*.zip") returned 5 [0143.057] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\RZw2R-WI.flv", pszSpec="*.rar") returned 0 [0143.057] lstrlenA (lpString="*.rar") returned 5 [0143.057] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\RZw2R-WI.flv", pszSpec="*.7z") returned 0 [0143.057] lstrlenA (lpString="*.7z") returned 4 [0143.057] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\RZw2R-WI.flv", pszSpec="*.tar") returned 0 [0143.057] lstrlenA (lpString="*.tar") returned 5 [0143.057] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\RZw2R-WI.flv", pszSpec="*.gzip") returned 0 [0143.057] lstrlenA (lpString="*.gzip") returned 6 [0143.057] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\RZw2R-WI.flv", pszSpec="*.jpg") returned 0 [0143.057] lstrlenA (lpString="*.jpg") returned 5 [0143.057] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\RZw2R-WI.flv", pszSpec="*.jpeg") returned 0 [0143.057] lstrlenA (lpString="*.jpeg") returned 6 [0143.057] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\RZw2R-WI.flv", pszSpec="*.psd") returned 0 [0143.057] lstrlenA (lpString="*.psd") returned 5 [0143.057] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\RZw2R-WI.flv", pszSpec="*.cdr") returned 0 [0143.057] lstrlenA (lpString="*.cdr") returned 5 [0143.057] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\RZw2R-WI.flv", pszSpec="*.dwg") returned 0 [0143.057] lstrlenA (lpString="*.dwg") returned 5 [0143.057] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\RZw2R-WI.flv", pszSpec="*.max") returned 0 [0143.057] lstrlenA (lpString="*.max") returned 5 [0143.057] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\RZw2R-WI.flv", pszSpec="*.bmp") returned 0 [0143.057] lstrlenA (lpString="*.bmp") returned 5 [0143.057] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\RZw2R-WI.flv", pszSpec="*.gif") returned 0 [0143.057] lstrlenA (lpString="*.gif") returned 5 [0143.057] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\RZw2R-WI.flv", pszSpec="*.png") returned 0 [0143.057] lstrlenA (lpString="*.png") returned 5 [0143.057] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\RZw2R-WI.flv", pszSpec="*.doc") returned 0 [0143.057] lstrlenA (lpString="*.doc") returned 5 [0143.057] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\RZw2R-WI.flv", pszSpec="*.docx") returned 0 [0143.057] lstrlenA (lpString="*.docx") returned 6 [0143.057] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\RZw2R-WI.flv", pszSpec="*.xls") returned 0 [0143.057] lstrlenA (lpString="*.xls") returned 5 [0143.057] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\RZw2R-WI.flv", pszSpec="*.xlsx") returned 0 [0143.057] lstrlenA (lpString="*.xlsx") returned 6 [0143.057] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\RZw2R-WI.flv", pszSpec="*.ppt") returned 0 [0143.057] lstrlenA (lpString="*.ppt") returned 5 [0143.057] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\RZw2R-WI.flv", pszSpec="*.pptx") returned 0 [0143.057] lstrlenA (lpString="*.pptx") returned 6 [0143.057] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\RZw2R-WI.flv", pszSpec="*.txt") returned 0 [0143.057] lstrlenA (lpString="*.txt") returned 5 [0143.057] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\RZw2R-WI.flv", pszSpec="*.pdf") returned 0 [0143.057] lstrlenA (lpString="*.pdf") returned 5 [0143.057] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\RZw2R-WI.flv", pszSpec="*.djvu") returned 0 [0143.057] lstrlenA (lpString="*.djvu") returned 6 [0143.057] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\RZw2R-WI.flv", pszSpec="*.htm") returned 0 [0143.057] lstrlenA (lpString="*.htm") returned 5 [0143.057] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\RZw2R-WI.flv", pszSpec="*.html") returned 0 [0143.057] lstrlenA (lpString="*.html") returned 6 [0143.057] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\RZw2R-WI.flv", pszSpec="*.mdb") returned 0 [0143.057] lstrlenA (lpString="*.mdb") returned 5 [0143.057] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\RZw2R-WI.flv", pszSpec="*.cer") returned 0 [0143.058] lstrlenA (lpString="*.cer") returned 5 [0143.058] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\RZw2R-WI.flv", pszSpec="*.p12") returned 0 [0143.058] lstrlenA (lpString="*.p12") returned 5 [0143.058] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\RZw2R-WI.flv", pszSpec="*.pfx") returned 0 [0143.058] lstrlenA (lpString="*.pfx") returned 5 [0143.058] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\RZw2R-WI.flv", pszSpec="*.kwm") returned 0 [0143.058] lstrlenA (lpString="*.kwm") returned 5 [0143.058] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\RZw2R-WI.flv", pszSpec="*.pwm") returned 0 [0143.058] lstrlenA (lpString="*.pwm") returned 5 [0143.058] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\RZw2R-WI.flv", pszSpec="*.1cd") returned 0 [0143.058] lstrlenA (lpString="*.1cd") returned 5 [0143.058] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\RZw2R-WI.flv", pszSpec="*.md") returned 0 [0143.058] lstrlenA (lpString="*.md") returned 4 [0143.058] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\RZw2R-WI.flv", pszSpec="*.mdf") returned 0 [0143.058] lstrlenA (lpString="*.mdf") returned 5 [0143.058] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\RZw2R-WI.flv", pszSpec="*.dbf") returned 0 [0143.058] lstrlenA (lpString="*.dbf") returned 5 [0143.058] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\RZw2R-WI.flv", pszSpec="*.odt") returned 0 [0143.058] lstrlenA (lpString="*.odt") returned 5 [0143.058] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\RZw2R-WI.flv", pszSpec="*.vob") returned 0 [0143.058] lstrlenA (lpString="*.vob") returned 5 [0143.058] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\RZw2R-WI.flv", pszSpec="*.ifo") returned 0 [0143.058] lstrlenA (lpString="*.ifo") returned 5 [0143.058] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\RZw2R-WI.flv", pszSpec="*.lnk") returned 0 [0143.058] lstrlenA (lpString="*.lnk") returned 5 [0143.058] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\RZw2R-WI.flv", pszSpec="*.torrent") returned 0 [0143.058] lstrlenA (lpString="*.torrent") returned 9 [0143.058] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\RZw2R-WI.flv", pszSpec="*.mov") returned 0 [0143.058] lstrlenA (lpString="*.mov") returned 5 [0143.058] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\RZw2R-WI.flv", pszSpec="*.m2v") returned 0 [0143.058] lstrlenA (lpString="*.m2v") returned 5 [0143.058] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\RZw2R-WI.flv", pszSpec="*.3gp") returned 0 [0143.058] lstrlenA (lpString="*.3gp") returned 5 [0143.058] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\RZw2R-WI.flv", pszSpec="*.mpeg") returned 0 [0143.058] lstrlenA (lpString="*.mpeg") returned 6 [0143.058] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\RZw2R-WI.flv", pszSpec="*.mpg") returned 0 [0143.058] lstrlenA (lpString="*.mpg") returned 5 [0143.058] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\RZw2R-WI.flv", pszSpec="*.flv") returned 1 [0143.058] lstrlenA (lpString="*.flv") returned 5 [0143.058] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\RZw2R-WI.flv" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\RZw2R-WI.flv") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\RZw2R-WI.flv" [0143.058] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\RZw2R-WI.flv" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\RZw2R-WI.flv") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\RZw2R-WI.flv" [0143.058] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\RZw2R-WI.flv", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\RZw2R-WI.flv.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\RZw2R-WI.flv." [0143.058] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\RZw2R-WI.flv.", lpString2="\xa0" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\RZw2R-WI.flv. ") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\RZw2R-WI.flv. " [0143.058] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\RZw2R-WI.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\rzw2r-wi.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0143.059] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x10d57 [0143.059] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x3192c910, dwHighDateTime=0x1d4aa3c), lpLastAccessTime=0x407536*(dwLowDateTime=0xdf75d880, dwHighDateTime=0x1d4a9a4), lpLastWriteTime=0x40753e*(dwLowDateTime=0xdf75d880, dwHighDateTime=0x1d4a9a4)) returned 1 [0143.059] SetFilePointer (in: hFile=0x90, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0143.059] ReadFile (in: hFile=0x90, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x10cfd, lpOverlapped=0x0) returned 1 [0143.060] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\RZw2R-WI.flv") returned="RZw2R-WI.flv" [0143.060] SetFilePointer (in: hFile=0x90, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0143.060] WriteFile (in: hFile=0x90, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x10cfd, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x10cfd, lpOverlapped=0x0) returned 1 [0143.060] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0143.060] CloseHandle (hObject=0x90) returned 1 [0143.060] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\RZw2R-WI.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\rzw2r-wi.flv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\RZw2R-WI.flv. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\rzw2r-wi.flv. ")) returned 1 [0143.061] FindNextFileA (in: hFindFile=0x5be260, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0143.061] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0143.061] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="S5nfZQToP_94zUWuMDFh.flv") returned -1 [0143.061] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="S5nfZQToP_94zUWuMDFh.flv") returned -1 [0143.062] lstrcmpiA (lpString1="", lpString2="S5nfZQToP_94zUWuMDFh.flv") returned -1 [0143.062] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\RZw2R-WI.flv") returned="RZw2R-WI.flv" [0143.062] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\", lpString2="S5nfZQToP_94zUWuMDFh.flv" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\S5nfZQToP_94zUWuMDFh.flv") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\S5nfZQToP_94zUWuMDFh.flv" [0143.062] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\S5nfZQToP_94zUWuMDFh.flv", pszSpec="*.zip") returned 0 [0143.062] lstrlenA (lpString="*.zip") returned 5 [0143.062] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\S5nfZQToP_94zUWuMDFh.flv", pszSpec="*.rar") returned 0 [0143.062] lstrlenA (lpString="*.rar") returned 5 [0143.062] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\S5nfZQToP_94zUWuMDFh.flv", pszSpec="*.7z") returned 0 [0143.062] lstrlenA (lpString="*.7z") returned 4 [0143.062] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\S5nfZQToP_94zUWuMDFh.flv", pszSpec="*.tar") returned 0 [0143.062] lstrlenA (lpString="*.tar") returned 5 [0143.062] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\S5nfZQToP_94zUWuMDFh.flv", pszSpec="*.gzip") returned 0 [0143.062] lstrlenA (lpString="*.gzip") returned 6 [0143.062] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\S5nfZQToP_94zUWuMDFh.flv", pszSpec="*.jpg") returned 0 [0143.062] lstrlenA (lpString="*.jpg") returned 5 [0143.062] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\S5nfZQToP_94zUWuMDFh.flv", pszSpec="*.jpeg") returned 0 [0143.062] lstrlenA (lpString="*.jpeg") returned 6 [0143.062] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\S5nfZQToP_94zUWuMDFh.flv", pszSpec="*.psd") returned 0 [0143.062] lstrlenA (lpString="*.psd") returned 5 [0143.062] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\S5nfZQToP_94zUWuMDFh.flv", pszSpec="*.cdr") returned 0 [0143.062] lstrlenA (lpString="*.cdr") returned 5 [0143.062] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\S5nfZQToP_94zUWuMDFh.flv", pszSpec="*.dwg") returned 0 [0143.062] lstrlenA (lpString="*.dwg") returned 5 [0143.062] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\S5nfZQToP_94zUWuMDFh.flv", pszSpec="*.max") returned 0 [0143.062] lstrlenA (lpString="*.max") returned 5 [0143.062] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\S5nfZQToP_94zUWuMDFh.flv", pszSpec="*.bmp") returned 0 [0143.062] lstrlenA (lpString="*.bmp") returned 5 [0143.062] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\S5nfZQToP_94zUWuMDFh.flv", pszSpec="*.gif") returned 0 [0143.062] lstrlenA (lpString="*.gif") returned 5 [0143.062] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\S5nfZQToP_94zUWuMDFh.flv", pszSpec="*.png") returned 0 [0143.062] lstrlenA (lpString="*.png") returned 5 [0143.062] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\S5nfZQToP_94zUWuMDFh.flv", pszSpec="*.doc") returned 0 [0143.062] lstrlenA (lpString="*.doc") returned 5 [0143.062] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\S5nfZQToP_94zUWuMDFh.flv", pszSpec="*.docx") returned 0 [0143.062] lstrlenA (lpString="*.docx") returned 6 [0143.062] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\S5nfZQToP_94zUWuMDFh.flv", pszSpec="*.xls") returned 0 [0143.062] lstrlenA (lpString="*.xls") returned 5 [0143.062] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\S5nfZQToP_94zUWuMDFh.flv", pszSpec="*.xlsx") returned 0 [0143.062] lstrlenA (lpString="*.xlsx") returned 6 [0143.062] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\S5nfZQToP_94zUWuMDFh.flv", pszSpec="*.ppt") returned 0 [0143.062] lstrlenA (lpString="*.ppt") returned 5 [0143.062] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\S5nfZQToP_94zUWuMDFh.flv", pszSpec="*.pptx") returned 0 [0143.062] lstrlenA (lpString="*.pptx") returned 6 [0143.062] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\S5nfZQToP_94zUWuMDFh.flv", pszSpec="*.txt") returned 0 [0143.062] lstrlenA (lpString="*.txt") returned 5 [0143.062] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\S5nfZQToP_94zUWuMDFh.flv", pszSpec="*.pdf") returned 0 [0143.062] lstrlenA (lpString="*.pdf") returned 5 [0143.062] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\S5nfZQToP_94zUWuMDFh.flv", pszSpec="*.djvu") returned 0 [0143.063] lstrlenA (lpString="*.djvu") returned 6 [0143.063] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\S5nfZQToP_94zUWuMDFh.flv", pszSpec="*.htm") returned 0 [0143.063] lstrlenA (lpString="*.htm") returned 5 [0143.063] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\S5nfZQToP_94zUWuMDFh.flv", pszSpec="*.html") returned 0 [0143.063] lstrlenA (lpString="*.html") returned 6 [0143.063] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\S5nfZQToP_94zUWuMDFh.flv", pszSpec="*.mdb") returned 0 [0143.063] lstrlenA (lpString="*.mdb") returned 5 [0143.063] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\S5nfZQToP_94zUWuMDFh.flv", pszSpec="*.cer") returned 0 [0143.063] lstrlenA (lpString="*.cer") returned 5 [0143.063] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\S5nfZQToP_94zUWuMDFh.flv", pszSpec="*.p12") returned 0 [0143.063] lstrlenA (lpString="*.p12") returned 5 [0143.063] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\S5nfZQToP_94zUWuMDFh.flv", pszSpec="*.pfx") returned 0 [0143.063] lstrlenA (lpString="*.pfx") returned 5 [0143.063] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\S5nfZQToP_94zUWuMDFh.flv", pszSpec="*.kwm") returned 0 [0143.063] lstrlenA (lpString="*.kwm") returned 5 [0143.063] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\S5nfZQToP_94zUWuMDFh.flv", pszSpec="*.pwm") returned 0 [0143.063] lstrlenA (lpString="*.pwm") returned 5 [0143.063] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\S5nfZQToP_94zUWuMDFh.flv", pszSpec="*.1cd") returned 0 [0143.063] lstrlenA (lpString="*.1cd") returned 5 [0143.063] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\S5nfZQToP_94zUWuMDFh.flv", pszSpec="*.md") returned 0 [0143.063] lstrlenA (lpString="*.md") returned 4 [0143.063] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\S5nfZQToP_94zUWuMDFh.flv", pszSpec="*.mdf") returned 0 [0143.063] lstrlenA (lpString="*.mdf") returned 5 [0143.063] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\S5nfZQToP_94zUWuMDFh.flv", pszSpec="*.dbf") returned 0 [0143.063] lstrlenA (lpString="*.dbf") returned 5 [0143.063] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\S5nfZQToP_94zUWuMDFh.flv", pszSpec="*.odt") returned 0 [0143.063] lstrlenA (lpString="*.odt") returned 5 [0143.063] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\S5nfZQToP_94zUWuMDFh.flv", pszSpec="*.vob") returned 0 [0143.063] lstrlenA (lpString="*.vob") returned 5 [0143.063] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\S5nfZQToP_94zUWuMDFh.flv", pszSpec="*.ifo") returned 0 [0143.063] lstrlenA (lpString="*.ifo") returned 5 [0143.063] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\S5nfZQToP_94zUWuMDFh.flv", pszSpec="*.lnk") returned 0 [0143.063] lstrlenA (lpString="*.lnk") returned 5 [0143.063] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\S5nfZQToP_94zUWuMDFh.flv", pszSpec="*.torrent") returned 0 [0143.063] lstrlenA (lpString="*.torrent") returned 9 [0143.063] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\S5nfZQToP_94zUWuMDFh.flv", pszSpec="*.mov") returned 0 [0143.063] lstrlenA (lpString="*.mov") returned 5 [0143.063] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\S5nfZQToP_94zUWuMDFh.flv", pszSpec="*.m2v") returned 0 [0143.063] lstrlenA (lpString="*.m2v") returned 5 [0143.063] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\S5nfZQToP_94zUWuMDFh.flv", pszSpec="*.3gp") returned 0 [0143.063] lstrlenA (lpString="*.3gp") returned 5 [0143.063] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\S5nfZQToP_94zUWuMDFh.flv", pszSpec="*.mpeg") returned 0 [0143.063] lstrlenA (lpString="*.mpeg") returned 6 [0143.063] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\S5nfZQToP_94zUWuMDFh.flv", pszSpec="*.mpg") returned 0 [0143.063] lstrlenA (lpString="*.mpg") returned 5 [0143.063] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\S5nfZQToP_94zUWuMDFh.flv", pszSpec="*.flv") returned 1 [0143.063] lstrlenA (lpString="*.flv") returned 5 [0143.063] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\S5nfZQToP_94zUWuMDFh.flv" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\S5nfZQToP_94zUWuMDFh.flv") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\S5nfZQToP_94zUWuMDFh.flv" [0143.063] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\S5nfZQToP_94zUWuMDFh.flv" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\S5nfZQToP_94zUWuMDFh.flv") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\S5nfZQToP_94zUWuMDFh.flv" [0143.064] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\S5nfZQToP_94zUWuMDFh.flv", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\S5nfZQToP_94zUWuMDFh.flv.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\S5nfZQToP_94zUWuMDFh.flv." [0143.064] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\S5nfZQToP_94zUWuMDFh.flv.", lpString2="\xa0" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\S5nfZQToP_94zUWuMDFh.flv. ") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\S5nfZQToP_94zUWuMDFh.flv. " [0143.064] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\S5nfZQToP_94zUWuMDFh.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\s5nfzqtop_94zuwumdfh.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0143.064] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x135d0 [0143.064] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x8d787960, dwHighDateTime=0x1d4ace8), lpLastAccessTime=0x407536*(dwLowDateTime=0xe00a9c90, dwHighDateTime=0x1d4a350), lpLastWriteTime=0x40753e*(dwLowDateTime=0xe00a9c90, dwHighDateTime=0x1d4a350)) returned 1 [0143.064] SetFilePointer (in: hFile=0x90, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0143.064] ReadFile (in: hFile=0x90, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x13576, lpOverlapped=0x0) returned 1 [0143.065] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\S5nfZQToP_94zUWuMDFh.flv") returned="S5nfZQToP_94zUWuMDFh.flv" [0143.065] SetFilePointer (in: hFile=0x90, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0143.065] WriteFile (in: hFile=0x90, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x13576, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x13576, lpOverlapped=0x0) returned 1 [0143.065] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0143.066] CloseHandle (hObject=0x90) returned 1 [0143.066] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\S5nfZQToP_94zUWuMDFh.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\s5nfzqtop_94zuwumdfh.flv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\S5nfZQToP_94zUWuMDFh.flv. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\s5nfzqtop_94zuwumdfh.flv. ")) returned 1 [0143.067] FindNextFileA (in: hFindFile=0x5be260, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0143.067] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0143.067] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="T 9BHE8_it2WtyA.jpg") returned -1 [0143.067] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="T 9BHE8_it2WtyA.jpg") returned -1 [0143.067] lstrcmpiA (lpString1="", lpString2="T 9BHE8_it2WtyA.jpg") returned -1 [0143.067] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\S5nfZQToP_94zUWuMDFh.flv") returned="S5nfZQToP_94zUWuMDFh.flv" [0143.067] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\", lpString2="T 9BHE8_it2WtyA.jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\T 9BHE8_it2WtyA.jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\T 9BHE8_it2WtyA.jpg" [0143.067] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\T 9BHE8_it2WtyA.jpg", pszSpec="*.zip") returned 0 [0143.067] lstrlenA (lpString="*.zip") returned 5 [0143.067] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\T 9BHE8_it2WtyA.jpg", pszSpec="*.rar") returned 0 [0143.067] lstrlenA (lpString="*.rar") returned 5 [0143.067] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\T 9BHE8_it2WtyA.jpg", pszSpec="*.7z") returned 0 [0143.067] lstrlenA (lpString="*.7z") returned 4 [0143.067] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\T 9BHE8_it2WtyA.jpg", pszSpec="*.tar") returned 0 [0143.067] lstrlenA (lpString="*.tar") returned 5 [0143.067] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\T 9BHE8_it2WtyA.jpg", pszSpec="*.gzip") returned 0 [0143.067] lstrlenA (lpString="*.gzip") returned 6 [0143.067] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\T 9BHE8_it2WtyA.jpg", pszSpec="*.jpg") returned 1 [0143.067] lstrlenA (lpString="*.jpg") returned 5 [0143.067] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\T 9BHE8_it2WtyA.jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\T 9BHE8_it2WtyA.jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\T 9BHE8_it2WtyA.jpg" [0143.067] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\T 9BHE8_it2WtyA.jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\T 9BHE8_it2WtyA.jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\T 9BHE8_it2WtyA.jpg" [0143.067] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\T 9BHE8_it2WtyA.jpg", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\T 9BHE8_it2WtyA.jpg.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\T 9BHE8_it2WtyA.jpg." [0143.067] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\T 9BHE8_it2WtyA.jpg.", lpString2="\xa0" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\T 9BHE8_it2WtyA.jpg. ") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\T 9BHE8_it2WtyA.jpg. " [0143.067] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\T 9BHE8_it2WtyA.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\t 9bhe8_it2wtya.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0143.068] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x16bb0 [0143.068] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xc332c080, dwHighDateTime=0x1d4ad27), lpLastAccessTime=0x407536*(dwLowDateTime=0xf195b4c0, dwHighDateTime=0x1d4a82a), lpLastWriteTime=0x40753e*(dwLowDateTime=0xf195b4c0, dwHighDateTime=0x1d4a82a)) returned 1 [0143.068] SetFilePointer (in: hFile=0x90, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0143.068] ReadFile (in: hFile=0x90, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x16b56, lpOverlapped=0x0) returned 1 [0143.069] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\T 9BHE8_it2WtyA.jpg") returned="T 9BHE8_it2WtyA.jpg" [0143.069] SetFilePointer (in: hFile=0x90, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0143.069] WriteFile (in: hFile=0x90, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x16b56, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x16b56, lpOverlapped=0x0) returned 1 [0143.069] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0143.069] CloseHandle (hObject=0x90) returned 1 [0143.069] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\T 9BHE8_it2WtyA.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\t 9bhe8_it2wtya.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\T 9BHE8_it2WtyA.jpg. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\t 9bhe8_it2wtya.jpg. ")) returned 1 [0143.070] FindNextFileA (in: hFindFile=0x5be260, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0143.070] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0143.070] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="T aOv5lKDdGXhsAEu.jpg") returned -1 [0143.070] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="T aOv5lKDdGXhsAEu.jpg") returned -1 [0143.070] lstrcmpiA (lpString1="", lpString2="T aOv5lKDdGXhsAEu.jpg") returned -1 [0143.070] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\T 9BHE8_it2WtyA.jpg") returned="T 9BHE8_it2WtyA.jpg" [0143.070] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\", lpString2="T aOv5lKDdGXhsAEu.jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\T aOv5lKDdGXhsAEu.jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\T aOv5lKDdGXhsAEu.jpg" [0143.070] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\T aOv5lKDdGXhsAEu.jpg", pszSpec="*.zip") returned 0 [0143.070] lstrlenA (lpString="*.zip") returned 5 [0143.070] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\T aOv5lKDdGXhsAEu.jpg", pszSpec="*.rar") returned 0 [0143.070] lstrlenA (lpString="*.rar") returned 5 [0143.071] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\T aOv5lKDdGXhsAEu.jpg", pszSpec="*.7z") returned 0 [0143.071] lstrlenA (lpString="*.7z") returned 4 [0143.071] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\T aOv5lKDdGXhsAEu.jpg", pszSpec="*.tar") returned 0 [0143.071] lstrlenA (lpString="*.tar") returned 5 [0143.071] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\T aOv5lKDdGXhsAEu.jpg", pszSpec="*.gzip") returned 0 [0143.071] lstrlenA (lpString="*.gzip") returned 6 [0143.071] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\T aOv5lKDdGXhsAEu.jpg", pszSpec="*.jpg") returned 1 [0143.071] lstrlenA (lpString="*.jpg") returned 5 [0143.071] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\T aOv5lKDdGXhsAEu.jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\T aOv5lKDdGXhsAEu.jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\T aOv5lKDdGXhsAEu.jpg" [0143.071] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\T aOv5lKDdGXhsAEu.jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\T aOv5lKDdGXhsAEu.jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\T aOv5lKDdGXhsAEu.jpg" [0143.071] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\T aOv5lKDdGXhsAEu.jpg", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\T aOv5lKDdGXhsAEu.jpg.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\T aOv5lKDdGXhsAEu.jpg." [0143.071] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\T aOv5lKDdGXhsAEu.jpg.", lpString2="\xa0" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\T aOv5lKDdGXhsAEu.jpg. ") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\T aOv5lKDdGXhsAEu.jpg. " [0143.071] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\T aOv5lKDdGXhsAEu.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\t aov5lkddgxhsaeu.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0143.071] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x38be [0143.071] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x566038c0, dwHighDateTime=0x1d4a62e), lpLastAccessTime=0x407536*(dwLowDateTime=0x1c35f7d0, dwHighDateTime=0x1d4a1d2), lpLastWriteTime=0x40753e*(dwLowDateTime=0x1c35f7d0, dwHighDateTime=0x1d4a1d2)) returned 1 [0143.071] SetFilePointer (in: hFile=0x90, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0143.071] ReadFile (in: hFile=0x90, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x3864, lpOverlapped=0x0) returned 1 [0143.072] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\T aOv5lKDdGXhsAEu.jpg") returned="T aOv5lKDdGXhsAEu.jpg" [0143.072] SetFilePointer (in: hFile=0x90, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0143.072] WriteFile (in: hFile=0x90, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x3864, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x3864, lpOverlapped=0x0) returned 1 [0143.072] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0143.072] CloseHandle (hObject=0x90) returned 1 [0143.072] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\T aOv5lKDdGXhsAEu.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\t aov5lkddgxhsaeu.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\T aOv5lKDdGXhsAEu.jpg. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\t aov5lkddgxhsaeu.jpg. ")) returned 1 [0143.073] FindNextFileA (in: hFindFile=0x5be260, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0143.073] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0143.073] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="t4Gfv3xbI.flv") returned -1 [0143.073] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="t4Gfv3xbI.flv") returned -1 [0143.073] lstrcmpiA (lpString1="", lpString2="t4Gfv3xbI.flv") returned -1 [0143.073] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\T aOv5lKDdGXhsAEu.jpg") returned="T aOv5lKDdGXhsAEu.jpg" [0143.073] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\", lpString2="t4Gfv3xbI.flv" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\t4Gfv3xbI.flv") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\t4Gfv3xbI.flv" [0143.073] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\t4Gfv3xbI.flv", pszSpec="*.zip") returned 0 [0143.073] lstrlenA (lpString="*.zip") returned 5 [0143.073] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\t4Gfv3xbI.flv", pszSpec="*.rar") returned 0 [0143.073] lstrlenA (lpString="*.rar") returned 5 [0143.073] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\t4Gfv3xbI.flv", pszSpec="*.7z") returned 0 [0143.073] lstrlenA (lpString="*.7z") returned 4 [0143.073] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\t4Gfv3xbI.flv", pszSpec="*.tar") returned 0 [0143.073] lstrlenA (lpString="*.tar") returned 5 [0143.073] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\t4Gfv3xbI.flv", pszSpec="*.gzip") returned 0 [0143.073] lstrlenA (lpString="*.gzip") returned 6 [0143.073] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\t4Gfv3xbI.flv", pszSpec="*.jpg") returned 0 [0143.073] lstrlenA (lpString="*.jpg") returned 5 [0143.074] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\t4Gfv3xbI.flv", pszSpec="*.jpeg") returned 0 [0143.074] lstrlenA (lpString="*.jpeg") returned 6 [0143.074] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\t4Gfv3xbI.flv", pszSpec="*.psd") returned 0 [0143.074] lstrlenA (lpString="*.psd") returned 5 [0143.074] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\t4Gfv3xbI.flv", pszSpec="*.cdr") returned 0 [0143.074] lstrlenA (lpString="*.cdr") returned 5 [0143.074] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\t4Gfv3xbI.flv", pszSpec="*.dwg") returned 0 [0143.074] lstrlenA (lpString="*.dwg") returned 5 [0143.074] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\t4Gfv3xbI.flv", pszSpec="*.max") returned 0 [0143.074] lstrlenA (lpString="*.max") returned 5 [0143.074] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\t4Gfv3xbI.flv", pszSpec="*.bmp") returned 0 [0143.074] lstrlenA (lpString="*.bmp") returned 5 [0143.074] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\t4Gfv3xbI.flv", pszSpec="*.gif") returned 0 [0143.074] lstrlenA (lpString="*.gif") returned 5 [0143.074] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\t4Gfv3xbI.flv", pszSpec="*.png") returned 0 [0143.074] lstrlenA (lpString="*.png") returned 5 [0143.074] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\t4Gfv3xbI.flv", pszSpec="*.doc") returned 0 [0143.074] lstrlenA (lpString="*.doc") returned 5 [0143.074] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\t4Gfv3xbI.flv", pszSpec="*.docx") returned 0 [0143.074] lstrlenA (lpString="*.docx") returned 6 [0143.074] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\t4Gfv3xbI.flv", pszSpec="*.xls") returned 0 [0143.074] lstrlenA (lpString="*.xls") returned 5 [0143.074] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\t4Gfv3xbI.flv", pszSpec="*.xlsx") returned 0 [0143.074] lstrlenA (lpString="*.xlsx") returned 6 [0143.074] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\t4Gfv3xbI.flv", pszSpec="*.ppt") returned 0 [0143.074] lstrlenA (lpString="*.ppt") returned 5 [0143.074] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\t4Gfv3xbI.flv", pszSpec="*.pptx") returned 0 [0143.074] lstrlenA (lpString="*.pptx") returned 6 [0143.074] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\t4Gfv3xbI.flv", pszSpec="*.txt") returned 0 [0143.074] lstrlenA (lpString="*.txt") returned 5 [0143.074] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\t4Gfv3xbI.flv", pszSpec="*.pdf") returned 0 [0143.074] lstrlenA (lpString="*.pdf") returned 5 [0143.074] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\t4Gfv3xbI.flv", pszSpec="*.djvu") returned 0 [0143.074] lstrlenA (lpString="*.djvu") returned 6 [0143.074] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\t4Gfv3xbI.flv", pszSpec="*.htm") returned 0 [0143.074] lstrlenA (lpString="*.htm") returned 5 [0143.074] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\t4Gfv3xbI.flv", pszSpec="*.html") returned 0 [0143.074] lstrlenA (lpString="*.html") returned 6 [0143.074] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\t4Gfv3xbI.flv", pszSpec="*.mdb") returned 0 [0143.074] lstrlenA (lpString="*.mdb") returned 5 [0143.074] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\t4Gfv3xbI.flv", pszSpec="*.cer") returned 0 [0143.074] lstrlenA (lpString="*.cer") returned 5 [0143.074] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\t4Gfv3xbI.flv", pszSpec="*.p12") returned 0 [0143.074] lstrlenA (lpString="*.p12") returned 5 [0143.074] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\t4Gfv3xbI.flv", pszSpec="*.pfx") returned 0 [0143.074] lstrlenA (lpString="*.pfx") returned 5 [0143.074] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\t4Gfv3xbI.flv", pszSpec="*.kwm") returned 0 [0143.074] lstrlenA (lpString="*.kwm") returned 5 [0143.074] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\t4Gfv3xbI.flv", pszSpec="*.pwm") returned 0 [0143.075] lstrlenA (lpString="*.pwm") returned 5 [0143.075] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\t4Gfv3xbI.flv", pszSpec="*.1cd") returned 0 [0143.075] lstrlenA (lpString="*.1cd") returned 5 [0143.075] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\t4Gfv3xbI.flv", pszSpec="*.md") returned 0 [0143.075] lstrlenA (lpString="*.md") returned 4 [0143.075] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\t4Gfv3xbI.flv", pszSpec="*.mdf") returned 0 [0143.075] lstrlenA (lpString="*.mdf") returned 5 [0143.075] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\t4Gfv3xbI.flv", pszSpec="*.dbf") returned 0 [0143.075] lstrlenA (lpString="*.dbf") returned 5 [0143.075] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\t4Gfv3xbI.flv", pszSpec="*.odt") returned 0 [0143.075] lstrlenA (lpString="*.odt") returned 5 [0143.075] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\t4Gfv3xbI.flv", pszSpec="*.vob") returned 0 [0143.075] lstrlenA (lpString="*.vob") returned 5 [0143.075] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\t4Gfv3xbI.flv", pszSpec="*.ifo") returned 0 [0143.075] lstrlenA (lpString="*.ifo") returned 5 [0143.075] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\t4Gfv3xbI.flv", pszSpec="*.lnk") returned 0 [0143.075] lstrlenA (lpString="*.lnk") returned 5 [0143.075] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\t4Gfv3xbI.flv", pszSpec="*.torrent") returned 0 [0143.075] lstrlenA (lpString="*.torrent") returned 9 [0143.075] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\t4Gfv3xbI.flv", pszSpec="*.mov") returned 0 [0143.075] lstrlenA (lpString="*.mov") returned 5 [0143.075] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\t4Gfv3xbI.flv", pszSpec="*.m2v") returned 0 [0143.075] lstrlenA (lpString="*.m2v") returned 5 [0143.075] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\t4Gfv3xbI.flv", pszSpec="*.3gp") returned 0 [0143.075] lstrlenA (lpString="*.3gp") returned 5 [0143.075] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\t4Gfv3xbI.flv", pszSpec="*.mpeg") returned 0 [0143.075] lstrlenA (lpString="*.mpeg") returned 6 [0143.075] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\t4Gfv3xbI.flv", pszSpec="*.mpg") returned 0 [0143.075] lstrlenA (lpString="*.mpg") returned 5 [0143.075] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\t4Gfv3xbI.flv", pszSpec="*.flv") returned 1 [0143.075] lstrlenA (lpString="*.flv") returned 5 [0143.075] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\t4Gfv3xbI.flv" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\t4Gfv3xbI.flv") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\t4Gfv3xbI.flv" [0143.075] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\t4Gfv3xbI.flv" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\t4Gfv3xbI.flv") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\t4Gfv3xbI.flv" [0143.075] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\t4Gfv3xbI.flv", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\t4Gfv3xbI.flv.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\t4Gfv3xbI.flv." [0143.075] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\t4Gfv3xbI.flv.", lpString2="\xa0" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\t4Gfv3xbI.flv. ") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\t4Gfv3xbI.flv. " [0143.075] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\t4Gfv3xbI.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\t4gfv3xbi.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0143.076] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x55ee [0143.076] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x3cc16220, dwHighDateTime=0x1d49df2), lpLastAccessTime=0x407536*(dwLowDateTime=0x746446c0, dwHighDateTime=0x1d4a09f), lpLastWriteTime=0x40753e*(dwLowDateTime=0x746446c0, dwHighDateTime=0x1d4a09f)) returned 1 [0143.076] SetFilePointer (in: hFile=0x90, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0143.076] ReadFile (in: hFile=0x90, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x5594, lpOverlapped=0x0) returned 1 [0143.076] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\t4Gfv3xbI.flv") returned="t4Gfv3xbI.flv" [0143.076] SetFilePointer (in: hFile=0x90, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0143.077] WriteFile (in: hFile=0x90, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x5594, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x5594, lpOverlapped=0x0) returned 1 [0143.077] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0143.077] CloseHandle (hObject=0x90) returned 1 [0143.077] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\t4Gfv3xbI.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\t4gfv3xbi.flv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\t4Gfv3xbI.flv. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\t4gfv3xbi.flv. ")) returned 1 [0143.078] FindNextFileA (in: hFindFile=0x5be260, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0143.078] lstrcmpA (lpString1=".", lpString2="Temporary Internet Files") returned -1 [0143.078] lstrcmpA (lpString1="..", lpString2="Temporary Internet Files") returned -1 [0143.078] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\t4Gfv3xbI.flv") returned="t4Gfv3xbI.flv" [0143.078] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\", lpString2="Temporary Internet Files" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files" [0143.078] lstrlenA (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files") returned 73 [0143.078] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0143.079] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0143.079] FindNextFileA (in: hFindFile=0x5be2a0, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0143.079] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0143.079] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0143.079] FindNextFileA (in: hFindFile=0x5be2a0, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0143.079] lstrcmpA (lpString1=".", lpString2="Content.IE5") returned -1 [0143.079] lstrcmpA (lpString1="..", lpString2="Content.IE5") returned -1 [0143.079] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\*.*") returned="*.*" [0143.079] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\", lpString2="Content.IE5" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5" [0143.079] lstrlenA (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5") returned 85 [0143.079] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\*.*", lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 0x5be2e0 [0143.079] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0143.079] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0143.079] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0143.079] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0143.079] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0143.079] lstrcmpA (lpString1=".", lpString2="03J4UQW0") returned -1 [0143.079] lstrcmpA (lpString1="..", lpString2="03J4UQW0") returned -1 [0143.079] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\*.*") returned="*.*" [0143.079] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\", lpString2="03J4UQW0" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0" [0143.079] lstrlenA (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0") returned 94 [0143.079] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0\\*.*", lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 0x5be320 [0143.080] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0143.080] FindNextFileA (in: hFindFile=0x5be320, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0143.080] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0143.080] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0143.080] FindNextFileA (in: hFindFile=0x5be320, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0143.080] PeekMessageA (in: lpMsg=0xaece4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaece4) returned 0 [0143.080] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="desktop.ini") returned 1 [0143.080] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="desktop.ini") returned 1 [0143.080] lstrcmpiA (lpString1="", lpString2="desktop.ini") returned -1 [0143.080] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0\\*.*") returned="*.*" [0143.080] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0\\", lpString2="desktop.ini" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0\\desktop.ini") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0\\desktop.ini" [0143.080] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0\\desktop.ini", pszSpec="*.zip") returned 0 [0143.080] lstrlenA (lpString="*.zip") returned 5 [0143.080] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0\\desktop.ini", pszSpec="*.rar") returned 0 [0143.080] lstrlenA (lpString="*.rar") returned 5 [0143.080] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0\\desktop.ini", pszSpec="*.7z") returned 0 [0143.080] lstrlenA (lpString="*.7z") returned 4 [0143.080] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0\\desktop.ini", pszSpec="*.tar") returned 0 [0143.080] lstrlenA (lpString="*.tar") returned 5 [0143.080] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0\\desktop.ini", pszSpec="*.gzip") returned 0 [0143.080] lstrlenA (lpString="*.gzip") returned 6 [0143.080] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0\\desktop.ini", pszSpec="*.jpg") returned 0 [0143.081] lstrlenA (lpString="*.jpg") returned 5 [0143.081] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0\\desktop.ini", pszSpec="*.jpeg") returned 0 [0143.081] lstrlenA (lpString="*.jpeg") returned 6 [0143.081] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0\\desktop.ini", pszSpec="*.psd") returned 0 [0143.081] lstrlenA (lpString="*.psd") returned 5 [0143.081] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0\\desktop.ini", pszSpec="*.cdr") returned 0 [0143.081] lstrlenA (lpString="*.cdr") returned 5 [0143.081] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0\\desktop.ini", pszSpec="*.dwg") returned 0 [0143.081] lstrlenA (lpString="*.dwg") returned 5 [0143.081] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0\\desktop.ini", pszSpec="*.max") returned 0 [0143.081] lstrlenA (lpString="*.max") returned 5 [0143.081] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0\\desktop.ini", pszSpec="*.bmp") returned 0 [0143.081] lstrlenA (lpString="*.bmp") returned 5 [0143.081] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0\\desktop.ini", pszSpec="*.gif") returned 0 [0143.081] lstrlenA (lpString="*.gif") returned 5 [0143.081] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0\\desktop.ini", pszSpec="*.png") returned 0 [0143.081] lstrlenA (lpString="*.png") returned 5 [0143.081] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0\\desktop.ini", pszSpec="*.doc") returned 0 [0143.081] lstrlenA (lpString="*.doc") returned 5 [0143.081] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0\\desktop.ini", pszSpec="*.docx") returned 0 [0143.081] lstrlenA (lpString="*.docx") returned 6 [0143.081] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0\\desktop.ini", pszSpec="*.xls") returned 0 [0143.081] lstrlenA (lpString="*.xls") returned 5 [0143.081] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0\\desktop.ini", pszSpec="*.xlsx") returned 0 [0143.081] lstrlenA (lpString="*.xlsx") returned 6 [0143.081] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0\\desktop.ini", pszSpec="*.ppt") returned 0 [0143.081] lstrlenA (lpString="*.ppt") returned 5 [0143.081] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0\\desktop.ini", pszSpec="*.pptx") returned 0 [0143.081] lstrlenA (lpString="*.pptx") returned 6 [0143.081] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0\\desktop.ini", pszSpec="*.txt") returned 0 [0143.081] lstrlenA (lpString="*.txt") returned 5 [0143.081] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0\\desktop.ini", pszSpec="*.pdf") returned 0 [0143.081] lstrlenA (lpString="*.pdf") returned 5 [0143.081] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0\\desktop.ini", pszSpec="*.djvu") returned 0 [0143.081] lstrlenA (lpString="*.djvu") returned 6 [0143.081] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0\\desktop.ini", pszSpec="*.htm") returned 0 [0143.081] lstrlenA (lpString="*.htm") returned 5 [0143.081] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0\\desktop.ini", pszSpec="*.html") returned 0 [0143.081] lstrlenA (lpString="*.html") returned 6 [0143.081] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0\\desktop.ini", pszSpec="*.mdb") returned 0 [0143.081] lstrlenA (lpString="*.mdb") returned 5 [0143.081] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0\\desktop.ini", pszSpec="*.cer") returned 0 [0143.081] lstrlenA (lpString="*.cer") returned 5 [0143.081] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0\\desktop.ini", pszSpec="*.p12") returned 0 [0143.081] lstrlenA (lpString="*.p12") returned 5 [0143.081] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0\\desktop.ini", pszSpec="*.pfx") returned 0 [0143.081] lstrlenA (lpString="*.pfx") returned 5 [0143.081] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0\\desktop.ini", pszSpec="*.kwm") returned 0 [0143.081] lstrlenA (lpString="*.kwm") returned 5 [0143.082] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0\\desktop.ini", pszSpec="*.pwm") returned 0 [0143.082] lstrlenA (lpString="*.pwm") returned 5 [0143.082] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0\\desktop.ini", pszSpec="*.1cd") returned 0 [0143.082] lstrlenA (lpString="*.1cd") returned 5 [0143.082] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0\\desktop.ini", pszSpec="*.md") returned 0 [0143.082] lstrlenA (lpString="*.md") returned 4 [0143.082] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0\\desktop.ini", pszSpec="*.mdf") returned 0 [0143.082] lstrlenA (lpString="*.mdf") returned 5 [0143.082] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0\\desktop.ini", pszSpec="*.dbf") returned 0 [0143.082] lstrlenA (lpString="*.dbf") returned 5 [0143.082] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0\\desktop.ini", pszSpec="*.odt") returned 0 [0143.082] lstrlenA (lpString="*.odt") returned 5 [0143.082] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0\\desktop.ini", pszSpec="*.vob") returned 0 [0143.082] lstrlenA (lpString="*.vob") returned 5 [0143.082] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0\\desktop.ini", pszSpec="*.ifo") returned 0 [0143.082] lstrlenA (lpString="*.ifo") returned 5 [0143.082] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0\\desktop.ini", pszSpec="*.lnk") returned 0 [0143.082] lstrlenA (lpString="*.lnk") returned 5 [0143.082] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0\\desktop.ini", pszSpec="*.torrent") returned 0 [0143.082] lstrlenA (lpString="*.torrent") returned 9 [0143.082] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0\\desktop.ini", pszSpec="*.mov") returned 0 [0143.082] lstrlenA (lpString="*.mov") returned 5 [0143.082] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0\\desktop.ini", pszSpec="*.m2v") returned 0 [0143.082] lstrlenA (lpString="*.m2v") returned 5 [0143.082] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0\\desktop.ini", pszSpec="*.3gp") returned 0 [0143.082] lstrlenA (lpString="*.3gp") returned 5 [0143.082] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0\\desktop.ini", pszSpec="*.mpeg") returned 0 [0143.082] lstrlenA (lpString="*.mpeg") returned 6 [0143.082] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0\\desktop.ini", pszSpec="*.mpg") returned 0 [0143.082] lstrlenA (lpString="*.mpg") returned 5 [0143.082] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0\\desktop.ini", pszSpec="*.flv") returned 0 [0143.082] lstrlenA (lpString="*.flv") returned 5 [0143.082] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0\\desktop.ini", pszSpec="*.avi") returned 0 [0143.082] lstrlenA (lpString="*.avi") returned 5 [0143.082] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0\\desktop.ini", pszSpec="*.mp4") returned 0 [0143.082] lstrlenA (lpString="*.mp4") returned 5 [0143.082] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0\\desktop.ini", pszSpec="*.wmv") returned 0 [0143.082] lstrlenA (lpString="*.wmv") returned 5 [0143.082] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0\\desktop.ini", pszSpec="*.divx") returned 0 [0143.082] lstrlenA (lpString="*.divx") returned 6 [0143.082] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0\\desktop.ini", pszSpec="*.mkv") returned 0 [0143.082] lstrlenA (lpString="*.mkv") returned 5 [0143.082] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0\\desktop.ini", pszSpec="*.mp3") returned 0 [0143.082] lstrlenA (lpString="*.mp3") returned 5 [0143.082] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0\\desktop.ini", pszSpec="*.wav") returned 0 [0143.082] lstrlenA (lpString="*.wav") returned 5 [0143.082] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0\\desktop.ini", pszSpec="*.flac") returned 0 [0143.082] lstrlenA (lpString="*.flac") returned 6 [0143.082] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0\\desktop.ini", pszSpec="*.ape") returned 0 [0143.082] lstrlenA (lpString="*.ape") returned 5 [0143.083] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0\\desktop.ini", pszSpec="*.wma") returned 0 [0143.083] lstrlenA (lpString="*.wma") returned 5 [0143.083] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0\\desktop.ini", pszSpec="*.ac3") returned 0 [0143.083] lstrlenA (lpString="*.ac3") returned 5 [0143.083] FindNextFileA (in: hFindFile=0x5be320, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 0 [0143.083] FindClose (in: hFindFile=0x5be320 | out: hFindFile=0x5be320) returned 1 [0143.083] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0143.083] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0143.083] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="desktop.ini") returned 1 [0143.083] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="desktop.ini") returned 1 [0143.083] lstrcmpiA (lpString1="", lpString2="desktop.ini") returned -1 [0143.083] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\*.*") returned="*.*" [0143.083] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\", lpString2="desktop.ini" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\desktop.ini") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\desktop.ini" [0143.083] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\desktop.ini", pszSpec="*.zip") returned 0 [0143.083] lstrlenA (lpString="*.zip") returned 5 [0143.083] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\desktop.ini", pszSpec="*.rar") returned 0 [0143.083] lstrlenA (lpString="*.rar") returned 5 [0143.083] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\desktop.ini", pszSpec="*.7z") returned 0 [0143.083] lstrlenA (lpString="*.7z") returned 4 [0143.083] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\desktop.ini", pszSpec="*.tar") returned 0 [0143.083] lstrlenA (lpString="*.tar") returned 5 [0143.083] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\desktop.ini", pszSpec="*.gzip") returned 0 [0143.083] lstrlenA (lpString="*.gzip") returned 6 [0143.083] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\desktop.ini", pszSpec="*.jpg") returned 0 [0143.083] lstrlenA (lpString="*.jpg") returned 5 [0143.083] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\desktop.ini", pszSpec="*.jpeg") returned 0 [0143.083] lstrlenA (lpString="*.jpeg") returned 6 [0143.083] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\desktop.ini", pszSpec="*.psd") returned 0 [0143.083] lstrlenA (lpString="*.psd") returned 5 [0143.083] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\desktop.ini", pszSpec="*.cdr") returned 0 [0143.083] lstrlenA (lpString="*.cdr") returned 5 [0143.083] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\desktop.ini", pszSpec="*.dwg") returned 0 [0143.083] lstrlenA (lpString="*.dwg") returned 5 [0143.083] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\desktop.ini", pszSpec="*.max") returned 0 [0143.083] lstrlenA (lpString="*.max") returned 5 [0143.083] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\desktop.ini", pszSpec="*.bmp") returned 0 [0143.083] lstrlenA (lpString="*.bmp") returned 5 [0143.083] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\desktop.ini", pszSpec="*.gif") returned 0 [0143.083] lstrlenA (lpString="*.gif") returned 5 [0143.083] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\desktop.ini", pszSpec="*.png") returned 0 [0143.083] lstrlenA (lpString="*.png") returned 5 [0143.083] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\desktop.ini", pszSpec="*.doc") returned 0 [0143.083] lstrlenA (lpString="*.doc") returned 5 [0143.083] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\desktop.ini", pszSpec="*.docx") returned 0 [0143.083] lstrlenA (lpString="*.docx") returned 6 [0143.083] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\desktop.ini", pszSpec="*.xls") returned 0 [0143.084] lstrlenA (lpString="*.xls") returned 5 [0143.084] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\desktop.ini", pszSpec="*.xlsx") returned 0 [0143.084] lstrlenA (lpString="*.xlsx") returned 6 [0143.084] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\desktop.ini", pszSpec="*.ppt") returned 0 [0143.084] lstrlenA (lpString="*.ppt") returned 5 [0143.084] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\desktop.ini", pszSpec="*.pptx") returned 0 [0143.084] lstrlenA (lpString="*.pptx") returned 6 [0143.084] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\desktop.ini", pszSpec="*.txt") returned 0 [0143.084] lstrlenA (lpString="*.txt") returned 5 [0143.084] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\desktop.ini", pszSpec="*.pdf") returned 0 [0143.084] lstrlenA (lpString="*.pdf") returned 5 [0143.084] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\desktop.ini", pszSpec="*.djvu") returned 0 [0143.084] lstrlenA (lpString="*.djvu") returned 6 [0143.084] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\desktop.ini", pszSpec="*.htm") returned 0 [0143.084] lstrlenA (lpString="*.htm") returned 5 [0143.084] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\desktop.ini", pszSpec="*.html") returned 0 [0143.084] lstrlenA (lpString="*.html") returned 6 [0143.084] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\desktop.ini", pszSpec="*.mdb") returned 0 [0143.084] lstrlenA (lpString="*.mdb") returned 5 [0143.084] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\desktop.ini", pszSpec="*.cer") returned 0 [0143.084] lstrlenA (lpString="*.cer") returned 5 [0143.084] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\desktop.ini", pszSpec="*.p12") returned 0 [0143.084] lstrlenA (lpString="*.p12") returned 5 [0143.084] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\desktop.ini", pszSpec="*.pfx") returned 0 [0143.084] lstrlenA (lpString="*.pfx") returned 5 [0143.084] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\desktop.ini", pszSpec="*.kwm") returned 0 [0143.084] lstrlenA (lpString="*.kwm") returned 5 [0143.084] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\desktop.ini", pszSpec="*.pwm") returned 0 [0143.084] lstrlenA (lpString="*.pwm") returned 5 [0143.084] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\desktop.ini", pszSpec="*.1cd") returned 0 [0143.084] lstrlenA (lpString="*.1cd") returned 5 [0143.084] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\desktop.ini", pszSpec="*.md") returned 0 [0143.084] lstrlenA (lpString="*.md") returned 4 [0143.084] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\desktop.ini", pszSpec="*.mdf") returned 0 [0143.084] lstrlenA (lpString="*.mdf") returned 5 [0143.084] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\desktop.ini", pszSpec="*.dbf") returned 0 [0143.084] lstrlenA (lpString="*.dbf") returned 5 [0143.084] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\desktop.ini", pszSpec="*.odt") returned 0 [0143.084] lstrlenA (lpString="*.odt") returned 5 [0143.084] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\desktop.ini", pszSpec="*.vob") returned 0 [0143.085] lstrlenA (lpString="*.vob") returned 5 [0143.085] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\desktop.ini", pszSpec="*.ifo") returned 0 [0143.085] lstrlenA (lpString="*.ifo") returned 5 [0143.085] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\desktop.ini", pszSpec="*.lnk") returned 0 [0143.085] lstrlenA (lpString="*.lnk") returned 5 [0143.085] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\desktop.ini", pszSpec="*.torrent") returned 0 [0143.085] lstrlenA (lpString="*.torrent") returned 9 [0143.085] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\desktop.ini", pszSpec="*.mov") returned 0 [0143.085] lstrlenA (lpString="*.mov") returned 5 [0143.085] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\desktop.ini", pszSpec="*.m2v") returned 0 [0143.085] lstrlenA (lpString="*.m2v") returned 5 [0143.085] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\desktop.ini", pszSpec="*.3gp") returned 0 [0143.085] lstrlenA (lpString="*.3gp") returned 5 [0143.085] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\desktop.ini", pszSpec="*.mpeg") returned 0 [0143.085] lstrlenA (lpString="*.mpeg") returned 6 [0143.085] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\desktop.ini", pszSpec="*.mpg") returned 0 [0143.085] lstrlenA (lpString="*.mpg") returned 5 [0143.085] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\desktop.ini", pszSpec="*.flv") returned 0 [0143.085] lstrlenA (lpString="*.flv") returned 5 [0143.085] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\desktop.ini", pszSpec="*.avi") returned 0 [0143.085] lstrlenA (lpString="*.avi") returned 5 [0143.085] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\desktop.ini", pszSpec="*.mp4") returned 0 [0143.085] lstrlenA (lpString="*.mp4") returned 5 [0143.085] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\desktop.ini", pszSpec="*.wmv") returned 0 [0143.085] lstrlenA (lpString="*.wmv") returned 5 [0143.085] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\desktop.ini", pszSpec="*.divx") returned 0 [0143.085] lstrlenA (lpString="*.divx") returned 6 [0143.085] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\desktop.ini", pszSpec="*.mkv") returned 0 [0143.085] lstrlenA (lpString="*.mkv") returned 5 [0143.085] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\desktop.ini", pszSpec="*.mp3") returned 0 [0143.085] lstrlenA (lpString="*.mp3") returned 5 [0143.085] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\desktop.ini", pszSpec="*.wav") returned 0 [0143.085] lstrlenA (lpString="*.wav") returned 5 [0143.085] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\desktop.ini", pszSpec="*.flac") returned 0 [0143.085] lstrlenA (lpString="*.flac") returned 6 [0143.085] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\desktop.ini", pszSpec="*.ape") returned 0 [0143.085] lstrlenA (lpString="*.ape") returned 5 [0143.085] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\desktop.ini", pszSpec="*.wma") returned 0 [0143.085] lstrlenA (lpString="*.wma") returned 5 [0143.085] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\desktop.ini", pszSpec="*.ac3") returned 0 [0143.085] lstrlenA (lpString="*.ac3") returned 5 [0143.086] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0143.086] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0143.086] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="index.dat") returned -1 [0143.086] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="index.dat") returned -1 [0143.086] lstrcmpiA (lpString1="", lpString2="index.dat") returned -1 [0143.086] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\desktop.ini") returned="desktop.ini" [0143.086] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\", lpString2="index.dat" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\index.dat") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\index.dat" [0143.086] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\index.dat", pszSpec="*.zip") returned 0 [0143.086] lstrlenA (lpString="*.zip") returned 5 [0143.086] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\index.dat", pszSpec="*.rar") returned 0 [0143.086] lstrlenA (lpString="*.rar") returned 5 [0143.086] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\index.dat", pszSpec="*.7z") returned 0 [0143.086] lstrlenA (lpString="*.7z") returned 4 [0143.086] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\index.dat", pszSpec="*.tar") returned 0 [0143.086] lstrlenA (lpString="*.tar") returned 5 [0143.086] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\index.dat", pszSpec="*.gzip") returned 0 [0143.086] lstrlenA (lpString="*.gzip") returned 6 [0143.086] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\index.dat", pszSpec="*.jpg") returned 0 [0143.086] lstrlenA (lpString="*.jpg") returned 5 [0143.086] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\index.dat", pszSpec="*.jpeg") returned 0 [0143.086] lstrlenA (lpString="*.jpeg") returned 6 [0143.086] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\index.dat", pszSpec="*.psd") returned 0 [0143.086] lstrlenA (lpString="*.psd") returned 5 [0143.086] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\index.dat", pszSpec="*.cdr") returned 0 [0143.086] lstrlenA (lpString="*.cdr") returned 5 [0143.086] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\index.dat", pszSpec="*.dwg") returned 0 [0143.086] lstrlenA (lpString="*.dwg") returned 5 [0143.086] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\index.dat", pszSpec="*.max") returned 0 [0143.086] lstrlenA (lpString="*.max") returned 5 [0143.086] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\index.dat", pszSpec="*.bmp") returned 0 [0143.086] lstrlenA (lpString="*.bmp") returned 5 [0143.086] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\index.dat", pszSpec="*.gif") returned 0 [0143.086] lstrlenA (lpString="*.gif") returned 5 [0143.086] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\index.dat", pszSpec="*.png") returned 0 [0143.086] lstrlenA (lpString="*.png") returned 5 [0143.086] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\index.dat", pszSpec="*.doc") returned 0 [0143.086] lstrlenA (lpString="*.doc") returned 5 [0143.086] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\index.dat", pszSpec="*.docx") returned 0 [0143.086] lstrlenA (lpString="*.docx") returned 6 [0143.086] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\index.dat", pszSpec="*.xls") returned 0 [0143.086] lstrlenA (lpString="*.xls") returned 5 [0143.086] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\index.dat", pszSpec="*.xlsx") returned 0 [0143.087] lstrlenA (lpString="*.xlsx") returned 6 [0143.087] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\index.dat", pszSpec="*.ppt") returned 0 [0143.087] lstrlenA (lpString="*.ppt") returned 5 [0143.087] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\index.dat", pszSpec="*.pptx") returned 0 [0143.087] lstrlenA (lpString="*.pptx") returned 6 [0143.087] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\index.dat", pszSpec="*.txt") returned 0 [0143.087] lstrlenA (lpString="*.txt") returned 5 [0143.087] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\index.dat", pszSpec="*.pdf") returned 0 [0143.087] lstrlenA (lpString="*.pdf") returned 5 [0143.087] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\index.dat", pszSpec="*.djvu") returned 0 [0143.087] lstrlenA (lpString="*.djvu") returned 6 [0143.087] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\index.dat", pszSpec="*.htm") returned 0 [0143.087] lstrlenA (lpString="*.htm") returned 5 [0143.087] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\index.dat", pszSpec="*.html") returned 0 [0143.087] lstrlenA (lpString="*.html") returned 6 [0143.087] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\index.dat", pszSpec="*.mdb") returned 0 [0143.087] lstrlenA (lpString="*.mdb") returned 5 [0143.087] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\index.dat", pszSpec="*.cer") returned 0 [0143.087] lstrlenA (lpString="*.cer") returned 5 [0143.087] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\index.dat", pszSpec="*.p12") returned 0 [0143.087] lstrlenA (lpString="*.p12") returned 5 [0143.087] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\index.dat", pszSpec="*.pfx") returned 0 [0143.087] lstrlenA (lpString="*.pfx") returned 5 [0143.087] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\index.dat", pszSpec="*.kwm") returned 0 [0143.087] lstrlenA (lpString="*.kwm") returned 5 [0143.087] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\index.dat", pszSpec="*.pwm") returned 0 [0143.087] lstrlenA (lpString="*.pwm") returned 5 [0143.087] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\index.dat", pszSpec="*.1cd") returned 0 [0143.087] lstrlenA (lpString="*.1cd") returned 5 [0143.087] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\index.dat", pszSpec="*.md") returned 0 [0143.087] lstrlenA (lpString="*.md") returned 4 [0143.087] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\index.dat", pszSpec="*.mdf") returned 0 [0143.087] lstrlenA (lpString="*.mdf") returned 5 [0143.087] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\index.dat", pszSpec="*.dbf") returned 0 [0143.087] lstrlenA (lpString="*.dbf") returned 5 [0143.087] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\index.dat", pszSpec="*.odt") returned 0 [0143.087] lstrlenA (lpString="*.odt") returned 5 [0143.087] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\index.dat", pszSpec="*.vob") returned 0 [0143.087] lstrlenA (lpString="*.vob") returned 5 [0143.087] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\index.dat", pszSpec="*.ifo") returned 0 [0143.087] lstrlenA (lpString="*.ifo") returned 5 [0143.087] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\index.dat", pszSpec="*.lnk") returned 0 [0143.087] lstrlenA (lpString="*.lnk") returned 5 [0143.088] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\index.dat", pszSpec="*.torrent") returned 0 [0143.088] lstrlenA (lpString="*.torrent") returned 9 [0143.088] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\index.dat", pszSpec="*.mov") returned 0 [0143.088] lstrlenA (lpString="*.mov") returned 5 [0143.088] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\index.dat", pszSpec="*.m2v") returned 0 [0143.088] lstrlenA (lpString="*.m2v") returned 5 [0143.088] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\index.dat", pszSpec="*.3gp") returned 0 [0143.088] lstrlenA (lpString="*.3gp") returned 5 [0143.088] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\index.dat", pszSpec="*.mpeg") returned 0 [0143.088] lstrlenA (lpString="*.mpeg") returned 6 [0143.088] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\index.dat", pszSpec="*.mpg") returned 0 [0143.088] lstrlenA (lpString="*.mpg") returned 5 [0143.088] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\index.dat", pszSpec="*.flv") returned 0 [0143.088] lstrlenA (lpString="*.flv") returned 5 [0143.088] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\index.dat", pszSpec="*.avi") returned 0 [0143.088] lstrlenA (lpString="*.avi") returned 5 [0143.088] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\index.dat", pszSpec="*.mp4") returned 0 [0143.088] lstrlenA (lpString="*.mp4") returned 5 [0143.088] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\index.dat", pszSpec="*.wmv") returned 0 [0143.088] lstrlenA (lpString="*.wmv") returned 5 [0143.088] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\index.dat", pszSpec="*.divx") returned 0 [0143.088] lstrlenA (lpString="*.divx") returned 6 [0143.088] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\index.dat", pszSpec="*.mkv") returned 0 [0143.088] lstrlenA (lpString="*.mkv") returned 5 [0143.088] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\index.dat", pszSpec="*.mp3") returned 0 [0143.088] lstrlenA (lpString="*.mp3") returned 5 [0143.088] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\index.dat", pszSpec="*.wav") returned 0 [0143.088] lstrlenA (lpString="*.wav") returned 5 [0143.088] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\index.dat", pszSpec="*.flac") returned 0 [0143.088] lstrlenA (lpString="*.flac") returned 6 [0143.088] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\index.dat", pszSpec="*.ape") returned 0 [0143.088] lstrlenA (lpString="*.ape") returned 5 [0143.088] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\index.dat", pszSpec="*.wma") returned 0 [0143.088] lstrlenA (lpString="*.wma") returned 5 [0143.088] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\index.dat", pszSpec="*.ac3") returned 0 [0143.088] lstrlenA (lpString="*.ac3") returned 5 [0143.088] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0143.088] lstrcmpA (lpString1=".", lpString2="KETAJP6D") returned -1 [0143.088] lstrcmpA (lpString1="..", lpString2="KETAJP6D") returned -1 [0143.088] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\index.dat") returned="index.dat" [0143.088] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\", lpString2="KETAJP6D" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D" [0143.088] lstrlenA (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D") returned 94 [0143.089] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D\\*.*", lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 0x5be320 [0143.089] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0143.089] FindNextFileA (in: hFindFile=0x5be320, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0143.089] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0143.089] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0143.089] FindNextFileA (in: hFindFile=0x5be320, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0143.089] PeekMessageA (in: lpMsg=0xaece4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaece4) returned 0 [0143.089] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="desktop.ini") returned 1 [0143.089] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="desktop.ini") returned 1 [0143.089] lstrcmpiA (lpString1="", lpString2="desktop.ini") returned -1 [0143.089] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D\\*.*") returned="*.*" [0143.089] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D\\", lpString2="desktop.ini" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D\\desktop.ini") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D\\desktop.ini" [0143.089] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D\\desktop.ini", pszSpec="*.zip") returned 0 [0143.089] lstrlenA (lpString="*.zip") returned 5 [0143.089] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D\\desktop.ini", pszSpec="*.rar") returned 0 [0143.089] lstrlenA (lpString="*.rar") returned 5 [0143.089] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D\\desktop.ini", pszSpec="*.7z") returned 0 [0143.089] lstrlenA (lpString="*.7z") returned 4 [0143.089] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D\\desktop.ini", pszSpec="*.tar") returned 0 [0143.089] lstrlenA (lpString="*.tar") returned 5 [0143.089] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D\\desktop.ini", pszSpec="*.gzip") returned 0 [0143.089] lstrlenA (lpString="*.gzip") returned 6 [0143.089] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D\\desktop.ini", pszSpec="*.jpg") returned 0 [0143.089] lstrlenA (lpString="*.jpg") returned 5 [0143.089] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D\\desktop.ini", pszSpec="*.jpeg") returned 0 [0143.089] lstrlenA (lpString="*.jpeg") returned 6 [0143.089] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D\\desktop.ini", pszSpec="*.psd") returned 0 [0143.089] lstrlenA (lpString="*.psd") returned 5 [0143.089] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D\\desktop.ini", pszSpec="*.cdr") returned 0 [0143.089] lstrlenA (lpString="*.cdr") returned 5 [0143.089] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D\\desktop.ini", pszSpec="*.dwg") returned 0 [0143.090] lstrlenA (lpString="*.dwg") returned 5 [0143.090] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D\\desktop.ini", pszSpec="*.max") returned 0 [0143.090] lstrlenA (lpString="*.max") returned 5 [0143.090] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D\\desktop.ini", pszSpec="*.bmp") returned 0 [0143.090] lstrlenA (lpString="*.bmp") returned 5 [0143.090] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D\\desktop.ini", pszSpec="*.gif") returned 0 [0143.090] lstrlenA (lpString="*.gif") returned 5 [0143.090] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D\\desktop.ini", pszSpec="*.png") returned 0 [0143.090] lstrlenA (lpString="*.png") returned 5 [0143.090] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D\\desktop.ini", pszSpec="*.doc") returned 0 [0143.090] lstrlenA (lpString="*.doc") returned 5 [0143.090] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D\\desktop.ini", pszSpec="*.docx") returned 0 [0143.090] lstrlenA (lpString="*.docx") returned 6 [0143.090] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D\\desktop.ini", pszSpec="*.xls") returned 0 [0143.090] lstrlenA (lpString="*.xls") returned 5 [0143.090] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D\\desktop.ini", pszSpec="*.xlsx") returned 0 [0143.090] lstrlenA (lpString="*.xlsx") returned 6 [0143.090] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D\\desktop.ini", pszSpec="*.ppt") returned 0 [0143.090] lstrlenA (lpString="*.ppt") returned 5 [0143.090] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D\\desktop.ini", pszSpec="*.pptx") returned 0 [0143.090] lstrlenA (lpString="*.pptx") returned 6 [0143.090] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D\\desktop.ini", pszSpec="*.txt") returned 0 [0143.090] lstrlenA (lpString="*.txt") returned 5 [0143.090] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D\\desktop.ini", pszSpec="*.pdf") returned 0 [0143.090] lstrlenA (lpString="*.pdf") returned 5 [0143.090] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D\\desktop.ini", pszSpec="*.djvu") returned 0 [0143.090] lstrlenA (lpString="*.djvu") returned 6 [0143.090] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D\\desktop.ini", pszSpec="*.htm") returned 0 [0143.090] lstrlenA (lpString="*.htm") returned 5 [0143.090] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D\\desktop.ini", pszSpec="*.html") returned 0 [0143.090] lstrlenA (lpString="*.html") returned 6 [0143.090] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D\\desktop.ini", pszSpec="*.mdb") returned 0 [0143.090] lstrlenA (lpString="*.mdb") returned 5 [0143.090] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D\\desktop.ini", pszSpec="*.cer") returned 0 [0143.090] lstrlenA (lpString="*.cer") returned 5 [0143.090] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D\\desktop.ini", pszSpec="*.p12") returned 0 [0143.090] lstrlenA (lpString="*.p12") returned 5 [0143.090] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D\\desktop.ini", pszSpec="*.pfx") returned 0 [0143.091] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D\\desktop.ini", pszSpec="*.kwm") returned 0 [0143.091] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D\\desktop.ini", pszSpec="*.pwm") returned 0 [0143.091] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D\\desktop.ini", pszSpec="*.1cd") returned 0 [0143.091] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D\\desktop.ini", pszSpec="*.md") returned 0 [0143.091] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D\\desktop.ini", pszSpec="*.mdf") returned 0 [0143.091] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D\\desktop.ini", pszSpec="*.dbf") returned 0 [0143.091] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D\\desktop.ini", pszSpec="*.odt") returned 0 [0143.091] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D\\desktop.ini", pszSpec="*.vob") returned 0 [0143.091] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D\\desktop.ini", pszSpec="*.ifo") returned 0 [0143.091] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D\\desktop.ini", pszSpec="*.lnk") returned 0 [0143.091] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D\\desktop.ini", pszSpec="*.torrent") returned 0 [0143.091] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D\\desktop.ini", pszSpec="*.mov") returned 0 [0143.091] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D\\desktop.ini", pszSpec="*.m2v") returned 0 [0143.091] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D\\desktop.ini", pszSpec="*.3gp") returned 0 [0143.091] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D\\desktop.ini", pszSpec="*.mpeg") returned 0 [0143.091] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D\\desktop.ini", pszSpec="*.mpg") returned 0 [0143.091] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D\\desktop.ini", pszSpec="*.flv") returned 0 [0143.091] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D\\desktop.ini", pszSpec="*.avi") returned 0 [0143.091] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D\\desktop.ini", pszSpec="*.mp4") returned 0 [0143.091] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D\\desktop.ini", pszSpec="*.wmv") returned 0 [0143.091] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D\\desktop.ini", pszSpec="*.divx") returned 0 [0143.091] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D\\desktop.ini", pszSpec="*.mkv") returned 0 [0143.092] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D\\desktop.ini", pszSpec="*.mp3") returned 0 [0143.092] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D\\desktop.ini", pszSpec="*.wav") returned 0 [0143.092] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D\\desktop.ini", pszSpec="*.flac") returned 0 [0143.092] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D\\desktop.ini", pszSpec="*.ape") returned 0 [0143.092] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D\\desktop.ini", pszSpec="*.wma") returned 0 [0143.092] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D\\desktop.ini", pszSpec="*.ac3") returned 0 [0143.092] FindNextFileA (in: hFindFile=0x5be320, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 0 [0143.092] FindClose (in: hFindFile=0x5be320 | out: hFindFile=0x5be320) returned 1 [0143.092] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0143.092] lstrcmpA (lpString1=".", lpString2="VB18B0KB") returned -1 [0143.092] lstrcmpA (lpString1="..", lpString2="VB18B0KB") returned -1 [0143.092] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\*.*") returned="*.*" [0143.092] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\", lpString2="VB18B0KB" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\VB18B0KB") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\VB18B0KB" [0143.092] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\VB18B0KB\\*.*", lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 0x5be320 [0143.092] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0143.092] FindNextFileA (in: hFindFile=0x5be320, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0143.092] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0143.092] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0143.092] FindNextFileA (in: hFindFile=0x5be320, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0143.092] PeekMessageA (in: lpMsg=0xaece4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaece4) returned 0 [0143.092] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="desktop.ini") returned 1 [0143.092] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="desktop.ini") returned 1 [0143.092] lstrcmpiA (lpString1="", lpString2="desktop.ini") returned -1 [0143.092] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\VB18B0KB\\*.*") returned="*.*" [0143.092] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\VB18B0KB\\", lpString2="desktop.ini" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\VB18B0KB\\desktop.ini") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\VB18B0KB\\desktop.ini" [0143.093] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\VB18B0KB\\desktop.ini", pszSpec="*.zip") returned 0 [0143.093] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\VB18B0KB\\desktop.ini", pszSpec="*.rar") returned 0 [0143.093] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\VB18B0KB\\desktop.ini", pszSpec="*.7z") returned 0 [0143.093] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\VB18B0KB\\desktop.ini", pszSpec="*.tar") returned 0 [0143.093] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\VB18B0KB\\desktop.ini", pszSpec="*.gzip") returned 0 [0143.093] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\VB18B0KB\\desktop.ini", pszSpec="*.jpg") returned 0 [0143.093] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\VB18B0KB\\desktop.ini", pszSpec="*.jpeg") returned 0 [0143.093] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\VB18B0KB\\desktop.ini", pszSpec="*.psd") returned 0 [0143.093] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\VB18B0KB\\desktop.ini", pszSpec="*.cdr") returned 0 [0143.093] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\VB18B0KB\\desktop.ini", pszSpec="*.dwg") returned 0 [0143.093] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\VB18B0KB\\desktop.ini", pszSpec="*.max") returned 0 [0143.093] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\VB18B0KB\\desktop.ini", pszSpec="*.bmp") returned 0 [0143.093] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\VB18B0KB\\desktop.ini", pszSpec="*.gif") returned 0 [0143.093] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\VB18B0KB\\desktop.ini", pszSpec="*.png") returned 0 [0143.093] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\VB18B0KB\\desktop.ini", pszSpec="*.doc") returned 0 [0143.093] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\VB18B0KB\\desktop.ini", pszSpec="*.docx") returned 0 [0143.093] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\VB18B0KB\\desktop.ini", pszSpec="*.xls") returned 0 [0143.093] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\VB18B0KB\\desktop.ini", pszSpec="*.xlsx") returned 0 [0143.093] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\VB18B0KB\\desktop.ini", pszSpec="*.ppt") returned 0 [0143.093] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\VB18B0KB\\desktop.ini", pszSpec="*.pptx") returned 0 [0143.093] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\VB18B0KB\\desktop.ini", pszSpec="*.txt") returned 0 [0143.094] FindNextFileA (in: hFindFile=0x5be320, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 0 [0143.094] FindClose (in: hFindFile=0x5be320 | out: hFindFile=0x5be320) returned 1 [0143.094] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0143.094] lstrcmpA (lpString1=".", lpString2="XT1RPYG9") returned -1 [0143.094] lstrcmpA (lpString1="..", lpString2="XT1RPYG9") returned -1 [0143.094] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\*.*") returned="*.*" [0143.094] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\", lpString2="XT1RPYG9" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\XT1RPYG9") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\XT1RPYG9" [0143.094] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\XT1RPYG9\\*.*", lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 0x5be320 [0143.095] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0143.095] FindNextFileA (in: hFindFile=0x5be320, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0143.095] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0143.095] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0143.095] FindNextFileA (in: hFindFile=0x5be320, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0143.095] PeekMessageA (in: lpMsg=0xaece4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaece4) returned 0 [0143.095] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="desktop.ini") returned 1 [0143.095] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="desktop.ini") returned 1 [0143.095] lstrcmpiA (lpString1="", lpString2="desktop.ini") returned -1 [0143.095] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\XT1RPYG9\\*.*") returned="*.*" [0143.095] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\XT1RPYG9\\", lpString2="desktop.ini" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\XT1RPYG9\\desktop.ini") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\XT1RPYG9\\desktop.ini" [0143.095] FindNextFileA (in: hFindFile=0x5be320, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 0 [0143.095] FindClose (in: hFindFile=0x5be320 | out: hFindFile=0x5be320) returned 1 [0143.095] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 0 [0143.095] FindClose (in: hFindFile=0x5be2e0 | out: hFindFile=0x5be2e0) returned 1 [0143.095] FindNextFileA (in: hFindFile=0x5be2a0, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0 [0143.095] FindClose (in: hFindFile=0x5be2a0 | out: hFindFile=0x5be2a0) returned 1 [0143.095] FindNextFileA (in: hFindFile=0x5be260, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0143.095] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0143.095] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="UKmtJmWpSNXRA.m4a") returned -1 [0143.095] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="UKmtJmWpSNXRA.m4a") returned -1 [0143.095] lstrcmpiA (lpString1="", lpString2="UKmtJmWpSNXRA.m4a") returned -1 [0143.095] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\*.*") returned="*.*" [0143.095] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\", lpString2="UKmtJmWpSNXRA.m4a" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\UKmtJmWpSNXRA.m4a") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\UKmtJmWpSNXRA.m4a" [0143.095] FindNextFileA (in: hFindFile=0x5be260, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0143.095] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0143.095] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="V7XN-CwXjvlEbQ5oJ.bmp") returned -1 [0143.095] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="V7XN-CwXjvlEbQ5oJ.bmp") returned -1 [0143.096] lstrcmpiA (lpString1="", lpString2="V7XN-CwXjvlEbQ5oJ.bmp") returned -1 [0143.096] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\UKmtJmWpSNXRA.m4a") returned="UKmtJmWpSNXRA.m4a" [0143.096] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\", lpString2="V7XN-CwXjvlEbQ5oJ.bmp" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\V7XN-CwXjvlEbQ5oJ.bmp") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\V7XN-CwXjvlEbQ5oJ.bmp" [0143.096] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\V7XN-CwXjvlEbQ5oJ.bmp" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\V7XN-CwXjvlEbQ5oJ.bmp") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\V7XN-CwXjvlEbQ5oJ.bmp" [0143.096] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\V7XN-CwXjvlEbQ5oJ.bmp" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\V7XN-CwXjvlEbQ5oJ.bmp") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\V7XN-CwXjvlEbQ5oJ.bmp" [0143.096] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\V7XN-CwXjvlEbQ5oJ.bmp", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\V7XN-CwXjvlEbQ5oJ.bmp.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\V7XN-CwXjvlEbQ5oJ.bmp." [0143.096] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\V7XN-CwXjvlEbQ5oJ.bmp.", lpString2="\xa0" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\V7XN-CwXjvlEbQ5oJ.bmp. ") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\V7XN-CwXjvlEbQ5oJ.bmp. " [0143.096] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\V7XN-CwXjvlEbQ5oJ.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\v7xn-cwxjvlebq5oj.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0143.096] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xfaa [0143.096] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xa6eb6960, dwHighDateTime=0x1d4ada2), lpLastAccessTime=0x407536*(dwLowDateTime=0xe45ee830, dwHighDateTime=0x1d4a906), lpLastWriteTime=0x40753e*(dwLowDateTime=0xe45ee830, dwHighDateTime=0x1d4a906)) returned 1 [0143.096] SetFilePointer (in: hFile=0x90, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0143.096] ReadFile (in: hFile=0x90, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0xf50, lpOverlapped=0x0) returned 1 [0143.097] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\V7XN-CwXjvlEbQ5oJ.bmp") returned="V7XN-CwXjvlEbQ5oJ.bmp" [0143.097] SetFilePointer (in: hFile=0x90, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0143.097] WriteFile (in: hFile=0x90, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0xf50, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0xf50, lpOverlapped=0x0) returned 1 [0143.097] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0143.097] CloseHandle (hObject=0x90) returned 1 [0143.097] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\V7XN-CwXjvlEbQ5oJ.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\v7xn-cwxjvlebq5oj.bmp"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\V7XN-CwXjvlEbQ5oJ.bmp. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\v7xn-cwxjvlebq5oj.bmp. ")) returned 1 [0143.098] FindNextFileA (in: hFindFile=0x5be260, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0143.098] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0143.098] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="vj8h.wav") returned -1 [0143.098] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="vj8h.wav") returned -1 [0143.098] lstrcmpiA (lpString1="", lpString2="vj8h.wav") returned -1 [0143.098] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\V7XN-CwXjvlEbQ5oJ.bmp") returned="V7XN-CwXjvlEbQ5oJ.bmp" [0143.099] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\", lpString2="vj8h.wav" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\vj8h.wav") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\vj8h.wav" [0143.099] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\vj8h.wav", pszSpec="*.zip") returned 0 [0143.099] lstrlenA (lpString="*.zip") returned 5 [0143.099] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\vj8h.wav", pszSpec="*.rar") returned 0 [0143.099] lstrlenA (lpString="*.rar") returned 5 [0143.099] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\vj8h.wav", pszSpec="*.7z") returned 0 [0143.099] lstrlenA (lpString="*.7z") returned 4 [0143.099] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\vj8h.wav", pszSpec="*.tar") returned 0 [0143.099] lstrlenA (lpString="*.tar") returned 5 [0143.099] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\vj8h.wav", pszSpec="*.gzip") returned 0 [0143.099] lstrlenA (lpString="*.gzip") returned 6 [0143.099] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\vj8h.wav", pszSpec="*.jpg") returned 0 [0143.099] lstrlenA (lpString="*.jpg") returned 5 [0143.099] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\vj8h.wav", pszSpec="*.jpeg") returned 0 [0143.099] lstrlenA (lpString="*.jpeg") returned 6 [0143.099] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\vj8h.wav", pszSpec="*.psd") returned 0 [0143.099] lstrlenA (lpString="*.psd") returned 5 [0143.099] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\vj8h.wav", pszSpec="*.cdr") returned 0 [0143.099] lstrlenA (lpString="*.cdr") returned 5 [0143.099] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\vj8h.wav", pszSpec="*.dwg") returned 0 [0143.099] lstrlenA (lpString="*.dwg") returned 5 [0143.099] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\vj8h.wav", pszSpec="*.max") returned 0 [0143.099] lstrlenA (lpString="*.max") returned 5 [0143.099] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\vj8h.wav", pszSpec="*.bmp") returned 0 [0143.099] lstrlenA (lpString="*.bmp") returned 5 [0143.099] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\vj8h.wav", pszSpec="*.gif") returned 0 [0143.099] lstrlenA (lpString="*.gif") returned 5 [0143.099] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\vj8h.wav", pszSpec="*.png") returned 0 [0143.099] lstrlenA (lpString="*.png") returned 5 [0143.099] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\vj8h.wav", pszSpec="*.doc") returned 0 [0143.099] lstrlenA (lpString="*.doc") returned 5 [0143.099] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\vj8h.wav", pszSpec="*.docx") returned 0 [0143.099] lstrlenA (lpString="*.docx") returned 6 [0143.099] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\vj8h.wav", pszSpec="*.xls") returned 0 [0143.099] lstrlenA (lpString="*.xls") returned 5 [0143.099] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\vj8h.wav", pszSpec="*.xlsx") returned 0 [0143.099] lstrlenA (lpString="*.xlsx") returned 6 [0143.099] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\vj8h.wav", pszSpec="*.ppt") returned 0 [0143.099] lstrlenA (lpString="*.ppt") returned 5 [0143.099] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\vj8h.wav", pszSpec="*.pptx") returned 0 [0143.100] lstrlenA (lpString="*.pptx") returned 6 [0143.100] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\vj8h.wav", pszSpec="*.txt") returned 0 [0143.100] lstrlenA (lpString="*.txt") returned 5 [0143.100] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\vj8h.wav", pszSpec="*.pdf") returned 0 [0143.100] lstrlenA (lpString="*.pdf") returned 5 [0143.100] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\vj8h.wav", pszSpec="*.djvu") returned 0 [0143.100] lstrlenA (lpString="*.djvu") returned 6 [0143.100] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\vj8h.wav", pszSpec="*.htm") returned 0 [0143.100] lstrlenA (lpString="*.htm") returned 5 [0143.100] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\vj8h.wav", pszSpec="*.html") returned 0 [0143.100] lstrlenA (lpString="*.html") returned 6 [0143.100] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\vj8h.wav", pszSpec="*.mdb") returned 0 [0143.100] lstrlenA (lpString="*.mdb") returned 5 [0143.100] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\vj8h.wav", pszSpec="*.cer") returned 0 [0143.100] lstrlenA (lpString="*.cer") returned 5 [0143.100] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\vj8h.wav", pszSpec="*.p12") returned 0 [0143.100] lstrlenA (lpString="*.p12") returned 5 [0143.100] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\vj8h.wav", pszSpec="*.pfx") returned 0 [0143.100] lstrlenA (lpString="*.pfx") returned 5 [0143.100] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\vj8h.wav", pszSpec="*.kwm") returned 0 [0143.100] lstrlenA (lpString="*.kwm") returned 5 [0143.100] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\vj8h.wav", pszSpec="*.pwm") returned 0 [0143.100] lstrlenA (lpString="*.pwm") returned 5 [0143.100] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\vj8h.wav", pszSpec="*.1cd") returned 0 [0143.100] lstrlenA (lpString="*.1cd") returned 5 [0143.100] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\vj8h.wav", pszSpec="*.md") returned 0 [0143.100] lstrlenA (lpString="*.md") returned 4 [0143.100] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\vj8h.wav", pszSpec="*.mdf") returned 0 [0143.100] lstrlenA (lpString="*.mdf") returned 5 [0143.100] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\vj8h.wav", pszSpec="*.dbf") returned 0 [0143.100] lstrlenA (lpString="*.dbf") returned 5 [0143.100] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\vj8h.wav", pszSpec="*.odt") returned 0 [0143.100] lstrlenA (lpString="*.odt") returned 5 [0143.100] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\vj8h.wav", pszSpec="*.vob") returned 0 [0143.100] lstrlenA (lpString="*.vob") returned 5 [0143.100] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\vj8h.wav", pszSpec="*.ifo") returned 0 [0143.100] lstrlenA (lpString="*.ifo") returned 5 [0143.100] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\vj8h.wav", pszSpec="*.lnk") returned 0 [0143.100] lstrlenA (lpString="*.lnk") returned 5 [0143.100] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\vj8h.wav", pszSpec="*.torrent") returned 0 [0143.101] lstrlenA (lpString="*.torrent") returned 9 [0143.101] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\vj8h.wav", pszSpec="*.mov") returned 0 [0143.101] lstrlenA (lpString="*.mov") returned 5 [0143.101] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\vj8h.wav", pszSpec="*.m2v") returned 0 [0143.101] lstrlenA (lpString="*.m2v") returned 5 [0143.101] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\vj8h.wav", pszSpec="*.3gp") returned 0 [0143.101] lstrlenA (lpString="*.3gp") returned 5 [0143.101] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\vj8h.wav", pszSpec="*.mpeg") returned 0 [0143.101] lstrlenA (lpString="*.mpeg") returned 6 [0143.101] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\vj8h.wav", pszSpec="*.mpg") returned 0 [0143.101] lstrlenA (lpString="*.mpg") returned 5 [0143.101] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\vj8h.wav", pszSpec="*.flv") returned 0 [0143.101] lstrlenA (lpString="*.flv") returned 5 [0143.101] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\vj8h.wav", pszSpec="*.avi") returned 0 [0143.101] lstrlenA (lpString="*.avi") returned 5 [0143.101] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\vj8h.wav", pszSpec="*.mp4") returned 0 [0143.101] lstrlenA (lpString="*.mp4") returned 5 [0143.101] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\vj8h.wav", pszSpec="*.wmv") returned 0 [0143.101] lstrlenA (lpString="*.wmv") returned 5 [0143.101] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\vj8h.wav", pszSpec="*.divx") returned 0 [0143.101] lstrlenA (lpString="*.divx") returned 6 [0143.101] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\vj8h.wav", pszSpec="*.mkv") returned 0 [0143.101] lstrlenA (lpString="*.mkv") returned 5 [0143.101] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\vj8h.wav", pszSpec="*.mp3") returned 0 [0143.101] lstrlenA (lpString="*.mp3") returned 5 [0143.101] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\vj8h.wav", pszSpec="*.wav") returned 1 [0143.101] lstrlenA (lpString="*.wav") returned 5 [0143.101] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\vj8h.wav" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\vj8h.wav") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\vj8h.wav" [0143.101] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\vj8h.wav" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\vj8h.wav") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\vj8h.wav" [0143.101] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\vj8h.wav", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\vj8h.wav.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\vj8h.wav." [0143.101] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\vj8h.wav.", lpString2="\xa0" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\vj8h.wav. ") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\vj8h.wav. " [0143.101] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\vj8h.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\vj8h.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0143.102] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1335a [0143.102] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x89e7ebd0, dwHighDateTime=0x1d4ab78), lpLastAccessTime=0x407536*(dwLowDateTime=0x3c6d57f0, dwHighDateTime=0x1d4a443), lpLastWriteTime=0x40753e*(dwLowDateTime=0x3c6d57f0, dwHighDateTime=0x1d4a443)) returned 1 [0143.102] SetFilePointer (in: hFile=0x90, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0143.102] ReadFile (in: hFile=0x90, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x13300, lpOverlapped=0x0) returned 1 [0143.103] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\vj8h.wav") returned="vj8h.wav" [0143.103] SetFilePointer (in: hFile=0x90, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0143.103] WriteFile (in: hFile=0x90, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x13300, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x13300, lpOverlapped=0x0) returned 1 [0143.103] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0143.103] CloseHandle (hObject=0x90) returned 1 [0143.104] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\vj8h.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\vj8h.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\vj8h.wav. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\vj8h.wav. ")) returned 1 [0143.105] FindNextFileA (in: hFindFile=0x5be260, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0143.105] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0143.105] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="VuaPTxB.bmp") returned -1 [0143.105] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="VuaPTxB.bmp") returned -1 [0143.105] lstrcmpiA (lpString1="", lpString2="VuaPTxB.bmp") returned -1 [0143.105] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\vj8h.wav") returned="vj8h.wav" [0143.105] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\", lpString2="VuaPTxB.bmp" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\VuaPTxB.bmp") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\VuaPTxB.bmp" [0143.105] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\VuaPTxB.bmp", pszSpec="*.zip") returned 0 [0143.105] lstrlenA (lpString="*.zip") returned 5 [0143.105] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\VuaPTxB.bmp", pszSpec="*.rar") returned 0 [0143.105] lstrlenA (lpString="*.rar") returned 5 [0143.105] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\VuaPTxB.bmp", pszSpec="*.7z") returned 0 [0143.105] lstrlenA (lpString="*.7z") returned 4 [0143.105] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\VuaPTxB.bmp", pszSpec="*.tar") returned 0 [0143.105] lstrlenA (lpString="*.tar") returned 5 [0143.105] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\VuaPTxB.bmp", pszSpec="*.gzip") returned 0 [0143.105] lstrlenA (lpString="*.gzip") returned 6 [0143.105] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\VuaPTxB.bmp", pszSpec="*.jpg") returned 0 [0143.105] lstrlenA (lpString="*.jpg") returned 5 [0143.105] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\VuaPTxB.bmp", pszSpec="*.jpeg") returned 0 [0143.105] lstrlenA (lpString="*.jpeg") returned 6 [0143.105] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\VuaPTxB.bmp", pszSpec="*.psd") returned 0 [0143.105] lstrlenA (lpString="*.psd") returned 5 [0143.105] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\VuaPTxB.bmp", pszSpec="*.cdr") returned 0 [0143.105] lstrlenA (lpString="*.cdr") returned 5 [0143.105] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\VuaPTxB.bmp", pszSpec="*.dwg") returned 0 [0143.105] lstrlenA (lpString="*.dwg") returned 5 [0143.105] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\VuaPTxB.bmp", pszSpec="*.max") returned 0 [0143.105] lstrlenA (lpString="*.max") returned 5 [0143.105] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\VuaPTxB.bmp", pszSpec="*.bmp") returned 1 [0143.105] lstrlenA (lpString="*.bmp") returned 5 [0143.105] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\VuaPTxB.bmp" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\VuaPTxB.bmp") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\VuaPTxB.bmp" [0143.105] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\VuaPTxB.bmp" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\VuaPTxB.bmp") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\VuaPTxB.bmp" [0143.105] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\VuaPTxB.bmp", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\VuaPTxB.bmp.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\VuaPTxB.bmp." [0143.105] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\VuaPTxB.bmp.", lpString2="\xa0" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\VuaPTxB.bmp. ") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\VuaPTxB.bmp. " [0143.105] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\VuaPTxB.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\vuaptxb.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0143.106] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x12ca4 [0143.106] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x45fa5d0, dwHighDateTime=0x1d4aaa5), lpLastAccessTime=0x407536*(dwLowDateTime=0xd7ac5f70, dwHighDateTime=0x1d4a9e5), lpLastWriteTime=0x40753e*(dwLowDateTime=0xd7ac5f70, dwHighDateTime=0x1d4a9e5)) returned 1 [0143.106] SetFilePointer (in: hFile=0x90, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0143.106] ReadFile (in: hFile=0x90, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x12c4a, lpOverlapped=0x0) returned 1 [0143.107] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\VuaPTxB.bmp") returned="VuaPTxB.bmp" [0143.107] SetFilePointer (in: hFile=0x90, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0143.107] WriteFile (in: hFile=0x90, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x12c4a, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x12c4a, lpOverlapped=0x0) returned 1 [0143.107] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0143.107] CloseHandle (hObject=0x90) returned 1 [0143.108] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\VuaPTxB.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\vuaptxb.bmp"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\VuaPTxB.bmp. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\vuaptxb.bmp. ")) returned 1 [0143.108] FindNextFileA (in: hFindFile=0x5be260, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0143.109] lstrcmpA (lpString1=".", lpString2="WPDNSE") returned -1 [0143.109] lstrcmpA (lpString1="..", lpString2="WPDNSE") returned -1 [0143.109] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\VuaPTxB.bmp") returned="VuaPTxB.bmp" [0143.109] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\", lpString2="WPDNSE" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\WPDNSE") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\WPDNSE" [0143.109] lstrlenA (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\WPDNSE") returned 55 [0143.109] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\WPDNSE\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0143.109] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0143.109] FindNextFileA (in: hFindFile=0x5be2a0, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0143.109] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0143.109] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0143.109] FindNextFileA (in: hFindFile=0x5be2a0, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0 [0143.109] FindClose (in: hFindFile=0x5be2a0 | out: hFindFile=0x5be2a0) returned 1 [0143.109] FindNextFileA (in: hFindFile=0x5be260, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0143.109] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0143.109] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="_pYPAT b.mp4") returned 1 [0143.109] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="_pYPAT b.mp4") returned 1 [0143.109] lstrcmpiA (lpString1="", lpString2="_pYPAT b.mp4") returned -1 [0143.109] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\*.*") returned="*.*" [0143.109] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\", lpString2="_pYPAT b.mp4" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\_pYPAT b.mp4") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\_pYPAT b.mp4" [0143.109] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\_pYPAT b.mp4", pszSpec="*.zip") returned 0 [0143.109] lstrlenA (lpString="*.zip") returned 5 [0143.109] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\_pYPAT b.mp4", pszSpec="*.rar") returned 0 [0143.109] lstrlenA (lpString="*.rar") returned 5 [0143.110] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\_pYPAT b.mp4", pszSpec="*.7z") returned 0 [0143.110] lstrlenA (lpString="*.7z") returned 4 [0143.110] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\_pYPAT b.mp4", pszSpec="*.tar") returned 0 [0143.110] lstrlenA (lpString="*.tar") returned 5 [0143.110] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\_pYPAT b.mp4", pszSpec="*.gzip") returned 0 [0143.110] lstrlenA (lpString="*.gzip") returned 6 [0143.110] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\_pYPAT b.mp4", pszSpec="*.jpg") returned 0 [0143.110] lstrlenA (lpString="*.jpg") returned 5 [0143.110] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\_pYPAT b.mp4", pszSpec="*.jpeg") returned 0 [0143.110] lstrlenA (lpString="*.jpeg") returned 6 [0143.110] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\_pYPAT b.mp4", pszSpec="*.psd") returned 0 [0143.110] lstrlenA (lpString="*.psd") returned 5 [0143.110] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\_pYPAT b.mp4", pszSpec="*.cdr") returned 0 [0143.110] lstrlenA (lpString="*.cdr") returned 5 [0143.110] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\_pYPAT b.mp4", pszSpec="*.dwg") returned 0 [0143.110] lstrlenA (lpString="*.dwg") returned 5 [0143.110] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\_pYPAT b.mp4", pszSpec="*.max") returned 0 [0143.110] lstrlenA (lpString="*.max") returned 5 [0143.110] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\_pYPAT b.mp4", pszSpec="*.bmp") returned 0 [0143.110] lstrlenA (lpString="*.bmp") returned 5 [0143.110] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\_pYPAT b.mp4", pszSpec="*.gif") returned 0 [0143.110] lstrlenA (lpString="*.gif") returned 5 [0143.110] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\_pYPAT b.mp4", pszSpec="*.png") returned 0 [0143.110] lstrlenA (lpString="*.png") returned 5 [0143.110] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\_pYPAT b.mp4", pszSpec="*.doc") returned 0 [0143.110] lstrlenA (lpString="*.doc") returned 5 [0143.110] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\_pYPAT b.mp4", pszSpec="*.docx") returned 0 [0143.110] lstrlenA (lpString="*.docx") returned 6 [0143.110] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\_pYPAT b.mp4", pszSpec="*.xls") returned 0 [0143.110] lstrlenA (lpString="*.xls") returned 5 [0143.110] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\_pYPAT b.mp4", pszSpec="*.xlsx") returned 0 [0143.110] lstrlenA (lpString="*.xlsx") returned 6 [0143.110] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\_pYPAT b.mp4", pszSpec="*.ppt") returned 0 [0143.110] lstrlenA (lpString="*.ppt") returned 5 [0143.110] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\_pYPAT b.mp4", pszSpec="*.pptx") returned 0 [0143.110] lstrlenA (lpString="*.pptx") returned 6 [0143.110] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\_pYPAT b.mp4", pszSpec="*.txt") returned 0 [0143.110] lstrlenA (lpString="*.txt") returned 5 [0143.110] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\_pYPAT b.mp4", pszSpec="*.pdf") returned 0 [0143.110] lstrlenA (lpString="*.pdf") returned 5 [0143.111] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\_pYPAT b.mp4", pszSpec="*.djvu") returned 0 [0143.111] lstrlenA (lpString="*.djvu") returned 6 [0143.111] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\_pYPAT b.mp4", pszSpec="*.htm") returned 0 [0143.111] lstrlenA (lpString="*.htm") returned 5 [0143.111] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\_pYPAT b.mp4", pszSpec="*.html") returned 0 [0143.111] lstrlenA (lpString="*.html") returned 6 [0143.111] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\_pYPAT b.mp4", pszSpec="*.mdb") returned 0 [0143.111] lstrlenA (lpString="*.mdb") returned 5 [0143.111] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\_pYPAT b.mp4", pszSpec="*.cer") returned 0 [0143.111] lstrlenA (lpString="*.cer") returned 5 [0143.111] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\_pYPAT b.mp4", pszSpec="*.p12") returned 0 [0143.111] lstrlenA (lpString="*.p12") returned 5 [0143.111] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\_pYPAT b.mp4", pszSpec="*.pfx") returned 0 [0143.111] lstrlenA (lpString="*.pfx") returned 5 [0143.111] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\_pYPAT b.mp4", pszSpec="*.kwm") returned 0 [0143.111] lstrlenA (lpString="*.kwm") returned 5 [0143.111] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\_pYPAT b.mp4", pszSpec="*.pwm") returned 0 [0143.111] lstrlenA (lpString="*.pwm") returned 5 [0143.111] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\_pYPAT b.mp4", pszSpec="*.1cd") returned 0 [0143.111] lstrlenA (lpString="*.1cd") returned 5 [0143.111] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\_pYPAT b.mp4", pszSpec="*.md") returned 0 [0143.111] lstrlenA (lpString="*.md") returned 4 [0143.111] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\_pYPAT b.mp4", pszSpec="*.mdf") returned 0 [0143.111] lstrlenA (lpString="*.mdf") returned 5 [0143.111] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\_pYPAT b.mp4", pszSpec="*.dbf") returned 0 [0143.111] lstrlenA (lpString="*.dbf") returned 5 [0143.111] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\_pYPAT b.mp4", pszSpec="*.odt") returned 0 [0143.111] lstrlenA (lpString="*.odt") returned 5 [0143.111] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\_pYPAT b.mp4", pszSpec="*.vob") returned 0 [0143.111] lstrlenA (lpString="*.vob") returned 5 [0143.111] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\_pYPAT b.mp4", pszSpec="*.ifo") returned 0 [0143.111] lstrlenA (lpString="*.ifo") returned 5 [0143.111] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\_pYPAT b.mp4", pszSpec="*.lnk") returned 0 [0143.111] lstrlenA (lpString="*.lnk") returned 5 [0143.111] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\_pYPAT b.mp4", pszSpec="*.torrent") returned 0 [0143.111] lstrlenA (lpString="*.torrent") returned 9 [0143.111] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\_pYPAT b.mp4", pszSpec="*.mov") returned 0 [0143.111] lstrlenA (lpString="*.mov") returned 5 [0143.111] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\_pYPAT b.mp4", pszSpec="*.m2v") returned 0 [0143.111] lstrlenA (lpString="*.m2v") returned 5 [0143.111] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\_pYPAT b.mp4", pszSpec="*.3gp") returned 0 [0143.112] lstrlenA (lpString="*.3gp") returned 5 [0143.112] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\_pYPAT b.mp4", pszSpec="*.mpeg") returned 0 [0143.112] lstrlenA (lpString="*.mpeg") returned 6 [0143.112] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\_pYPAT b.mp4", pszSpec="*.mpg") returned 0 [0143.112] lstrlenA (lpString="*.mpg") returned 5 [0143.112] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\_pYPAT b.mp4", pszSpec="*.flv") returned 0 [0143.112] lstrlenA (lpString="*.flv") returned 5 [0143.112] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\_pYPAT b.mp4", pszSpec="*.avi") returned 0 [0143.112] lstrlenA (lpString="*.avi") returned 5 [0143.112] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\_pYPAT b.mp4", pszSpec="*.mp4") returned 1 [0143.112] lstrlenA (lpString="*.mp4") returned 5 [0143.112] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\_pYPAT b.mp4" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\_pYPAT b.mp4") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\_pYPAT b.mp4" [0143.112] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\_pYPAT b.mp4" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\_pYPAT b.mp4") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\_pYPAT b.mp4" [0143.112] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\_pYPAT b.mp4", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\_pYPAT b.mp4.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\_pYPAT b.mp4." [0143.112] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\_pYPAT b.mp4.", lpString2="\xa0" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\_pYPAT b.mp4. ") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\_pYPAT b.mp4. " [0143.112] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\_pYPAT b.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\_pypat b.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90 [0143.112] GetFileSize (in: hFile=0x90, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x396a [0143.113] GetFileTime (in: hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xa14f3310, dwHighDateTime=0x1d4aa1e), lpLastAccessTime=0x407536*(dwLowDateTime=0x70d8520, dwHighDateTime=0x1d4ad81), lpLastWriteTime=0x40753e*(dwLowDateTime=0x70d8520, dwHighDateTime=0x1d4ad81)) returned 1 [0143.113] SetFilePointer (in: hFile=0x90, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0143.113] ReadFile (in: hFile=0x90, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x3910, lpOverlapped=0x0) returned 1 [0143.113] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\_pYPAT b.mp4") returned="_pYPAT b.mp4" [0143.113] SetFilePointer (in: hFile=0x90, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0143.113] WriteFile (in: hFile=0x90, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x3910, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x3910, lpOverlapped=0x0) returned 1 [0143.114] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0143.114] CloseHandle (hObject=0x90) returned 1 [0143.114] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\_pYPAT b.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\_pypat b.mp4"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\_pYPAT b.mp4. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\_pypat b.mp4. ")) returned 1 [0143.115] FindNextFileA (in: hFindFile=0x5be260, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0143.115] lstrcmpA (lpString1=".", lpString2="~nsu.tmp") returned -1 [0143.115] lstrcmpA (lpString1="..", lpString2="~nsu.tmp") returned -1 [0143.116] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\_pYPAT b.mp4") returned="_pYPAT b.mp4" [0143.116] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\", lpString2="~nsu.tmp" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\~nsu.tmp") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\~nsu.tmp" [0143.116] lstrlenA (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\~nsu.tmp") returned 57 [0143.116] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\~nsu.tmp\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0143.116] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0143.116] FindNextFileA (in: hFindFile=0x5be2a0, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0143.116] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0143.116] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0143.116] FindNextFileA (in: hFindFile=0x5be2a0, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0143.116] PeekMessageA (in: lpMsg=0xaef84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaef84) returned 0 [0143.116] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Au_.exe") returned 1 [0143.116] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Au_.exe") returned 1 [0143.116] lstrcmpiA (lpString1="", lpString2="Au_.exe") returned -1 [0143.116] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\~nsu.tmp\\*.*") returned="*.*" [0143.116] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\~nsu.tmp\\", lpString2="Au_.exe" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\~nsu.tmp\\Au_.exe") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\~nsu.tmp\\Au_.exe" [0143.116] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\~nsu.tmp\\Au_.exe", pszSpec="*.zip") returned 0 [0143.116] lstrlenA (lpString="*.zip") returned 5 [0143.116] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\~nsu.tmp\\Au_.exe", pszSpec="*.rar") returned 0 [0143.116] lstrlenA (lpString="*.rar") returned 5 [0143.116] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\~nsu.tmp\\Au_.exe", pszSpec="*.7z") returned 0 [0143.116] lstrlenA (lpString="*.7z") returned 4 [0143.116] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\~nsu.tmp\\Au_.exe", pszSpec="*.tar") returned 0 [0143.116] lstrlenA (lpString="*.tar") returned 5 [0143.116] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\~nsu.tmp\\Au_.exe", pszSpec="*.gzip") returned 0 [0143.116] lstrlenA (lpString="*.gzip") returned 6 [0143.116] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\~nsu.tmp\\Au_.exe", pszSpec="*.jpg") returned 0 [0143.116] lstrlenA (lpString="*.jpg") returned 5 [0143.116] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\~nsu.tmp\\Au_.exe", pszSpec="*.jpeg") returned 0 [0143.116] lstrlenA (lpString="*.jpeg") returned 6 [0143.116] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\~nsu.tmp\\Au_.exe", pszSpec="*.psd") returned 0 [0143.116] lstrlenA (lpString="*.psd") returned 5 [0143.116] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\~nsu.tmp\\Au_.exe", pszSpec="*.cdr") returned 0 [0143.116] lstrlenA (lpString="*.cdr") returned 5 [0143.116] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\~nsu.tmp\\Au_.exe", pszSpec="*.dwg") returned 0 [0143.116] lstrlenA (lpString="*.dwg") returned 5 [0143.116] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\~nsu.tmp\\Au_.exe", pszSpec="*.max") returned 0 [0143.116] lstrlenA (lpString="*.max") returned 5 [0143.117] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\~nsu.tmp\\Au_.exe", pszSpec="*.bmp") returned 0 [0143.117] lstrlenA (lpString="*.bmp") returned 5 [0143.117] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\~nsu.tmp\\Au_.exe", pszSpec="*.gif") returned 0 [0143.117] lstrlenA (lpString="*.gif") returned 5 [0143.117] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\~nsu.tmp\\Au_.exe", pszSpec="*.png") returned 0 [0143.117] lstrlenA (lpString="*.png") returned 5 [0143.117] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\~nsu.tmp\\Au_.exe", pszSpec="*.doc") returned 0 [0143.117] lstrlenA (lpString="*.doc") returned 5 [0143.117] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\~nsu.tmp\\Au_.exe", pszSpec="*.docx") returned 0 [0143.117] lstrlenA (lpString="*.docx") returned 6 [0143.117] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\~nsu.tmp\\Au_.exe", pszSpec="*.xls") returned 0 [0143.117] lstrlenA (lpString="*.xls") returned 5 [0143.117] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\~nsu.tmp\\Au_.exe", pszSpec="*.xlsx") returned 0 [0143.117] lstrlenA (lpString="*.xlsx") returned 6 [0143.117] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\~nsu.tmp\\Au_.exe", pszSpec="*.ppt") returned 0 [0143.117] lstrlenA (lpString="*.ppt") returned 5 [0143.117] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\~nsu.tmp\\Au_.exe", pszSpec="*.pptx") returned 0 [0143.117] lstrlenA (lpString="*.pptx") returned 6 [0143.117] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\~nsu.tmp\\Au_.exe", pszSpec="*.txt") returned 0 [0143.117] lstrlenA (lpString="*.txt") returned 5 [0143.117] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\~nsu.tmp\\Au_.exe", pszSpec="*.pdf") returned 0 [0143.117] lstrlenA (lpString="*.pdf") returned 5 [0143.117] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\~nsu.tmp\\Au_.exe", pszSpec="*.djvu") returned 0 [0143.117] lstrlenA (lpString="*.djvu") returned 6 [0143.117] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\~nsu.tmp\\Au_.exe", pszSpec="*.htm") returned 0 [0143.117] lstrlenA (lpString="*.htm") returned 5 [0143.117] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\~nsu.tmp\\Au_.exe", pszSpec="*.html") returned 0 [0143.117] lstrlenA (lpString="*.html") returned 6 [0143.117] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\~nsu.tmp\\Au_.exe", pszSpec="*.mdb") returned 0 [0143.117] lstrlenA (lpString="*.mdb") returned 5 [0143.117] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\~nsu.tmp\\Au_.exe", pszSpec="*.cer") returned 0 [0143.117] lstrlenA (lpString="*.cer") returned 5 [0143.117] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\~nsu.tmp\\Au_.exe", pszSpec="*.p12") returned 0 [0143.117] lstrlenA (lpString="*.p12") returned 5 [0143.117] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\~nsu.tmp\\Au_.exe", pszSpec="*.pfx") returned 0 [0143.117] lstrlenA (lpString="*.pfx") returned 5 [0143.117] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\~nsu.tmp\\Au_.exe", pszSpec="*.kwm") returned 0 [0143.117] lstrlenA (lpString="*.kwm") returned 5 [0143.117] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\~nsu.tmp\\Au_.exe", pszSpec="*.pwm") returned 0 [0143.117] lstrlenA (lpString="*.pwm") returned 5 [0143.117] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\~nsu.tmp\\Au_.exe", pszSpec="*.1cd") returned 0 [0143.117] lstrlenA (lpString="*.1cd") returned 5 [0143.117] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\~nsu.tmp\\Au_.exe", pszSpec="*.md") returned 0 [0143.117] lstrlenA (lpString="*.md") returned 4 [0143.117] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\~nsu.tmp\\Au_.exe", pszSpec="*.mdf") returned 0 [0143.117] lstrlenA (lpString="*.mdf") returned 5 [0143.118] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\~nsu.tmp\\Au_.exe", pszSpec="*.dbf") returned 0 [0143.118] lstrlenA (lpString="*.dbf") returned 5 [0143.118] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\~nsu.tmp\\Au_.exe", pszSpec="*.odt") returned 0 [0143.118] lstrlenA (lpString="*.odt") returned 5 [0143.118] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\~nsu.tmp\\Au_.exe", pszSpec="*.vob") returned 0 [0143.118] lstrlenA (lpString="*.vob") returned 5 [0143.118] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\~nsu.tmp\\Au_.exe", pszSpec="*.ifo") returned 0 [0143.118] lstrlenA (lpString="*.ifo") returned 5 [0143.118] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\~nsu.tmp\\Au_.exe", pszSpec="*.lnk") returned 0 [0143.118] lstrlenA (lpString="*.lnk") returned 5 [0143.118] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\~nsu.tmp\\Au_.exe", pszSpec="*.torrent") returned 0 [0143.118] lstrlenA (lpString="*.torrent") returned 9 [0143.118] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\~nsu.tmp\\Au_.exe", pszSpec="*.mov") returned 0 [0143.118] lstrlenA (lpString="*.mov") returned 5 [0143.118] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\~nsu.tmp\\Au_.exe", pszSpec="*.m2v") returned 0 [0143.118] lstrlenA (lpString="*.m2v") returned 5 [0143.118] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\~nsu.tmp\\Au_.exe", pszSpec="*.3gp") returned 0 [0143.118] lstrlenA (lpString="*.3gp") returned 5 [0143.118] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\~nsu.tmp\\Au_.exe", pszSpec="*.mpeg") returned 0 [0143.118] lstrlenA (lpString="*.mpeg") returned 6 [0143.118] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\~nsu.tmp\\Au_.exe", pszSpec="*.mpg") returned 0 [0143.118] lstrlenA (lpString="*.mpg") returned 5 [0143.118] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\~nsu.tmp\\Au_.exe", pszSpec="*.flv") returned 0 [0143.118] lstrlenA (lpString="*.flv") returned 5 [0143.118] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\~nsu.tmp\\Au_.exe", pszSpec="*.avi") returned 0 [0143.118] lstrlenA (lpString="*.avi") returned 5 [0143.118] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\~nsu.tmp\\Au_.exe", pszSpec="*.mp4") returned 0 [0143.118] lstrlenA (lpString="*.mp4") returned 5 [0143.118] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\~nsu.tmp\\Au_.exe", pszSpec="*.wmv") returned 0 [0143.118] lstrlenA (lpString="*.wmv") returned 5 [0143.118] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\~nsu.tmp\\Au_.exe", pszSpec="*.divx") returned 0 [0143.118] lstrlenA (lpString="*.divx") returned 6 [0143.118] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\~nsu.tmp\\Au_.exe", pszSpec="*.mkv") returned 0 [0143.118] lstrlenA (lpString="*.mkv") returned 5 [0143.118] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\~nsu.tmp\\Au_.exe", pszSpec="*.mp3") returned 0 [0143.118] lstrlenA (lpString="*.mp3") returned 5 [0143.118] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\~nsu.tmp\\Au_.exe", pszSpec="*.wav") returned 0 [0143.118] lstrlenA (lpString="*.wav") returned 5 [0143.118] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\~nsu.tmp\\Au_.exe", pszSpec="*.flac") returned 0 [0143.118] lstrlenA (lpString="*.flac") returned 6 [0143.118] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\~nsu.tmp\\Au_.exe", pszSpec="*.ape") returned 0 [0143.118] lstrlenA (lpString="*.ape") returned 5 [0143.118] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\~nsu.tmp\\Au_.exe", pszSpec="*.wma") returned 0 [0143.118] lstrlenA (lpString="*.wma") returned 5 [0143.118] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\~nsu.tmp\\Au_.exe", pszSpec="*.ac3") returned 0 [0143.118] lstrlenA (lpString="*.ac3") returned 5 [0143.118] FindNextFileA (in: hFindFile=0x5be2a0, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0 [0143.118] FindClose (in: hFindFile=0x5be2a0 | out: hFindFile=0x5be2a0) returned 1 [0143.119] FindNextFileA (in: hFindFile=0x5be260, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0 [0143.119] FindClose (in: hFindFile=0x5be260 | out: hFindFile=0x5be260) returned 1 [0143.119] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0143.119] lstrcmpA (lpString1=".", lpString2="Temporary Internet Files") returned -1 [0143.119] lstrcmpA (lpString1="..", lpString2="Temporary Internet Files") returned -1 [0143.119] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\*.*") returned="*.*" [0143.119] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\", lpString2="Temporary Internet Files" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temporary Internet Files") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temporary Internet Files" [0143.119] lstrlenA (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temporary Internet Files") returned 68 [0143.119] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temporary Internet Files\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0xffffffff [0143.119] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0143.119] lstrcmpA (lpString1=".", lpString2="VirtualStore") returned -1 [0143.119] lstrcmpA (lpString1="..", lpString2="VirtualStore") returned -1 [0143.119] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\*.*") returned="*.*" [0143.119] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\", lpString2="VirtualStore" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\VirtualStore") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\VirtualStore" [0143.119] lstrlenA (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\VirtualStore") returned 56 [0143.119] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\VirtualStore\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0143.119] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0143.119] FindNextFileA (in: hFindFile=0x5be260, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0143.119] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0143.119] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0143.119] FindNextFileA (in: hFindFile=0x5be260, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0 [0143.120] FindClose (in: hFindFile=0x5be260 | out: hFindFile=0x5be260) returned 1 [0143.120] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0 [0143.120] FindClose (in: hFindFile=0x5be160 | out: hFindFile=0x5be160) returned 1 [0143.120] FindNextFileA (in: hFindFile=0x5be220, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0143.120] lstrcmpA (lpString1=".", lpString2="LocalLow") returned -1 [0143.120] lstrcmpA (lpString1="..", lpString2="LocalLow") returned -1 [0143.120] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\*.*") returned="*.*" [0143.120] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\", lpString2="LocalLow" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow" [0143.120] lstrlenA (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow") returned 46 [0143.120] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be160 [0143.120] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0143.120] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0143.120] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0143.120] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0143.120] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0143.120] lstrcmpA (lpString1=".", lpString2="Adobe") returned -1 [0143.120] lstrcmpA (lpString1="..", lpString2="Adobe") returned -1 [0143.120] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\*.*") returned="*.*" [0143.120] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\", lpString2="Adobe" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe" [0143.120] lstrlenA (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe") returned 52 [0143.120] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0143.121] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0143.121] FindNextFileA (in: hFindFile=0x5be260, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0143.121] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0143.121] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0143.121] FindNextFileA (in: hFindFile=0x5be260, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0143.121] lstrcmpA (lpString1=".", lpString2="Acrobat") returned -1 [0143.121] lstrcmpA (lpString1="..", lpString2="Acrobat") returned -1 [0143.121] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\*.*") returned="*.*" [0143.121] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\", lpString2="Acrobat" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat" [0143.121] lstrlenA (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat") returned 60 [0143.121] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0143.121] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0143.121] FindNextFileA (in: hFindFile=0x5be2a0, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0143.121] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0143.121] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0143.121] FindNextFileA (in: hFindFile=0x5be2a0, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0143.121] lstrcmpA (lpString1=".", lpString2="10.0") returned -1 [0143.121] lstrcmpA (lpString1="..", lpString2="10.0") returned -1 [0143.121] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\*.*") returned="*.*" [0143.121] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\", lpString2="10.0" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0" [0143.121] lstrlenA (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0") returned 65 [0143.121] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\*.*", lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 0x5be2e0 [0143.164] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0143.164] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0143.164] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0143.164] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0143.164] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0143.164] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0143.164] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="rdrmessage.zip") returned -1 [0143.164] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="rdrmessage.zip") returned -1 [0143.164] lstrcmpiA (lpString1="", lpString2="rdrmessage.zip") returned -1 [0143.164] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\*.*") returned="*.*" [0143.164] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\", lpString2="rdrmessage.zip" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\rdrmessage.zip") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\rdrmessage.zip" [0143.164] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\rdrmessage.zip", pszSpec="*.zip") returned 1 [0143.164] lstrlenA (lpString="*.zip") returned 5 [0143.164] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\rdrmessage.zip" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\rdrmessage.zip") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\rdrmessage.zip" [0143.164] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\rdrmessage.zip" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\rdrmessage.zip") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\rdrmessage.zip" [0143.164] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\rdrmessage.zip", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\rdrmessage.zip.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\rdrmessage.zip." [0143.164] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\rdrmessage.zip.", lpString2="\xa0" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\rdrmessage.zip. ") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\rdrmessage.zip. " [0143.164] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\rdrmessage.zip" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\adobe\\acrobat\\10.0\\rdrmessage.zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x98 [0143.165] GetFileSize (in: hFile=0x98, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xa5ff [0143.165] GetFileTime (in: hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xd9b6a040, dwHighDateTime=0x1d2dda0), lpLastAccessTime=0x407536*(dwLowDateTime=0xd9b6a040, dwHighDateTime=0x1d2dda0), lpLastWriteTime=0x40753e*(dwLowDateTime=0xde963ca0, dwHighDateTime=0x1d2e625)) returned 1 [0143.165] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0143.165] ReadFile (in: hFile=0x98, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0xa5a5, lpOverlapped=0x0) returned 1 [0143.400] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\rdrmessage.zip") returned="rdrmessage.zip" [0143.400] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0143.400] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0xa5a5, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0xa5a5, lpOverlapped=0x0) returned 1 [0143.401] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0143.401] CloseHandle (hObject=0x98) returned 1 [0143.401] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\rdrmessage.zip" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\adobe\\acrobat\\10.0\\rdrmessage.zip"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\rdrmessage.zip. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\adobe\\acrobat\\10.0\\rdrmessage.zip. ")) returned 1 [0143.402] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0143.402] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0143.402] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="ReaderMessages") returned -1 [0143.402] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ReaderMessages") returned -1 [0143.402] lstrcmpiA (lpString1="", lpString2="ReaderMessages") returned -1 [0143.402] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\rdrmessage.zip") returned="rdrmessage.zip" [0143.402] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\", lpString2="ReaderMessages" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\ReaderMessages") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\ReaderMessages" [0143.402] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\ReaderMessages", pszSpec="*.zip") returned 0 [0143.402] lstrlenA (lpString="*.zip") returned 5 [0143.402] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\ReaderMessages", pszSpec="*.rar") returned 0 [0143.402] lstrlenA (lpString="*.rar") returned 5 [0143.402] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\ReaderMessages", pszSpec="*.7z") returned 0 [0143.402] lstrlenA (lpString="*.7z") returned 4 [0143.402] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\ReaderMessages", pszSpec="*.tar") returned 0 [0143.402] lstrlenA (lpString="*.tar") returned 5 [0143.402] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\ReaderMessages", pszSpec="*.gzip") returned 0 [0143.402] lstrlenA (lpString="*.gzip") returned 6 [0143.402] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\ReaderMessages", pszSpec="*.jpg") returned 0 [0143.402] lstrlenA (lpString="*.jpg") returned 5 [0143.402] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\ReaderMessages", pszSpec="*.jpeg") returned 0 [0143.402] lstrlenA (lpString="*.jpeg") returned 6 [0143.402] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\ReaderMessages", pszSpec="*.psd") returned 0 [0143.402] lstrlenA (lpString="*.psd") returned 5 [0143.402] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\ReaderMessages", pszSpec="*.cdr") returned 0 [0143.402] lstrlenA (lpString="*.cdr") returned 5 [0143.402] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\ReaderMessages", pszSpec="*.dwg") returned 0 [0143.402] lstrlenA (lpString="*.dwg") returned 5 [0143.402] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\ReaderMessages", pszSpec="*.max") returned 0 [0143.402] lstrlenA (lpString="*.max") returned 5 [0143.402] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\ReaderMessages", pszSpec="*.bmp") returned 0 [0143.402] lstrlenA (lpString="*.bmp") returned 5 [0143.402] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\ReaderMessages", pszSpec="*.gif") returned 0 [0143.402] lstrlenA (lpString="*.gif") returned 5 [0143.402] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\ReaderMessages", pszSpec="*.png") returned 0 [0143.402] lstrlenA (lpString="*.png") returned 5 [0143.403] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\ReaderMessages", pszSpec="*.doc") returned 0 [0143.403] lstrlenA (lpString="*.doc") returned 5 [0143.403] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\ReaderMessages", pszSpec="*.docx") returned 0 [0143.403] lstrlenA (lpString="*.docx") returned 6 [0143.403] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\ReaderMessages", pszSpec="*.xls") returned 0 [0143.403] lstrlenA (lpString="*.xls") returned 5 [0143.403] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\ReaderMessages", pszSpec="*.xlsx") returned 0 [0143.403] lstrlenA (lpString="*.xlsx") returned 6 [0143.403] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\ReaderMessages", pszSpec="*.ppt") returned 0 [0143.403] lstrlenA (lpString="*.ppt") returned 5 [0143.403] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\ReaderMessages", pszSpec="*.pptx") returned 0 [0143.403] lstrlenA (lpString="*.pptx") returned 6 [0143.403] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\ReaderMessages", pszSpec="*.txt") returned 0 [0143.403] lstrlenA (lpString="*.txt") returned 5 [0143.403] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\ReaderMessages", pszSpec="*.pdf") returned 0 [0143.403] lstrlenA (lpString="*.pdf") returned 5 [0143.403] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\ReaderMessages", pszSpec="*.djvu") returned 0 [0143.403] lstrlenA (lpString="*.djvu") returned 6 [0143.403] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\ReaderMessages", pszSpec="*.htm") returned 0 [0143.403] lstrlenA (lpString="*.htm") returned 5 [0143.403] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\ReaderMessages", pszSpec="*.html") returned 0 [0143.403] lstrlenA (lpString="*.html") returned 6 [0143.403] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\ReaderMessages", pszSpec="*.mdb") returned 0 [0143.403] lstrlenA (lpString="*.mdb") returned 5 [0143.403] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\ReaderMessages", pszSpec="*.cer") returned 0 [0143.403] lstrlenA (lpString="*.cer") returned 5 [0143.403] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\ReaderMessages", pszSpec="*.p12") returned 0 [0143.403] lstrlenA (lpString="*.p12") returned 5 [0143.403] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\ReaderMessages", pszSpec="*.pfx") returned 0 [0143.403] lstrlenA (lpString="*.pfx") returned 5 [0143.403] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\ReaderMessages", pszSpec="*.kwm") returned 0 [0143.403] lstrlenA (lpString="*.kwm") returned 5 [0143.403] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\ReaderMessages", pszSpec="*.pwm") returned 0 [0143.403] lstrlenA (lpString="*.pwm") returned 5 [0143.403] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\ReaderMessages", pszSpec="*.1cd") returned 0 [0143.403] lstrlenA (lpString="*.1cd") returned 5 [0143.403] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\ReaderMessages", pszSpec="*.md") returned 0 [0143.403] lstrlenA (lpString="*.md") returned 4 [0143.404] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\ReaderMessages", pszSpec="*.mdf") returned 0 [0143.404] lstrlenA (lpString="*.mdf") returned 5 [0143.404] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\ReaderMessages", pszSpec="*.dbf") returned 0 [0143.404] lstrlenA (lpString="*.dbf") returned 5 [0143.404] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\ReaderMessages", pszSpec="*.odt") returned 0 [0143.404] lstrlenA (lpString="*.odt") returned 5 [0143.404] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\ReaderMessages", pszSpec="*.vob") returned 0 [0143.404] lstrlenA (lpString="*.vob") returned 5 [0143.404] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\ReaderMessages", pszSpec="*.ifo") returned 0 [0143.404] lstrlenA (lpString="*.ifo") returned 5 [0143.404] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\ReaderMessages", pszSpec="*.lnk") returned 0 [0143.404] lstrlenA (lpString="*.lnk") returned 5 [0143.404] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\ReaderMessages", pszSpec="*.torrent") returned 0 [0143.404] lstrlenA (lpString="*.torrent") returned 9 [0143.404] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\ReaderMessages", pszSpec="*.mov") returned 0 [0143.404] lstrlenA (lpString="*.mov") returned 5 [0143.404] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\ReaderMessages", pszSpec="*.m2v") returned 0 [0143.404] lstrlenA (lpString="*.m2v") returned 5 [0143.404] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\ReaderMessages", pszSpec="*.3gp") returned 0 [0143.404] lstrlenA (lpString="*.3gp") returned 5 [0143.404] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\ReaderMessages", pszSpec="*.mpeg") returned 0 [0143.404] lstrlenA (lpString="*.mpeg") returned 6 [0143.404] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\ReaderMessages", pszSpec="*.mpg") returned 0 [0143.404] lstrlenA (lpString="*.mpg") returned 5 [0143.404] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\ReaderMessages", pszSpec="*.flv") returned 0 [0143.404] lstrlenA (lpString="*.flv") returned 5 [0143.404] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\ReaderMessages", pszSpec="*.avi") returned 0 [0143.404] lstrlenA (lpString="*.avi") returned 5 [0143.404] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\ReaderMessages", pszSpec="*.mp4") returned 0 [0143.404] lstrlenA (lpString="*.mp4") returned 5 [0143.404] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\ReaderMessages", pszSpec="*.wmv") returned 0 [0143.404] lstrlenA (lpString="*.wmv") returned 5 [0143.404] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\ReaderMessages", pszSpec="*.divx") returned 0 [0143.404] lstrlenA (lpString="*.divx") returned 6 [0143.404] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\ReaderMessages", pszSpec="*.mkv") returned 0 [0143.404] lstrlenA (lpString="*.mkv") returned 5 [0143.404] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\ReaderMessages", pszSpec="*.mp3") returned 0 [0143.404] lstrlenA (lpString="*.mp3") returned 5 [0143.404] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\ReaderMessages", pszSpec="*.wav") returned 0 [0143.404] lstrlenA (lpString="*.wav") returned 5 [0143.405] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\ReaderMessages", pszSpec="*.flac") returned 0 [0143.405] lstrlenA (lpString="*.flac") returned 6 [0143.405] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\ReaderMessages", pszSpec="*.ape") returned 0 [0143.405] lstrlenA (lpString="*.ape") returned 5 [0143.405] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\ReaderMessages", pszSpec="*.wma") returned 0 [0143.405] lstrlenA (lpString="*.wma") returned 5 [0143.405] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\ReaderMessages", pszSpec="*.ac3") returned 0 [0143.405] lstrlenA (lpString="*.ac3") returned 5 [0143.405] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0143.405] lstrcmpA (lpString1=".", lpString2="Search") returned -1 [0143.405] lstrcmpA (lpString1="..", lpString2="Search") returned -1 [0143.405] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\ReaderMessages") returned="ReaderMessages" [0143.405] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\", lpString2="Search" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\Search") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\Search" [0143.405] lstrlenA (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\Search") returned 72 [0143.405] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\Search\\*.*", lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 0x5be320 [0143.406] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0143.406] FindNextFileA (in: hFindFile=0x5be320, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0143.406] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0143.406] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0143.406] FindNextFileA (in: hFindFile=0x5be320, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 0 [0143.406] FindClose (in: hFindFile=0x5be320 | out: hFindFile=0x5be320) returned 1 [0143.406] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 0 [0143.406] FindClose (in: hFindFile=0x5be2e0 | out: hFindFile=0x5be2e0) returned 1 [0143.406] FindNextFileA (in: hFindFile=0x5be2a0, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0 [0143.406] FindClose (in: hFindFile=0x5be2a0 | out: hFindFile=0x5be2a0) returned 1 [0143.406] FindNextFileA (in: hFindFile=0x5be260, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0143.406] lstrcmpA (lpString1=".", lpString2="Linguistics") returned -1 [0143.406] lstrcmpA (lpString1="..", lpString2="Linguistics") returned -1 [0143.406] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\*.*") returned="*.*" [0143.406] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\", lpString2="Linguistics" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics" [0143.406] lstrlenA (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics") returned 64 [0143.406] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0143.406] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0143.406] FindNextFileA (in: hFindFile=0x5be2a0, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0143.406] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0143.406] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0143.406] FindNextFileA (in: hFindFile=0x5be2a0, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0143.406] lstrcmpA (lpString1=".", lpString2="Dictionaries") returned -1 [0143.406] lstrcmpA (lpString1="..", lpString2="Dictionaries") returned -1 [0143.407] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\*.*") returned="*.*" [0143.407] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\", lpString2="Dictionaries" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries" [0143.407] lstrlenA (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries") returned 77 [0143.407] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\*.*", lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 0x5be2e0 [0143.408] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0143.408] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0143.408] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0143.408] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0143.408] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0143.408] lstrcmpA (lpString1=".", lpString2="Adobe Custom Dictionary") returned -1 [0143.408] lstrcmpA (lpString1="..", lpString2="Adobe Custom Dictionary") returned -1 [0143.408] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\*.*") returned="*.*" [0143.408] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\", lpString2="Adobe Custom Dictionary" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary" [0143.408] lstrlenA (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary") returned 101 [0143.408] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\*.*", lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 0x5be320 [0143.499] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0143.499] FindNextFileA (in: hFindFile=0x5be320, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0143.499] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0143.500] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0143.500] FindNextFileA (in: hFindFile=0x5be320, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0143.500] lstrcmpA (lpString1=".", lpString2="all") returned -1 [0143.500] lstrcmpA (lpString1="..", lpString2="all") returned -1 [0143.500] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\*.*") returned="*.*" [0143.500] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\", lpString2="all" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\all") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\all" [0143.500] lstrlenA (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\all") returned 105 [0143.500] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\all\\*.*", lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 0x5be360 [0143.500] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0143.500] FindNextFileA (in: hFindFile=0x5be360, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 1 [0143.500] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0143.500] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0143.500] FindNextFileA (in: hFindFile=0x5be360, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 0 [0143.500] FindClose (in: hFindFile=0x5be360 | out: hFindFile=0x5be360) returned 1 [0143.500] FindNextFileA (in: hFindFile=0x5be320, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0143.500] lstrcmpA (lpString1=".", lpString2="brt") returned -1 [0143.500] lstrcmpA (lpString1="..", lpString2="brt") returned -1 [0143.500] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\*.*") returned="*.*" [0143.500] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\", lpString2="brt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\brt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\brt" [0143.500] lstrlenA (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\brt") returned 105 [0143.500] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\brt\\*.*", lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 0x5be360 [0143.501] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0143.501] FindNextFileA (in: hFindFile=0x5be360, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 1 [0143.501] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0143.501] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0143.501] FindNextFileA (in: hFindFile=0x5be360, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 0 [0143.501] FindClose (in: hFindFile=0x5be360 | out: hFindFile=0x5be360) returned 1 [0143.501] FindNextFileA (in: hFindFile=0x5be320, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0143.501] lstrcmpA (lpString1=".", lpString2="brz") returned -1 [0143.501] lstrcmpA (lpString1="..", lpString2="brz") returned -1 [0143.501] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\*.*") returned="*.*" [0143.501] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\", lpString2="brz" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\brz") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\brz" [0143.501] lstrlenA (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\brz") returned 105 [0143.501] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\brz\\*.*", lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 0x5be360 [0143.502] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0143.502] FindNextFileA (in: hFindFile=0x5be360, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 1 [0143.502] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0143.502] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0143.502] FindNextFileA (in: hFindFile=0x5be360, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 0 [0143.502] FindClose (in: hFindFile=0x5be360 | out: hFindFile=0x5be360) returned 1 [0143.502] FindNextFileA (in: hFindFile=0x5be320, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0143.502] lstrcmpA (lpString1=".", lpString2="dan") returned -1 [0143.502] lstrcmpA (lpString1="..", lpString2="dan") returned -1 [0143.502] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\*.*") returned="*.*" [0143.502] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\", lpString2="dan" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\dan") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\dan" [0143.502] lstrlenA (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\dan") returned 105 [0143.502] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\dan\\*.*", lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 0x5be360 [0143.502] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0143.502] FindNextFileA (in: hFindFile=0x5be360, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 1 [0143.502] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0143.502] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0143.502] FindNextFileA (in: hFindFile=0x5be360, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 0 [0143.503] FindClose (in: hFindFile=0x5be360 | out: hFindFile=0x5be360) returned 1 [0143.503] FindNextFileA (in: hFindFile=0x5be320, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0143.503] lstrcmpA (lpString1=".", lpString2="dut") returned -1 [0143.503] lstrcmpA (lpString1="..", lpString2="dut") returned -1 [0143.503] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\*.*") returned="*.*" [0143.503] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\", lpString2="dut" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\dut") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\dut" [0143.503] lstrlenA (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\dut") returned 105 [0143.503] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\dut\\*.*", lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 0x5be360 [0143.503] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0143.503] FindNextFileA (in: hFindFile=0x5be360, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 1 [0143.503] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0143.503] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0143.503] FindNextFileA (in: hFindFile=0x5be360, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 0 [0143.503] FindClose (in: hFindFile=0x5be360 | out: hFindFile=0x5be360) returned 1 [0143.503] FindNextFileA (in: hFindFile=0x5be320, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0143.503] lstrcmpA (lpString1=".", lpString2="eng") returned -1 [0143.503] lstrcmpA (lpString1="..", lpString2="eng") returned -1 [0143.503] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\*.*") returned="*.*" [0143.503] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\", lpString2="eng" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\eng") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\eng" [0143.503] lstrlenA (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\eng") returned 105 [0143.503] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\eng\\*.*", lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 0x5be360 [0143.503] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0143.503] FindNextFileA (in: hFindFile=0x5be360, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 1 [0143.503] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0143.503] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0143.503] FindNextFileA (in: hFindFile=0x5be360, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 0 [0143.504] FindClose (in: hFindFile=0x5be360 | out: hFindFile=0x5be360) returned 1 [0143.504] FindNextFileA (in: hFindFile=0x5be320, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0143.504] lstrcmpA (lpString1=".", lpString2="frn") returned -1 [0143.504] lstrcmpA (lpString1="..", lpString2="frn") returned -1 [0143.504] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\*.*") returned="*.*" [0143.504] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\", lpString2="frn" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\frn") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\frn" [0143.504] lstrlenA (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\frn") returned 105 [0143.504] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\frn\\*.*", lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 0x5be360 [0143.504] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0143.504] FindNextFileA (in: hFindFile=0x5be360, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 1 [0143.504] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0143.504] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0143.504] FindNextFileA (in: hFindFile=0x5be360, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 0 [0143.504] FindClose (in: hFindFile=0x5be360 | out: hFindFile=0x5be360) returned 1 [0143.504] FindNextFileA (in: hFindFile=0x5be320, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0143.504] lstrcmpA (lpString1=".", lpString2="grm") returned -1 [0143.504] lstrcmpA (lpString1="..", lpString2="grm") returned -1 [0143.504] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\*.*") returned="*.*" [0143.504] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\", lpString2="grm" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\grm") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\grm" [0143.504] lstrlenA (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\grm") returned 105 [0143.504] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\grm\\*.*", lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 0x5be360 [0143.504] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0143.504] FindNextFileA (in: hFindFile=0x5be360, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 1 [0143.504] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0143.504] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0143.505] FindNextFileA (in: hFindFile=0x5be360, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 0 [0143.505] FindClose (in: hFindFile=0x5be360 | out: hFindFile=0x5be360) returned 1 [0143.505] FindNextFileA (in: hFindFile=0x5be320, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0143.505] lstrcmpA (lpString1=".", lpString2="itl") returned -1 [0143.505] lstrcmpA (lpString1="..", lpString2="itl") returned -1 [0143.505] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\*.*") returned="*.*" [0143.505] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\", lpString2="itl" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\itl") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\itl" [0143.505] lstrlenA (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\itl") returned 105 [0143.505] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\itl\\*.*", lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 0x5be360 [0143.505] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0143.505] FindNextFileA (in: hFindFile=0x5be360, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 1 [0143.505] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0143.505] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0143.505] FindNextFileA (in: hFindFile=0x5be360, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 0 [0143.505] FindClose (in: hFindFile=0x5be360 | out: hFindFile=0x5be360) returned 1 [0143.505] FindNextFileA (in: hFindFile=0x5be320, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0143.505] lstrcmpA (lpString1=".", lpString2="nrw") returned -1 [0143.505] lstrcmpA (lpString1="..", lpString2="nrw") returned -1 [0143.505] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\*.*") returned="*.*" [0143.505] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\", lpString2="nrw" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\nrw") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\nrw" [0143.505] lstrlenA (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\nrw") returned 105 [0143.505] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\nrw\\*.*", lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 0x5be360 [0143.505] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0143.505] FindNextFileA (in: hFindFile=0x5be360, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 1 [0143.506] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0143.506] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0143.506] FindNextFileA (in: hFindFile=0x5be360, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 0 [0143.506] FindClose (in: hFindFile=0x5be360 | out: hFindFile=0x5be360) returned 1 [0143.506] FindNextFileA (in: hFindFile=0x5be320, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0143.506] lstrcmpA (lpString1=".", lpString2="prt") returned -1 [0143.506] lstrcmpA (lpString1="..", lpString2="prt") returned -1 [0143.506] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\*.*") returned="*.*" [0143.506] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\", lpString2="prt" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\prt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\prt" [0143.506] lstrlenA (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\prt") returned 105 [0143.506] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\prt\\*.*", lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 0x5be360 [0143.506] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0143.506] FindNextFileA (in: hFindFile=0x5be360, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 1 [0143.506] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0143.506] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0143.506] FindNextFileA (in: hFindFile=0x5be360, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 0 [0143.506] FindClose (in: hFindFile=0x5be360 | out: hFindFile=0x5be360) returned 1 [0143.506] FindNextFileA (in: hFindFile=0x5be320, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0143.506] lstrcmpA (lpString1=".", lpString2="spn") returned -1 [0143.506] lstrcmpA (lpString1="..", lpString2="spn") returned -1 [0143.506] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\*.*") returned="*.*" [0143.506] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\", lpString2="spn" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\spn") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\spn" [0143.506] lstrlenA (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\spn") returned 105 [0143.506] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\spn\\*.*", lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 0x5be360 [0143.506] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0143.506] FindNextFileA (in: hFindFile=0x5be360, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 1 [0143.506] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0143.507] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0143.507] FindNextFileA (in: hFindFile=0x5be360, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 0 [0143.507] FindClose (in: hFindFile=0x5be360 | out: hFindFile=0x5be360) returned 1 [0143.507] FindNextFileA (in: hFindFile=0x5be320, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0143.507] lstrcmpA (lpString1=".", lpString2="swd") returned -1 [0143.507] lstrcmpA (lpString1="..", lpString2="swd") returned -1 [0143.507] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\*.*") returned="*.*" [0143.507] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\", lpString2="swd" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\swd") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\swd" [0143.507] lstrlenA (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\swd") returned 105 [0143.507] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\swd\\*.*", lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 0x5be360 [0143.507] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0143.507] FindNextFileA (in: hFindFile=0x5be360, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 1 [0143.507] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0143.507] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0143.507] FindNextFileA (in: hFindFile=0x5be360, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 0 [0143.507] FindClose (in: hFindFile=0x5be360 | out: hFindFile=0x5be360) returned 1 [0143.507] FindNextFileA (in: hFindFile=0x5be320, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 0 [0143.507] FindClose (in: hFindFile=0x5be320 | out: hFindFile=0x5be320) returned 1 [0143.507] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 0 [0143.507] FindClose (in: hFindFile=0x5be2e0 | out: hFindFile=0x5be2e0) returned 1 [0143.507] FindNextFileA (in: hFindFile=0x5be2a0, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0 [0143.507] FindClose (in: hFindFile=0x5be2a0 | out: hFindFile=0x5be2a0) returned 1 [0143.507] FindNextFileA (in: hFindFile=0x5be260, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0 [0143.507] FindClose (in: hFindFile=0x5be260 | out: hFindFile=0x5be260) returned 1 [0143.507] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0143.507] lstrcmpA (lpString1=".", lpString2="Microsoft") returned -1 [0143.507] lstrcmpA (lpString1="..", lpString2="Microsoft") returned -1 [0143.507] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\*.*") returned="*.*" [0143.508] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\", lpString2="Microsoft" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft" [0143.508] lstrlenA (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft") returned 56 [0143.508] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0143.508] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0143.508] FindNextFileA (in: hFindFile=0x5be260, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0143.508] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0143.508] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0143.508] FindNextFileA (in: hFindFile=0x5be260, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0143.508] lstrcmpA (lpString1=".", lpString2="CryptnetUrlCache") returned -1 [0143.508] lstrcmpA (lpString1="..", lpString2="CryptnetUrlCache") returned -1 [0143.508] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\*.*") returned="*.*" [0143.508] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\", lpString2="CryptnetUrlCache" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache" [0143.508] lstrlenA (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache") returned 73 [0143.508] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0143.508] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0143.508] FindNextFileA (in: hFindFile=0x5be2a0, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0143.508] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0143.508] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0143.508] FindNextFileA (in: hFindFile=0x5be2a0, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0143.508] lstrcmpA (lpString1=".", lpString2="Content") returned -1 [0143.508] lstrcmpA (lpString1="..", lpString2="Content") returned -1 [0143.508] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\*.*") returned="*.*" [0143.508] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\", lpString2="Content" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content" [0143.508] lstrlenA (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content") returned 81 [0143.508] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\*.*", lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 0x5be2e0 [0143.508] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0143.508] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0143.508] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0143.509] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0143.509] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0143.509] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0143.509] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B") returned 1 [0143.509] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B") returned 1 [0143.509] lstrcmpiA (lpString1="", lpString2="024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B") returned -1 [0143.509] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\*.*") returned="*.*" [0143.509] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\", lpString2="024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B" [0143.509] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B", pszSpec="*.zip") returned 0 [0143.509] lstrlenA (lpString="*.zip") returned 5 [0143.509] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B", pszSpec="*.rar") returned 0 [0143.509] lstrlenA (lpString="*.rar") returned 5 [0143.509] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B", pszSpec="*.7z") returned 0 [0143.509] lstrlenA (lpString="*.7z") returned 4 [0143.509] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B", pszSpec="*.tar") returned 0 [0143.509] lstrlenA (lpString="*.tar") returned 5 [0143.509] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B", pszSpec="*.gzip") returned 0 [0143.509] lstrlenA (lpString="*.gzip") returned 6 [0143.509] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B", pszSpec="*.jpg") returned 0 [0143.509] lstrlenA (lpString="*.jpg") returned 5 [0143.509] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B", pszSpec="*.jpeg") returned 0 [0143.509] lstrlenA (lpString="*.jpeg") returned 6 [0143.509] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B", pszSpec="*.psd") returned 0 [0143.509] lstrlenA (lpString="*.psd") returned 5 [0143.509] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B", pszSpec="*.cdr") returned 0 [0143.509] lstrlenA (lpString="*.cdr") returned 5 [0143.509] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B", pszSpec="*.dwg") returned 0 [0143.509] lstrlenA (lpString="*.dwg") returned 5 [0143.509] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B", pszSpec="*.max") returned 0 [0143.509] lstrlenA (lpString="*.max") returned 5 [0143.509] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B", pszSpec="*.bmp") returned 0 [0143.509] lstrlenA (lpString="*.bmp") returned 5 [0143.509] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B", pszSpec="*.gif") returned 0 [0143.509] lstrlenA (lpString="*.gif") returned 5 [0143.509] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B", pszSpec="*.png") returned 0 [0143.509] lstrlenA (lpString="*.png") returned 5 [0143.509] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B", pszSpec="*.doc") returned 0 [0143.509] lstrlenA (lpString="*.doc") returned 5 [0143.509] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B", pszSpec="*.docx") returned 0 [0143.509] lstrlenA (lpString="*.docx") returned 6 [0143.510] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B", pszSpec="*.xls") returned 0 [0143.510] lstrlenA (lpString="*.xls") returned 5 [0143.510] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B", pszSpec="*.xlsx") returned 0 [0143.510] lstrlenA (lpString="*.xlsx") returned 6 [0143.510] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B", pszSpec="*.ppt") returned 0 [0143.510] lstrlenA (lpString="*.ppt") returned 5 [0143.510] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B", pszSpec="*.pptx") returned 0 [0143.510] lstrlenA (lpString="*.pptx") returned 6 [0143.510] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B", pszSpec="*.txt") returned 0 [0143.510] lstrlenA (lpString="*.txt") returned 5 [0143.510] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B", pszSpec="*.pdf") returned 0 [0143.510] lstrlenA (lpString="*.pdf") returned 5 [0143.510] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B", pszSpec="*.djvu") returned 0 [0143.510] lstrlenA (lpString="*.djvu") returned 6 [0143.510] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B", pszSpec="*.htm") returned 0 [0143.510] lstrlenA (lpString="*.htm") returned 5 [0143.510] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B", pszSpec="*.html") returned 0 [0143.510] lstrlenA (lpString="*.html") returned 6 [0143.510] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B", pszSpec="*.mdb") returned 0 [0143.510] lstrlenA (lpString="*.mdb") returned 5 [0143.510] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B", pszSpec="*.cer") returned 0 [0143.510] lstrlenA (lpString="*.cer") returned 5 [0143.510] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B", pszSpec="*.p12") returned 0 [0143.510] lstrlenA (lpString="*.p12") returned 5 [0143.510] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B", pszSpec="*.pfx") returned 0 [0143.510] lstrlenA (lpString="*.pfx") returned 5 [0143.510] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B", pszSpec="*.kwm") returned 0 [0143.510] lstrlenA (lpString="*.kwm") returned 5 [0143.510] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B", pszSpec="*.pwm") returned 0 [0143.510] lstrlenA (lpString="*.pwm") returned 5 [0143.510] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B", pszSpec="*.1cd") returned 0 [0143.510] lstrlenA (lpString="*.1cd") returned 5 [0143.510] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B", pszSpec="*.md") returned 0 [0143.510] lstrlenA (lpString="*.md") returned 4 [0143.510] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B", pszSpec="*.mdf") returned 0 [0143.510] lstrlenA (lpString="*.mdf") returned 5 [0143.510] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B", pszSpec="*.dbf") returned 0 [0143.510] lstrlenA (lpString="*.dbf") returned 5 [0143.510] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B", pszSpec="*.odt") returned 0 [0143.510] lstrlenA (lpString="*.odt") returned 5 [0143.510] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B", pszSpec="*.vob") returned 0 [0143.510] lstrlenA (lpString="*.vob") returned 5 [0143.511] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B", pszSpec="*.ifo") returned 0 [0143.511] lstrlenA (lpString="*.ifo") returned 5 [0143.511] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B", pszSpec="*.lnk") returned 0 [0143.511] lstrlenA (lpString="*.lnk") returned 5 [0143.511] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B", pszSpec="*.torrent") returned 0 [0143.511] lstrlenA (lpString="*.torrent") returned 9 [0143.511] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B", pszSpec="*.mov") returned 0 [0143.511] lstrlenA (lpString="*.mov") returned 5 [0143.511] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B", pszSpec="*.m2v") returned 0 [0143.511] lstrlenA (lpString="*.m2v") returned 5 [0143.511] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B", pszSpec="*.3gp") returned 0 [0143.511] lstrlenA (lpString="*.3gp") returned 5 [0143.511] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B", pszSpec="*.mpeg") returned 0 [0143.511] lstrlenA (lpString="*.mpeg") returned 6 [0143.511] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B", pszSpec="*.mpg") returned 0 [0143.511] lstrlenA (lpString="*.mpg") returned 5 [0143.511] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B", pszSpec="*.flv") returned 0 [0143.511] lstrlenA (lpString="*.flv") returned 5 [0143.511] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B", pszSpec="*.avi") returned 0 [0143.511] lstrlenA (lpString="*.avi") returned 5 [0143.511] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B", pszSpec="*.mp4") returned 0 [0143.511] lstrlenA (lpString="*.mp4") returned 5 [0143.511] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B", pszSpec="*.wmv") returned 0 [0143.511] lstrlenA (lpString="*.wmv") returned 5 [0143.511] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B", pszSpec="*.divx") returned 0 [0143.511] lstrlenA (lpString="*.divx") returned 6 [0143.511] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B", pszSpec="*.mkv") returned 0 [0143.511] lstrlenA (lpString="*.mkv") returned 5 [0143.511] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B", pszSpec="*.mp3") returned 0 [0143.511] lstrlenA (lpString="*.mp3") returned 5 [0143.511] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B", pszSpec="*.wav") returned 0 [0143.511] lstrlenA (lpString="*.wav") returned 5 [0143.511] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B", pszSpec="*.flac") returned 0 [0143.511] lstrlenA (lpString="*.flac") returned 6 [0143.511] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B", pszSpec="*.ape") returned 0 [0143.511] lstrlenA (lpString="*.ape") returned 5 [0143.511] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B", pszSpec="*.wma") returned 0 [0143.511] lstrlenA (lpString="*.wma") returned 5 [0143.511] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B", pszSpec="*.ac3") returned 0 [0143.511] lstrlenA (lpString="*.ac3") returned 5 [0143.511] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0143.511] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0143.511] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="0F1583FFF42FFF476A09801ACB69213F_E3F4A8C96454D7D3441D2C1BCE81F875") returned 1 [0143.511] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="0F1583FFF42FFF476A09801ACB69213F_E3F4A8C96454D7D3441D2C1BCE81F875") returned 1 [0143.512] lstrcmpiA (lpString1="", lpString2="0F1583FFF42FFF476A09801ACB69213F_E3F4A8C96454D7D3441D2C1BCE81F875") returned -1 [0143.512] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B") returned="024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B" [0143.512] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\", lpString2="0F1583FFF42FFF476A09801ACB69213F_E3F4A8C96454D7D3441D2C1BCE81F875" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\0F1583FFF42FFF476A09801ACB69213F_E3F4A8C96454D7D3441D2C1BCE81F875") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\0F1583FFF42FFF476A09801ACB69213F_E3F4A8C96454D7D3441D2C1BCE81F875" [0143.512] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\0F1583FFF42FFF476A09801ACB69213F_E3F4A8C96454D7D3441D2C1BCE81F875", pszSpec="*.zip") returned 0 [0143.512] lstrlenA (lpString="*.zip") returned 5 [0143.512] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\0F1583FFF42FFF476A09801ACB69213F_E3F4A8C96454D7D3441D2C1BCE81F875", pszSpec="*.rar") returned 0 [0143.512] lstrlenA (lpString="*.rar") returned 5 [0143.512] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\0F1583FFF42FFF476A09801ACB69213F_E3F4A8C96454D7D3441D2C1BCE81F875", pszSpec="*.7z") returned 0 [0143.512] lstrlenA (lpString="*.7z") returned 4 [0143.512] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\0F1583FFF42FFF476A09801ACB69213F_E3F4A8C96454D7D3441D2C1BCE81F875", pszSpec="*.tar") returned 0 [0143.512] lstrlenA (lpString="*.tar") returned 5 [0143.512] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\0F1583FFF42FFF476A09801ACB69213F_E3F4A8C96454D7D3441D2C1BCE81F875", pszSpec="*.gzip") returned 0 [0143.512] lstrlenA (lpString="*.gzip") returned 6 [0143.512] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\0F1583FFF42FFF476A09801ACB69213F_E3F4A8C96454D7D3441D2C1BCE81F875", pszSpec="*.jpg") returned 0 [0143.512] lstrlenA (lpString="*.jpg") returned 5 [0143.512] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\0F1583FFF42FFF476A09801ACB69213F_E3F4A8C96454D7D3441D2C1BCE81F875", pszSpec="*.jpeg") returned 0 [0143.512] lstrlenA (lpString="*.jpeg") returned 6 [0143.512] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\0F1583FFF42FFF476A09801ACB69213F_E3F4A8C96454D7D3441D2C1BCE81F875", pszSpec="*.psd") returned 0 [0143.512] lstrlenA (lpString="*.psd") returned 5 [0143.512] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\0F1583FFF42FFF476A09801ACB69213F_E3F4A8C96454D7D3441D2C1BCE81F875", pszSpec="*.cdr") returned 0 [0143.512] lstrlenA (lpString="*.cdr") returned 5 [0143.512] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\0F1583FFF42FFF476A09801ACB69213F_E3F4A8C96454D7D3441D2C1BCE81F875", pszSpec="*.dwg") returned 0 [0143.512] lstrlenA (lpString="*.dwg") returned 5 [0143.512] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\0F1583FFF42FFF476A09801ACB69213F_E3F4A8C96454D7D3441D2C1BCE81F875", pszSpec="*.max") returned 0 [0143.512] lstrlenA (lpString="*.max") returned 5 [0143.512] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\0F1583FFF42FFF476A09801ACB69213F_E3F4A8C96454D7D3441D2C1BCE81F875", pszSpec="*.bmp") returned 0 [0143.512] lstrlenA (lpString="*.bmp") returned 5 [0143.512] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\0F1583FFF42FFF476A09801ACB69213F_E3F4A8C96454D7D3441D2C1BCE81F875", pszSpec="*.gif") returned 0 [0143.512] lstrlenA (lpString="*.gif") returned 5 [0143.512] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\0F1583FFF42FFF476A09801ACB69213F_E3F4A8C96454D7D3441D2C1BCE81F875", pszSpec="*.png") returned 0 [0143.512] lstrlenA (lpString="*.png") returned 5 [0143.512] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\0F1583FFF42FFF476A09801ACB69213F_E3F4A8C96454D7D3441D2C1BCE81F875", pszSpec="*.doc") returned 0 [0143.512] lstrlenA (lpString="*.doc") returned 5 [0143.512] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\0F1583FFF42FFF476A09801ACB69213F_E3F4A8C96454D7D3441D2C1BCE81F875", pszSpec="*.docx") returned 0 [0143.512] lstrlenA (lpString="*.docx") returned 6 [0143.512] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\0F1583FFF42FFF476A09801ACB69213F_E3F4A8C96454D7D3441D2C1BCE81F875", pszSpec="*.xls") returned 0 [0143.512] lstrlenA (lpString="*.xls") returned 5 [0143.512] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\0F1583FFF42FFF476A09801ACB69213F_E3F4A8C96454D7D3441D2C1BCE81F875", pszSpec="*.xlsx") returned 0 [0143.512] lstrlenA (lpString="*.xlsx") returned 6 [0143.512] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\0F1583FFF42FFF476A09801ACB69213F_E3F4A8C96454D7D3441D2C1BCE81F875", pszSpec="*.ppt") returned 0 [0143.512] lstrlenA (lpString="*.ppt") returned 5 [0143.512] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\0F1583FFF42FFF476A09801ACB69213F_E3F4A8C96454D7D3441D2C1BCE81F875", pszSpec="*.pptx") returned 0 [0143.512] lstrlenA (lpString="*.pptx") returned 6 [0143.512] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\0F1583FFF42FFF476A09801ACB69213F_E3F4A8C96454D7D3441D2C1BCE81F875", pszSpec="*.txt") returned 0 [0143.513] lstrlenA (lpString="*.txt") returned 5 [0143.513] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\0F1583FFF42FFF476A09801ACB69213F_E3F4A8C96454D7D3441D2C1BCE81F875", pszSpec="*.pdf") returned 0 [0143.513] lstrlenA (lpString="*.pdf") returned 5 [0143.513] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\0F1583FFF42FFF476A09801ACB69213F_E3F4A8C96454D7D3441D2C1BCE81F875", pszSpec="*.djvu") returned 0 [0143.513] lstrlenA (lpString="*.djvu") returned 6 [0143.513] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\0F1583FFF42FFF476A09801ACB69213F_E3F4A8C96454D7D3441D2C1BCE81F875", pszSpec="*.htm") returned 0 [0143.513] lstrlenA (lpString="*.htm") returned 5 [0143.513] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\0F1583FFF42FFF476A09801ACB69213F_E3F4A8C96454D7D3441D2C1BCE81F875", pszSpec="*.html") returned 0 [0143.513] lstrlenA (lpString="*.html") returned 6 [0143.513] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\0F1583FFF42FFF476A09801ACB69213F_E3F4A8C96454D7D3441D2C1BCE81F875", pszSpec="*.mdb") returned 0 [0143.513] lstrlenA (lpString="*.mdb") returned 5 [0143.513] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\0F1583FFF42FFF476A09801ACB69213F_E3F4A8C96454D7D3441D2C1BCE81F875", pszSpec="*.cer") returned 0 [0143.513] lstrlenA (lpString="*.cer") returned 5 [0143.513] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\0F1583FFF42FFF476A09801ACB69213F_E3F4A8C96454D7D3441D2C1BCE81F875", pszSpec="*.p12") returned 0 [0143.513] lstrlenA (lpString="*.p12") returned 5 [0143.513] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\0F1583FFF42FFF476A09801ACB69213F_E3F4A8C96454D7D3441D2C1BCE81F875", pszSpec="*.pfx") returned 0 [0143.513] lstrlenA (lpString="*.pfx") returned 5 [0143.513] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\0F1583FFF42FFF476A09801ACB69213F_E3F4A8C96454D7D3441D2C1BCE81F875", pszSpec="*.kwm") returned 0 [0143.513] lstrlenA (lpString="*.kwm") returned 5 [0143.513] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\0F1583FFF42FFF476A09801ACB69213F_E3F4A8C96454D7D3441D2C1BCE81F875", pszSpec="*.pwm") returned 0 [0143.513] lstrlenA (lpString="*.pwm") returned 5 [0143.513] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\0F1583FFF42FFF476A09801ACB69213F_E3F4A8C96454D7D3441D2C1BCE81F875", pszSpec="*.1cd") returned 0 [0143.513] lstrlenA (lpString="*.1cd") returned 5 [0143.513] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\0F1583FFF42FFF476A09801ACB69213F_E3F4A8C96454D7D3441D2C1BCE81F875", pszSpec="*.md") returned 0 [0143.513] lstrlenA (lpString="*.md") returned 4 [0143.513] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\0F1583FFF42FFF476A09801ACB69213F_E3F4A8C96454D7D3441D2C1BCE81F875", pszSpec="*.mdf") returned 0 [0143.513] lstrlenA (lpString="*.mdf") returned 5 [0143.513] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\0F1583FFF42FFF476A09801ACB69213F_E3F4A8C96454D7D3441D2C1BCE81F875", pszSpec="*.dbf") returned 0 [0143.513] lstrlenA (lpString="*.dbf") returned 5 [0143.513] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\0F1583FFF42FFF476A09801ACB69213F_E3F4A8C96454D7D3441D2C1BCE81F875", pszSpec="*.odt") returned 0 [0143.513] lstrlenA (lpString="*.odt") returned 5 [0143.513] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\0F1583FFF42FFF476A09801ACB69213F_E3F4A8C96454D7D3441D2C1BCE81F875", pszSpec="*.vob") returned 0 [0143.513] lstrlenA (lpString="*.vob") returned 5 [0143.513] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\0F1583FFF42FFF476A09801ACB69213F_E3F4A8C96454D7D3441D2C1BCE81F875", pszSpec="*.ifo") returned 0 [0143.513] lstrlenA (lpString="*.ifo") returned 5 [0143.513] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\0F1583FFF42FFF476A09801ACB69213F_E3F4A8C96454D7D3441D2C1BCE81F875", pszSpec="*.lnk") returned 0 [0143.513] lstrlenA (lpString="*.lnk") returned 5 [0143.513] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\0F1583FFF42FFF476A09801ACB69213F_E3F4A8C96454D7D3441D2C1BCE81F875", pszSpec="*.torrent") returned 0 [0143.513] lstrlenA (lpString="*.torrent") returned 9 [0143.513] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\0F1583FFF42FFF476A09801ACB69213F_E3F4A8C96454D7D3441D2C1BCE81F875", pszSpec="*.mov") returned 0 [0143.513] lstrlenA (lpString="*.mov") returned 5 [0143.513] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\0F1583FFF42FFF476A09801ACB69213F_E3F4A8C96454D7D3441D2C1BCE81F875", pszSpec="*.m2v") returned 0 [0143.513] lstrlenA (lpString="*.m2v") returned 5 [0143.513] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\0F1583FFF42FFF476A09801ACB69213F_E3F4A8C96454D7D3441D2C1BCE81F875", pszSpec="*.3gp") returned 0 [0143.513] lstrlenA (lpString="*.3gp") returned 5 [0143.514] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\0F1583FFF42FFF476A09801ACB69213F_E3F4A8C96454D7D3441D2C1BCE81F875", pszSpec="*.mpeg") returned 0 [0143.514] lstrlenA (lpString="*.mpeg") returned 6 [0143.514] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\0F1583FFF42FFF476A09801ACB69213F_E3F4A8C96454D7D3441D2C1BCE81F875", pszSpec="*.mpg") returned 0 [0143.514] lstrlenA (lpString="*.mpg") returned 5 [0143.514] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\0F1583FFF42FFF476A09801ACB69213F_E3F4A8C96454D7D3441D2C1BCE81F875", pszSpec="*.flv") returned 0 [0143.514] lstrlenA (lpString="*.flv") returned 5 [0143.514] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\0F1583FFF42FFF476A09801ACB69213F_E3F4A8C96454D7D3441D2C1BCE81F875", pszSpec="*.avi") returned 0 [0143.514] lstrlenA (lpString="*.avi") returned 5 [0143.514] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\0F1583FFF42FFF476A09801ACB69213F_E3F4A8C96454D7D3441D2C1BCE81F875", pszSpec="*.mp4") returned 0 [0143.514] lstrlenA (lpString="*.mp4") returned 5 [0143.514] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\0F1583FFF42FFF476A09801ACB69213F_E3F4A8C96454D7D3441D2C1BCE81F875", pszSpec="*.wmv") returned 0 [0143.514] lstrlenA (lpString="*.wmv") returned 5 [0143.514] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\0F1583FFF42FFF476A09801ACB69213F_E3F4A8C96454D7D3441D2C1BCE81F875", pszSpec="*.divx") returned 0 [0143.514] lstrlenA (lpString="*.divx") returned 6 [0143.514] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\0F1583FFF42FFF476A09801ACB69213F_E3F4A8C96454D7D3441D2C1BCE81F875", pszSpec="*.mkv") returned 0 [0143.514] lstrlenA (lpString="*.mkv") returned 5 [0143.514] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\0F1583FFF42FFF476A09801ACB69213F_E3F4A8C96454D7D3441D2C1BCE81F875", pszSpec="*.mp3") returned 0 [0143.514] lstrlenA (lpString="*.mp3") returned 5 [0143.514] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\0F1583FFF42FFF476A09801ACB69213F_E3F4A8C96454D7D3441D2C1BCE81F875", pszSpec="*.wav") returned 0 [0143.514] lstrlenA (lpString="*.wav") returned 5 [0143.514] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\0F1583FFF42FFF476A09801ACB69213F_E3F4A8C96454D7D3441D2C1BCE81F875", pszSpec="*.flac") returned 0 [0143.514] lstrlenA (lpString="*.flac") returned 6 [0143.514] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\0F1583FFF42FFF476A09801ACB69213F_E3F4A8C96454D7D3441D2C1BCE81F875", pszSpec="*.ape") returned 0 [0143.514] lstrlenA (lpString="*.ape") returned 5 [0143.514] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\0F1583FFF42FFF476A09801ACB69213F_E3F4A8C96454D7D3441D2C1BCE81F875", pszSpec="*.wma") returned 0 [0143.514] lstrlenA (lpString="*.wma") returned 5 [0143.514] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\0F1583FFF42FFF476A09801ACB69213F_E3F4A8C96454D7D3441D2C1BCE81F875", pszSpec="*.ac3") returned 0 [0143.514] lstrlenA (lpString="*.ac3") returned 5 [0143.514] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0143.514] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0143.514] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="1BB09BEEC155258835C193A7AA85AA5B_A7B2B53AF2A12E2CB0A41B96D21D7973") returned 1 [0143.514] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="1BB09BEEC155258835C193A7AA85AA5B_A7B2B53AF2A12E2CB0A41B96D21D7973") returned 1 [0143.514] lstrcmpiA (lpString1="", lpString2="1BB09BEEC155258835C193A7AA85AA5B_A7B2B53AF2A12E2CB0A41B96D21D7973") returned -1 [0143.514] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\0F1583FFF42FFF476A09801ACB69213F_E3F4A8C96454D7D3441D2C1BCE81F875") returned="0F1583FFF42FFF476A09801ACB69213F_E3F4A8C96454D7D3441D2C1BCE81F875" [0143.514] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\", lpString2="1BB09BEEC155258835C193A7AA85AA5B_A7B2B53AF2A12E2CB0A41B96D21D7973" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\1BB09BEEC155258835C193A7AA85AA5B_A7B2B53AF2A12E2CB0A41B96D21D7973") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\1BB09BEEC155258835C193A7AA85AA5B_A7B2B53AF2A12E2CB0A41B96D21D7973" [0143.514] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\1BB09BEEC155258835C193A7AA85AA5B_A7B2B53AF2A12E2CB0A41B96D21D7973", pszSpec="*.zip") returned 0 [0143.514] lstrlenA (lpString="*.zip") returned 5 [0143.514] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\1BB09BEEC155258835C193A7AA85AA5B_A7B2B53AF2A12E2CB0A41B96D21D7973", pszSpec="*.rar") returned 0 [0143.514] lstrlenA (lpString="*.rar") returned 5 [0143.514] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\1BB09BEEC155258835C193A7AA85AA5B_A7B2B53AF2A12E2CB0A41B96D21D7973", pszSpec="*.7z") returned 0 [0143.514] lstrlenA (lpString="*.7z") returned 4 [0143.514] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\1BB09BEEC155258835C193A7AA85AA5B_A7B2B53AF2A12E2CB0A41B96D21D7973", pszSpec="*.tar") returned 0 [0143.514] lstrlenA (lpString="*.tar") returned 5 [0143.514] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\1BB09BEEC155258835C193A7AA85AA5B_A7B2B53AF2A12E2CB0A41B96D21D7973", pszSpec="*.gzip") returned 0 [0143.514] lstrlenA (lpString="*.gzip") returned 6 [0143.514] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\1BB09BEEC155258835C193A7AA85AA5B_A7B2B53AF2A12E2CB0A41B96D21D7973", pszSpec="*.jpg") returned 0 [0143.515] lstrlenA (lpString="*.jpg") returned 5 [0143.515] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\1BB09BEEC155258835C193A7AA85AA5B_A7B2B53AF2A12E2CB0A41B96D21D7973", pszSpec="*.jpeg") returned 0 [0143.515] lstrlenA (lpString="*.jpeg") returned 6 [0143.515] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\1BB09BEEC155258835C193A7AA85AA5B_A7B2B53AF2A12E2CB0A41B96D21D7973", pszSpec="*.psd") returned 0 [0143.515] lstrlenA (lpString="*.psd") returned 5 [0143.515] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\1BB09BEEC155258835C193A7AA85AA5B_A7B2B53AF2A12E2CB0A41B96D21D7973", pszSpec="*.cdr") returned 0 [0143.515] lstrlenA (lpString="*.cdr") returned 5 [0143.515] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\1BB09BEEC155258835C193A7AA85AA5B_A7B2B53AF2A12E2CB0A41B96D21D7973", pszSpec="*.dwg") returned 0 [0143.515] lstrlenA (lpString="*.dwg") returned 5 [0143.515] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\1BB09BEEC155258835C193A7AA85AA5B_A7B2B53AF2A12E2CB0A41B96D21D7973", pszSpec="*.max") returned 0 [0143.515] lstrlenA (lpString="*.max") returned 5 [0143.515] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\1BB09BEEC155258835C193A7AA85AA5B_A7B2B53AF2A12E2CB0A41B96D21D7973", pszSpec="*.bmp") returned 0 [0143.515] lstrlenA (lpString="*.bmp") returned 5 [0143.515] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\1BB09BEEC155258835C193A7AA85AA5B_A7B2B53AF2A12E2CB0A41B96D21D7973", pszSpec="*.gif") returned 0 [0143.515] lstrlenA (lpString="*.gif") returned 5 [0143.515] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\1BB09BEEC155258835C193A7AA85AA5B_A7B2B53AF2A12E2CB0A41B96D21D7973", pszSpec="*.png") returned 0 [0143.515] lstrlenA (lpString="*.png") returned 5 [0143.515] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\1BB09BEEC155258835C193A7AA85AA5B_A7B2B53AF2A12E2CB0A41B96D21D7973", pszSpec="*.doc") returned 0 [0143.515] lstrlenA (lpString="*.doc") returned 5 [0143.515] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\1BB09BEEC155258835C193A7AA85AA5B_A7B2B53AF2A12E2CB0A41B96D21D7973", pszSpec="*.docx") returned 0 [0143.515] lstrlenA (lpString="*.docx") returned 6 [0143.515] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\1BB09BEEC155258835C193A7AA85AA5B_A7B2B53AF2A12E2CB0A41B96D21D7973", pszSpec="*.xls") returned 0 [0143.515] lstrlenA (lpString="*.xls") returned 5 [0143.515] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\1BB09BEEC155258835C193A7AA85AA5B_A7B2B53AF2A12E2CB0A41B96D21D7973", pszSpec="*.xlsx") returned 0 [0143.515] lstrlenA (lpString="*.xlsx") returned 6 [0143.515] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\1BB09BEEC155258835C193A7AA85AA5B_A7B2B53AF2A12E2CB0A41B96D21D7973", pszSpec="*.ppt") returned 0 [0143.515] lstrlenA (lpString="*.ppt") returned 5 [0143.515] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\1BB09BEEC155258835C193A7AA85AA5B_A7B2B53AF2A12E2CB0A41B96D21D7973", pszSpec="*.pptx") returned 0 [0143.515] lstrlenA (lpString="*.pptx") returned 6 [0143.515] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\1BB09BEEC155258835C193A7AA85AA5B_A7B2B53AF2A12E2CB0A41B96D21D7973", pszSpec="*.txt") returned 0 [0143.515] lstrlenA (lpString="*.txt") returned 5 [0143.515] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\1BB09BEEC155258835C193A7AA85AA5B_A7B2B53AF2A12E2CB0A41B96D21D7973", pszSpec="*.pdf") returned 0 [0143.515] lstrlenA (lpString="*.pdf") returned 5 [0143.515] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\1BB09BEEC155258835C193A7AA85AA5B_A7B2B53AF2A12E2CB0A41B96D21D7973", pszSpec="*.djvu") returned 0 [0143.515] lstrlenA (lpString="*.djvu") returned 6 [0143.515] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\1BB09BEEC155258835C193A7AA85AA5B_A7B2B53AF2A12E2CB0A41B96D21D7973", pszSpec="*.htm") returned 0 [0143.515] lstrlenA (lpString="*.htm") returned 5 [0143.515] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\1BB09BEEC155258835C193A7AA85AA5B_A7B2B53AF2A12E2CB0A41B96D21D7973", pszSpec="*.html") returned 0 [0143.515] lstrlenA (lpString="*.html") returned 6 [0143.515] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\1BB09BEEC155258835C193A7AA85AA5B_A7B2B53AF2A12E2CB0A41B96D21D7973", pszSpec="*.mdb") returned 0 [0143.515] lstrlenA (lpString="*.mdb") returned 5 [0143.515] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\1BB09BEEC155258835C193A7AA85AA5B_A7B2B53AF2A12E2CB0A41B96D21D7973", pszSpec="*.cer") returned 0 [0143.515] lstrlenA (lpString="*.cer") returned 5 [0143.515] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\1BB09BEEC155258835C193A7AA85AA5B_A7B2B53AF2A12E2CB0A41B96D21D7973", pszSpec="*.p12") returned 0 [0143.515] lstrlenA (lpString="*.p12") returned 5 [0143.516] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\1BB09BEEC155258835C193A7AA85AA5B_A7B2B53AF2A12E2CB0A41B96D21D7973", pszSpec="*.pfx") returned 0 [0143.516] lstrlenA (lpString="*.pfx") returned 5 [0143.516] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\1BB09BEEC155258835C193A7AA85AA5B_A7B2B53AF2A12E2CB0A41B96D21D7973", pszSpec="*.kwm") returned 0 [0143.516] lstrlenA (lpString="*.kwm") returned 5 [0143.516] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\1BB09BEEC155258835C193A7AA85AA5B_A7B2B53AF2A12E2CB0A41B96D21D7973", pszSpec="*.pwm") returned 0 [0143.516] lstrlenA (lpString="*.pwm") returned 5 [0143.516] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\1BB09BEEC155258835C193A7AA85AA5B_A7B2B53AF2A12E2CB0A41B96D21D7973", pszSpec="*.1cd") returned 0 [0143.516] lstrlenA (lpString="*.1cd") returned 5 [0143.516] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\1BB09BEEC155258835C193A7AA85AA5B_A7B2B53AF2A12E2CB0A41B96D21D7973", pszSpec="*.md") returned 0 [0143.516] lstrlenA (lpString="*.md") returned 4 [0143.516] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\1BB09BEEC155258835C193A7AA85AA5B_A7B2B53AF2A12E2CB0A41B96D21D7973", pszSpec="*.mdf") returned 0 [0143.516] lstrlenA (lpString="*.mdf") returned 5 [0143.516] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\1BB09BEEC155258835C193A7AA85AA5B_A7B2B53AF2A12E2CB0A41B96D21D7973", pszSpec="*.dbf") returned 0 [0143.516] lstrlenA (lpString="*.dbf") returned 5 [0143.516] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\1BB09BEEC155258835C193A7AA85AA5B_A7B2B53AF2A12E2CB0A41B96D21D7973", pszSpec="*.odt") returned 0 [0143.516] lstrlenA (lpString="*.odt") returned 5 [0143.516] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\1BB09BEEC155258835C193A7AA85AA5B_A7B2B53AF2A12E2CB0A41B96D21D7973", pszSpec="*.vob") returned 0 [0143.516] lstrlenA (lpString="*.vob") returned 5 [0143.516] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\1BB09BEEC155258835C193A7AA85AA5B_A7B2B53AF2A12E2CB0A41B96D21D7973", pszSpec="*.ifo") returned 0 [0143.516] lstrlenA (lpString="*.ifo") returned 5 [0143.516] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\1BB09BEEC155258835C193A7AA85AA5B_A7B2B53AF2A12E2CB0A41B96D21D7973", pszSpec="*.lnk") returned 0 [0143.516] lstrlenA (lpString="*.lnk") returned 5 [0143.516] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\1BB09BEEC155258835C193A7AA85AA5B_A7B2B53AF2A12E2CB0A41B96D21D7973", pszSpec="*.torrent") returned 0 [0143.516] lstrlenA (lpString="*.torrent") returned 9 [0143.516] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\1BB09BEEC155258835C193A7AA85AA5B_A7B2B53AF2A12E2CB0A41B96D21D7973", pszSpec="*.mov") returned 0 [0143.516] lstrlenA (lpString="*.mov") returned 5 [0143.516] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\1BB09BEEC155258835C193A7AA85AA5B_A7B2B53AF2A12E2CB0A41B96D21D7973", pszSpec="*.m2v") returned 0 [0143.516] lstrlenA (lpString="*.m2v") returned 5 [0143.516] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\1BB09BEEC155258835C193A7AA85AA5B_A7B2B53AF2A12E2CB0A41B96D21D7973", pszSpec="*.3gp") returned 0 [0143.516] lstrlenA (lpString="*.3gp") returned 5 [0143.516] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\1BB09BEEC155258835C193A7AA85AA5B_A7B2B53AF2A12E2CB0A41B96D21D7973", pszSpec="*.mpeg") returned 0 [0143.516] lstrlenA (lpString="*.mpeg") returned 6 [0143.516] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\1BB09BEEC155258835C193A7AA85AA5B_A7B2B53AF2A12E2CB0A41B96D21D7973", pszSpec="*.mpg") returned 0 [0143.516] lstrlenA (lpString="*.mpg") returned 5 [0143.516] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\1BB09BEEC155258835C193A7AA85AA5B_A7B2B53AF2A12E2CB0A41B96D21D7973", pszSpec="*.flv") returned 0 [0143.516] lstrlenA (lpString="*.flv") returned 5 [0143.516] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\1BB09BEEC155258835C193A7AA85AA5B_A7B2B53AF2A12E2CB0A41B96D21D7973", pszSpec="*.avi") returned 0 [0143.516] lstrlenA (lpString="*.avi") returned 5 [0143.516] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\1BB09BEEC155258835C193A7AA85AA5B_A7B2B53AF2A12E2CB0A41B96D21D7973", pszSpec="*.mp4") returned 0 [0143.516] lstrlenA (lpString="*.mp4") returned 5 [0143.516] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\1BB09BEEC155258835C193A7AA85AA5B_A7B2B53AF2A12E2CB0A41B96D21D7973", pszSpec="*.wmv") returned 0 [0143.516] lstrlenA (lpString="*.wmv") returned 5 [0143.516] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\1BB09BEEC155258835C193A7AA85AA5B_A7B2B53AF2A12E2CB0A41B96D21D7973", pszSpec="*.divx") returned 0 [0143.516] lstrlenA (lpString="*.divx") returned 6 [0143.517] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\1BB09BEEC155258835C193A7AA85AA5B_A7B2B53AF2A12E2CB0A41B96D21D7973", pszSpec="*.mkv") returned 0 [0143.517] lstrlenA (lpString="*.mkv") returned 5 [0143.517] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\1BB09BEEC155258835C193A7AA85AA5B_A7B2B53AF2A12E2CB0A41B96D21D7973", pszSpec="*.mp3") returned 0 [0143.517] lstrlenA (lpString="*.mp3") returned 5 [0143.517] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\1BB09BEEC155258835C193A7AA85AA5B_A7B2B53AF2A12E2CB0A41B96D21D7973", pszSpec="*.wav") returned 0 [0143.517] lstrlenA (lpString="*.wav") returned 5 [0143.517] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\1BB09BEEC155258835C193A7AA85AA5B_A7B2B53AF2A12E2CB0A41B96D21D7973", pszSpec="*.flac") returned 0 [0143.517] lstrlenA (lpString="*.flac") returned 6 [0143.517] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\1BB09BEEC155258835C193A7AA85AA5B_A7B2B53AF2A12E2CB0A41B96D21D7973", pszSpec="*.ape") returned 0 [0143.517] lstrlenA (lpString="*.ape") returned 5 [0143.517] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\1BB09BEEC155258835C193A7AA85AA5B_A7B2B53AF2A12E2CB0A41B96D21D7973", pszSpec="*.wma") returned 0 [0143.517] lstrlenA (lpString="*.wma") returned 5 [0143.517] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\1BB09BEEC155258835C193A7AA85AA5B_A7B2B53AF2A12E2CB0A41B96D21D7973", pszSpec="*.ac3") returned 0 [0143.517] lstrlenA (lpString="*.ac3") returned 5 [0143.517] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0143.517] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0143.517] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="1DAF2884EC4DFA96BA4A58D4DBC9C406") returned 1 [0143.517] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="1DAF2884EC4DFA96BA4A58D4DBC9C406") returned 1 [0143.517] lstrcmpiA (lpString1="", lpString2="1DAF2884EC4DFA96BA4A58D4DBC9C406") returned -1 [0143.517] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\1BB09BEEC155258835C193A7AA85AA5B_A7B2B53AF2A12E2CB0A41B96D21D7973") returned="1BB09BEEC155258835C193A7AA85AA5B_A7B2B53AF2A12E2CB0A41B96D21D7973" [0143.517] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\", lpString2="1DAF2884EC4DFA96BA4A58D4DBC9C406" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\1DAF2884EC4DFA96BA4A58D4DBC9C406") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\1DAF2884EC4DFA96BA4A58D4DBC9C406" [0143.517] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\1DAF2884EC4DFA96BA4A58D4DBC9C406", pszSpec="*.zip") returned 0 [0143.517] lstrlenA (lpString="*.zip") returned 5 [0143.517] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\1DAF2884EC4DFA96BA4A58D4DBC9C406", pszSpec="*.rar") returned 0 [0143.517] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\1DAF2884EC4DFA96BA4A58D4DBC9C406", pszSpec="*.7z") returned 0 [0143.517] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\1DAF2884EC4DFA96BA4A58D4DBC9C406", pszSpec="*.tar") returned 0 [0143.517] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\1DAF2884EC4DFA96BA4A58D4DBC9C406", pszSpec="*.gzip") returned 0 [0143.517] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\1DAF2884EC4DFA96BA4A58D4DBC9C406", pszSpec="*.jpg") returned 0 [0143.517] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\1DAF2884EC4DFA96BA4A58D4DBC9C406", pszSpec="*.jpeg") returned 0 [0143.518] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\1DAF2884EC4DFA96BA4A58D4DBC9C406", pszSpec="*.psd") returned 0 [0143.518] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\1DAF2884EC4DFA96BA4A58D4DBC9C406", pszSpec="*.cdr") returned 0 [0143.518] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\1DAF2884EC4DFA96BA4A58D4DBC9C406", pszSpec="*.dwg") returned 0 [0143.518] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\1DAF2884EC4DFA96BA4A58D4DBC9C406", pszSpec="*.max") returned 0 [0143.518] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\1DAF2884EC4DFA96BA4A58D4DBC9C406", pszSpec="*.bmp") returned 0 [0143.518] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\1DAF2884EC4DFA96BA4A58D4DBC9C406", pszSpec="*.gif") returned 0 [0143.518] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\1DAF2884EC4DFA96BA4A58D4DBC9C406", pszSpec="*.png") returned 0 [0143.518] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\1DAF2884EC4DFA96BA4A58D4DBC9C406", pszSpec="*.doc") returned 0 [0143.518] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\1DAF2884EC4DFA96BA4A58D4DBC9C406", pszSpec="*.docx") returned 0 [0143.518] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\1DAF2884EC4DFA96BA4A58D4DBC9C406", pszSpec="*.xls") returned 0 [0143.518] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\1DAF2884EC4DFA96BA4A58D4DBC9C406", pszSpec="*.xlsx") returned 0 [0143.518] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\1DAF2884EC4DFA96BA4A58D4DBC9C406", pszSpec="*.ppt") returned 0 [0143.518] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\1DAF2884EC4DFA96BA4A58D4DBC9C406", pszSpec="*.pptx") returned 0 [0143.518] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\1DAF2884EC4DFA96BA4A58D4DBC9C406", pszSpec="*.txt") returned 0 [0143.518] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0143.518] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0143.518] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="23B523C9E7746F715D33C6527C18EB9D") returned 1 [0143.518] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="23B523C9E7746F715D33C6527C18EB9D") returned 1 [0143.518] lstrcmpiA (lpString1="", lpString2="23B523C9E7746F715D33C6527C18EB9D") returned -1 [0143.518] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\1DAF2884EC4DFA96BA4A58D4DBC9C406") returned="1DAF2884EC4DFA96BA4A58D4DBC9C406" [0143.518] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\", lpString2="23B523C9E7746F715D33C6527C18EB9D" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\23B523C9E7746F715D33C6527C18EB9D") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\23B523C9E7746F715D33C6527C18EB9D" [0143.518] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0143.518] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0143.518] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="3130B1871A126520A8C47861EFE3ED4D") returned 1 [0143.518] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="3130B1871A126520A8C47861EFE3ED4D") returned 1 [0143.518] lstrcmpiA (lpString1="", lpString2="3130B1871A126520A8C47861EFE3ED4D") returned -1 [0143.519] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\23B523C9E7746F715D33C6527C18EB9D") returned="23B523C9E7746F715D33C6527C18EB9D" [0143.519] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\", lpString2="3130B1871A126520A8C47861EFE3ED4D" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\3130B1871A126520A8C47861EFE3ED4D") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\3130B1871A126520A8C47861EFE3ED4D" [0143.519] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0143.519] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0143.519] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="3388ECC3F7BC4A9271C10ED8621E5A65_F55C512047947B70F94DE5DEC6D6838D") returned 1 [0143.519] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="3388ECC3F7BC4A9271C10ED8621E5A65_F55C512047947B70F94DE5DEC6D6838D") returned 1 [0143.519] lstrcmpiA (lpString1="", lpString2="3388ECC3F7BC4A9271C10ED8621E5A65_F55C512047947B70F94DE5DEC6D6838D") returned -1 [0143.519] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\3130B1871A126520A8C47861EFE3ED4D") returned="3130B1871A126520A8C47861EFE3ED4D" [0143.519] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\", lpString2="3388ECC3F7BC4A9271C10ED8621E5A65_F55C512047947B70F94DE5DEC6D6838D" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\3388ECC3F7BC4A9271C10ED8621E5A65_F55C512047947B70F94DE5DEC6D6838D") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\3388ECC3F7BC4A9271C10ED8621E5A65_F55C512047947B70F94DE5DEC6D6838D" [0143.519] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0143.519] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0143.519] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="40E450F7CE13419A2CCC2A5445035A0A_06F02B1F13AB4B11B8FC669BDE565AF1") returned 1 [0143.519] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="40E450F7CE13419A2CCC2A5445035A0A_06F02B1F13AB4B11B8FC669BDE565AF1") returned 1 [0143.519] lstrcmpiA (lpString1="", lpString2="40E450F7CE13419A2CCC2A5445035A0A_06F02B1F13AB4B11B8FC669BDE565AF1") returned -1 [0143.519] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\3388ECC3F7BC4A9271C10ED8621E5A65_F55C512047947B70F94DE5DEC6D6838D") returned="3388ECC3F7BC4A9271C10ED8621E5A65_F55C512047947B70F94DE5DEC6D6838D" [0143.519] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\", lpString2="40E450F7CE13419A2CCC2A5445035A0A_06F02B1F13AB4B11B8FC669BDE565AF1" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\40E450F7CE13419A2CCC2A5445035A0A_06F02B1F13AB4B11B8FC669BDE565AF1") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\40E450F7CE13419A2CCC2A5445035A0A_06F02B1F13AB4B11B8FC669BDE565AF1" [0143.519] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0143.519] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0143.519] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="4C8F841FB02DEC8C10108028DB86A08D_8DAFFFD2D43BDC7A1717F5B61C303398") returned 1 [0143.519] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="4C8F841FB02DEC8C10108028DB86A08D_8DAFFFD2D43BDC7A1717F5B61C303398") returned 1 [0143.519] lstrcmpiA (lpString1="", lpString2="4C8F841FB02DEC8C10108028DB86A08D_8DAFFFD2D43BDC7A1717F5B61C303398") returned -1 [0143.519] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\40E450F7CE13419A2CCC2A5445035A0A_06F02B1F13AB4B11B8FC669BDE565AF1") returned="40E450F7CE13419A2CCC2A5445035A0A_06F02B1F13AB4B11B8FC669BDE565AF1" [0143.519] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\", lpString2="4C8F841FB02DEC8C10108028DB86A08D_8DAFFFD2D43BDC7A1717F5B61C303398" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\4C8F841FB02DEC8C10108028DB86A08D_8DAFFFD2D43BDC7A1717F5B61C303398") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\4C8F841FB02DEC8C10108028DB86A08D_8DAFFFD2D43BDC7A1717F5B61C303398" [0143.519] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0143.519] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0143.519] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="4DD39726D4B55AC3B4119B35A893323C_46CCCFB940A93F39A734F69EFCDD76E9") returned 1 [0143.519] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="4DD39726D4B55AC3B4119B35A893323C_46CCCFB940A93F39A734F69EFCDD76E9") returned 1 [0143.519] lstrcmpiA (lpString1="", lpString2="4DD39726D4B55AC3B4119B35A893323C_46CCCFB940A93F39A734F69EFCDD76E9") returned -1 [0143.519] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\4C8F841FB02DEC8C10108028DB86A08D_8DAFFFD2D43BDC7A1717F5B61C303398") returned="4C8F841FB02DEC8C10108028DB86A08D_8DAFFFD2D43BDC7A1717F5B61C303398" [0143.519] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\", lpString2="4DD39726D4B55AC3B4119B35A893323C_46CCCFB940A93F39A734F69EFCDD76E9" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\4DD39726D4B55AC3B4119B35A893323C_46CCCFB940A93F39A734F69EFCDD76E9") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\4DD39726D4B55AC3B4119B35A893323C_46CCCFB940A93F39A734F69EFCDD76E9" [0143.519] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0143.519] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0143.519] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="5080DC7A65DB6A5960ECD874088F3328_2908F682DFC81A793BD240CF29711C77") returned 1 [0143.519] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="5080DC7A65DB6A5960ECD874088F3328_2908F682DFC81A793BD240CF29711C77") returned 1 [0143.519] lstrcmpiA (lpString1="", lpString2="5080DC7A65DB6A5960ECD874088F3328_2908F682DFC81A793BD240CF29711C77") returned -1 [0143.520] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\4DD39726D4B55AC3B4119B35A893323C_46CCCFB940A93F39A734F69EFCDD76E9") returned="4DD39726D4B55AC3B4119B35A893323C_46CCCFB940A93F39A734F69EFCDD76E9" [0143.520] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\", lpString2="5080DC7A65DB6A5960ECD874088F3328_2908F682DFC81A793BD240CF29711C77" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\5080DC7A65DB6A5960ECD874088F3328_2908F682DFC81A793BD240CF29711C77") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\5080DC7A65DB6A5960ECD874088F3328_2908F682DFC81A793BD240CF29711C77" [0143.520] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0143.520] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0143.520] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="5080DC7A65DB6A5960ECD874088F3328_6CBA2C06D5985DD95AE59AF8FC7C6220") returned 1 [0143.520] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="5080DC7A65DB6A5960ECD874088F3328_6CBA2C06D5985DD95AE59AF8FC7C6220") returned 1 [0143.520] lstrcmpiA (lpString1="", lpString2="5080DC7A65DB6A5960ECD874088F3328_6CBA2C06D5985DD95AE59AF8FC7C6220") returned -1 [0143.520] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\5080DC7A65DB6A5960ECD874088F3328_2908F682DFC81A793BD240CF29711C77") returned="5080DC7A65DB6A5960ECD874088F3328_2908F682DFC81A793BD240CF29711C77" [0143.520] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\", lpString2="5080DC7A65DB6A5960ECD874088F3328_6CBA2C06D5985DD95AE59AF8FC7C6220" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\5080DC7A65DB6A5960ECD874088F3328_6CBA2C06D5985DD95AE59AF8FC7C6220") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\5080DC7A65DB6A5960ECD874088F3328_6CBA2C06D5985DD95AE59AF8FC7C6220" [0143.520] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0143.520] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0143.520] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="5457A8CE4B2A7499F8299A013B6E1C7C_CE50F893881D43DC0C815E4D80FAF2B4") returned 1 [0143.520] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="5457A8CE4B2A7499F8299A013B6E1C7C_CE50F893881D43DC0C815E4D80FAF2B4") returned 1 [0143.520] lstrcmpiA (lpString1="", lpString2="5457A8CE4B2A7499F8299A013B6E1C7C_CE50F893881D43DC0C815E4D80FAF2B4") returned -1 [0143.520] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\5080DC7A65DB6A5960ECD874088F3328_6CBA2C06D5985DD95AE59AF8FC7C6220") returned="5080DC7A65DB6A5960ECD874088F3328_6CBA2C06D5985DD95AE59AF8FC7C6220" [0143.520] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\", lpString2="5457A8CE4B2A7499F8299A013B6E1C7C_CE50F893881D43DC0C815E4D80FAF2B4" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\5457A8CE4B2A7499F8299A013B6E1C7C_CE50F893881D43DC0C815E4D80FAF2B4") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\5457A8CE4B2A7499F8299A013B6E1C7C_CE50F893881D43DC0C815E4D80FAF2B4" [0143.520] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0143.520] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0143.520] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="696F3DE637E6DE85B458996D49D759AD") returned 1 [0143.520] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="696F3DE637E6DE85B458996D49D759AD") returned 1 [0143.520] lstrcmpiA (lpString1="", lpString2="696F3DE637E6DE85B458996D49D759AD") returned -1 [0143.520] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\5457A8CE4B2A7499F8299A013B6E1C7C_CE50F893881D43DC0C815E4D80FAF2B4") returned="5457A8CE4B2A7499F8299A013B6E1C7C_CE50F893881D43DC0C815E4D80FAF2B4" [0143.520] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\", lpString2="696F3DE637E6DE85B458996D49D759AD" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\696F3DE637E6DE85B458996D49D759AD") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\696F3DE637E6DE85B458996D49D759AD" [0143.520] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0143.520] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0143.520] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="705A76DE71EA2CAEBB8F0907449CE086_9752C5B2D53EE7A19F7764B52968EC21") returned 1 [0143.520] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="705A76DE71EA2CAEBB8F0907449CE086_9752C5B2D53EE7A19F7764B52968EC21") returned 1 [0143.520] lstrcmpiA (lpString1="", lpString2="705A76DE71EA2CAEBB8F0907449CE086_9752C5B2D53EE7A19F7764B52968EC21") returned -1 [0143.520] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\696F3DE637E6DE85B458996D49D759AD") returned="696F3DE637E6DE85B458996D49D759AD" [0143.520] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\", lpString2="705A76DE71EA2CAEBB8F0907449CE086_9752C5B2D53EE7A19F7764B52968EC21" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\705A76DE71EA2CAEBB8F0907449CE086_9752C5B2D53EE7A19F7764B52968EC21") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\705A76DE71EA2CAEBB8F0907449CE086_9752C5B2D53EE7A19F7764B52968EC21" [0143.520] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0143.520] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0143.520] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="7396C420A8E1BC1DA97F1AF0D10BAD21") returned 1 [0143.521] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="7396C420A8E1BC1DA97F1AF0D10BAD21") returned 1 [0143.521] lstrcmpiA (lpString1="", lpString2="7396C420A8E1BC1DA97F1AF0D10BAD21") returned -1 [0143.521] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\705A76DE71EA2CAEBB8F0907449CE086_9752C5B2D53EE7A19F7764B52968EC21") returned="705A76DE71EA2CAEBB8F0907449CE086_9752C5B2D53EE7A19F7764B52968EC21" [0143.521] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\", lpString2="7396C420A8E1BC1DA97F1AF0D10BAD21" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\7396C420A8E1BC1DA97F1AF0D10BAD21") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\7396C420A8E1BC1DA97F1AF0D10BAD21" [0143.521] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0143.521] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0143.521] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="7423F88C7F265F0DEFC08EA88C3BDE45_D975BBA8033175C8D112023D8A7A8AD6") returned 1 [0143.521] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="7423F88C7F265F0DEFC08EA88C3BDE45_D975BBA8033175C8D112023D8A7A8AD6") returned 1 [0143.522] lstrcmpiA (lpString1="", lpString2="7423F88C7F265F0DEFC08EA88C3BDE45_D975BBA8033175C8D112023D8A7A8AD6") returned -1 [0143.522] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\7396C420A8E1BC1DA97F1AF0D10BAD21") returned="7396C420A8E1BC1DA97F1AF0D10BAD21" [0143.522] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\", lpString2="7423F88C7F265F0DEFC08EA88C3BDE45_D975BBA8033175C8D112023D8A7A8AD6" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\7423F88C7F265F0DEFC08EA88C3BDE45_D975BBA8033175C8D112023D8A7A8AD6") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\7423F88C7F265F0DEFC08EA88C3BDE45_D975BBA8033175C8D112023D8A7A8AD6" [0143.522] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0143.522] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0143.522] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="7B2238AACCEDC3F1FFE8E7EB5F575EC9") returned 1 [0143.522] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="7B2238AACCEDC3F1FFE8E7EB5F575EC9") returned 1 [0143.522] lstrcmpiA (lpString1="", lpString2="7B2238AACCEDC3F1FFE8E7EB5F575EC9") returned -1 [0143.522] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\7423F88C7F265F0DEFC08EA88C3BDE45_D975BBA8033175C8D112023D8A7A8AD6") returned="7423F88C7F265F0DEFC08EA88C3BDE45_D975BBA8033175C8D112023D8A7A8AD6" [0143.522] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\", lpString2="7B2238AACCEDC3F1FFE8E7EB5F575EC9" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\7B2238AACCEDC3F1FFE8E7EB5F575EC9") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\7B2238AACCEDC3F1FFE8E7EB5F575EC9" [0143.522] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0143.522] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0143.522] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="7B8944BA8AD0EFDF0E01A43EF62BECD0_B2DB1CC4B5F2D2A802D56AAED525802D") returned 1 [0143.522] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="7B8944BA8AD0EFDF0E01A43EF62BECD0_B2DB1CC4B5F2D2A802D56AAED525802D") returned 1 [0143.522] lstrcmpiA (lpString1="", lpString2="7B8944BA8AD0EFDF0E01A43EF62BECD0_B2DB1CC4B5F2D2A802D56AAED525802D") returned -1 [0143.523] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\7B2238AACCEDC3F1FFE8E7EB5F575EC9") returned="7B2238AACCEDC3F1FFE8E7EB5F575EC9" [0143.523] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\", lpString2="7B8944BA8AD0EFDF0E01A43EF62BECD0_B2DB1CC4B5F2D2A802D56AAED525802D" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\7B8944BA8AD0EFDF0E01A43EF62BECD0_B2DB1CC4B5F2D2A802D56AAED525802D") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\7B8944BA8AD0EFDF0E01A43EF62BECD0_B2DB1CC4B5F2D2A802D56AAED525802D" [0143.523] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0143.523] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0143.523] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="7D266D9E1E69FA1EEFB9699B009B34C8_0A9BFDD75B598C2110CBF610C078E6E6") returned 1 [0143.523] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="7D266D9E1E69FA1EEFB9699B009B34C8_0A9BFDD75B598C2110CBF610C078E6E6") returned 1 [0143.523] lstrcmpiA (lpString1="", lpString2="7D266D9E1E69FA1EEFB9699B009B34C8_0A9BFDD75B598C2110CBF610C078E6E6") returned -1 [0143.523] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\7B8944BA8AD0EFDF0E01A43EF62BECD0_B2DB1CC4B5F2D2A802D56AAED525802D") returned="7B8944BA8AD0EFDF0E01A43EF62BECD0_B2DB1CC4B5F2D2A802D56AAED525802D" [0143.523] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\", lpString2="7D266D9E1E69FA1EEFB9699B009B34C8_0A9BFDD75B598C2110CBF610C078E6E6" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\7D266D9E1E69FA1EEFB9699B009B34C8_0A9BFDD75B598C2110CBF610C078E6E6") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\7D266D9E1E69FA1EEFB9699B009B34C8_0A9BFDD75B598C2110CBF610C078E6E6" [0143.523] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0143.523] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0143.523] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="7D266D9E1E69FA1EEFB9699B009B34C8_1D5A876A9113EC07224C45E5A870E3BD") returned 1 [0143.523] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="7D266D9E1E69FA1EEFB9699B009B34C8_1D5A876A9113EC07224C45E5A870E3BD") returned 1 [0143.523] lstrcmpiA (lpString1="", lpString2="7D266D9E1E69FA1EEFB9699B009B34C8_1D5A876A9113EC07224C45E5A870E3BD") returned -1 [0143.523] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\7D266D9E1E69FA1EEFB9699B009B34C8_0A9BFDD75B598C2110CBF610C078E6E6") returned="7D266D9E1E69FA1EEFB9699B009B34C8_0A9BFDD75B598C2110CBF610C078E6E6" [0143.523] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\", lpString2="7D266D9E1E69FA1EEFB9699B009B34C8_1D5A876A9113EC07224C45E5A870E3BD" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\7D266D9E1E69FA1EEFB9699B009B34C8_1D5A876A9113EC07224C45E5A870E3BD") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\7D266D9E1E69FA1EEFB9699B009B34C8_1D5A876A9113EC07224C45E5A870E3BD" [0143.523] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0143.523] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0143.523] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="8059E9A0D314877E40FE93D8CCFB3C69_234CB5D64705D4DBB4DA839716359AF0") returned 1 [0143.523] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="8059E9A0D314877E40FE93D8CCFB3C69_234CB5D64705D4DBB4DA839716359AF0") returned 1 [0143.523] lstrcmpiA (lpString1="", lpString2="8059E9A0D314877E40FE93D8CCFB3C69_234CB5D64705D4DBB4DA839716359AF0") returned -1 [0143.524] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\7D266D9E1E69FA1EEFB9699B009B34C8_1D5A876A9113EC07224C45E5A870E3BD") returned="7D266D9E1E69FA1EEFB9699B009B34C8_1D5A876A9113EC07224C45E5A870E3BD" [0143.524] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\", lpString2="8059E9A0D314877E40FE93D8CCFB3C69_234CB5D64705D4DBB4DA839716359AF0" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8059E9A0D314877E40FE93D8CCFB3C69_234CB5D64705D4DBB4DA839716359AF0") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8059E9A0D314877E40FE93D8CCFB3C69_234CB5D64705D4DBB4DA839716359AF0" [0143.524] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0143.524] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0143.524] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="8059E9A0D314877E40FE93D8CCFB3C69_294110D6990EE392327F8A606D55BC1E") returned 1 [0143.524] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="8059E9A0D314877E40FE93D8CCFB3C69_294110D6990EE392327F8A606D55BC1E") returned 1 [0143.524] lstrcmpiA (lpString1="", lpString2="8059E9A0D314877E40FE93D8CCFB3C69_294110D6990EE392327F8A606D55BC1E") returned -1 [0143.524] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8059E9A0D314877E40FE93D8CCFB3C69_234CB5D64705D4DBB4DA839716359AF0") returned="8059E9A0D314877E40FE93D8CCFB3C69_234CB5D64705D4DBB4DA839716359AF0" [0143.524] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\", lpString2="8059E9A0D314877E40FE93D8CCFB3C69_294110D6990EE392327F8A606D55BC1E" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8059E9A0D314877E40FE93D8CCFB3C69_294110D6990EE392327F8A606D55BC1E") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8059E9A0D314877E40FE93D8CCFB3C69_294110D6990EE392327F8A606D55BC1E" [0143.524] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0143.524] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0143.524] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="8059E9A0D314877E40FE93D8CCFB3C69_50167909FCFE0C66153F1901439CBBA1") returned 1 [0143.524] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="8059E9A0D314877E40FE93D8CCFB3C69_50167909FCFE0C66153F1901439CBBA1") returned 1 [0143.524] lstrcmpiA (lpString1="", lpString2="8059E9A0D314877E40FE93D8CCFB3C69_50167909FCFE0C66153F1901439CBBA1") returned -1 [0143.524] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8059E9A0D314877E40FE93D8CCFB3C69_294110D6990EE392327F8A606D55BC1E") returned="8059E9A0D314877E40FE93D8CCFB3C69_294110D6990EE392327F8A606D55BC1E" [0143.524] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\", lpString2="8059E9A0D314877E40FE93D8CCFB3C69_50167909FCFE0C66153F1901439CBBA1" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8059E9A0D314877E40FE93D8CCFB3C69_50167909FCFE0C66153F1901439CBBA1") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8059E9A0D314877E40FE93D8CCFB3C69_50167909FCFE0C66153F1901439CBBA1" [0143.524] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0143.524] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0143.524] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="8059E9A0D314877E40FE93D8CCFB3C69_581C904DB5924E46A6C1A8637614A40E") returned 1 [0143.524] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="8059E9A0D314877E40FE93D8CCFB3C69_581C904DB5924E46A6C1A8637614A40E") returned 1 [0143.524] lstrcmpiA (lpString1="", lpString2="8059E9A0D314877E40FE93D8CCFB3C69_581C904DB5924E46A6C1A8637614A40E") returned -1 [0143.524] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8059E9A0D314877E40FE93D8CCFB3C69_50167909FCFE0C66153F1901439CBBA1") returned="8059E9A0D314877E40FE93D8CCFB3C69_50167909FCFE0C66153F1901439CBBA1" [0143.524] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\", lpString2="8059E9A0D314877E40FE93D8CCFB3C69_581C904DB5924E46A6C1A8637614A40E" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8059E9A0D314877E40FE93D8CCFB3C69_581C904DB5924E46A6C1A8637614A40E") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8059E9A0D314877E40FE93D8CCFB3C69_581C904DB5924E46A6C1A8637614A40E" [0143.524] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0143.524] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0143.524] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="8059E9A0D314877E40FE93D8CCFB3C69_5EA65844B9EF5670A9C002CBD85B10A4") returned 1 [0143.525] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="8059E9A0D314877E40FE93D8CCFB3C69_5EA65844B9EF5670A9C002CBD85B10A4") returned 1 [0143.525] lstrcmpiA (lpString1="", lpString2="8059E9A0D314877E40FE93D8CCFB3C69_5EA65844B9EF5670A9C002CBD85B10A4") returned -1 [0143.525] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8059E9A0D314877E40FE93D8CCFB3C69_581C904DB5924E46A6C1A8637614A40E") returned="8059E9A0D314877E40FE93D8CCFB3C69_581C904DB5924E46A6C1A8637614A40E" [0143.525] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\", lpString2="8059E9A0D314877E40FE93D8CCFB3C69_5EA65844B9EF5670A9C002CBD85B10A4" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8059E9A0D314877E40FE93D8CCFB3C69_5EA65844B9EF5670A9C002CBD85B10A4") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8059E9A0D314877E40FE93D8CCFB3C69_5EA65844B9EF5670A9C002CBD85B10A4" [0143.525] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0143.525] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0143.525] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="8059E9A0D314877E40FE93D8CCFB3C69_74E943F7DAB6D19E37E4854057155778") returned 1 [0143.525] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="8059E9A0D314877E40FE93D8CCFB3C69_74E943F7DAB6D19E37E4854057155778") returned 1 [0143.525] lstrcmpiA (lpString1="", lpString2="8059E9A0D314877E40FE93D8CCFB3C69_74E943F7DAB6D19E37E4854057155778") returned -1 [0143.525] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8059E9A0D314877E40FE93D8CCFB3C69_5EA65844B9EF5670A9C002CBD85B10A4") returned="8059E9A0D314877E40FE93D8CCFB3C69_5EA65844B9EF5670A9C002CBD85B10A4" [0143.525] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\", lpString2="8059E9A0D314877E40FE93D8CCFB3C69_74E943F7DAB6D19E37E4854057155778" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8059E9A0D314877E40FE93D8CCFB3C69_74E943F7DAB6D19E37E4854057155778") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8059E9A0D314877E40FE93D8CCFB3C69_74E943F7DAB6D19E37E4854057155778" [0143.525] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0143.525] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0143.525] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="8059E9A0D314877E40FE93D8CCFB3C69_C080DA2AE431C1A7F3B0C147EEB043ED") returned 1 [0143.525] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="8059E9A0D314877E40FE93D8CCFB3C69_C080DA2AE431C1A7F3B0C147EEB043ED") returned 1 [0143.525] lstrcmpiA (lpString1="", lpString2="8059E9A0D314877E40FE93D8CCFB3C69_C080DA2AE431C1A7F3B0C147EEB043ED") returned -1 [0143.525] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8059E9A0D314877E40FE93D8CCFB3C69_74E943F7DAB6D19E37E4854057155778") returned="8059E9A0D314877E40FE93D8CCFB3C69_74E943F7DAB6D19E37E4854057155778" [0143.525] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\", lpString2="8059E9A0D314877E40FE93D8CCFB3C69_C080DA2AE431C1A7F3B0C147EEB043ED" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8059E9A0D314877E40FE93D8CCFB3C69_C080DA2AE431C1A7F3B0C147EEB043ED") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8059E9A0D314877E40FE93D8CCFB3C69_C080DA2AE431C1A7F3B0C147EEB043ED" [0143.525] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0143.525] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0143.525] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="8059E9A0D314877E40FE93D8CCFB3C69_E907D7A04657714B5B06D18BC920971E") returned 1 [0143.525] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="8059E9A0D314877E40FE93D8CCFB3C69_E907D7A04657714B5B06D18BC920971E") returned 1 [0143.525] lstrcmpiA (lpString1="", lpString2="8059E9A0D314877E40FE93D8CCFB3C69_E907D7A04657714B5B06D18BC920971E") returned -1 [0143.525] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8059E9A0D314877E40FE93D8CCFB3C69_C080DA2AE431C1A7F3B0C147EEB043ED") returned="8059E9A0D314877E40FE93D8CCFB3C69_C080DA2AE431C1A7F3B0C147EEB043ED" [0143.525] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\", lpString2="8059E9A0D314877E40FE93D8CCFB3C69_E907D7A04657714B5B06D18BC920971E" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8059E9A0D314877E40FE93D8CCFB3C69_E907D7A04657714B5B06D18BC920971E") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8059E9A0D314877E40FE93D8CCFB3C69_E907D7A04657714B5B06D18BC920971E" [0143.525] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0143.526] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0143.526] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="8059E9A0D314877E40FE93D8CCFB3C69_F2318F7AB33980A131A265454C39CA30") returned 1 [0143.526] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="8059E9A0D314877E40FE93D8CCFB3C69_F2318F7AB33980A131A265454C39CA30") returned 1 [0143.526] lstrcmpiA (lpString1="", lpString2="8059E9A0D314877E40FE93D8CCFB3C69_F2318F7AB33980A131A265454C39CA30") returned -1 [0143.526] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8059E9A0D314877E40FE93D8CCFB3C69_E907D7A04657714B5B06D18BC920971E") returned="8059E9A0D314877E40FE93D8CCFB3C69_E907D7A04657714B5B06D18BC920971E" [0143.526] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\", lpString2="8059E9A0D314877E40FE93D8CCFB3C69_F2318F7AB33980A131A265454C39CA30" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8059E9A0D314877E40FE93D8CCFB3C69_F2318F7AB33980A131A265454C39CA30") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8059E9A0D314877E40FE93D8CCFB3C69_F2318F7AB33980A131A265454C39CA30" [0143.526] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0143.526] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0143.526] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="8059E9A0D314877E40FE93D8CCFB3C69_F6E15778DC8E326895C606FBFA0392EB") returned 1 [0143.526] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="8059E9A0D314877E40FE93D8CCFB3C69_F6E15778DC8E326895C606FBFA0392EB") returned 1 [0143.526] lstrcmpiA (lpString1="", lpString2="8059E9A0D314877E40FE93D8CCFB3C69_F6E15778DC8E326895C606FBFA0392EB") returned -1 [0143.526] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8059E9A0D314877E40FE93D8CCFB3C69_F2318F7AB33980A131A265454C39CA30") returned="8059E9A0D314877E40FE93D8CCFB3C69_F2318F7AB33980A131A265454C39CA30" [0143.526] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\", lpString2="8059E9A0D314877E40FE93D8CCFB3C69_F6E15778DC8E326895C606FBFA0392EB" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8059E9A0D314877E40FE93D8CCFB3C69_F6E15778DC8E326895C606FBFA0392EB") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8059E9A0D314877E40FE93D8CCFB3C69_F6E15778DC8E326895C606FBFA0392EB" [0143.526] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0143.526] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0143.526] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="828298824EA5549947C17DDABF6871F5_0206EFBC540300C3BF0163CDBC3D7D56") returned 1 [0143.526] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="828298824EA5549947C17DDABF6871F5_0206EFBC540300C3BF0163CDBC3D7D56") returned 1 [0143.526] lstrcmpiA (lpString1="", lpString2="828298824EA5549947C17DDABF6871F5_0206EFBC540300C3BF0163CDBC3D7D56") returned -1 [0143.526] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8059E9A0D314877E40FE93D8CCFB3C69_F6E15778DC8E326895C606FBFA0392EB") returned="8059E9A0D314877E40FE93D8CCFB3C69_F6E15778DC8E326895C606FBFA0392EB" [0143.526] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\", lpString2="828298824EA5549947C17DDABF6871F5_0206EFBC540300C3BF0163CDBC3D7D56" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\828298824EA5549947C17DDABF6871F5_0206EFBC540300C3BF0163CDBC3D7D56") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\828298824EA5549947C17DDABF6871F5_0206EFBC540300C3BF0163CDBC3D7D56" [0143.526] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0143.526] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0143.526] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="8828F39C7C0CE9A14B25C7EB321181BA_3DF94EB797096674F7793A562A778C5F") returned 1 [0143.526] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="8828F39C7C0CE9A14B25C7EB321181BA_3DF94EB797096674F7793A562A778C5F") returned 1 [0143.526] lstrcmpiA (lpString1="", lpString2="8828F39C7C0CE9A14B25C7EB321181BA_3DF94EB797096674F7793A562A778C5F") returned -1 [0143.526] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\828298824EA5549947C17DDABF6871F5_0206EFBC540300C3BF0163CDBC3D7D56") returned="828298824EA5549947C17DDABF6871F5_0206EFBC540300C3BF0163CDBC3D7D56" [0143.526] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\", lpString2="8828F39C7C0CE9A14B25C7EB321181BA_3DF94EB797096674F7793A562A778C5F" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8828F39C7C0CE9A14B25C7EB321181BA_3DF94EB797096674F7793A562A778C5F") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8828F39C7C0CE9A14B25C7EB321181BA_3DF94EB797096674F7793A562A778C5F" [0143.527] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0143.527] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0143.527] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="8828F39C7C0CE9A14B25C7EB321181BA_C6EF73E4482B2588B1252D1A64B99416") returned 1 [0143.527] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="8828F39C7C0CE9A14B25C7EB321181BA_C6EF73E4482B2588B1252D1A64B99416") returned 1 [0143.527] lstrcmpiA (lpString1="", lpString2="8828F39C7C0CE9A14B25C7EB321181BA_C6EF73E4482B2588B1252D1A64B99416") returned -1 [0143.527] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8828F39C7C0CE9A14B25C7EB321181BA_3DF94EB797096674F7793A562A778C5F") returned="8828F39C7C0CE9A14B25C7EB321181BA_3DF94EB797096674F7793A562A778C5F" [0143.527] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\", lpString2="8828F39C7C0CE9A14B25C7EB321181BA_C6EF73E4482B2588B1252D1A64B99416" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8828F39C7C0CE9A14B25C7EB321181BA_C6EF73E4482B2588B1252D1A64B99416") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8828F39C7C0CE9A14B25C7EB321181BA_C6EF73E4482B2588B1252D1A64B99416" [0143.527] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0143.527] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0143.527] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="8E4E510F44A56B8C8ECFEC352907C373_411140098D71F028134E9B8A21255C61") returned 1 [0143.527] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="8E4E510F44A56B8C8ECFEC352907C373_411140098D71F028134E9B8A21255C61") returned 1 [0143.527] lstrcmpiA (lpString1="", lpString2="8E4E510F44A56B8C8ECFEC352907C373_411140098D71F028134E9B8A21255C61") returned -1 [0143.527] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8828F39C7C0CE9A14B25C7EB321181BA_C6EF73E4482B2588B1252D1A64B99416") returned="8828F39C7C0CE9A14B25C7EB321181BA_C6EF73E4482B2588B1252D1A64B99416" [0143.527] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\", lpString2="8E4E510F44A56B8C8ECFEC352907C373_411140098D71F028134E9B8A21255C61" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8E4E510F44A56B8C8ECFEC352907C373_411140098D71F028134E9B8A21255C61") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8E4E510F44A56B8C8ECFEC352907C373_411140098D71F028134E9B8A21255C61" [0143.527] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0143.527] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0143.527] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="94308059B57B3142E455B38A6EB92015") returned 1 [0143.527] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="94308059B57B3142E455B38A6EB92015") returned 1 [0143.527] lstrcmpiA (lpString1="", lpString2="94308059B57B3142E455B38A6EB92015") returned -1 [0143.527] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8E4E510F44A56B8C8ECFEC352907C373_411140098D71F028134E9B8A21255C61") returned="8E4E510F44A56B8C8ECFEC352907C373_411140098D71F028134E9B8A21255C61" [0143.527] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\", lpString2="94308059B57B3142E455B38A6EB92015" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\94308059B57B3142E455B38A6EB92015") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\94308059B57B3142E455B38A6EB92015" [0143.527] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0143.527] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0143.527] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="955CAB6FF6A24D5820D50B5BA1CF79C7_AD9E7615297A3A83320AACE5801A04F9") returned 1 [0143.527] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="955CAB6FF6A24D5820D50B5BA1CF79C7_AD9E7615297A3A83320AACE5801A04F9") returned 1 [0143.527] lstrcmpiA (lpString1="", lpString2="955CAB6FF6A24D5820D50B5BA1CF79C7_AD9E7615297A3A83320AACE5801A04F9") returned -1 [0143.527] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\94308059B57B3142E455B38A6EB92015") returned="94308059B57B3142E455B38A6EB92015" [0143.527] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\", lpString2="955CAB6FF6A24D5820D50B5BA1CF79C7_AD9E7615297A3A83320AACE5801A04F9" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\955CAB6FF6A24D5820D50B5BA1CF79C7_AD9E7615297A3A83320AACE5801A04F9") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\955CAB6FF6A24D5820D50B5BA1CF79C7_AD9E7615297A3A83320AACE5801A04F9" [0143.528] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0143.528] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0143.528] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="9BC2FFC5D9591E1BD3545230E9B7CC36_CF30943571F9BEE96C487B2D9F0436E6") returned 1 [0143.528] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="9BC2FFC5D9591E1BD3545230E9B7CC36_CF30943571F9BEE96C487B2D9F0436E6") returned 1 [0143.528] lstrcmpiA (lpString1="", lpString2="9BC2FFC5D9591E1BD3545230E9B7CC36_CF30943571F9BEE96C487B2D9F0436E6") returned -1 [0143.528] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\955CAB6FF6A24D5820D50B5BA1CF79C7_AD9E7615297A3A83320AACE5801A04F9") returned="955CAB6FF6A24D5820D50B5BA1CF79C7_AD9E7615297A3A83320AACE5801A04F9" [0143.528] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\", lpString2="9BC2FFC5D9591E1BD3545230E9B7CC36_CF30943571F9BEE96C487B2D9F0436E6" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\9BC2FFC5D9591E1BD3545230E9B7CC36_CF30943571F9BEE96C487B2D9F0436E6") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\9BC2FFC5D9591E1BD3545230E9B7CC36_CF30943571F9BEE96C487B2D9F0436E6" [0143.528] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0143.528] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0143.528] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="9C888BEABCCBC2A97B0D6D9214C3BA37_1213DC6F71E4C3B05E7BCEEBC203A31E") returned 1 [0143.528] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="9C888BEABCCBC2A97B0D6D9214C3BA37_1213DC6F71E4C3B05E7BCEEBC203A31E") returned 1 [0143.528] lstrcmpiA (lpString1="", lpString2="9C888BEABCCBC2A97B0D6D9214C3BA37_1213DC6F71E4C3B05E7BCEEBC203A31E") returned -1 [0143.528] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\9BC2FFC5D9591E1BD3545230E9B7CC36_CF30943571F9BEE96C487B2D9F0436E6") returned="9BC2FFC5D9591E1BD3545230E9B7CC36_CF30943571F9BEE96C487B2D9F0436E6" [0143.528] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\", lpString2="9C888BEABCCBC2A97B0D6D9214C3BA37_1213DC6F71E4C3B05E7BCEEBC203A31E" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\9C888BEABCCBC2A97B0D6D9214C3BA37_1213DC6F71E4C3B05E7BCEEBC203A31E") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\9C888BEABCCBC2A97B0D6D9214C3BA37_1213DC6F71E4C3B05E7BCEEBC203A31E" [0143.528] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0143.528] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0143.528] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="9C888BEABCCBC2A97B0D6D9214C3BA37_EBC75728C6119A77E4DA8559DD10F061") returned 1 [0143.528] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="9C888BEABCCBC2A97B0D6D9214C3BA37_EBC75728C6119A77E4DA8559DD10F061") returned 1 [0143.528] lstrcmpiA (lpString1="", lpString2="9C888BEABCCBC2A97B0D6D9214C3BA37_EBC75728C6119A77E4DA8559DD10F061") returned -1 [0143.528] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\9C888BEABCCBC2A97B0D6D9214C3BA37_1213DC6F71E4C3B05E7BCEEBC203A31E") returned="9C888BEABCCBC2A97B0D6D9214C3BA37_1213DC6F71E4C3B05E7BCEEBC203A31E" [0143.528] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\", lpString2="9C888BEABCCBC2A97B0D6D9214C3BA37_EBC75728C6119A77E4DA8559DD10F061" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\9C888BEABCCBC2A97B0D6D9214C3BA37_EBC75728C6119A77E4DA8559DD10F061") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\9C888BEABCCBC2A97B0D6D9214C3BA37_EBC75728C6119A77E4DA8559DD10F061" [0143.528] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0143.528] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0143.528] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="A9E4F776657345B52012CE8E279D314C_183A5BE0B233CC1D513955FABECF9450") returned 1 [0143.528] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="A9E4F776657345B52012CE8E279D314C_183A5BE0B233CC1D513955FABECF9450") returned 1 [0143.529] lstrcmpiA (lpString1="", lpString2="A9E4F776657345B52012CE8E279D314C_183A5BE0B233CC1D513955FABECF9450") returned -1 [0143.529] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\9C888BEABCCBC2A97B0D6D9214C3BA37_EBC75728C6119A77E4DA8559DD10F061") returned="9C888BEABCCBC2A97B0D6D9214C3BA37_EBC75728C6119A77E4DA8559DD10F061" [0143.529] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\", lpString2="A9E4F776657345B52012CE8E279D314C_183A5BE0B233CC1D513955FABECF9450" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\A9E4F776657345B52012CE8E279D314C_183A5BE0B233CC1D513955FABECF9450") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\A9E4F776657345B52012CE8E279D314C_183A5BE0B233CC1D513955FABECF9450" [0143.529] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0143.529] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0143.529] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="ACF244F1A10D4DBED0D88EBA0C43A9B5_BA1AB6C2BDFDF57799E8116E4002D001") returned 1 [0143.529] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ACF244F1A10D4DBED0D88EBA0C43A9B5_BA1AB6C2BDFDF57799E8116E4002D001") returned 1 [0143.529] lstrcmpiA (lpString1="", lpString2="ACF244F1A10D4DBED0D88EBA0C43A9B5_BA1AB6C2BDFDF57799E8116E4002D001") returned -1 [0143.529] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\A9E4F776657345B52012CE8E279D314C_183A5BE0B233CC1D513955FABECF9450") returned="A9E4F776657345B52012CE8E279D314C_183A5BE0B233CC1D513955FABECF9450" [0143.529] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\", lpString2="ACF244F1A10D4DBED0D88EBA0C43A9B5_BA1AB6C2BDFDF57799E8116E4002D001" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\ACF244F1A10D4DBED0D88EBA0C43A9B5_BA1AB6C2BDFDF57799E8116E4002D001") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\ACF244F1A10D4DBED0D88EBA0C43A9B5_BA1AB6C2BDFDF57799E8116E4002D001" [0143.529] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0143.529] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0143.529] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="B3BB9C1BA2D19E090AE305B2683903A0_6F0A84CE2BA99BD19D42C92610275852") returned 1 [0143.529] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="B3BB9C1BA2D19E090AE305B2683903A0_6F0A84CE2BA99BD19D42C92610275852") returned 1 [0143.529] lstrcmpiA (lpString1="", lpString2="B3BB9C1BA2D19E090AE305B2683903A0_6F0A84CE2BA99BD19D42C92610275852") returned -1 [0143.529] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\ACF244F1A10D4DBED0D88EBA0C43A9B5_BA1AB6C2BDFDF57799E8116E4002D001") returned="ACF244F1A10D4DBED0D88EBA0C43A9B5_BA1AB6C2BDFDF57799E8116E4002D001" [0143.529] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\", lpString2="B3BB9C1BA2D19E090AE305B2683903A0_6F0A84CE2BA99BD19D42C92610275852" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\B3BB9C1BA2D19E090AE305B2683903A0_6F0A84CE2BA99BD19D42C92610275852") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\B3BB9C1BA2D19E090AE305B2683903A0_6F0A84CE2BA99BD19D42C92610275852" [0143.529] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0143.529] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0143.529] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="B3BB9C1BA2D19E090AE305B2683903A0_B89A63AC6877BD1ED812438CE82C3EB8") returned 1 [0143.529] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="B3BB9C1BA2D19E090AE305B2683903A0_B89A63AC6877BD1ED812438CE82C3EB8") returned 1 [0143.529] lstrcmpiA (lpString1="", lpString2="B3BB9C1BA2D19E090AE305B2683903A0_B89A63AC6877BD1ED812438CE82C3EB8") returned -1 [0143.529] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\B3BB9C1BA2D19E090AE305B2683903A0_6F0A84CE2BA99BD19D42C92610275852") returned="B3BB9C1BA2D19E090AE305B2683903A0_6F0A84CE2BA99BD19D42C92610275852" [0143.529] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\", lpString2="B3BB9C1BA2D19E090AE305B2683903A0_B89A63AC6877BD1ED812438CE82C3EB8" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\B3BB9C1BA2D19E090AE305B2683903A0_B89A63AC6877BD1ED812438CE82C3EB8") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\B3BB9C1BA2D19E090AE305B2683903A0_B89A63AC6877BD1ED812438CE82C3EB8" [0143.529] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0143.530] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0143.530] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BC570EC0DE58335AFAF92FDC8E3AA330_6CE6E578B5C8485B4BE3C4D58E12F150") returned 1 [0143.530] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BC570EC0DE58335AFAF92FDC8E3AA330_6CE6E578B5C8485B4BE3C4D58E12F150") returned 1 [0143.530] lstrcmpiA (lpString1="", lpString2="BC570EC0DE58335AFAF92FDC8E3AA330_6CE6E578B5C8485B4BE3C4D58E12F150") returned -1 [0143.530] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\B3BB9C1BA2D19E090AE305B2683903A0_B89A63AC6877BD1ED812438CE82C3EB8") returned="B3BB9C1BA2D19E090AE305B2683903A0_B89A63AC6877BD1ED812438CE82C3EB8" [0143.530] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\", lpString2="BC570EC0DE58335AFAF92FDC8E3AA330_6CE6E578B5C8485B4BE3C4D58E12F150" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\BC570EC0DE58335AFAF92FDC8E3AA330_6CE6E578B5C8485B4BE3C4D58E12F150") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\BC570EC0DE58335AFAF92FDC8E3AA330_6CE6E578B5C8485B4BE3C4D58E12F150" [0143.530] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0143.530] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0143.530] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="BC570EC0DE58335AFAF92FDC8E3AA330_F4D449CA9E0EACCFE15946F8FCD349FC") returned 1 [0143.530] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="BC570EC0DE58335AFAF92FDC8E3AA330_F4D449CA9E0EACCFE15946F8FCD349FC") returned 1 [0143.530] lstrcmpiA (lpString1="", lpString2="BC570EC0DE58335AFAF92FDC8E3AA330_F4D449CA9E0EACCFE15946F8FCD349FC") returned -1 [0143.530] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\BC570EC0DE58335AFAF92FDC8E3AA330_6CE6E578B5C8485B4BE3C4D58E12F150") returned="BC570EC0DE58335AFAF92FDC8E3AA330_6CE6E578B5C8485B4BE3C4D58E12F150" [0143.530] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\", lpString2="BC570EC0DE58335AFAF92FDC8E3AA330_F4D449CA9E0EACCFE15946F8FCD349FC" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\BC570EC0DE58335AFAF92FDC8E3AA330_F4D449CA9E0EACCFE15946F8FCD349FC") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\BC570EC0DE58335AFAF92FDC8E3AA330_F4D449CA9E0EACCFE15946F8FCD349FC" [0143.530] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0143.530] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0143.530] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="C46E7B0F942663A1EDC8D9D6D7869173_42820CDFEA41DC84AAB89A6B63561873") returned 1 [0143.530] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="C46E7B0F942663A1EDC8D9D6D7869173_42820CDFEA41DC84AAB89A6B63561873") returned 1 [0143.530] lstrcmpiA (lpString1="", lpString2="C46E7B0F942663A1EDC8D9D6D7869173_42820CDFEA41DC84AAB89A6B63561873") returned -1 [0143.530] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\BC570EC0DE58335AFAF92FDC8E3AA330_F4D449CA9E0EACCFE15946F8FCD349FC") returned="BC570EC0DE58335AFAF92FDC8E3AA330_F4D449CA9E0EACCFE15946F8FCD349FC" [0143.530] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\", lpString2="C46E7B0F942663A1EDC8D9D6D7869173_42820CDFEA41DC84AAB89A6B63561873" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\C46E7B0F942663A1EDC8D9D6D7869173_42820CDFEA41DC84AAB89A6B63561873") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\C46E7B0F942663A1EDC8D9D6D7869173_42820CDFEA41DC84AAB89A6B63561873" [0143.530] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0143.530] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0143.530] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="C46E7B0F942663A1EDC8D9D6D7869173_6043FC604A395E1485AF7AC16D16B7CE") returned 1 [0143.530] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="C46E7B0F942663A1EDC8D9D6D7869173_6043FC604A395E1485AF7AC16D16B7CE") returned 1 [0143.530] lstrcmpiA (lpString1="", lpString2="C46E7B0F942663A1EDC8D9D6D7869173_6043FC604A395E1485AF7AC16D16B7CE") returned -1 [0143.530] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\C46E7B0F942663A1EDC8D9D6D7869173_42820CDFEA41DC84AAB89A6B63561873") returned="C46E7B0F942663A1EDC8D9D6D7869173_42820CDFEA41DC84AAB89A6B63561873" [0143.530] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\", lpString2="C46E7B0F942663A1EDC8D9D6D7869173_6043FC604A395E1485AF7AC16D16B7CE" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\C46E7B0F942663A1EDC8D9D6D7869173_6043FC604A395E1485AF7AC16D16B7CE") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\C46E7B0F942663A1EDC8D9D6D7869173_6043FC604A395E1485AF7AC16D16B7CE" [0143.531] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0143.531] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0143.531] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="C46E7B0F942663A1EDC8D9D6D7869173_D9B9F37ECE595B0B7B6AA12451D392CF") returned 1 [0143.531] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="C46E7B0F942663A1EDC8D9D6D7869173_D9B9F37ECE595B0B7B6AA12451D392CF") returned 1 [0143.531] lstrcmpiA (lpString1="", lpString2="C46E7B0F942663A1EDC8D9D6D7869173_D9B9F37ECE595B0B7B6AA12451D392CF") returned -1 [0143.531] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\C46E7B0F942663A1EDC8D9D6D7869173_6043FC604A395E1485AF7AC16D16B7CE") returned="C46E7B0F942663A1EDC8D9D6D7869173_6043FC604A395E1485AF7AC16D16B7CE" [0143.531] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\", lpString2="C46E7B0F942663A1EDC8D9D6D7869173_D9B9F37ECE595B0B7B6AA12451D392CF" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\C46E7B0F942663A1EDC8D9D6D7869173_D9B9F37ECE595B0B7B6AA12451D392CF") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\C46E7B0F942663A1EDC8D9D6D7869173_D9B9F37ECE595B0B7B6AA12451D392CF" [0143.531] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0143.531] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0143.531] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="D47DBD2F9E3365FBBE008D71FB06716F_4DD1053BCC726DA41115FFF4C7D6E9CC") returned 1 [0143.531] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="D47DBD2F9E3365FBBE008D71FB06716F_4DD1053BCC726DA41115FFF4C7D6E9CC") returned 1 [0143.531] lstrcmpiA (lpString1="", lpString2="D47DBD2F9E3365FBBE008D71FB06716F_4DD1053BCC726DA41115FFF4C7D6E9CC") returned -1 [0143.531] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\C46E7B0F942663A1EDC8D9D6D7869173_D9B9F37ECE595B0B7B6AA12451D392CF") returned="C46E7B0F942663A1EDC8D9D6D7869173_D9B9F37ECE595B0B7B6AA12451D392CF" [0143.531] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\", lpString2="D47DBD2F9E3365FBBE008D71FB06716F_4DD1053BCC726DA41115FFF4C7D6E9CC" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\D47DBD2F9E3365FBBE008D71FB06716F_4DD1053BCC726DA41115FFF4C7D6E9CC") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\D47DBD2F9E3365FBBE008D71FB06716F_4DD1053BCC726DA41115FFF4C7D6E9CC" [0143.531] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0143.531] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0143.531] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="D47DBD2F9E3365FBBE008D71FB06716F_D33192D58AA9CA2B9097E848E9FE86DE") returned 1 [0143.531] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="D47DBD2F9E3365FBBE008D71FB06716F_D33192D58AA9CA2B9097E848E9FE86DE") returned 1 [0143.531] lstrcmpiA (lpString1="", lpString2="D47DBD2F9E3365FBBE008D71FB06716F_D33192D58AA9CA2B9097E848E9FE86DE") returned -1 [0143.531] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\D47DBD2F9E3365FBBE008D71FB06716F_4DD1053BCC726DA41115FFF4C7D6E9CC") returned="D47DBD2F9E3365FBBE008D71FB06716F_4DD1053BCC726DA41115FFF4C7D6E9CC" [0143.531] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\", lpString2="D47DBD2F9E3365FBBE008D71FB06716F_D33192D58AA9CA2B9097E848E9FE86DE" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\D47DBD2F9E3365FBBE008D71FB06716F_D33192D58AA9CA2B9097E848E9FE86DE") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\D47DBD2F9E3365FBBE008D71FB06716F_D33192D58AA9CA2B9097E848E9FE86DE" [0143.531] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0143.531] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0143.531] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="D52C56D8F24BEC96604372AFBAF264E1_E76A2B627DD019EB51D9335F24B14C2C") returned 1 [0143.531] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="D52C56D8F24BEC96604372AFBAF264E1_E76A2B627DD019EB51D9335F24B14C2C") returned 1 [0143.531] lstrcmpiA (lpString1="", lpString2="D52C56D8F24BEC96604372AFBAF264E1_E76A2B627DD019EB51D9335F24B14C2C") returned -1 [0143.531] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\D47DBD2F9E3365FBBE008D71FB06716F_D33192D58AA9CA2B9097E848E9FE86DE") returned="D47DBD2F9E3365FBBE008D71FB06716F_D33192D58AA9CA2B9097E848E9FE86DE" [0143.531] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\", lpString2="D52C56D8F24BEC96604372AFBAF264E1_E76A2B627DD019EB51D9335F24B14C2C" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\D52C56D8F24BEC96604372AFBAF264E1_E76A2B627DD019EB51D9335F24B14C2C") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\D52C56D8F24BEC96604372AFBAF264E1_E76A2B627DD019EB51D9335F24B14C2C" [0143.532] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0143.532] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0143.532] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="EA618097E393409AFA316F0F87E2C202_827C1B837652B048C4C84237D0838585") returned 1 [0143.532] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="EA618097E393409AFA316F0F87E2C202_827C1B837652B048C4C84237D0838585") returned 1 [0143.532] lstrcmpiA (lpString1="", lpString2="EA618097E393409AFA316F0F87E2C202_827C1B837652B048C4C84237D0838585") returned -1 [0143.532] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\D52C56D8F24BEC96604372AFBAF264E1_E76A2B627DD019EB51D9335F24B14C2C") returned="D52C56D8F24BEC96604372AFBAF264E1_E76A2B627DD019EB51D9335F24B14C2C" [0143.532] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\", lpString2="EA618097E393409AFA316F0F87E2C202_827C1B837652B048C4C84237D0838585" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\EA618097E393409AFA316F0F87E2C202_827C1B837652B048C4C84237D0838585") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\EA618097E393409AFA316F0F87E2C202_827C1B837652B048C4C84237D0838585" [0143.532] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0143.532] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0143.532] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="F293AEAD5E84FACFB686C4A620718928_C8424A0B24A72939B13720D0C000C9C1") returned -1 [0143.532] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="F293AEAD5E84FACFB686C4A620718928_C8424A0B24A72939B13720D0C000C9C1") returned 1 [0143.532] lstrcmpiA (lpString1="", lpString2="F293AEAD5E84FACFB686C4A620718928_C8424A0B24A72939B13720D0C000C9C1") returned -1 [0143.532] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\EA618097E393409AFA316F0F87E2C202_827C1B837652B048C4C84237D0838585") returned="EA618097E393409AFA316F0F87E2C202_827C1B837652B048C4C84237D0838585" [0143.532] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\", lpString2="F293AEAD5E84FACFB686C4A620718928_C8424A0B24A72939B13720D0C000C9C1" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\F293AEAD5E84FACFB686C4A620718928_C8424A0B24A72939B13720D0C000C9C1") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\F293AEAD5E84FACFB686C4A620718928_C8424A0B24A72939B13720D0C000C9C1" [0143.532] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0143.532] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0143.532] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="F90F18257CBB4D84216AC1E1F3BB2C76") returned -1 [0143.532] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="F90F18257CBB4D84216AC1E1F3BB2C76") returned 1 [0143.532] lstrcmpiA (lpString1="", lpString2="F90F18257CBB4D84216AC1E1F3BB2C76") returned -1 [0143.532] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\F293AEAD5E84FACFB686C4A620718928_C8424A0B24A72939B13720D0C000C9C1") returned="F293AEAD5E84FACFB686C4A620718928_C8424A0B24A72939B13720D0C000C9C1" [0143.532] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\", lpString2="F90F18257CBB4D84216AC1E1F3BB2C76" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\F90F18257CBB4D84216AC1E1F3BB2C76") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\F90F18257CBB4D84216AC1E1F3BB2C76" [0143.532] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 0 [0143.532] FindClose (in: hFindFile=0x5be2e0 | out: hFindFile=0x5be2e0) returned 1 [0143.533] FindNextFileA (in: hFindFile=0x5be2a0, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0143.533] lstrcmpA (lpString1=".", lpString2="MetaData") returned -1 [0143.533] lstrcmpA (lpString1="..", lpString2="MetaData") returned -1 [0143.533] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\*.*") returned="*.*" [0143.533] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\", lpString2="MetaData" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData" [0143.533] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\*.*", lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 0x5be2e0 [0143.533] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0143.533] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0143.533] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0143.533] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0143.533] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0143.533] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0143.533] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B") returned 1 [0143.533] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B") returned 1 [0143.533] lstrcmpiA (lpString1="", lpString2="024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B") returned -1 [0143.533] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\*.*") returned="*.*" [0143.533] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\", lpString2="024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B" [0143.533] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0143.533] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0143.533] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="0F1583FFF42FFF476A09801ACB69213F_E3F4A8C96454D7D3441D2C1BCE81F875") returned 1 [0143.533] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="0F1583FFF42FFF476A09801ACB69213F_E3F4A8C96454D7D3441D2C1BCE81F875") returned 1 [0143.533] lstrcmpiA (lpString1="", lpString2="0F1583FFF42FFF476A09801ACB69213F_E3F4A8C96454D7D3441D2C1BCE81F875") returned -1 [0143.533] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B") returned="024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B" [0143.534] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\", lpString2="0F1583FFF42FFF476A09801ACB69213F_E3F4A8C96454D7D3441D2C1BCE81F875" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\0F1583FFF42FFF476A09801ACB69213F_E3F4A8C96454D7D3441D2C1BCE81F875") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\0F1583FFF42FFF476A09801ACB69213F_E3F4A8C96454D7D3441D2C1BCE81F875" [0143.534] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0143.534] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0143.534] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="1BB09BEEC155258835C193A7AA85AA5B_A7B2B53AF2A12E2CB0A41B96D21D7973") returned 1 [0143.534] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="1BB09BEEC155258835C193A7AA85AA5B_A7B2B53AF2A12E2CB0A41B96D21D7973") returned 1 [0143.534] lstrcmpiA (lpString1="", lpString2="1BB09BEEC155258835C193A7AA85AA5B_A7B2B53AF2A12E2CB0A41B96D21D7973") returned -1 [0143.534] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\0F1583FFF42FFF476A09801ACB69213F_E3F4A8C96454D7D3441D2C1BCE81F875") returned="0F1583FFF42FFF476A09801ACB69213F_E3F4A8C96454D7D3441D2C1BCE81F875" [0143.534] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\", lpString2="1BB09BEEC155258835C193A7AA85AA5B_A7B2B53AF2A12E2CB0A41B96D21D7973" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\1BB09BEEC155258835C193A7AA85AA5B_A7B2B53AF2A12E2CB0A41B96D21D7973") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\1BB09BEEC155258835C193A7AA85AA5B_A7B2B53AF2A12E2CB0A41B96D21D7973" [0143.534] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0143.534] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0143.534] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="1DAF2884EC4DFA96BA4A58D4DBC9C406") returned 1 [0143.534] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="1DAF2884EC4DFA96BA4A58D4DBC9C406") returned 1 [0143.534] lstrcmpiA (lpString1="", lpString2="1DAF2884EC4DFA96BA4A58D4DBC9C406") returned -1 [0143.534] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\1BB09BEEC155258835C193A7AA85AA5B_A7B2B53AF2A12E2CB0A41B96D21D7973") returned="1BB09BEEC155258835C193A7AA85AA5B_A7B2B53AF2A12E2CB0A41B96D21D7973" [0143.534] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\", lpString2="1DAF2884EC4DFA96BA4A58D4DBC9C406" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\1DAF2884EC4DFA96BA4A58D4DBC9C406") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\1DAF2884EC4DFA96BA4A58D4DBC9C406" [0143.534] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0143.534] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0143.534] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="23B523C9E7746F715D33C6527C18EB9D") returned 1 [0143.534] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="23B523C9E7746F715D33C6527C18EB9D") returned 1 [0143.534] lstrcmpiA (lpString1="", lpString2="23B523C9E7746F715D33C6527C18EB9D") returned -1 [0143.534] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\1DAF2884EC4DFA96BA4A58D4DBC9C406") returned="1DAF2884EC4DFA96BA4A58D4DBC9C406" [0143.534] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\", lpString2="23B523C9E7746F715D33C6527C18EB9D" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\23B523C9E7746F715D33C6527C18EB9D") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\23B523C9E7746F715D33C6527C18EB9D" [0143.534] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0143.534] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0143.534] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="3130B1871A126520A8C47861EFE3ED4D") returned 1 [0143.534] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="3130B1871A126520A8C47861EFE3ED4D") returned 1 [0143.534] lstrcmpiA (lpString1="", lpString2="3130B1871A126520A8C47861EFE3ED4D") returned -1 [0143.535] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\23B523C9E7746F715D33C6527C18EB9D") returned="23B523C9E7746F715D33C6527C18EB9D" [0143.535] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\", lpString2="3130B1871A126520A8C47861EFE3ED4D" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\3130B1871A126520A8C47861EFE3ED4D") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\3130B1871A126520A8C47861EFE3ED4D" [0143.535] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0143.535] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0143.535] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="3388ECC3F7BC4A9271C10ED8621E5A65_F55C512047947B70F94DE5DEC6D6838D") returned 1 [0143.535] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="3388ECC3F7BC4A9271C10ED8621E5A65_F55C512047947B70F94DE5DEC6D6838D") returned 1 [0143.535] lstrcmpiA (lpString1="", lpString2="3388ECC3F7BC4A9271C10ED8621E5A65_F55C512047947B70F94DE5DEC6D6838D") returned -1 [0143.535] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\3130B1871A126520A8C47861EFE3ED4D") returned="3130B1871A126520A8C47861EFE3ED4D" [0143.535] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\", lpString2="3388ECC3F7BC4A9271C10ED8621E5A65_F55C512047947B70F94DE5DEC6D6838D" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\3388ECC3F7BC4A9271C10ED8621E5A65_F55C512047947B70F94DE5DEC6D6838D") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\3388ECC3F7BC4A9271C10ED8621E5A65_F55C512047947B70F94DE5DEC6D6838D" [0143.535] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0143.535] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0143.535] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="40E450F7CE13419A2CCC2A5445035A0A_06F02B1F13AB4B11B8FC669BDE565AF1") returned 1 [0143.535] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="40E450F7CE13419A2CCC2A5445035A0A_06F02B1F13AB4B11B8FC669BDE565AF1") returned 1 [0143.535] lstrcmpiA (lpString1="", lpString2="40E450F7CE13419A2CCC2A5445035A0A_06F02B1F13AB4B11B8FC669BDE565AF1") returned -1 [0143.535] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\3388ECC3F7BC4A9271C10ED8621E5A65_F55C512047947B70F94DE5DEC6D6838D") returned="3388ECC3F7BC4A9271C10ED8621E5A65_F55C512047947B70F94DE5DEC6D6838D" [0143.535] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\", lpString2="40E450F7CE13419A2CCC2A5445035A0A_06F02B1F13AB4B11B8FC669BDE565AF1" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\40E450F7CE13419A2CCC2A5445035A0A_06F02B1F13AB4B11B8FC669BDE565AF1") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\40E450F7CE13419A2CCC2A5445035A0A_06F02B1F13AB4B11B8FC669BDE565AF1" [0143.535] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0143.535] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0143.535] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="4C8F841FB02DEC8C10108028DB86A08D_8DAFFFD2D43BDC7A1717F5B61C303398") returned 1 [0143.535] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="4C8F841FB02DEC8C10108028DB86A08D_8DAFFFD2D43BDC7A1717F5B61C303398") returned 1 [0143.535] lstrcmpiA (lpString1="", lpString2="4C8F841FB02DEC8C10108028DB86A08D_8DAFFFD2D43BDC7A1717F5B61C303398") returned -1 [0143.535] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\40E450F7CE13419A2CCC2A5445035A0A_06F02B1F13AB4B11B8FC669BDE565AF1") returned="40E450F7CE13419A2CCC2A5445035A0A_06F02B1F13AB4B11B8FC669BDE565AF1" [0143.535] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\", lpString2="4C8F841FB02DEC8C10108028DB86A08D_8DAFFFD2D43BDC7A1717F5B61C303398" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\4C8F841FB02DEC8C10108028DB86A08D_8DAFFFD2D43BDC7A1717F5B61C303398") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\4C8F841FB02DEC8C10108028DB86A08D_8DAFFFD2D43BDC7A1717F5B61C303398" [0143.535] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0143.535] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0143.535] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="4DD39726D4B55AC3B4119B35A893323C_46CCCFB940A93F39A734F69EFCDD76E9") returned 1 [0143.536] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="4DD39726D4B55AC3B4119B35A893323C_46CCCFB940A93F39A734F69EFCDD76E9") returned 1 [0143.536] lstrcmpiA (lpString1="", lpString2="4DD39726D4B55AC3B4119B35A893323C_46CCCFB940A93F39A734F69EFCDD76E9") returned -1 [0143.536] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\4C8F841FB02DEC8C10108028DB86A08D_8DAFFFD2D43BDC7A1717F5B61C303398") returned="4C8F841FB02DEC8C10108028DB86A08D_8DAFFFD2D43BDC7A1717F5B61C303398" [0143.536] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\", lpString2="4DD39726D4B55AC3B4119B35A893323C_46CCCFB940A93F39A734F69EFCDD76E9" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\4DD39726D4B55AC3B4119B35A893323C_46CCCFB940A93F39A734F69EFCDD76E9") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\4DD39726D4B55AC3B4119B35A893323C_46CCCFB940A93F39A734F69EFCDD76E9" [0143.536] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0143.536] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0143.536] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="5080DC7A65DB6A5960ECD874088F3328_2908F682DFC81A793BD240CF29711C77") returned 1 [0143.536] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="5080DC7A65DB6A5960ECD874088F3328_2908F682DFC81A793BD240CF29711C77") returned 1 [0143.536] lstrcmpiA (lpString1="", lpString2="5080DC7A65DB6A5960ECD874088F3328_2908F682DFC81A793BD240CF29711C77") returned -1 [0143.536] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\4DD39726D4B55AC3B4119B35A893323C_46CCCFB940A93F39A734F69EFCDD76E9") returned="4DD39726D4B55AC3B4119B35A893323C_46CCCFB940A93F39A734F69EFCDD76E9" [0143.536] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\", lpString2="5080DC7A65DB6A5960ECD874088F3328_2908F682DFC81A793BD240CF29711C77" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\5080DC7A65DB6A5960ECD874088F3328_2908F682DFC81A793BD240CF29711C77") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\5080DC7A65DB6A5960ECD874088F3328_2908F682DFC81A793BD240CF29711C77" [0143.536] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0143.536] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0143.536] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="5080DC7A65DB6A5960ECD874088F3328_6CBA2C06D5985DD95AE59AF8FC7C6220") returned 1 [0143.536] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="5080DC7A65DB6A5960ECD874088F3328_6CBA2C06D5985DD95AE59AF8FC7C6220") returned 1 [0143.536] lstrcmpiA (lpString1="", lpString2="5080DC7A65DB6A5960ECD874088F3328_6CBA2C06D5985DD95AE59AF8FC7C6220") returned -1 [0143.536] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\5080DC7A65DB6A5960ECD874088F3328_2908F682DFC81A793BD240CF29711C77") returned="5080DC7A65DB6A5960ECD874088F3328_2908F682DFC81A793BD240CF29711C77" [0143.536] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\", lpString2="5080DC7A65DB6A5960ECD874088F3328_6CBA2C06D5985DD95AE59AF8FC7C6220" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\5080DC7A65DB6A5960ECD874088F3328_6CBA2C06D5985DD95AE59AF8FC7C6220") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\5080DC7A65DB6A5960ECD874088F3328_6CBA2C06D5985DD95AE59AF8FC7C6220" [0143.536] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0143.536] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0143.536] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="5457A8CE4B2A7499F8299A013B6E1C7C_CE50F893881D43DC0C815E4D80FAF2B4") returned 1 [0143.542] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="5457A8CE4B2A7499F8299A013B6E1C7C_CE50F893881D43DC0C815E4D80FAF2B4") returned 1 [0143.542] lstrcmpiA (lpString1="", lpString2="5457A8CE4B2A7499F8299A013B6E1C7C_CE50F893881D43DC0C815E4D80FAF2B4") returned -1 [0143.542] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\5080DC7A65DB6A5960ECD874088F3328_6CBA2C06D5985DD95AE59AF8FC7C6220") returned="5080DC7A65DB6A5960ECD874088F3328_6CBA2C06D5985DD95AE59AF8FC7C6220" [0143.542] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\", lpString2="5457A8CE4B2A7499F8299A013B6E1C7C_CE50F893881D43DC0C815E4D80FAF2B4" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\5457A8CE4B2A7499F8299A013B6E1C7C_CE50F893881D43DC0C815E4D80FAF2B4") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\5457A8CE4B2A7499F8299A013B6E1C7C_CE50F893881D43DC0C815E4D80FAF2B4" [0143.542] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0143.542] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0143.542] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="696F3DE637E6DE85B458996D49D759AD") returned 1 [0143.542] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="696F3DE637E6DE85B458996D49D759AD") returned 1 [0143.542] lstrcmpiA (lpString1="", lpString2="696F3DE637E6DE85B458996D49D759AD") returned -1 [0143.542] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\5457A8CE4B2A7499F8299A013B6E1C7C_CE50F893881D43DC0C815E4D80FAF2B4") returned="5457A8CE4B2A7499F8299A013B6E1C7C_CE50F893881D43DC0C815E4D80FAF2B4" [0143.542] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\", lpString2="696F3DE637E6DE85B458996D49D759AD" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\696F3DE637E6DE85B458996D49D759AD") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\696F3DE637E6DE85B458996D49D759AD" [0143.542] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0143.542] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0143.542] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="705A76DE71EA2CAEBB8F0907449CE086_9752C5B2D53EE7A19F7764B52968EC21") returned 1 [0143.542] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="705A76DE71EA2CAEBB8F0907449CE086_9752C5B2D53EE7A19F7764B52968EC21") returned 1 [0143.542] lstrcmpiA (lpString1="", lpString2="705A76DE71EA2CAEBB8F0907449CE086_9752C5B2D53EE7A19F7764B52968EC21") returned -1 [0143.542] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\696F3DE637E6DE85B458996D49D759AD") returned="696F3DE637E6DE85B458996D49D759AD" [0143.542] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\", lpString2="705A76DE71EA2CAEBB8F0907449CE086_9752C5B2D53EE7A19F7764B52968EC21" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\705A76DE71EA2CAEBB8F0907449CE086_9752C5B2D53EE7A19F7764B52968EC21") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\705A76DE71EA2CAEBB8F0907449CE086_9752C5B2D53EE7A19F7764B52968EC21" [0143.542] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0143.542] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0143.543] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="7396C420A8E1BC1DA97F1AF0D10BAD21") returned 1 [0143.543] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="7396C420A8E1BC1DA97F1AF0D10BAD21") returned 1 [0143.543] lstrcmpiA (lpString1="", lpString2="7396C420A8E1BC1DA97F1AF0D10BAD21") returned -1 [0143.543] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\705A76DE71EA2CAEBB8F0907449CE086_9752C5B2D53EE7A19F7764B52968EC21") returned="705A76DE71EA2CAEBB8F0907449CE086_9752C5B2D53EE7A19F7764B52968EC21" [0143.543] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\", lpString2="7396C420A8E1BC1DA97F1AF0D10BAD21" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\7396C420A8E1BC1DA97F1AF0D10BAD21") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\7396C420A8E1BC1DA97F1AF0D10BAD21" [0143.543] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0143.543] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0143.543] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="7423F88C7F265F0DEFC08EA88C3BDE45_D975BBA8033175C8D112023D8A7A8AD6") returned 1 [0143.543] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="7423F88C7F265F0DEFC08EA88C3BDE45_D975BBA8033175C8D112023D8A7A8AD6") returned 1 [0143.543] lstrcmpiA (lpString1="", lpString2="7423F88C7F265F0DEFC08EA88C3BDE45_D975BBA8033175C8D112023D8A7A8AD6") returned -1 [0143.543] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\7396C420A8E1BC1DA97F1AF0D10BAD21") returned="7396C420A8E1BC1DA97F1AF0D10BAD21" [0143.543] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\", lpString2="7423F88C7F265F0DEFC08EA88C3BDE45_D975BBA8033175C8D112023D8A7A8AD6" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\7423F88C7F265F0DEFC08EA88C3BDE45_D975BBA8033175C8D112023D8A7A8AD6") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\7423F88C7F265F0DEFC08EA88C3BDE45_D975BBA8033175C8D112023D8A7A8AD6" [0143.543] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0143.543] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0143.543] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="7B2238AACCEDC3F1FFE8E7EB5F575EC9") returned 1 [0143.543] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="7B2238AACCEDC3F1FFE8E7EB5F575EC9") returned 1 [0143.543] lstrcmpiA (lpString1="", lpString2="7B2238AACCEDC3F1FFE8E7EB5F575EC9") returned -1 [0143.543] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\7423F88C7F265F0DEFC08EA88C3BDE45_D975BBA8033175C8D112023D8A7A8AD6") returned="7423F88C7F265F0DEFC08EA88C3BDE45_D975BBA8033175C8D112023D8A7A8AD6" [0143.543] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\", lpString2="7B2238AACCEDC3F1FFE8E7EB5F575EC9" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\7B2238AACCEDC3F1FFE8E7EB5F575EC9") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\7B2238AACCEDC3F1FFE8E7EB5F575EC9" [0143.543] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0143.543] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0143.543] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="7B8944BA8AD0EFDF0E01A43EF62BECD0_B2DB1CC4B5F2D2A802D56AAED525802D") returned 1 [0143.543] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="7B8944BA8AD0EFDF0E01A43EF62BECD0_B2DB1CC4B5F2D2A802D56AAED525802D") returned 1 [0143.543] lstrcmpiA (lpString1="", lpString2="7B8944BA8AD0EFDF0E01A43EF62BECD0_B2DB1CC4B5F2D2A802D56AAED525802D") returned -1 [0143.543] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\7B2238AACCEDC3F1FFE8E7EB5F575EC9") returned="7B2238AACCEDC3F1FFE8E7EB5F575EC9" [0143.543] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\", lpString2="7B8944BA8AD0EFDF0E01A43EF62BECD0_B2DB1CC4B5F2D2A802D56AAED525802D" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\7B8944BA8AD0EFDF0E01A43EF62BECD0_B2DB1CC4B5F2D2A802D56AAED525802D") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\7B8944BA8AD0EFDF0E01A43EF62BECD0_B2DB1CC4B5F2D2A802D56AAED525802D" [0143.543] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0143.544] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0143.544] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="7D266D9E1E69FA1EEFB9699B009B34C8_0A9BFDD75B598C2110CBF610C078E6E6") returned 1 [0143.544] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="7D266D9E1E69FA1EEFB9699B009B34C8_0A9BFDD75B598C2110CBF610C078E6E6") returned 1 [0143.544] lstrcmpiA (lpString1="", lpString2="7D266D9E1E69FA1EEFB9699B009B34C8_0A9BFDD75B598C2110CBF610C078E6E6") returned -1 [0143.544] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\7B8944BA8AD0EFDF0E01A43EF62BECD0_B2DB1CC4B5F2D2A802D56AAED525802D") returned="7B8944BA8AD0EFDF0E01A43EF62BECD0_B2DB1CC4B5F2D2A802D56AAED525802D" [0143.544] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\", lpString2="7D266D9E1E69FA1EEFB9699B009B34C8_0A9BFDD75B598C2110CBF610C078E6E6" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\7D266D9E1E69FA1EEFB9699B009B34C8_0A9BFDD75B598C2110CBF610C078E6E6") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\7D266D9E1E69FA1EEFB9699B009B34C8_0A9BFDD75B598C2110CBF610C078E6E6" [0143.544] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0143.544] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0143.544] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="7D266D9E1E69FA1EEFB9699B009B34C8_1D5A876A9113EC07224C45E5A870E3BD") returned 1 [0143.544] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="7D266D9E1E69FA1EEFB9699B009B34C8_1D5A876A9113EC07224C45E5A870E3BD") returned 1 [0143.544] lstrcmpiA (lpString1="", lpString2="7D266D9E1E69FA1EEFB9699B009B34C8_1D5A876A9113EC07224C45E5A870E3BD") returned -1 [0143.544] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\7D266D9E1E69FA1EEFB9699B009B34C8_0A9BFDD75B598C2110CBF610C078E6E6") returned="7D266D9E1E69FA1EEFB9699B009B34C8_0A9BFDD75B598C2110CBF610C078E6E6" [0143.544] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\", lpString2="7D266D9E1E69FA1EEFB9699B009B34C8_1D5A876A9113EC07224C45E5A870E3BD" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\7D266D9E1E69FA1EEFB9699B009B34C8_1D5A876A9113EC07224C45E5A870E3BD") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\7D266D9E1E69FA1EEFB9699B009B34C8_1D5A876A9113EC07224C45E5A870E3BD" [0143.545] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0143.545] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0143.545] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="8059E9A0D314877E40FE93D8CCFB3C69_234CB5D64705D4DBB4DA839716359AF0") returned 1 [0143.545] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="8059E9A0D314877E40FE93D8CCFB3C69_234CB5D64705D4DBB4DA839716359AF0") returned 1 [0143.545] lstrcmpiA (lpString1="", lpString2="8059E9A0D314877E40FE93D8CCFB3C69_234CB5D64705D4DBB4DA839716359AF0") returned -1 [0143.545] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\7D266D9E1E69FA1EEFB9699B009B34C8_1D5A876A9113EC07224C45E5A870E3BD") returned="7D266D9E1E69FA1EEFB9699B009B34C8_1D5A876A9113EC07224C45E5A870E3BD" [0143.545] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\", lpString2="8059E9A0D314877E40FE93D8CCFB3C69_234CB5D64705D4DBB4DA839716359AF0" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\8059E9A0D314877E40FE93D8CCFB3C69_234CB5D64705D4DBB4DA839716359AF0") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\8059E9A0D314877E40FE93D8CCFB3C69_234CB5D64705D4DBB4DA839716359AF0" [0143.545] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0143.545] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0143.545] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="8059E9A0D314877E40FE93D8CCFB3C69_294110D6990EE392327F8A606D55BC1E") returned 1 [0143.545] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="8059E9A0D314877E40FE93D8CCFB3C69_294110D6990EE392327F8A606D55BC1E") returned 1 [0143.545] lstrcmpiA (lpString1="", lpString2="8059E9A0D314877E40FE93D8CCFB3C69_294110D6990EE392327F8A606D55BC1E") returned -1 [0143.545] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\8059E9A0D314877E40FE93D8CCFB3C69_234CB5D64705D4DBB4DA839716359AF0") returned="8059E9A0D314877E40FE93D8CCFB3C69_234CB5D64705D4DBB4DA839716359AF0" [0143.545] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\", lpString2="8059E9A0D314877E40FE93D8CCFB3C69_294110D6990EE392327F8A606D55BC1E" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\8059E9A0D314877E40FE93D8CCFB3C69_294110D6990EE392327F8A606D55BC1E") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\8059E9A0D314877E40FE93D8CCFB3C69_294110D6990EE392327F8A606D55BC1E" [0143.545] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0143.545] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0143.545] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="8059E9A0D314877E40FE93D8CCFB3C69_50167909FCFE0C66153F1901439CBBA1") returned 1 [0143.545] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="8059E9A0D314877E40FE93D8CCFB3C69_50167909FCFE0C66153F1901439CBBA1") returned 1 [0143.545] lstrcmpiA (lpString1="", lpString2="8059E9A0D314877E40FE93D8CCFB3C69_50167909FCFE0C66153F1901439CBBA1") returned -1 [0143.545] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\8059E9A0D314877E40FE93D8CCFB3C69_294110D6990EE392327F8A606D55BC1E") returned="8059E9A0D314877E40FE93D8CCFB3C69_294110D6990EE392327F8A606D55BC1E" [0143.545] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\", lpString2="8059E9A0D314877E40FE93D8CCFB3C69_50167909FCFE0C66153F1901439CBBA1" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\8059E9A0D314877E40FE93D8CCFB3C69_50167909FCFE0C66153F1901439CBBA1") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\8059E9A0D314877E40FE93D8CCFB3C69_50167909FCFE0C66153F1901439CBBA1" [0143.545] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0143.545] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0143.545] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="8059E9A0D314877E40FE93D8CCFB3C69_581C904DB5924E46A6C1A8637614A40E") returned 1 [0143.545] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="8059E9A0D314877E40FE93D8CCFB3C69_581C904DB5924E46A6C1A8637614A40E") returned 1 [0143.545] lstrcmpiA (lpString1="", lpString2="8059E9A0D314877E40FE93D8CCFB3C69_581C904DB5924E46A6C1A8637614A40E") returned -1 [0143.545] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\8059E9A0D314877E40FE93D8CCFB3C69_50167909FCFE0C66153F1901439CBBA1") returned="8059E9A0D314877E40FE93D8CCFB3C69_50167909FCFE0C66153F1901439CBBA1" [0143.545] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\", lpString2="8059E9A0D314877E40FE93D8CCFB3C69_581C904DB5924E46A6C1A8637614A40E" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\8059E9A0D314877E40FE93D8CCFB3C69_581C904DB5924E46A6C1A8637614A40E") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\8059E9A0D314877E40FE93D8CCFB3C69_581C904DB5924E46A6C1A8637614A40E" [0143.545] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0143.545] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0143.546] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="8059E9A0D314877E40FE93D8CCFB3C69_5EA65844B9EF5670A9C002CBD85B10A4") returned 1 [0143.546] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="8059E9A0D314877E40FE93D8CCFB3C69_5EA65844B9EF5670A9C002CBD85B10A4") returned 1 [0143.546] lstrcmpiA (lpString1="", lpString2="8059E9A0D314877E40FE93D8CCFB3C69_5EA65844B9EF5670A9C002CBD85B10A4") returned -1 [0143.546] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\8059E9A0D314877E40FE93D8CCFB3C69_581C904DB5924E46A6C1A8637614A40E") returned="8059E9A0D314877E40FE93D8CCFB3C69_581C904DB5924E46A6C1A8637614A40E" [0143.546] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\", lpString2="8059E9A0D314877E40FE93D8CCFB3C69_5EA65844B9EF5670A9C002CBD85B10A4" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\8059E9A0D314877E40FE93D8CCFB3C69_5EA65844B9EF5670A9C002CBD85B10A4") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\8059E9A0D314877E40FE93D8CCFB3C69_5EA65844B9EF5670A9C002CBD85B10A4" [0143.546] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0143.546] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0143.546] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="8059E9A0D314877E40FE93D8CCFB3C69_74E943F7DAB6D19E37E4854057155778") returned 1 [0143.546] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="8059E9A0D314877E40FE93D8CCFB3C69_74E943F7DAB6D19E37E4854057155778") returned 1 [0143.546] lstrcmpiA (lpString1="", lpString2="8059E9A0D314877E40FE93D8CCFB3C69_74E943F7DAB6D19E37E4854057155778") returned -1 [0143.546] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\8059E9A0D314877E40FE93D8CCFB3C69_5EA65844B9EF5670A9C002CBD85B10A4") returned="8059E9A0D314877E40FE93D8CCFB3C69_5EA65844B9EF5670A9C002CBD85B10A4" [0143.546] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\", lpString2="8059E9A0D314877E40FE93D8CCFB3C69_74E943F7DAB6D19E37E4854057155778" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\8059E9A0D314877E40FE93D8CCFB3C69_74E943F7DAB6D19E37E4854057155778") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\8059E9A0D314877E40FE93D8CCFB3C69_74E943F7DAB6D19E37E4854057155778" [0143.546] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0143.546] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0143.546] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\8059E9A0D314877E40FE93D8CCFB3C69_74E943F7DAB6D19E37E4854057155778") returned="8059E9A0D314877E40FE93D8CCFB3C69_74E943F7DAB6D19E37E4854057155778" [0143.546] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\", lpString2="8059E9A0D314877E40FE93D8CCFB3C69_C080DA2AE431C1A7F3B0C147EEB043ED" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\8059E9A0D314877E40FE93D8CCFB3C69_C080DA2AE431C1A7F3B0C147EEB043ED") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\8059E9A0D314877E40FE93D8CCFB3C69_C080DA2AE431C1A7F3B0C147EEB043ED" [0143.546] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0143.546] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0143.546] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\8059E9A0D314877E40FE93D8CCFB3C69_C080DA2AE431C1A7F3B0C147EEB043ED") returned="8059E9A0D314877E40FE93D8CCFB3C69_C080DA2AE431C1A7F3B0C147EEB043ED" [0143.546] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\", lpString2="8059E9A0D314877E40FE93D8CCFB3C69_E907D7A04657714B5B06D18BC920971E" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\8059E9A0D314877E40FE93D8CCFB3C69_E907D7A04657714B5B06D18BC920971E") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\8059E9A0D314877E40FE93D8CCFB3C69_E907D7A04657714B5B06D18BC920971E" [0143.546] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0143.546] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0143.546] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\8059E9A0D314877E40FE93D8CCFB3C69_E907D7A04657714B5B06D18BC920971E") returned="8059E9A0D314877E40FE93D8CCFB3C69_E907D7A04657714B5B06D18BC920971E" [0143.546] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\", lpString2="8059E9A0D314877E40FE93D8CCFB3C69_F2318F7AB33980A131A265454C39CA30" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\8059E9A0D314877E40FE93D8CCFB3C69_F2318F7AB33980A131A265454C39CA30") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\8059E9A0D314877E40FE93D8CCFB3C69_F2318F7AB33980A131A265454C39CA30" [0143.546] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0143.546] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0143.546] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\8059E9A0D314877E40FE93D8CCFB3C69_F2318F7AB33980A131A265454C39CA30") returned="8059E9A0D314877E40FE93D8CCFB3C69_F2318F7AB33980A131A265454C39CA30" [0143.546] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\", lpString2="8059E9A0D314877E40FE93D8CCFB3C69_F6E15778DC8E326895C606FBFA0392EB" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\8059E9A0D314877E40FE93D8CCFB3C69_F6E15778DC8E326895C606FBFA0392EB") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\8059E9A0D314877E40FE93D8CCFB3C69_F6E15778DC8E326895C606FBFA0392EB" [0143.547] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0143.547] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0143.547] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\8059E9A0D314877E40FE93D8CCFB3C69_F6E15778DC8E326895C606FBFA0392EB") returned="8059E9A0D314877E40FE93D8CCFB3C69_F6E15778DC8E326895C606FBFA0392EB" [0143.547] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\", lpString2="828298824EA5549947C17DDABF6871F5_0206EFBC540300C3BF0163CDBC3D7D56" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\828298824EA5549947C17DDABF6871F5_0206EFBC540300C3BF0163CDBC3D7D56") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\828298824EA5549947C17DDABF6871F5_0206EFBC540300C3BF0163CDBC3D7D56" [0143.547] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0143.547] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0143.547] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\828298824EA5549947C17DDABF6871F5_0206EFBC540300C3BF0163CDBC3D7D56") returned="828298824EA5549947C17DDABF6871F5_0206EFBC540300C3BF0163CDBC3D7D56" [0143.547] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\", lpString2="8828F39C7C0CE9A14B25C7EB321181BA_3DF94EB797096674F7793A562A778C5F" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\8828F39C7C0CE9A14B25C7EB321181BA_3DF94EB797096674F7793A562A778C5F") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\8828F39C7C0CE9A14B25C7EB321181BA_3DF94EB797096674F7793A562A778C5F" [0143.547] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0143.547] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0143.547] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\8828F39C7C0CE9A14B25C7EB321181BA_3DF94EB797096674F7793A562A778C5F") returned="8828F39C7C0CE9A14B25C7EB321181BA_3DF94EB797096674F7793A562A778C5F" [0143.547] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\", lpString2="8828F39C7C0CE9A14B25C7EB321181BA_C6EF73E4482B2588B1252D1A64B99416" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\8828F39C7C0CE9A14B25C7EB321181BA_C6EF73E4482B2588B1252D1A64B99416") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\8828F39C7C0CE9A14B25C7EB321181BA_C6EF73E4482B2588B1252D1A64B99416" [0143.547] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0143.547] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0143.547] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\8828F39C7C0CE9A14B25C7EB321181BA_C6EF73E4482B2588B1252D1A64B99416") returned="8828F39C7C0CE9A14B25C7EB321181BA_C6EF73E4482B2588B1252D1A64B99416" [0143.547] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\", lpString2="8E4E510F44A56B8C8ECFEC352907C373_411140098D71F028134E9B8A21255C61" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\8E4E510F44A56B8C8ECFEC352907C373_411140098D71F028134E9B8A21255C61") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\8E4E510F44A56B8C8ECFEC352907C373_411140098D71F028134E9B8A21255C61" [0143.547] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0143.547] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0143.547] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\8E4E510F44A56B8C8ECFEC352907C373_411140098D71F028134E9B8A21255C61") returned="8E4E510F44A56B8C8ECFEC352907C373_411140098D71F028134E9B8A21255C61" [0143.547] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\", lpString2="94308059B57B3142E455B38A6EB92015" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\94308059B57B3142E455B38A6EB92015") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\94308059B57B3142E455B38A6EB92015" [0143.547] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0143.548] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0143.548] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\94308059B57B3142E455B38A6EB92015") returned="94308059B57B3142E455B38A6EB92015" [0143.548] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\", lpString2="955CAB6FF6A24D5820D50B5BA1CF79C7_AD9E7615297A3A83320AACE5801A04F9" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\955CAB6FF6A24D5820D50B5BA1CF79C7_AD9E7615297A3A83320AACE5801A04F9") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\955CAB6FF6A24D5820D50B5BA1CF79C7_AD9E7615297A3A83320AACE5801A04F9" [0143.548] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0143.548] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0143.548] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\955CAB6FF6A24D5820D50B5BA1CF79C7_AD9E7615297A3A83320AACE5801A04F9") returned="955CAB6FF6A24D5820D50B5BA1CF79C7_AD9E7615297A3A83320AACE5801A04F9" [0143.548] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\", lpString2="9BC2FFC5D9591E1BD3545230E9B7CC36_CF30943571F9BEE96C487B2D9F0436E6" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\9BC2FFC5D9591E1BD3545230E9B7CC36_CF30943571F9BEE96C487B2D9F0436E6") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\9BC2FFC5D9591E1BD3545230E9B7CC36_CF30943571F9BEE96C487B2D9F0436E6" [0143.548] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0143.548] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0143.548] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\9BC2FFC5D9591E1BD3545230E9B7CC36_CF30943571F9BEE96C487B2D9F0436E6") returned="9BC2FFC5D9591E1BD3545230E9B7CC36_CF30943571F9BEE96C487B2D9F0436E6" [0143.548] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\", lpString2="9C888BEABCCBC2A97B0D6D9214C3BA37_1213DC6F71E4C3B05E7BCEEBC203A31E" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\9C888BEABCCBC2A97B0D6D9214C3BA37_1213DC6F71E4C3B05E7BCEEBC203A31E") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\9C888BEABCCBC2A97B0D6D9214C3BA37_1213DC6F71E4C3B05E7BCEEBC203A31E" [0143.548] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0143.548] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0143.548] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\9C888BEABCCBC2A97B0D6D9214C3BA37_1213DC6F71E4C3B05E7BCEEBC203A31E") returned="9C888BEABCCBC2A97B0D6D9214C3BA37_1213DC6F71E4C3B05E7BCEEBC203A31E" [0143.548] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\", lpString2="9C888BEABCCBC2A97B0D6D9214C3BA37_EBC75728C6119A77E4DA8559DD10F061" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\9C888BEABCCBC2A97B0D6D9214C3BA37_EBC75728C6119A77E4DA8559DD10F061") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\9C888BEABCCBC2A97B0D6D9214C3BA37_EBC75728C6119A77E4DA8559DD10F061" [0143.548] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0143.548] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0143.548] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\9C888BEABCCBC2A97B0D6D9214C3BA37_EBC75728C6119A77E4DA8559DD10F061") returned="9C888BEABCCBC2A97B0D6D9214C3BA37_EBC75728C6119A77E4DA8559DD10F061" [0143.549] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\", lpString2="A9E4F776657345B52012CE8E279D314C_183A5BE0B233CC1D513955FABECF9450" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\A9E4F776657345B52012CE8E279D314C_183A5BE0B233CC1D513955FABECF9450") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\A9E4F776657345B52012CE8E279D314C_183A5BE0B233CC1D513955FABECF9450" [0143.549] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0143.549] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0143.549] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\A9E4F776657345B52012CE8E279D314C_183A5BE0B233CC1D513955FABECF9450") returned="A9E4F776657345B52012CE8E279D314C_183A5BE0B233CC1D513955FABECF9450" [0143.549] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\", lpString2="ACF244F1A10D4DBED0D88EBA0C43A9B5_BA1AB6C2BDFDF57799E8116E4002D001" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\ACF244F1A10D4DBED0D88EBA0C43A9B5_BA1AB6C2BDFDF57799E8116E4002D001") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\ACF244F1A10D4DBED0D88EBA0C43A9B5_BA1AB6C2BDFDF57799E8116E4002D001" [0143.549] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0143.549] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0143.549] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\ACF244F1A10D4DBED0D88EBA0C43A9B5_BA1AB6C2BDFDF57799E8116E4002D001") returned="ACF244F1A10D4DBED0D88EBA0C43A9B5_BA1AB6C2BDFDF57799E8116E4002D001" [0143.549] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\", lpString2="B3BB9C1BA2D19E090AE305B2683903A0_6F0A84CE2BA99BD19D42C92610275852" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\B3BB9C1BA2D19E090AE305B2683903A0_6F0A84CE2BA99BD19D42C92610275852") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\B3BB9C1BA2D19E090AE305B2683903A0_6F0A84CE2BA99BD19D42C92610275852" [0143.549] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0143.549] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0143.549] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\B3BB9C1BA2D19E090AE305B2683903A0_6F0A84CE2BA99BD19D42C92610275852") returned="B3BB9C1BA2D19E090AE305B2683903A0_6F0A84CE2BA99BD19D42C92610275852" [0143.549] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\", lpString2="B3BB9C1BA2D19E090AE305B2683903A0_B89A63AC6877BD1ED812438CE82C3EB8" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\B3BB9C1BA2D19E090AE305B2683903A0_B89A63AC6877BD1ED812438CE82C3EB8") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\B3BB9C1BA2D19E090AE305B2683903A0_B89A63AC6877BD1ED812438CE82C3EB8" [0143.549] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0143.549] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0143.549] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\B3BB9C1BA2D19E090AE305B2683903A0_B89A63AC6877BD1ED812438CE82C3EB8") returned="B3BB9C1BA2D19E090AE305B2683903A0_B89A63AC6877BD1ED812438CE82C3EB8" [0143.549] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\", lpString2="BC570EC0DE58335AFAF92FDC8E3AA330_6CE6E578B5C8485B4BE3C4D58E12F150" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\BC570EC0DE58335AFAF92FDC8E3AA330_6CE6E578B5C8485B4BE3C4D58E12F150") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\BC570EC0DE58335AFAF92FDC8E3AA330_6CE6E578B5C8485B4BE3C4D58E12F150" [0143.549] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0143.549] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0143.549] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\BC570EC0DE58335AFAF92FDC8E3AA330_6CE6E578B5C8485B4BE3C4D58E12F150") returned="BC570EC0DE58335AFAF92FDC8E3AA330_6CE6E578B5C8485B4BE3C4D58E12F150" [0143.549] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\", lpString2="BC570EC0DE58335AFAF92FDC8E3AA330_F4D449CA9E0EACCFE15946F8FCD349FC" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\BC570EC0DE58335AFAF92FDC8E3AA330_F4D449CA9E0EACCFE15946F8FCD349FC") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\BC570EC0DE58335AFAF92FDC8E3AA330_F4D449CA9E0EACCFE15946F8FCD349FC" [0143.550] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0143.550] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0143.550] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\BC570EC0DE58335AFAF92FDC8E3AA330_F4D449CA9E0EACCFE15946F8FCD349FC") returned="BC570EC0DE58335AFAF92FDC8E3AA330_F4D449CA9E0EACCFE15946F8FCD349FC" [0143.550] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\", lpString2="C46E7B0F942663A1EDC8D9D6D7869173_42820CDFEA41DC84AAB89A6B63561873" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\C46E7B0F942663A1EDC8D9D6D7869173_42820CDFEA41DC84AAB89A6B63561873") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\C46E7B0F942663A1EDC8D9D6D7869173_42820CDFEA41DC84AAB89A6B63561873" [0143.550] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0143.550] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0143.550] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\C46E7B0F942663A1EDC8D9D6D7869173_42820CDFEA41DC84AAB89A6B63561873") returned="C46E7B0F942663A1EDC8D9D6D7869173_42820CDFEA41DC84AAB89A6B63561873" [0143.550] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\", lpString2="C46E7B0F942663A1EDC8D9D6D7869173_6043FC604A395E1485AF7AC16D16B7CE" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\C46E7B0F942663A1EDC8D9D6D7869173_6043FC604A395E1485AF7AC16D16B7CE") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\C46E7B0F942663A1EDC8D9D6D7869173_6043FC604A395E1485AF7AC16D16B7CE" [0143.550] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0143.550] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0143.550] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\C46E7B0F942663A1EDC8D9D6D7869173_6043FC604A395E1485AF7AC16D16B7CE") returned="C46E7B0F942663A1EDC8D9D6D7869173_6043FC604A395E1485AF7AC16D16B7CE" [0143.550] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\", lpString2="C46E7B0F942663A1EDC8D9D6D7869173_D9B9F37ECE595B0B7B6AA12451D392CF" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\C46E7B0F942663A1EDC8D9D6D7869173_D9B9F37ECE595B0B7B6AA12451D392CF") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\C46E7B0F942663A1EDC8D9D6D7869173_D9B9F37ECE595B0B7B6AA12451D392CF" [0143.550] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0143.550] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0143.550] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\C46E7B0F942663A1EDC8D9D6D7869173_D9B9F37ECE595B0B7B6AA12451D392CF") returned="C46E7B0F942663A1EDC8D9D6D7869173_D9B9F37ECE595B0B7B6AA12451D392CF" [0143.550] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\", lpString2="D47DBD2F9E3365FBBE008D71FB06716F_4DD1053BCC726DA41115FFF4C7D6E9CC" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\D47DBD2F9E3365FBBE008D71FB06716F_4DD1053BCC726DA41115FFF4C7D6E9CC") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\D47DBD2F9E3365FBBE008D71FB06716F_4DD1053BCC726DA41115FFF4C7D6E9CC" [0143.550] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0143.550] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0143.550] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\D47DBD2F9E3365FBBE008D71FB06716F_4DD1053BCC726DA41115FFF4C7D6E9CC") returned="D47DBD2F9E3365FBBE008D71FB06716F_4DD1053BCC726DA41115FFF4C7D6E9CC" [0143.550] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\", lpString2="D47DBD2F9E3365FBBE008D71FB06716F_D33192D58AA9CA2B9097E848E9FE86DE" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\D47DBD2F9E3365FBBE008D71FB06716F_D33192D58AA9CA2B9097E848E9FE86DE") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\D47DBD2F9E3365FBBE008D71FB06716F_D33192D58AA9CA2B9097E848E9FE86DE" [0143.550] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0143.550] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0143.550] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\D47DBD2F9E3365FBBE008D71FB06716F_D33192D58AA9CA2B9097E848E9FE86DE") returned="D47DBD2F9E3365FBBE008D71FB06716F_D33192D58AA9CA2B9097E848E9FE86DE" [0143.550] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\", lpString2="D52C56D8F24BEC96604372AFBAF264E1_E76A2B627DD019EB51D9335F24B14C2C" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\D52C56D8F24BEC96604372AFBAF264E1_E76A2B627DD019EB51D9335F24B14C2C") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\D52C56D8F24BEC96604372AFBAF264E1_E76A2B627DD019EB51D9335F24B14C2C" [0143.550] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0143.550] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0143.551] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\D52C56D8F24BEC96604372AFBAF264E1_E76A2B627DD019EB51D9335F24B14C2C") returned="D52C56D8F24BEC96604372AFBAF264E1_E76A2B627DD019EB51D9335F24B14C2C" [0143.551] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\", lpString2="EA618097E393409AFA316F0F87E2C202_827C1B837652B048C4C84237D0838585" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\EA618097E393409AFA316F0F87E2C202_827C1B837652B048C4C84237D0838585") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\EA618097E393409AFA316F0F87E2C202_827C1B837652B048C4C84237D0838585" [0143.551] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0143.551] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0143.551] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\EA618097E393409AFA316F0F87E2C202_827C1B837652B048C4C84237D0838585") returned="EA618097E393409AFA316F0F87E2C202_827C1B837652B048C4C84237D0838585" [0143.551] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\", lpString2="F293AEAD5E84FACFB686C4A620718928_C8424A0B24A72939B13720D0C000C9C1" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\F293AEAD5E84FACFB686C4A620718928_C8424A0B24A72939B13720D0C000C9C1") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\F293AEAD5E84FACFB686C4A620718928_C8424A0B24A72939B13720D0C000C9C1" [0143.551] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0143.551] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0143.551] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\F293AEAD5E84FACFB686C4A620718928_C8424A0B24A72939B13720D0C000C9C1") returned="F293AEAD5E84FACFB686C4A620718928_C8424A0B24A72939B13720D0C000C9C1" [0143.551] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\", lpString2="F90F18257CBB4D84216AC1E1F3BB2C76" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\F90F18257CBB4D84216AC1E1F3BB2C76") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\F90F18257CBB4D84216AC1E1F3BB2C76" [0143.551] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 0 [0143.551] FindClose (in: hFindFile=0x5be2e0 | out: hFindFile=0x5be2e0) returned 1 [0143.551] FindNextFileA (in: hFindFile=0x5be2a0, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0 [0143.551] FindClose (in: hFindFile=0x5be2a0 | out: hFindFile=0x5be2a0) returned 1 [0143.551] FindNextFileA (in: hFindFile=0x5be260, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0143.551] lstrcmpA (lpString1=".", lpString2="IME12") returned -1 [0143.551] lstrcmpA (lpString1="..", lpString2="IME12") returned -1 [0143.551] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\*.*") returned="*.*" [0143.551] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\", lpString2="IME12" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\IME12") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\IME12" [0143.551] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\IME12\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0143.552] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0143.552] FindNextFileA (in: hFindFile=0x5be2a0, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0143.552] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0143.552] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0143.552] FindNextFileA (in: hFindFile=0x5be2a0, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0 [0143.552] FindClose (in: hFindFile=0x5be2a0 | out: hFindFile=0x5be2a0) returned 1 [0143.552] FindNextFileA (in: hFindFile=0x5be260, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0143.552] lstrcmpA (lpString1=".", lpString2="IMJP12") returned -1 [0143.553] lstrcmpA (lpString1="..", lpString2="IMJP12") returned -1 [0143.553] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\*.*") returned="*.*" [0143.553] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\", lpString2="IMJP12" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\IMJP12") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\IMJP12" [0143.553] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\IMJP12\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0143.553] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0143.553] FindNextFileA (in: hFindFile=0x5be2a0, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0143.553] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0143.553] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0143.553] FindNextFileA (in: hFindFile=0x5be2a0, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0 [0143.553] FindClose (in: hFindFile=0x5be2a0 | out: hFindFile=0x5be2a0) returned 1 [0143.553] FindNextFileA (in: hFindFile=0x5be260, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0143.553] lstrcmpA (lpString1=".", lpString2="IMJP8_1") returned -1 [0143.553] lstrcmpA (lpString1="..", lpString2="IMJP8_1") returned -1 [0143.553] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\*.*") returned="*.*" [0143.553] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\", lpString2="IMJP8_1" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\IMJP8_1") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\IMJP8_1" [0143.553] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\IMJP8_1\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0143.553] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0143.553] FindNextFileA (in: hFindFile=0x5be2a0, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0143.553] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0143.553] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0143.553] FindNextFileA (in: hFindFile=0x5be2a0, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0 [0143.554] FindClose (in: hFindFile=0x5be2a0 | out: hFindFile=0x5be2a0) returned 1 [0143.554] FindNextFileA (in: hFindFile=0x5be260, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0143.554] lstrcmpA (lpString1=".", lpString2="IMJP9_0") returned -1 [0143.554] lstrcmpA (lpString1="..", lpString2="IMJP9_0") returned -1 [0143.554] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\*.*") returned="*.*" [0143.554] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\", lpString2="IMJP9_0" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\IMJP9_0") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\IMJP9_0" [0143.554] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\IMJP9_0\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0143.554] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0143.554] FindNextFileA (in: hFindFile=0x5be2a0, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0143.554] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0143.554] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0143.554] FindNextFileA (in: hFindFile=0x5be2a0, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0 [0143.554] FindClose (in: hFindFile=0x5be2a0 | out: hFindFile=0x5be2a0) returned 1 [0143.554] FindNextFileA (in: hFindFile=0x5be260, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0143.554] lstrcmpA (lpString1=".", lpString2="Internet Explorer") returned -1 [0143.554] lstrcmpA (lpString1="..", lpString2="Internet Explorer") returned -1 [0143.554] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\*.*") returned="*.*" [0143.554] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\", lpString2="Internet Explorer" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer" [0143.554] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0143.555] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0143.555] FindNextFileA (in: hFindFile=0x5be2a0, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0143.555] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0143.555] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0143.555] FindNextFileA (in: hFindFile=0x5be2a0, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0143.555] lstrcmpA (lpString1=".", lpString2="DOMStore") returned -1 [0143.555] lstrcmpA (lpString1="..", lpString2="DOMStore") returned -1 [0143.555] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\*.*") returned="*.*" [0143.555] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\", lpString2="DOMStore" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore" [0143.555] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\*.*", lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 0x5be2e0 [0143.555] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0143.555] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0143.555] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0143.555] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0143.556] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0143.556] lstrcmpA (lpString1=".", lpString2="36USA68T") returned -1 [0143.556] lstrcmpA (lpString1="..", lpString2="36USA68T") returned -1 [0143.556] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\*.*") returned="*.*" [0143.556] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\", lpString2="36USA68T" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\36USA68T") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\36USA68T" [0143.556] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\36USA68T\\*.*", lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 0x5be320 [0143.556] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0143.556] FindNextFileA (in: hFindFile=0x5be320, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0143.556] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0143.556] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0143.556] FindNextFileA (in: hFindFile=0x5be320, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0143.556] PeekMessageA (in: lpMsg=0xaece4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaece4) returned 0 [0143.556] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\36USA68T\\*.*") returned="*.*" [0143.556] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\36USA68T\\", lpString2="imagesrv.adition[1].xml" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\36USA68T\\imagesrv.adition[1].xml") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\36USA68T\\imagesrv.adition[1].xml" [0143.556] FindNextFileA (in: hFindFile=0x5be320, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 0 [0143.556] FindClose (in: hFindFile=0x5be320 | out: hFindFile=0x5be320) returned 1 [0143.558] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0143.558] lstrcmpA (lpString1=".", lpString2="3O75JDME") returned -1 [0143.558] lstrcmpA (lpString1="..", lpString2="3O75JDME") returned -1 [0143.558] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\*.*") returned="*.*" [0143.558] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\", lpString2="3O75JDME" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\3O75JDME") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\3O75JDME" [0143.558] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\3O75JDME\\*.*", lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 0x5be320 [0143.565] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0143.565] FindNextFileA (in: hFindFile=0x5be320, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0143.565] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0143.565] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0143.565] FindNextFileA (in: hFindFile=0x5be320, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0143.565] PeekMessageA (in: lpMsg=0xaece4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaece4) returned 0 [0143.565] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\3O75JDME\\*.*") returned="*.*" [0143.565] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\3O75JDME\\", lpString2="www.google[1].xml" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\3O75JDME\\www.google[1].xml") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\3O75JDME\\www.google[1].xml" [0143.565] FindNextFileA (in: hFindFile=0x5be320, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 0 [0143.565] FindClose (in: hFindFile=0x5be320 | out: hFindFile=0x5be320) returned 1 [0143.565] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0143.565] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0143.565] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\*.*") returned="*.*" [0143.566] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\", lpString2="index.dat" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\index.dat") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\index.dat" [0143.566] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0143.566] lstrcmpA (lpString1=".", lpString2="UV0DUWVB") returned -1 [0143.566] lstrcmpA (lpString1="..", lpString2="UV0DUWVB") returned -1 [0143.566] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\index.dat") returned="index.dat" [0143.566] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\", lpString2="UV0DUWVB" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\UV0DUWVB") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\UV0DUWVB" [0143.566] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\UV0DUWVB\\*.*", lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 0x5be320 [0143.566] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0143.566] FindNextFileA (in: hFindFile=0x5be320, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0143.566] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0143.566] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0143.566] FindNextFileA (in: hFindFile=0x5be320, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 0 [0143.566] FindClose (in: hFindFile=0x5be320 | out: hFindFile=0x5be320) returned 1 [0143.566] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0143.566] lstrcmpA (lpString1=".", lpString2="VGMTOI09") returned -1 [0143.566] lstrcmpA (lpString1="..", lpString2="VGMTOI09") returned -1 [0143.566] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\*.*") returned="*.*" [0143.566] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\", lpString2="VGMTOI09" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\VGMTOI09") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\VGMTOI09" [0143.566] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\VGMTOI09\\*.*", lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 0x5be320 [0143.566] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0143.566] FindNextFileA (in: hFindFile=0x5be320, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0143.566] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0143.566] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0143.567] FindNextFileA (in: hFindFile=0x5be320, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0143.567] PeekMessageA (in: lpMsg=0xaece4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaece4) returned 0 [0143.567] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\VGMTOI09\\*.*") returned="*.*" [0143.567] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\VGMTOI09\\", lpString2="www.msn[1].xml" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\VGMTOI09\\www.msn[1].xml") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\VGMTOI09\\www.msn[1].xml" [0143.567] FindNextFileA (in: hFindFile=0x5be320, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 0 [0143.567] FindClose (in: hFindFile=0x5be320 | out: hFindFile=0x5be320) returned 1 [0143.567] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 0 [0143.567] FindClose (in: hFindFile=0x5be2e0 | out: hFindFile=0x5be2e0) returned 1 [0143.567] FindNextFileA (in: hFindFile=0x5be2a0, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0143.567] lstrcmpA (lpString1=".", lpString2="Services") returned -1 [0143.567] lstrcmpA (lpString1="..", lpString2="Services") returned -1 [0143.567] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\*.*") returned="*.*" [0143.567] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\", lpString2="Services" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services" [0143.567] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\*.*", lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 0x5be2e0 [0143.568] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0143.568] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0143.568] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0143.568] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0143.568] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 0 [0143.568] FindClose (in: hFindFile=0x5be2e0 | out: hFindFile=0x5be2e0) returned 1 [0143.568] FindNextFileA (in: hFindFile=0x5be2a0, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0 [0143.568] FindClose (in: hFindFile=0x5be2a0 | out: hFindFile=0x5be2a0) returned 1 [0143.568] FindNextFileA (in: hFindFile=0x5be260, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0 [0143.568] FindClose (in: hFindFile=0x5be260 | out: hFindFile=0x5be260) returned 1 [0143.568] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0143.568] lstrcmpA (lpString1=".", lpString2="Sun") returned -1 [0143.568] lstrcmpA (lpString1="..", lpString2="Sun") returned -1 [0143.568] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\*.*") returned="*.*" [0143.568] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\", lpString2="Sun" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun" [0143.568] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0143.569] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0143.569] FindNextFileA (in: hFindFile=0x5be260, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0143.569] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0143.569] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0143.569] FindNextFileA (in: hFindFile=0x5be260, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0143.569] lstrcmpA (lpString1=".", lpString2="Java") returned -1 [0143.569] lstrcmpA (lpString1="..", lpString2="Java") returned -1 [0143.570] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\*.*") returned="*.*" [0143.570] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\", lpString2="Java" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java" [0143.570] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0143.570] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0143.570] FindNextFileA (in: hFindFile=0x5be2a0, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0143.570] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0143.570] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0143.570] FindNextFileA (in: hFindFile=0x5be2a0, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0143.571] lstrcmpA (lpString1=".", lpString2="AU") returned -1 [0143.571] lstrcmpA (lpString1="..", lpString2="AU") returned -1 [0143.571] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\*.*") returned="*.*" [0143.571] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\", lpString2="AU" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\AU") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\AU" [0143.571] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\AU\\*.*", lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 0x5be2e0 [0143.571] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0143.571] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0143.571] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0143.571] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0143.571] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0143.571] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0143.571] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\AU\\*.*") returned="*.*" [0143.571] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\AU\\", lpString2="au.cab" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\AU\\au.cab") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\AU\\au.cab" [0143.571] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0143.571] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0143.571] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\AU\\au.cab") returned="au.cab" [0143.571] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\AU\\", lpString2="au.msi" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\AU\\au.msi") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\AU\\au.msi" [0143.571] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 0 [0143.571] FindClose (in: hFindFile=0x5be2e0 | out: hFindFile=0x5be2e0) returned 1 [0143.571] FindNextFileA (in: hFindFile=0x5be2a0, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0143.571] lstrcmpA (lpString1=".", lpString2="Deployment") returned -1 [0143.571] lstrcmpA (lpString1="..", lpString2="Deployment") returned -1 [0143.571] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\*.*") returned="*.*" [0143.571] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\", lpString2="Deployment" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment" [0143.571] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\*.*", lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 0x5be2e0 [0143.572] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0143.572] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0143.572] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0143.572] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0143.572] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0143.572] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0143.572] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\*.*") returned="*.*" [0143.572] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\", lpString2="deployment.properties" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\deployment.properties") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\deployment.properties" [0143.572] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0143.572] lstrcmpA (lpString1=".", lpString2="security") returned -1 [0143.573] lstrcmpA (lpString1="..", lpString2="security") returned -1 [0143.573] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\deployment.properties") returned="deployment.properties" [0143.573] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\", lpString2="security" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\security") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\security" [0143.573] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\security\\*.*", lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 0x5be320 [0143.573] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0143.573] FindNextFileA (in: hFindFile=0x5be320, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0143.573] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0143.573] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0143.573] FindNextFileA (in: hFindFile=0x5be320, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 0 [0143.573] FindClose (in: hFindFile=0x5be320 | out: hFindFile=0x5be320) returned 1 [0143.574] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0143.574] lstrcmpA (lpString1=".", lpString2="tmp") returned -1 [0143.574] lstrcmpA (lpString1="..", lpString2="tmp") returned -1 [0143.574] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\*.*") returned="*.*" [0143.574] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\", lpString2="tmp" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\tmp") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\tmp" [0143.574] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\tmp\\*.*", lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 0x5be320 [0143.574] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0143.574] FindNextFileA (in: hFindFile=0x5be320, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0143.574] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0143.574] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0143.574] FindNextFileA (in: hFindFile=0x5be320, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0143.574] lstrcmpA (lpString1=".", lpString2="si") returned -1 [0143.574] lstrcmpA (lpString1="..", lpString2="si") returned -1 [0143.574] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\tmp\\*.*") returned="*.*" [0143.574] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\tmp\\", lpString2="si" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\tmp\\si") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\tmp\\si" [0143.574] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\tmp\\si\\*.*", lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 0x5be360 [0143.574] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0143.574] FindNextFileA (in: hFindFile=0x5be360, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 1 [0143.574] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0143.574] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0143.574] FindNextFileA (in: hFindFile=0x5be360, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 0 [0143.574] FindClose (in: hFindFile=0x5be360 | out: hFindFile=0x5be360) returned 1 [0143.575] FindNextFileA (in: hFindFile=0x5be320, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 0 [0143.575] FindClose (in: hFindFile=0x5be320 | out: hFindFile=0x5be320) returned 1 [0143.575] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 0 [0143.575] FindClose (in: hFindFile=0x5be2e0 | out: hFindFile=0x5be2e0) returned 1 [0143.575] FindNextFileA (in: hFindFile=0x5be2a0, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0143.575] lstrcmpA (lpString1=".", lpString2="jre1.7.0_45") returned -1 [0143.575] lstrcmpA (lpString1="..", lpString2="jre1.7.0_45") returned -1 [0143.575] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\*.*") returned="*.*" [0143.575] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\", lpString2="jre1.7.0_45" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45" [0143.575] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\*.*", lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 0x5be2e0 [0143.575] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0143.575] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0143.575] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0143.575] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0143.575] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0143.575] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0143.575] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\*.*") returned="*.*" [0143.575] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\", lpString2="Data1.cab" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\Data1.cab") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\Data1.cab" [0143.575] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0143.575] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0143.575] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\Data1.cab") returned="Data1.cab" [0143.575] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\", lpString2="jre1.7.0_45.msi" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\jre1.7.0_45.msi") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\jre1.7.0_45.msi" [0143.575] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 0 [0143.576] FindClose (in: hFindFile=0x5be2e0 | out: hFindFile=0x5be2e0) returned 1 [0143.576] FindNextFileA (in: hFindFile=0x5be2a0, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0 [0143.576] FindClose (in: hFindFile=0x5be2a0 | out: hFindFile=0x5be2a0) returned 1 [0143.576] FindNextFileA (in: hFindFile=0x5be260, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0 [0143.576] FindClose (in: hFindFile=0x5be260 | out: hFindFile=0x5be260) returned 1 [0143.576] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0 [0143.576] FindClose (in: hFindFile=0x5be160 | out: hFindFile=0x5be160) returned 1 [0143.576] FindNextFileA (in: hFindFile=0x5be220, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0143.576] lstrcmpA (lpString1=".", lpString2="Roaming") returned -1 [0143.576] lstrcmpA (lpString1="..", lpString2="Roaming") returned -1 [0143.576] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\*.*") returned="*.*" [0143.576] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\", lpString2="Roaming" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming" [0143.576] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be160 [0143.576] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0143.576] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0143.576] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0143.576] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0143.576] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0143.576] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0143.576] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\*.*") returned="*.*" [0143.576] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\", lpString2="2bsanz3dRmlbjQf_Wfn.png" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2bsanz3dRmlbjQf_Wfn.png") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2bsanz3dRmlbjQf_Wfn.png" [0143.576] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2bsanz3dRmlbjQf_Wfn.png" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2bsanz3dRmlbjQf_Wfn.png") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2bsanz3dRmlbjQf_Wfn.png" [0143.576] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2bsanz3dRmlbjQf_Wfn.png" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2bsanz3dRmlbjQf_Wfn.png") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2bsanz3dRmlbjQf_Wfn.png" [0143.576] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2bsanz3dRmlbjQf_Wfn.png", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2bsanz3dRmlbjQf_Wfn.png.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2bsanz3dRmlbjQf_Wfn.png." [0143.577] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2bsanz3dRmlbjQf_Wfn.png.", lpString2="\xa0" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2bsanz3dRmlbjQf_Wfn.png. ") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2bsanz3dRmlbjQf_Wfn.png. " [0143.577] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2bsanz3dRmlbjQf_Wfn.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\2bsanz3drmlbjqf_wfn.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c [0143.577] GetFileSize (in: hFile=0x8c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xcad0 [0143.577] GetFileTime (in: hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x38f935b0, dwHighDateTime=0x1d4a3c8), lpLastAccessTime=0x407536*(dwLowDateTime=0x7867f0e0, dwHighDateTime=0x1d4a843), lpLastWriteTime=0x40753e*(dwLowDateTime=0x7867f0e0, dwHighDateTime=0x1d4a843)) returned 1 [0143.577] SetFilePointer (in: hFile=0x8c, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0143.577] ReadFile (in: hFile=0x8c, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0xca76, lpOverlapped=0x0) returned 1 [0143.578] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2bsanz3dRmlbjQf_Wfn.png") returned="2bsanz3dRmlbjQf_Wfn.png" [0143.578] SetFilePointer (in: hFile=0x8c, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0143.578] WriteFile (in: hFile=0x8c, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0xca76, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0xca76, lpOverlapped=0x0) returned 1 [0143.579] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0143.582] CloseHandle (hObject=0x8c) returned 1 [0143.582] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2bsanz3dRmlbjQf_Wfn.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\2bsanz3drmlbjqf_wfn.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2bsanz3dRmlbjQf_Wfn.png. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\2bsanz3drmlbjqf_wfn.png. ")) returned 1 [0143.583] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0143.583] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0143.583] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="3yEM63.gif") returned 1 [0143.583] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="3yEM63.gif") returned 1 [0143.583] lstrcmpiA (lpString1="", lpString2="3yEM63.gif") returned -1 [0143.583] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\2bsanz3dRmlbjQf_Wfn.png") returned="2bsanz3dRmlbjQf_Wfn.png" [0143.583] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\", lpString2="3yEM63.gif" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\3yEM63.gif") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\3yEM63.gif" [0143.583] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\3yEM63.gif", pszSpec="*.zip") returned 0 [0143.583] lstrlenA (lpString="*.zip") returned 5 [0143.583] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\3yEM63.gif", pszSpec="*.rar") returned 0 [0143.583] lstrlenA (lpString="*.rar") returned 5 [0143.583] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\3yEM63.gif", pszSpec="*.7z") returned 0 [0143.583] lstrlenA (lpString="*.7z") returned 4 [0143.583] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\3yEM63.gif", pszSpec="*.tar") returned 0 [0143.583] lstrlenA (lpString="*.tar") returned 5 [0143.583] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\3yEM63.gif", pszSpec="*.gzip") returned 0 [0143.583] lstrlenA (lpString="*.gzip") returned 6 [0143.583] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\3yEM63.gif", pszSpec="*.jpg") returned 0 [0143.583] lstrlenA (lpString="*.jpg") returned 5 [0143.584] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\3yEM63.gif", pszSpec="*.jpeg") returned 0 [0143.584] lstrlenA (lpString="*.jpeg") returned 6 [0143.584] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\3yEM63.gif", pszSpec="*.psd") returned 0 [0143.584] lstrlenA (lpString="*.psd") returned 5 [0143.584] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\3yEM63.gif", pszSpec="*.cdr") returned 0 [0143.584] lstrlenA (lpString="*.cdr") returned 5 [0143.584] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\3yEM63.gif", pszSpec="*.dwg") returned 0 [0143.584] lstrlenA (lpString="*.dwg") returned 5 [0143.584] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\3yEM63.gif", pszSpec="*.max") returned 0 [0143.584] lstrlenA (lpString="*.max") returned 5 [0143.584] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\3yEM63.gif", pszSpec="*.bmp") returned 0 [0143.584] lstrlenA (lpString="*.bmp") returned 5 [0143.584] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\3yEM63.gif", pszSpec="*.gif") returned 1 [0143.584] lstrlenA (lpString="*.gif") returned 5 [0143.584] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\3yEM63.gif" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\3yEM63.gif") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\3yEM63.gif" [0143.584] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\3yEM63.gif" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\3yEM63.gif") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\3yEM63.gif" [0143.584] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\3yEM63.gif", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\3yEM63.gif.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\3yEM63.gif." [0143.584] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\3yEM63.gif.", lpString2="\xa0" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\3yEM63.gif. ") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\3yEM63.gif. " [0143.584] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\3yEM63.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\3yem63.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c [0143.584] GetFileSize (in: hFile=0x8c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xf4af [0143.584] GetFileTime (in: hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x2d65f1c0, dwHighDateTime=0x1d4a62a), lpLastAccessTime=0x407536*(dwLowDateTime=0x247a3e40, dwHighDateTime=0x1d4aae9), lpLastWriteTime=0x40753e*(dwLowDateTime=0x247a3e40, dwHighDateTime=0x1d4aae9)) returned 1 [0143.584] SetFilePointer (in: hFile=0x8c, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0143.584] ReadFile (in: hFile=0x8c, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0xf455, lpOverlapped=0x0) returned 1 [0143.585] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\3yEM63.gif") returned="3yEM63.gif" [0143.585] SetFilePointer (in: hFile=0x8c, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0143.585] WriteFile (in: hFile=0x8c, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0xf455, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0xf455, lpOverlapped=0x0) returned 1 [0143.586] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0143.586] CloseHandle (hObject=0x8c) returned 1 [0143.586] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\3yEM63.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\3yem63.gif"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\3yEM63.gif. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\3yem63.gif. ")) returned 1 [0143.587] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0143.587] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0143.587] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="5dqJP.m4a") returned 1 [0143.587] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="5dqJP.m4a") returned 1 [0143.587] lstrcmpiA (lpString1="", lpString2="5dqJP.m4a") returned -1 [0143.587] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\3yEM63.gif") returned="3yEM63.gif" [0143.587] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\", lpString2="5dqJP.m4a" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\5dqJP.m4a") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\5dqJP.m4a" [0143.587] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\5dqJP.m4a", pszSpec="*.zip") returned 0 [0143.587] lstrlenA (lpString="*.zip") returned 5 [0143.587] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\5dqJP.m4a", pszSpec="*.rar") returned 0 [0143.587] lstrlenA (lpString="*.rar") returned 5 [0143.587] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\5dqJP.m4a", pszSpec="*.7z") returned 0 [0143.587] lstrlenA (lpString="*.7z") returned 4 [0143.587] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\5dqJP.m4a", pszSpec="*.tar") returned 0 [0143.587] lstrlenA (lpString="*.tar") returned 5 [0143.587] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\5dqJP.m4a", pszSpec="*.gzip") returned 0 [0143.587] lstrlenA (lpString="*.gzip") returned 6 [0143.587] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\5dqJP.m4a", pszSpec="*.jpg") returned 0 [0143.587] lstrlenA (lpString="*.jpg") returned 5 [0143.587] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\5dqJP.m4a", pszSpec="*.jpeg") returned 0 [0143.587] lstrlenA (lpString="*.jpeg") returned 6 [0143.587] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\5dqJP.m4a", pszSpec="*.psd") returned 0 [0143.587] lstrlenA (lpString="*.psd") returned 5 [0143.587] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\5dqJP.m4a", pszSpec="*.cdr") returned 0 [0143.587] lstrlenA (lpString="*.cdr") returned 5 [0143.587] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\5dqJP.m4a", pszSpec="*.dwg") returned 0 [0143.587] lstrlenA (lpString="*.dwg") returned 5 [0143.587] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\5dqJP.m4a", pszSpec="*.max") returned 0 [0143.587] lstrlenA (lpString="*.max") returned 5 [0143.587] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\5dqJP.m4a", pszSpec="*.bmp") returned 0 [0143.587] lstrlenA (lpString="*.bmp") returned 5 [0143.587] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\5dqJP.m4a", pszSpec="*.gif") returned 0 [0143.587] lstrlenA (lpString="*.gif") returned 5 [0143.587] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\5dqJP.m4a", pszSpec="*.png") returned 0 [0143.587] lstrlenA (lpString="*.png") returned 5 [0143.587] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\5dqJP.m4a", pszSpec="*.doc") returned 0 [0143.587] lstrlenA (lpString="*.doc") returned 5 [0143.587] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\5dqJP.m4a", pszSpec="*.docx") returned 0 [0143.587] lstrlenA (lpString="*.docx") returned 6 [0143.587] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\5dqJP.m4a", pszSpec="*.xls") returned 0 [0143.587] lstrlenA (lpString="*.xls") returned 5 [0143.587] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\5dqJP.m4a", pszSpec="*.xlsx") returned 0 [0143.587] lstrlenA (lpString="*.xlsx") returned 6 [0143.587] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\5dqJP.m4a", pszSpec="*.ppt") returned 0 [0143.588] lstrlenA (lpString="*.ppt") returned 5 [0143.588] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\5dqJP.m4a", pszSpec="*.pptx") returned 0 [0143.588] lstrlenA (lpString="*.pptx") returned 6 [0143.588] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\5dqJP.m4a", pszSpec="*.txt") returned 0 [0143.588] lstrlenA (lpString="*.txt") returned 5 [0143.588] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\5dqJP.m4a", pszSpec="*.pdf") returned 0 [0143.588] lstrlenA (lpString="*.pdf") returned 5 [0143.588] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\5dqJP.m4a", pszSpec="*.djvu") returned 0 [0143.588] lstrlenA (lpString="*.djvu") returned 6 [0143.588] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\5dqJP.m4a", pszSpec="*.htm") returned 0 [0143.588] lstrlenA (lpString="*.htm") returned 5 [0143.588] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\5dqJP.m4a", pszSpec="*.html") returned 0 [0143.588] lstrlenA (lpString="*.html") returned 6 [0143.588] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\5dqJP.m4a", pszSpec="*.mdb") returned 0 [0143.588] lstrlenA (lpString="*.mdb") returned 5 [0143.588] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\5dqJP.m4a", pszSpec="*.cer") returned 0 [0143.588] lstrlenA (lpString="*.cer") returned 5 [0143.588] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\5dqJP.m4a", pszSpec="*.p12") returned 0 [0143.588] lstrlenA (lpString="*.p12") returned 5 [0143.588] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\5dqJP.m4a", pszSpec="*.pfx") returned 0 [0143.588] lstrlenA (lpString="*.pfx") returned 5 [0143.588] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\5dqJP.m4a", pszSpec="*.kwm") returned 0 [0143.588] lstrlenA (lpString="*.kwm") returned 5 [0143.588] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\5dqJP.m4a", pszSpec="*.pwm") returned 0 [0143.588] lstrlenA (lpString="*.pwm") returned 5 [0143.588] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\5dqJP.m4a", pszSpec="*.1cd") returned 0 [0143.588] lstrlenA (lpString="*.1cd") returned 5 [0143.588] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\5dqJP.m4a", pszSpec="*.md") returned 0 [0143.588] lstrlenA (lpString="*.md") returned 4 [0143.588] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\5dqJP.m4a", pszSpec="*.mdf") returned 0 [0143.588] lstrlenA (lpString="*.mdf") returned 5 [0143.588] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\5dqJP.m4a", pszSpec="*.dbf") returned 0 [0143.588] lstrlenA (lpString="*.dbf") returned 5 [0143.588] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\5dqJP.m4a", pszSpec="*.odt") returned 0 [0143.588] lstrlenA (lpString="*.odt") returned 5 [0143.588] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\5dqJP.m4a", pszSpec="*.vob") returned 0 [0143.588] lstrlenA (lpString="*.vob") returned 5 [0143.588] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\5dqJP.m4a", pszSpec="*.ifo") returned 0 [0143.588] lstrlenA (lpString="*.ifo") returned 5 [0143.588] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\5dqJP.m4a", pszSpec="*.lnk") returned 0 [0143.588] lstrlenA (lpString="*.lnk") returned 5 [0143.588] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\5dqJP.m4a", pszSpec="*.torrent") returned 0 [0143.588] lstrlenA (lpString="*.torrent") returned 9 [0143.588] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\5dqJP.m4a", pszSpec="*.mov") returned 0 [0143.588] lstrlenA (lpString="*.mov") returned 5 [0143.588] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\5dqJP.m4a", pszSpec="*.m2v") returned 0 [0143.588] lstrlenA (lpString="*.m2v") returned 5 [0143.588] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\5dqJP.m4a", pszSpec="*.3gp") returned 0 [0143.588] lstrlenA (lpString="*.3gp") returned 5 [0143.588] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\5dqJP.m4a", pszSpec="*.mpeg") returned 0 [0143.589] lstrlenA (lpString="*.mpeg") returned 6 [0143.589] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\5dqJP.m4a", pszSpec="*.mpg") returned 0 [0143.589] lstrlenA (lpString="*.mpg") returned 5 [0143.589] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\5dqJP.m4a", pszSpec="*.flv") returned 0 [0143.589] lstrlenA (lpString="*.flv") returned 5 [0143.589] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\5dqJP.m4a", pszSpec="*.avi") returned 0 [0143.589] lstrlenA (lpString="*.avi") returned 5 [0143.589] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\5dqJP.m4a", pszSpec="*.mp4") returned 0 [0143.589] lstrlenA (lpString="*.mp4") returned 5 [0143.589] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\5dqJP.m4a", pszSpec="*.wmv") returned 0 [0143.589] lstrlenA (lpString="*.wmv") returned 5 [0143.589] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\5dqJP.m4a", pszSpec="*.divx") returned 0 [0143.589] lstrlenA (lpString="*.divx") returned 6 [0143.589] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\5dqJP.m4a", pszSpec="*.mkv") returned 0 [0143.589] lstrlenA (lpString="*.mkv") returned 5 [0143.589] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\5dqJP.m4a", pszSpec="*.mp3") returned 0 [0143.589] lstrlenA (lpString="*.mp3") returned 5 [0143.589] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\5dqJP.m4a", pszSpec="*.wav") returned 0 [0143.589] lstrlenA (lpString="*.wav") returned 5 [0143.589] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\5dqJP.m4a", pszSpec="*.flac") returned 0 [0143.589] lstrlenA (lpString="*.flac") returned 6 [0143.589] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\5dqJP.m4a", pszSpec="*.ape") returned 0 [0143.589] lstrlenA (lpString="*.ape") returned 5 [0143.589] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\5dqJP.m4a", pszSpec="*.wma") returned 0 [0143.589] lstrlenA (lpString="*.wma") returned 5 [0143.589] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\5dqJP.m4a", pszSpec="*.ac3") returned 0 [0143.589] lstrlenA (lpString="*.ac3") returned 5 [0143.589] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0143.589] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0143.589] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="5Sk6EtcvqXru1Lwj9.swf") returned 1 [0143.589] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="5Sk6EtcvqXru1Lwj9.swf") returned 1 [0143.589] lstrcmpiA (lpString1="", lpString2="5Sk6EtcvqXru1Lwj9.swf") returned -1 [0143.589] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\5dqJP.m4a") returned="5dqJP.m4a" [0143.589] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\", lpString2="5Sk6EtcvqXru1Lwj9.swf" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\5Sk6EtcvqXru1Lwj9.swf") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\5Sk6EtcvqXru1Lwj9.swf" [0143.589] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\5Sk6EtcvqXru1Lwj9.swf", pszSpec="*.zip") returned 0 [0143.589] lstrlenA (lpString="*.zip") returned 5 [0143.589] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\5Sk6EtcvqXru1Lwj9.swf", pszSpec="*.rar") returned 0 [0143.589] lstrlenA (lpString="*.rar") returned 5 [0143.589] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\5Sk6EtcvqXru1Lwj9.swf", pszSpec="*.7z") returned 0 [0143.589] lstrlenA (lpString="*.7z") returned 4 [0143.589] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\5Sk6EtcvqXru1Lwj9.swf", pszSpec="*.tar") returned 0 [0143.589] lstrlenA (lpString="*.tar") returned 5 [0143.589] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\5Sk6EtcvqXru1Lwj9.swf", pszSpec="*.gzip") returned 0 [0143.589] lstrlenA (lpString="*.gzip") returned 6 [0143.589] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\5Sk6EtcvqXru1Lwj9.swf", pszSpec="*.jpg") returned 0 [0143.589] lstrlenA (lpString="*.jpg") returned 5 [0143.589] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\5Sk6EtcvqXru1Lwj9.swf", pszSpec="*.jpeg") returned 0 [0143.590] lstrlenA (lpString="*.jpeg") returned 6 [0143.590] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\5Sk6EtcvqXru1Lwj9.swf", pszSpec="*.psd") returned 0 [0143.590] lstrlenA (lpString="*.psd") returned 5 [0143.590] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\5Sk6EtcvqXru1Lwj9.swf", pszSpec="*.cdr") returned 0 [0143.590] lstrlenA (lpString="*.cdr") returned 5 [0143.590] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\5Sk6EtcvqXru1Lwj9.swf", pszSpec="*.dwg") returned 0 [0143.590] lstrlenA (lpString="*.dwg") returned 5 [0143.590] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\5Sk6EtcvqXru1Lwj9.swf", pszSpec="*.max") returned 0 [0143.590] lstrlenA (lpString="*.max") returned 5 [0143.590] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\5Sk6EtcvqXru1Lwj9.swf", pszSpec="*.bmp") returned 0 [0143.590] lstrlenA (lpString="*.bmp") returned 5 [0143.590] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\5Sk6EtcvqXru1Lwj9.swf", pszSpec="*.gif") returned 0 [0143.590] lstrlenA (lpString="*.gif") returned 5 [0143.590] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\5Sk6EtcvqXru1Lwj9.swf", pszSpec="*.png") returned 0 [0143.590] lstrlenA (lpString="*.png") returned 5 [0143.590] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\5Sk6EtcvqXru1Lwj9.swf", pszSpec="*.doc") returned 0 [0143.590] lstrlenA (lpString="*.doc") returned 5 [0143.590] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\5Sk6EtcvqXru1Lwj9.swf", pszSpec="*.docx") returned 0 [0143.590] lstrlenA (lpString="*.docx") returned 6 [0143.590] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\5Sk6EtcvqXru1Lwj9.swf", pszSpec="*.xls") returned 0 [0143.590] lstrlenA (lpString="*.xls") returned 5 [0143.590] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\5Sk6EtcvqXru1Lwj9.swf", pszSpec="*.xlsx") returned 0 [0143.590] lstrlenA (lpString="*.xlsx") returned 6 [0143.590] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\5Sk6EtcvqXru1Lwj9.swf", pszSpec="*.ppt") returned 0 [0143.590] lstrlenA (lpString="*.ppt") returned 5 [0143.590] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\5Sk6EtcvqXru1Lwj9.swf", pszSpec="*.pptx") returned 0 [0143.590] lstrlenA (lpString="*.pptx") returned 6 [0143.590] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\5Sk6EtcvqXru1Lwj9.swf", pszSpec="*.txt") returned 0 [0143.590] lstrlenA (lpString="*.txt") returned 5 [0143.590] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\5Sk6EtcvqXru1Lwj9.swf", pszSpec="*.pdf") returned 0 [0143.590] lstrlenA (lpString="*.pdf") returned 5 [0143.590] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\5Sk6EtcvqXru1Lwj9.swf", pszSpec="*.djvu") returned 0 [0143.590] lstrlenA (lpString="*.djvu") returned 6 [0143.590] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\5Sk6EtcvqXru1Lwj9.swf", pszSpec="*.htm") returned 0 [0143.590] lstrlenA (lpString="*.htm") returned 5 [0143.590] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\5Sk6EtcvqXru1Lwj9.swf", pszSpec="*.html") returned 0 [0143.590] lstrlenA (lpString="*.html") returned 6 [0143.590] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\5Sk6EtcvqXru1Lwj9.swf", pszSpec="*.mdb") returned 0 [0143.590] lstrlenA (lpString="*.mdb") returned 5 [0143.590] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\5Sk6EtcvqXru1Lwj9.swf", pszSpec="*.cer") returned 0 [0143.590] lstrlenA (lpString="*.cer") returned 5 [0143.590] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\5Sk6EtcvqXru1Lwj9.swf", pszSpec="*.p12") returned 0 [0143.590] lstrlenA (lpString="*.p12") returned 5 [0143.590] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\5Sk6EtcvqXru1Lwj9.swf", pszSpec="*.pfx") returned 0 [0143.590] lstrlenA (lpString="*.pfx") returned 5 [0143.590] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\5Sk6EtcvqXru1Lwj9.swf", pszSpec="*.kwm") returned 0 [0143.590] lstrlenA (lpString="*.kwm") returned 5 [0143.590] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\5Sk6EtcvqXru1Lwj9.swf", pszSpec="*.pwm") returned 0 [0143.590] lstrlenA (lpString="*.pwm") returned 5 [0143.590] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\5Sk6EtcvqXru1Lwj9.swf", pszSpec="*.1cd") returned 0 [0143.591] lstrlenA (lpString="*.1cd") returned 5 [0143.591] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\5Sk6EtcvqXru1Lwj9.swf", pszSpec="*.md") returned 0 [0143.591] lstrlenA (lpString="*.md") returned 4 [0143.591] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\5Sk6EtcvqXru1Lwj9.swf", pszSpec="*.mdf") returned 0 [0143.591] lstrlenA (lpString="*.mdf") returned 5 [0143.591] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\5Sk6EtcvqXru1Lwj9.swf", pszSpec="*.dbf") returned 0 [0143.591] lstrlenA (lpString="*.dbf") returned 5 [0143.591] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\5Sk6EtcvqXru1Lwj9.swf", pszSpec="*.odt") returned 0 [0143.591] lstrlenA (lpString="*.odt") returned 5 [0143.591] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\5Sk6EtcvqXru1Lwj9.swf", pszSpec="*.vob") returned 0 [0143.591] lstrlenA (lpString="*.vob") returned 5 [0143.591] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\5Sk6EtcvqXru1Lwj9.swf", pszSpec="*.ifo") returned 0 [0143.591] lstrlenA (lpString="*.ifo") returned 5 [0143.591] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\5Sk6EtcvqXru1Lwj9.swf", pszSpec="*.lnk") returned 0 [0143.591] lstrlenA (lpString="*.lnk") returned 5 [0143.591] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\5Sk6EtcvqXru1Lwj9.swf", pszSpec="*.torrent") returned 0 [0143.591] lstrlenA (lpString="*.torrent") returned 9 [0143.591] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\5Sk6EtcvqXru1Lwj9.swf", pszSpec="*.mov") returned 0 [0143.591] lstrlenA (lpString="*.mov") returned 5 [0143.591] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\5Sk6EtcvqXru1Lwj9.swf", pszSpec="*.m2v") returned 0 [0143.591] lstrlenA (lpString="*.m2v") returned 5 [0143.591] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\5Sk6EtcvqXru1Lwj9.swf", pszSpec="*.3gp") returned 0 [0143.591] lstrlenA (lpString="*.3gp") returned 5 [0143.591] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\5Sk6EtcvqXru1Lwj9.swf", pszSpec="*.mpeg") returned 0 [0143.591] lstrlenA (lpString="*.mpeg") returned 6 [0143.591] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\5Sk6EtcvqXru1Lwj9.swf", pszSpec="*.mpg") returned 0 [0143.591] lstrlenA (lpString="*.mpg") returned 5 [0143.591] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\5Sk6EtcvqXru1Lwj9.swf", pszSpec="*.flv") returned 0 [0143.591] lstrlenA (lpString="*.flv") returned 5 [0143.591] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\5Sk6EtcvqXru1Lwj9.swf", pszSpec="*.avi") returned 0 [0143.591] lstrlenA (lpString="*.avi") returned 5 [0143.591] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\5Sk6EtcvqXru1Lwj9.swf", pszSpec="*.mp4") returned 0 [0143.591] lstrlenA (lpString="*.mp4") returned 5 [0143.591] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\5Sk6EtcvqXru1Lwj9.swf", pszSpec="*.wmv") returned 0 [0143.591] lstrlenA (lpString="*.wmv") returned 5 [0143.591] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\5Sk6EtcvqXru1Lwj9.swf", pszSpec="*.divx") returned 0 [0143.591] lstrlenA (lpString="*.divx") returned 6 [0143.591] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\5Sk6EtcvqXru1Lwj9.swf", pszSpec="*.mkv") returned 0 [0143.591] lstrlenA (lpString="*.mkv") returned 5 [0143.591] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\5Sk6EtcvqXru1Lwj9.swf", pszSpec="*.mp3") returned 0 [0143.591] lstrlenA (lpString="*.mp3") returned 5 [0143.591] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\5Sk6EtcvqXru1Lwj9.swf", pszSpec="*.wav") returned 0 [0143.591] lstrlenA (lpString="*.wav") returned 5 [0143.591] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\5Sk6EtcvqXru1Lwj9.swf", pszSpec="*.flac") returned 0 [0143.591] lstrlenA (lpString="*.flac") returned 6 [0143.591] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\5Sk6EtcvqXru1Lwj9.swf", pszSpec="*.ape") returned 0 [0143.591] lstrlenA (lpString="*.ape") returned 5 [0143.591] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\5Sk6EtcvqXru1Lwj9.swf", pszSpec="*.wma") returned 0 [0143.591] lstrlenA (lpString="*.wma") returned 5 [0143.592] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\5Sk6EtcvqXru1Lwj9.swf", pszSpec="*.ac3") returned 0 [0143.592] lstrlenA (lpString="*.ac3") returned 5 [0143.592] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0143.592] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0143.592] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="7DHNurxjXK.png") returned 1 [0143.592] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="7DHNurxjXK.png") returned 1 [0143.592] lstrcmpiA (lpString1="", lpString2="7DHNurxjXK.png") returned -1 [0143.592] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\5Sk6EtcvqXru1Lwj9.swf") returned="5Sk6EtcvqXru1Lwj9.swf" [0143.592] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\", lpString2="7DHNurxjXK.png" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\7DHNurxjXK.png") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\7DHNurxjXK.png" [0143.592] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\7DHNurxjXK.png", pszSpec="*.zip") returned 0 [0143.592] lstrlenA (lpString="*.zip") returned 5 [0143.592] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\7DHNurxjXK.png", pszSpec="*.rar") returned 0 [0143.592] lstrlenA (lpString="*.rar") returned 5 [0143.592] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\7DHNurxjXK.png", pszSpec="*.7z") returned 0 [0143.592] lstrlenA (lpString="*.7z") returned 4 [0143.592] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\7DHNurxjXK.png", pszSpec="*.tar") returned 0 [0143.592] lstrlenA (lpString="*.tar") returned 5 [0143.592] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\7DHNurxjXK.png", pszSpec="*.gzip") returned 0 [0143.592] lstrlenA (lpString="*.gzip") returned 6 [0143.592] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\7DHNurxjXK.png", pszSpec="*.jpg") returned 0 [0143.592] lstrlenA (lpString="*.jpg") returned 5 [0143.592] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\7DHNurxjXK.png", pszSpec="*.jpeg") returned 0 [0143.592] lstrlenA (lpString="*.jpeg") returned 6 [0143.592] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\7DHNurxjXK.png", pszSpec="*.psd") returned 0 [0143.592] lstrlenA (lpString="*.psd") returned 5 [0143.592] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\7DHNurxjXK.png", pszSpec="*.cdr") returned 0 [0143.592] lstrlenA (lpString="*.cdr") returned 5 [0143.592] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\7DHNurxjXK.png", pszSpec="*.dwg") returned 0 [0143.592] lstrlenA (lpString="*.dwg") returned 5 [0143.592] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\7DHNurxjXK.png", pszSpec="*.max") returned 0 [0143.592] lstrlenA (lpString="*.max") returned 5 [0143.592] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\7DHNurxjXK.png", pszSpec="*.bmp") returned 0 [0143.592] lstrlenA (lpString="*.bmp") returned 5 [0143.592] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\7DHNurxjXK.png", pszSpec="*.gif") returned 0 [0143.592] lstrlenA (lpString="*.gif") returned 5 [0143.592] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\7DHNurxjXK.png", pszSpec="*.png") returned 1 [0143.592] lstrlenA (lpString="*.png") returned 5 [0143.592] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\7DHNurxjXK.png" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\7DHNurxjXK.png") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\7DHNurxjXK.png" [0143.592] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\7DHNurxjXK.png" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\7DHNurxjXK.png") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\7DHNurxjXK.png" [0143.592] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\7DHNurxjXK.png", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\7DHNurxjXK.png.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\7DHNurxjXK.png." [0143.592] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\7DHNurxjXK.png.", lpString2="\xa0" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\7DHNurxjXK.png. ") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\7DHNurxjXK.png. " [0143.592] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\7DHNurxjXK.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\7dhnurxjxk.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c [0143.593] GetFileSize (in: hFile=0x8c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x17e59 [0143.593] GetFileTime (in: hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x3f390090, dwHighDateTime=0x1d4a05d), lpLastAccessTime=0x407536*(dwLowDateTime=0x5474a930, dwHighDateTime=0x1d49dda), lpLastWriteTime=0x40753e*(dwLowDateTime=0x5474a930, dwHighDateTime=0x1d49dda)) returned 1 [0143.593] SetFilePointer (in: hFile=0x8c, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0143.593] ReadFile (in: hFile=0x8c, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x17dff, lpOverlapped=0x0) returned 1 [0143.594] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\7DHNurxjXK.png") returned="7DHNurxjXK.png" [0143.594] SetFilePointer (in: hFile=0x8c, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0143.594] WriteFile (in: hFile=0x8c, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x17dff, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x17dff, lpOverlapped=0x0) returned 1 [0143.594] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0143.594] CloseHandle (hObject=0x8c) returned 1 [0143.595] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\7DHNurxjXK.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\7dhnurxjxk.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\7DHNurxjXK.png. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\7dhnurxjxk.png. ")) returned 1 [0143.595] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0143.595] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0143.595] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="A3r09Z6nlT.xls") returned 1 [0143.595] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="A3r09Z6nlT.xls") returned 1 [0143.595] lstrcmpiA (lpString1="", lpString2="A3r09Z6nlT.xls") returned -1 [0143.595] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\7DHNurxjXK.png") returned="7DHNurxjXK.png" [0143.595] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\", lpString2="A3r09Z6nlT.xls" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\A3r09Z6nlT.xls") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\A3r09Z6nlT.xls" [0143.596] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\A3r09Z6nlT.xls", pszSpec="*.zip") returned 0 [0143.596] lstrlenA (lpString="*.zip") returned 5 [0143.596] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\A3r09Z6nlT.xls", pszSpec="*.rar") returned 0 [0143.596] lstrlenA (lpString="*.rar") returned 5 [0143.596] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\A3r09Z6nlT.xls", pszSpec="*.7z") returned 0 [0143.596] lstrlenA (lpString="*.7z") returned 4 [0143.596] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\A3r09Z6nlT.xls", pszSpec="*.tar") returned 0 [0143.596] lstrlenA (lpString="*.tar") returned 5 [0143.596] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\A3r09Z6nlT.xls", pszSpec="*.gzip") returned 0 [0143.596] lstrlenA (lpString="*.gzip") returned 6 [0143.596] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\A3r09Z6nlT.xls", pszSpec="*.jpg") returned 0 [0143.596] lstrlenA (lpString="*.jpg") returned 5 [0143.596] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\A3r09Z6nlT.xls", pszSpec="*.jpeg") returned 0 [0143.596] lstrlenA (lpString="*.jpeg") returned 6 [0143.596] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\A3r09Z6nlT.xls", pszSpec="*.psd") returned 0 [0143.596] lstrlenA (lpString="*.psd") returned 5 [0143.596] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\A3r09Z6nlT.xls", pszSpec="*.cdr") returned 0 [0143.596] lstrlenA (lpString="*.cdr") returned 5 [0143.596] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\A3r09Z6nlT.xls", pszSpec="*.dwg") returned 0 [0143.596] lstrlenA (lpString="*.dwg") returned 5 [0143.596] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\A3r09Z6nlT.xls", pszSpec="*.max") returned 0 [0143.596] lstrlenA (lpString="*.max") returned 5 [0143.596] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\A3r09Z6nlT.xls", pszSpec="*.bmp") returned 0 [0143.596] lstrlenA (lpString="*.bmp") returned 5 [0143.596] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\A3r09Z6nlT.xls", pszSpec="*.gif") returned 0 [0143.596] lstrlenA (lpString="*.gif") returned 5 [0143.596] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\A3r09Z6nlT.xls", pszSpec="*.png") returned 0 [0143.596] lstrlenA (lpString="*.png") returned 5 [0143.596] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\A3r09Z6nlT.xls", pszSpec="*.doc") returned 0 [0143.596] lstrlenA (lpString="*.doc") returned 5 [0143.596] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\A3r09Z6nlT.xls", pszSpec="*.docx") returned 0 [0143.596] lstrlenA (lpString="*.docx") returned 6 [0143.596] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\A3r09Z6nlT.xls", pszSpec="*.xls") returned 1 [0143.596] lstrlenA (lpString="*.xls") returned 5 [0143.596] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\A3r09Z6nlT.xls" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\A3r09Z6nlT.xls") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\A3r09Z6nlT.xls" [0143.596] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\A3r09Z6nlT.xls" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\A3r09Z6nlT.xls") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\A3r09Z6nlT.xls" [0143.596] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\A3r09Z6nlT.xls", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\A3r09Z6nlT.xls.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\A3r09Z6nlT.xls." [0143.596] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\A3r09Z6nlT.xls.", lpString2="\xa0" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\A3r09Z6nlT.xls. ") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\A3r09Z6nlT.xls. " [0143.596] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\A3r09Z6nlT.xls" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\a3r09z6nlt.xls"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c [0143.597] GetFileSize (in: hFile=0x8c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1712e [0143.597] GetFileTime (in: hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x71040fa0, dwHighDateTime=0x1d4a690), lpLastAccessTime=0x407536*(dwLowDateTime=0xba383a40, dwHighDateTime=0x1d4a21f), lpLastWriteTime=0x40753e*(dwLowDateTime=0xba383a40, dwHighDateTime=0x1d4a21f)) returned 1 [0143.597] SetFilePointer (in: hFile=0x8c, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0143.597] ReadFile (in: hFile=0x8c, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x170d4, lpOverlapped=0x0) returned 1 [0143.598] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\A3r09Z6nlT.xls") returned="A3r09Z6nlT.xls" [0143.598] SetFilePointer (in: hFile=0x8c, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0143.598] WriteFile (in: hFile=0x8c, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x170d4, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x170d4, lpOverlapped=0x0) returned 1 [0143.598] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0143.598] CloseHandle (hObject=0x8c) returned 1 [0143.598] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\A3r09Z6nlT.xls" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\a3r09z6nlt.xls"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\A3r09Z6nlT.xls. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\a3r09z6nlt.xls. ")) returned 1 [0143.599] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0143.599] lstrcmpA (lpString1=".", lpString2="Adobe") returned -1 [0143.599] lstrcmpA (lpString1="..", lpString2="Adobe") returned -1 [0143.599] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\A3r09Z6nlT.xls") returned="A3r09Z6nlT.xls" [0143.599] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\", lpString2="Adobe" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe" [0143.599] lstrlenA (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe") returned 51 [0143.599] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0143.601] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0143.601] FindNextFileA (in: hFindFile=0x5be260, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0143.601] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0143.601] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0143.601] FindNextFileA (in: hFindFile=0x5be260, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0143.601] lstrcmpA (lpString1=".", lpString2="Acrobat") returned -1 [0143.601] lstrcmpA (lpString1="..", lpString2="Acrobat") returned -1 [0143.601] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\*.*") returned="*.*" [0143.601] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\", lpString2="Acrobat" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat" [0143.601] lstrlenA (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat") returned 59 [0143.601] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0143.601] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0143.601] FindNextFileA (in: hFindFile=0x5be2a0, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0143.601] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0143.601] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0143.601] FindNextFileA (in: hFindFile=0x5be2a0, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0143.601] lstrcmpA (lpString1=".", lpString2="10.0") returned -1 [0143.601] lstrcmpA (lpString1="..", lpString2="10.0") returned -1 [0143.601] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\*.*") returned="*.*" [0143.601] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\", lpString2="10.0" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0" [0143.601] lstrlenA (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0") returned 64 [0143.601] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\*.*", lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 0x5be2e0 [0143.601] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0143.601] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0143.602] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0143.602] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0143.602] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0143.602] lstrcmpA (lpString1=".", lpString2="Collab") returned -1 [0143.602] lstrcmpA (lpString1="..", lpString2="Collab") returned -1 [0143.602] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\*.*") returned="*.*" [0143.602] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\", lpString2="Collab" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Collab") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Collab" [0143.602] lstrlenA (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Collab") returned 71 [0143.602] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Collab\\*.*", lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 0x5be320 [0143.602] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0143.602] FindNextFileA (in: hFindFile=0x5be320, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0143.602] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0143.602] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0143.602] FindNextFileA (in: hFindFile=0x5be320, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 0 [0143.602] FindClose (in: hFindFile=0x5be320 | out: hFindFile=0x5be320) returned 1 [0143.602] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0143.602] lstrcmpA (lpString1=".", lpString2="Forms") returned -1 [0143.602] lstrcmpA (lpString1="..", lpString2="Forms") returned -1 [0143.602] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\*.*") returned="*.*" [0143.602] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\", lpString2="Forms" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Forms") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Forms" [0143.602] lstrlenA (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Forms") returned 70 [0143.602] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Forms\\*.*", lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 0x5be320 [0143.602] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0143.602] FindNextFileA (in: hFindFile=0x5be320, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0143.602] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0143.602] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0143.602] FindNextFileA (in: hFindFile=0x5be320, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 0 [0143.602] FindClose (in: hFindFile=0x5be320 | out: hFindFile=0x5be320) returned 1 [0143.602] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0143.602] lstrcmpA (lpString1=".", lpString2="JavaScripts") returned -1 [0143.602] lstrcmpA (lpString1="..", lpString2="JavaScripts") returned -1 [0143.602] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\*.*") returned="*.*" [0143.602] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\", lpString2="JavaScripts" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts" [0143.603] lstrlenA (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts") returned 76 [0143.603] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\*.*", lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 0x5be320 [0143.603] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0143.603] FindNextFileA (in: hFindFile=0x5be320, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0143.603] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0143.603] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0143.603] FindNextFileA (in: hFindFile=0x5be320, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0143.603] PeekMessageA (in: lpMsg=0xaece4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaece4) returned 0 [0143.603] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="glob.js") returned -1 [0143.603] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="glob.js") returned 1 [0143.603] lstrcmpiA (lpString1="", lpString2="glob.js") returned -1 [0143.603] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\*.*") returned="*.*" [0143.603] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\", lpString2="glob.js" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.js") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.js" [0143.603] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.js", pszSpec="*.zip") returned 0 [0143.603] lstrlenA (lpString="*.zip") returned 5 [0143.603] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.js", pszSpec="*.rar") returned 0 [0143.603] lstrlenA (lpString="*.rar") returned 5 [0143.603] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.js", pszSpec="*.7z") returned 0 [0143.603] lstrlenA (lpString="*.7z") returned 4 [0143.603] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.js", pszSpec="*.tar") returned 0 [0143.603] lstrlenA (lpString="*.tar") returned 5 [0143.603] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.js", pszSpec="*.gzip") returned 0 [0143.603] lstrlenA (lpString="*.gzip") returned 6 [0143.603] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.js", pszSpec="*.jpg") returned 0 [0143.603] lstrlenA (lpString="*.jpg") returned 5 [0143.603] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.js", pszSpec="*.jpeg") returned 0 [0143.603] lstrlenA (lpString="*.jpeg") returned 6 [0143.603] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.js", pszSpec="*.psd") returned 0 [0143.603] lstrlenA (lpString="*.psd") returned 5 [0143.603] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.js", pszSpec="*.cdr") returned 0 [0143.603] lstrlenA (lpString="*.cdr") returned 5 [0143.603] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.js", pszSpec="*.dwg") returned 0 [0143.603] lstrlenA (lpString="*.dwg") returned 5 [0143.603] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.js", pszSpec="*.max") returned 0 [0143.603] lstrlenA (lpString="*.max") returned 5 [0143.603] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.js", pszSpec="*.bmp") returned 0 [0143.603] lstrlenA (lpString="*.bmp") returned 5 [0143.603] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.js", pszSpec="*.gif") returned 0 [0143.603] lstrlenA (lpString="*.gif") returned 5 [0143.603] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.js", pszSpec="*.png") returned 0 [0143.603] lstrlenA (lpString="*.png") returned 5 [0143.604] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.js", pszSpec="*.doc") returned 0 [0143.604] lstrlenA (lpString="*.doc") returned 5 [0143.604] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.js", pszSpec="*.docx") returned 0 [0143.604] lstrlenA (lpString="*.docx") returned 6 [0143.604] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.js", pszSpec="*.xls") returned 0 [0143.604] lstrlenA (lpString="*.xls") returned 5 [0143.604] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.js", pszSpec="*.xlsx") returned 0 [0143.604] lstrlenA (lpString="*.xlsx") returned 6 [0143.604] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.js", pszSpec="*.ppt") returned 0 [0143.604] lstrlenA (lpString="*.ppt") returned 5 [0143.604] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.js", pszSpec="*.pptx") returned 0 [0143.604] lstrlenA (lpString="*.pptx") returned 6 [0143.604] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.js", pszSpec="*.txt") returned 0 [0143.604] lstrlenA (lpString="*.txt") returned 5 [0143.604] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.js", pszSpec="*.pdf") returned 0 [0143.604] lstrlenA (lpString="*.pdf") returned 5 [0143.604] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.js", pszSpec="*.djvu") returned 0 [0143.604] lstrlenA (lpString="*.djvu") returned 6 [0143.604] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.js", pszSpec="*.htm") returned 0 [0143.604] lstrlenA (lpString="*.htm") returned 5 [0143.604] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.js", pszSpec="*.html") returned 0 [0143.604] lstrlenA (lpString="*.html") returned 6 [0143.604] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.js", pszSpec="*.mdb") returned 0 [0143.604] lstrlenA (lpString="*.mdb") returned 5 [0143.604] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.js", pszSpec="*.cer") returned 0 [0143.604] lstrlenA (lpString="*.cer") returned 5 [0143.604] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.js", pszSpec="*.p12") returned 0 [0143.604] lstrlenA (lpString="*.p12") returned 5 [0143.604] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.js", pszSpec="*.pfx") returned 0 [0143.604] lstrlenA (lpString="*.pfx") returned 5 [0143.604] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.js", pszSpec="*.kwm") returned 0 [0143.604] lstrlenA (lpString="*.kwm") returned 5 [0143.604] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.js", pszSpec="*.pwm") returned 0 [0143.604] lstrlenA (lpString="*.pwm") returned 5 [0143.604] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.js", pszSpec="*.1cd") returned 0 [0143.604] lstrlenA (lpString="*.1cd") returned 5 [0143.604] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.js", pszSpec="*.md") returned 0 [0143.604] lstrlenA (lpString="*.md") returned 4 [0143.604] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.js", pszSpec="*.mdf") returned 0 [0143.604] lstrlenA (lpString="*.mdf") returned 5 [0143.604] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.js", pszSpec="*.dbf") returned 0 [0143.604] lstrlenA (lpString="*.dbf") returned 5 [0143.604] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.js", pszSpec="*.odt") returned 0 [0143.604] lstrlenA (lpString="*.odt") returned 5 [0143.604] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.js", pszSpec="*.vob") returned 0 [0143.604] lstrlenA (lpString="*.vob") returned 5 [0143.604] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.js", pszSpec="*.ifo") returned 0 [0143.604] lstrlenA (lpString="*.ifo") returned 5 [0143.604] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.js", pszSpec="*.lnk") returned 0 [0143.604] lstrlenA (lpString="*.lnk") returned 5 [0143.604] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.js", pszSpec="*.torrent") returned 0 [0143.605] lstrlenA (lpString="*.torrent") returned 9 [0143.605] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.js", pszSpec="*.mov") returned 0 [0143.605] lstrlenA (lpString="*.mov") returned 5 [0143.605] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.js", pszSpec="*.m2v") returned 0 [0143.605] lstrlenA (lpString="*.m2v") returned 5 [0143.605] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.js", pszSpec="*.3gp") returned 0 [0143.605] lstrlenA (lpString="*.3gp") returned 5 [0143.605] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.js", pszSpec="*.mpeg") returned 0 [0143.605] lstrlenA (lpString="*.mpeg") returned 6 [0143.605] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.js", pszSpec="*.mpg") returned 0 [0143.605] lstrlenA (lpString="*.mpg") returned 5 [0143.605] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.js", pszSpec="*.flv") returned 0 [0143.605] lstrlenA (lpString="*.flv") returned 5 [0143.605] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.js", pszSpec="*.avi") returned 0 [0143.605] lstrlenA (lpString="*.avi") returned 5 [0143.605] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.js", pszSpec="*.mp4") returned 0 [0143.605] lstrlenA (lpString="*.mp4") returned 5 [0143.605] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.js", pszSpec="*.wmv") returned 0 [0143.605] lstrlenA (lpString="*.wmv") returned 5 [0143.605] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.js", pszSpec="*.divx") returned 0 [0143.605] lstrlenA (lpString="*.divx") returned 6 [0143.605] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.js", pszSpec="*.mkv") returned 0 [0143.605] lstrlenA (lpString="*.mkv") returned 5 [0143.605] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.js", pszSpec="*.mp3") returned 0 [0143.605] lstrlenA (lpString="*.mp3") returned 5 [0143.605] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.js", pszSpec="*.wav") returned 0 [0143.605] lstrlenA (lpString="*.wav") returned 5 [0143.605] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.js", pszSpec="*.flac") returned 0 [0143.605] lstrlenA (lpString="*.flac") returned 6 [0143.605] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.js", pszSpec="*.ape") returned 0 [0143.605] lstrlenA (lpString="*.ape") returned 5 [0143.605] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.js", pszSpec="*.wma") returned 0 [0143.605] lstrlenA (lpString="*.wma") returned 5 [0143.605] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.js", pszSpec="*.ac3") returned 0 [0143.605] lstrlenA (lpString="*.ac3") returned 5 [0143.605] FindNextFileA (in: hFindFile=0x5be320, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0143.605] PeekMessageA (in: lpMsg=0xaece4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaece4) returned 0 [0143.605] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="glob.settings.js") returned -1 [0143.605] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="glob.settings.js") returned 1 [0143.605] lstrcmpiA (lpString1="", lpString2="glob.settings.js") returned -1 [0143.605] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.js") returned="glob.js" [0143.605] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\", lpString2="glob.settings.js" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.settings.js") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.settings.js" [0143.605] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.settings.js", pszSpec="*.zip") returned 0 [0143.606] lstrlenA (lpString="*.zip") returned 5 [0143.606] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.settings.js", pszSpec="*.rar") returned 0 [0143.606] lstrlenA (lpString="*.rar") returned 5 [0143.606] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.settings.js", pszSpec="*.7z") returned 0 [0143.606] lstrlenA (lpString="*.7z") returned 4 [0143.606] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.settings.js", pszSpec="*.tar") returned 0 [0143.606] lstrlenA (lpString="*.tar") returned 5 [0143.606] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.settings.js", pszSpec="*.gzip") returned 0 [0143.606] lstrlenA (lpString="*.gzip") returned 6 [0143.606] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.settings.js", pszSpec="*.jpg") returned 0 [0143.606] lstrlenA (lpString="*.jpg") returned 5 [0143.606] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.settings.js", pszSpec="*.jpeg") returned 0 [0143.606] lstrlenA (lpString="*.jpeg") returned 6 [0143.606] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.settings.js", pszSpec="*.psd") returned 0 [0143.606] lstrlenA (lpString="*.psd") returned 5 [0143.606] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.settings.js", pszSpec="*.cdr") returned 0 [0143.606] lstrlenA (lpString="*.cdr") returned 5 [0143.606] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.settings.js", pszSpec="*.dwg") returned 0 [0143.606] lstrlenA (lpString="*.dwg") returned 5 [0143.606] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.settings.js", pszSpec="*.max") returned 0 [0143.606] lstrlenA (lpString="*.max") returned 5 [0143.606] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.settings.js", pszSpec="*.bmp") returned 0 [0143.606] lstrlenA (lpString="*.bmp") returned 5 [0143.606] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.settings.js", pszSpec="*.gif") returned 0 [0143.606] lstrlenA (lpString="*.gif") returned 5 [0143.606] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.settings.js", pszSpec="*.png") returned 0 [0143.606] lstrlenA (lpString="*.png") returned 5 [0143.606] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.settings.js", pszSpec="*.doc") returned 0 [0143.606] lstrlenA (lpString="*.doc") returned 5 [0143.606] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.settings.js", pszSpec="*.docx") returned 0 [0143.606] lstrlenA (lpString="*.docx") returned 6 [0143.606] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.settings.js", pszSpec="*.xls") returned 0 [0143.606] lstrlenA (lpString="*.xls") returned 5 [0143.606] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.settings.js", pszSpec="*.xlsx") returned 0 [0143.606] lstrlenA (lpString="*.xlsx") returned 6 [0143.606] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.settings.js", pszSpec="*.ppt") returned 0 [0143.606] lstrlenA (lpString="*.ppt") returned 5 [0143.606] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.settings.js", pszSpec="*.pptx") returned 0 [0143.606] lstrlenA (lpString="*.pptx") returned 6 [0143.606] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.settings.js", pszSpec="*.txt") returned 0 [0143.606] lstrlenA (lpString="*.txt") returned 5 [0143.606] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.settings.js", pszSpec="*.pdf") returned 0 [0143.607] lstrlenA (lpString="*.pdf") returned 5 [0143.607] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.settings.js", pszSpec="*.djvu") returned 0 [0143.607] lstrlenA (lpString="*.djvu") returned 6 [0143.607] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.settings.js", pszSpec="*.htm") returned 0 [0143.607] lstrlenA (lpString="*.htm") returned 5 [0143.607] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.settings.js", pszSpec="*.html") returned 0 [0143.607] lstrlenA (lpString="*.html") returned 6 [0143.607] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.settings.js", pszSpec="*.mdb") returned 0 [0143.607] lstrlenA (lpString="*.mdb") returned 5 [0143.607] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.settings.js", pszSpec="*.cer") returned 0 [0143.607] lstrlenA (lpString="*.cer") returned 5 [0143.607] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.settings.js", pszSpec="*.p12") returned 0 [0143.607] lstrlenA (lpString="*.p12") returned 5 [0143.607] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.settings.js", pszSpec="*.pfx") returned 0 [0143.607] lstrlenA (lpString="*.pfx") returned 5 [0143.607] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.settings.js", pszSpec="*.kwm") returned 0 [0143.607] lstrlenA (lpString="*.kwm") returned 5 [0143.607] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.settings.js", pszSpec="*.pwm") returned 0 [0143.607] lstrlenA (lpString="*.pwm") returned 5 [0143.607] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.settings.js", pszSpec="*.1cd") returned 0 [0143.607] lstrlenA (lpString="*.1cd") returned 5 [0143.607] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.settings.js", pszSpec="*.md") returned 0 [0143.607] lstrlenA (lpString="*.md") returned 4 [0143.607] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.settings.js", pszSpec="*.mdf") returned 0 [0143.607] lstrlenA (lpString="*.mdf") returned 5 [0143.607] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.settings.js", pszSpec="*.dbf") returned 0 [0143.607] lstrlenA (lpString="*.dbf") returned 5 [0143.607] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.settings.js", pszSpec="*.odt") returned 0 [0143.607] lstrlenA (lpString="*.odt") returned 5 [0143.607] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.settings.js", pszSpec="*.vob") returned 0 [0143.607] lstrlenA (lpString="*.vob") returned 5 [0143.607] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.settings.js", pszSpec="*.ifo") returned 0 [0143.607] lstrlenA (lpString="*.ifo") returned 5 [0143.607] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.settings.js", pszSpec="*.lnk") returned 0 [0143.607] lstrlenA (lpString="*.lnk") returned 5 [0143.607] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.settings.js", pszSpec="*.torrent") returned 0 [0143.607] lstrlenA (lpString="*.torrent") returned 9 [0143.607] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.settings.js", pszSpec="*.mov") returned 0 [0143.607] lstrlenA (lpString="*.mov") returned 5 [0143.607] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.settings.js", pszSpec="*.m2v") returned 0 [0143.607] lstrlenA (lpString="*.m2v") returned 5 [0143.607] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.settings.js", pszSpec="*.3gp") returned 0 [0143.607] lstrlenA (lpString="*.3gp") returned 5 [0143.607] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.settings.js", pszSpec="*.mpeg") returned 0 [0143.607] lstrlenA (lpString="*.mpeg") returned 6 [0143.607] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.settings.js", pszSpec="*.mpg") returned 0 [0143.607] lstrlenA (lpString="*.mpg") returned 5 [0143.607] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.settings.js", pszSpec="*.flv") returned 0 [0143.608] lstrlenA (lpString="*.flv") returned 5 [0143.608] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.settings.js", pszSpec="*.avi") returned 0 [0143.608] lstrlenA (lpString="*.avi") returned 5 [0143.608] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.settings.js", pszSpec="*.mp4") returned 0 [0143.608] lstrlenA (lpString="*.mp4") returned 5 [0143.608] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.settings.js", pszSpec="*.wmv") returned 0 [0143.608] lstrlenA (lpString="*.wmv") returned 5 [0143.608] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.settings.js", pszSpec="*.divx") returned 0 [0143.608] lstrlenA (lpString="*.divx") returned 6 [0143.608] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.settings.js", pszSpec="*.mkv") returned 0 [0143.608] lstrlenA (lpString="*.mkv") returned 5 [0143.608] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.settings.js", pszSpec="*.mp3") returned 0 [0143.608] lstrlenA (lpString="*.mp3") returned 5 [0143.608] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.settings.js", pszSpec="*.wav") returned 0 [0143.608] lstrlenA (lpString="*.wav") returned 5 [0143.608] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.settings.js", pszSpec="*.flac") returned 0 [0143.608] lstrlenA (lpString="*.flac") returned 6 [0143.608] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.settings.js", pszSpec="*.ape") returned 0 [0143.608] lstrlenA (lpString="*.ape") returned 5 [0143.608] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.settings.js", pszSpec="*.wma") returned 0 [0143.608] lstrlenA (lpString="*.wma") returned 5 [0143.608] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.settings.js", pszSpec="*.ac3") returned 0 [0143.608] lstrlenA (lpString="*.ac3") returned 5 [0143.608] FindNextFileA (in: hFindFile=0x5be320, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 0 [0143.608] FindClose (in: hFindFile=0x5be320 | out: hFindFile=0x5be320) returned 1 [0143.608] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0143.608] lstrcmpA (lpString1=".", lpString2="Security") returned -1 [0143.608] lstrcmpA (lpString1="..", lpString2="Security") returned -1 [0143.608] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\*.*") returned="*.*" [0143.608] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\", lpString2="Security" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security" [0143.608] lstrlenA (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security") returned 73 [0143.608] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\*.*", lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 0x5be320 [0143.608] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0143.608] FindNextFileA (in: hFindFile=0x5be320, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0143.608] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0143.608] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0143.608] FindNextFileA (in: hFindFile=0x5be320, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0143.608] PeekMessageA (in: lpMsg=0xaece4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaece4) returned 0 [0143.609] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="addressbook.acrodata") returned 1 [0143.609] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="addressbook.acrodata") returned 1 [0143.609] lstrcmpiA (lpString1="", lpString2="addressbook.acrodata") returned -1 [0143.609] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\*.*") returned="*.*" [0143.609] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\", lpString2="addressbook.acrodata" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\addressbook.acrodata") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\addressbook.acrodata" [0143.609] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\addressbook.acrodata", pszSpec="*.zip") returned 0 [0143.609] lstrlenA (lpString="*.zip") returned 5 [0143.609] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\addressbook.acrodata", pszSpec="*.rar") returned 0 [0143.609] lstrlenA (lpString="*.rar") returned 5 [0143.609] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\addressbook.acrodata", pszSpec="*.7z") returned 0 [0143.609] lstrlenA (lpString="*.7z") returned 4 [0143.609] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\addressbook.acrodata", pszSpec="*.tar") returned 0 [0143.609] lstrlenA (lpString="*.tar") returned 5 [0143.609] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\addressbook.acrodata", pszSpec="*.gzip") returned 0 [0143.609] lstrlenA (lpString="*.gzip") returned 6 [0143.609] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\addressbook.acrodata", pszSpec="*.jpg") returned 0 [0143.609] lstrlenA (lpString="*.jpg") returned 5 [0143.609] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\addressbook.acrodata", pszSpec="*.jpeg") returned 0 [0143.609] lstrlenA (lpString="*.jpeg") returned 6 [0143.609] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\addressbook.acrodata", pszSpec="*.psd") returned 0 [0143.609] lstrlenA (lpString="*.psd") returned 5 [0143.609] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\addressbook.acrodata", pszSpec="*.cdr") returned 0 [0143.609] lstrlenA (lpString="*.cdr") returned 5 [0143.609] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\addressbook.acrodata", pszSpec="*.dwg") returned 0 [0143.609] lstrlenA (lpString="*.dwg") returned 5 [0143.609] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\addressbook.acrodata", pszSpec="*.max") returned 0 [0143.609] lstrlenA (lpString="*.max") returned 5 [0143.609] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\addressbook.acrodata", pszSpec="*.bmp") returned 0 [0143.609] lstrlenA (lpString="*.bmp") returned 5 [0143.609] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\addressbook.acrodata", pszSpec="*.gif") returned 0 [0143.609] lstrlenA (lpString="*.gif") returned 5 [0143.609] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\addressbook.acrodata", pszSpec="*.png") returned 0 [0143.609] lstrlenA (lpString="*.png") returned 5 [0143.609] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\addressbook.acrodata", pszSpec="*.doc") returned 0 [0143.609] lstrlenA (lpString="*.doc") returned 5 [0143.609] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\addressbook.acrodata", pszSpec="*.docx") returned 0 [0143.609] lstrlenA (lpString="*.docx") returned 6 [0143.609] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\addressbook.acrodata", pszSpec="*.xls") returned 0 [0143.609] lstrlenA (lpString="*.xls") returned 5 [0143.609] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\addressbook.acrodata", pszSpec="*.xlsx") returned 0 [0143.609] lstrlenA (lpString="*.xlsx") returned 6 [0143.609] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\addressbook.acrodata", pszSpec="*.ppt") returned 0 [0143.609] lstrlenA (lpString="*.ppt") returned 5 [0143.609] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\addressbook.acrodata", pszSpec="*.pptx") returned 0 [0143.609] lstrlenA (lpString="*.pptx") returned 6 [0143.609] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\addressbook.acrodata", pszSpec="*.txt") returned 0 [0143.610] lstrlenA (lpString="*.txt") returned 5 [0143.610] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\addressbook.acrodata", pszSpec="*.pdf") returned 0 [0143.610] lstrlenA (lpString="*.pdf") returned 5 [0143.610] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\addressbook.acrodata", pszSpec="*.djvu") returned 0 [0143.610] lstrlenA (lpString="*.djvu") returned 6 [0143.610] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\addressbook.acrodata", pszSpec="*.htm") returned 0 [0143.610] lstrlenA (lpString="*.htm") returned 5 [0143.610] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\addressbook.acrodata", pszSpec="*.html") returned 0 [0143.610] lstrlenA (lpString="*.html") returned 6 [0143.610] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\addressbook.acrodata", pszSpec="*.mdb") returned 0 [0143.610] lstrlenA (lpString="*.mdb") returned 5 [0143.610] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\addressbook.acrodata", pszSpec="*.cer") returned 0 [0143.610] lstrlenA (lpString="*.cer") returned 5 [0143.610] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\addressbook.acrodata", pszSpec="*.p12") returned 0 [0143.610] lstrlenA (lpString="*.p12") returned 5 [0143.610] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\addressbook.acrodata", pszSpec="*.pfx") returned 0 [0143.610] lstrlenA (lpString="*.pfx") returned 5 [0143.610] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\addressbook.acrodata", pszSpec="*.kwm") returned 0 [0143.610] lstrlenA (lpString="*.kwm") returned 5 [0143.610] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\addressbook.acrodata", pszSpec="*.pwm") returned 0 [0143.610] lstrlenA (lpString="*.pwm") returned 5 [0143.610] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\addressbook.acrodata", pszSpec="*.1cd") returned 0 [0143.610] lstrlenA (lpString="*.1cd") returned 5 [0143.610] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\addressbook.acrodata", pszSpec="*.md") returned 0 [0143.610] lstrlenA (lpString="*.md") returned 4 [0143.610] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\addressbook.acrodata", pszSpec="*.mdf") returned 0 [0143.610] lstrlenA (lpString="*.mdf") returned 5 [0143.610] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\addressbook.acrodata", pszSpec="*.dbf") returned 0 [0143.610] lstrlenA (lpString="*.dbf") returned 5 [0143.610] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\addressbook.acrodata", pszSpec="*.odt") returned 0 [0143.610] lstrlenA (lpString="*.odt") returned 5 [0143.610] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\addressbook.acrodata", pszSpec="*.vob") returned 0 [0143.610] lstrlenA (lpString="*.vob") returned 5 [0143.610] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\addressbook.acrodata", pszSpec="*.ifo") returned 0 [0143.610] lstrlenA (lpString="*.ifo") returned 5 [0143.610] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\addressbook.acrodata", pszSpec="*.lnk") returned 0 [0143.610] lstrlenA (lpString="*.lnk") returned 5 [0143.610] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\addressbook.acrodata", pszSpec="*.torrent") returned 0 [0143.610] lstrlenA (lpString="*.torrent") returned 9 [0143.610] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\addressbook.acrodata", pszSpec="*.mov") returned 0 [0143.610] lstrlenA (lpString="*.mov") returned 5 [0143.610] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\addressbook.acrodata", pszSpec="*.m2v") returned 0 [0143.610] lstrlenA (lpString="*.m2v") returned 5 [0143.610] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\addressbook.acrodata", pszSpec="*.3gp") returned 0 [0143.610] lstrlenA (lpString="*.3gp") returned 5 [0143.610] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\addressbook.acrodata", pszSpec="*.mpeg") returned 0 [0143.610] lstrlenA (lpString="*.mpeg") returned 6 [0143.610] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\addressbook.acrodata", pszSpec="*.mpg") returned 0 [0143.610] lstrlenA (lpString="*.mpg") returned 5 [0143.610] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\addressbook.acrodata", pszSpec="*.flv") returned 0 [0143.611] lstrlenA (lpString="*.flv") returned 5 [0143.611] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\addressbook.acrodata", pszSpec="*.avi") returned 0 [0143.611] lstrlenA (lpString="*.avi") returned 5 [0143.611] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\addressbook.acrodata", pszSpec="*.mp4") returned 0 [0143.611] lstrlenA (lpString="*.mp4") returned 5 [0143.611] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\addressbook.acrodata", pszSpec="*.wmv") returned 0 [0143.611] lstrlenA (lpString="*.wmv") returned 5 [0143.611] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\addressbook.acrodata", pszSpec="*.divx") returned 0 [0143.611] lstrlenA (lpString="*.divx") returned 6 [0143.611] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\addressbook.acrodata", pszSpec="*.mkv") returned 0 [0143.611] lstrlenA (lpString="*.mkv") returned 5 [0143.611] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\addressbook.acrodata", pszSpec="*.mp3") returned 0 [0143.611] lstrlenA (lpString="*.mp3") returned 5 [0143.611] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\addressbook.acrodata", pszSpec="*.wav") returned 0 [0143.611] lstrlenA (lpString="*.wav") returned 5 [0143.611] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\addressbook.acrodata", pszSpec="*.flac") returned 0 [0143.611] lstrlenA (lpString="*.flac") returned 6 [0143.611] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\addressbook.acrodata", pszSpec="*.ape") returned 0 [0143.611] lstrlenA (lpString="*.ape") returned 5 [0143.611] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\addressbook.acrodata", pszSpec="*.wma") returned 0 [0143.611] lstrlenA (lpString="*.wma") returned 5 [0143.611] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\addressbook.acrodata", pszSpec="*.ac3") returned 0 [0143.611] lstrlenA (lpString="*.ac3") returned 5 [0143.611] FindNextFileA (in: hFindFile=0x5be320, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0143.611] lstrcmpA (lpString1=".", lpString2="CRLCache") returned -1 [0143.611] lstrcmpA (lpString1="..", lpString2="CRLCache") returned -1 [0143.611] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\addressbook.acrodata") returned="addressbook.acrodata" [0143.611] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\", lpString2="CRLCache" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\CRLCache") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\CRLCache" [0143.611] lstrlenA (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\CRLCache") returned 82 [0143.611] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\CRLCache\\*.*", lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 0x5be360 [0143.612] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0143.612] FindNextFileA (in: hFindFile=0x5be360, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 1 [0143.612] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0143.612] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0143.612] FindNextFileA (in: hFindFile=0x5be360, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 1 [0143.612] PeekMessageA (in: lpMsg=0xaeb94, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaeb94) returned 0 [0143.612] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="48B76449F3D5FEFA1133AA805E420F0FCA643651.crl") returned 1 [0143.612] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="48B76449F3D5FEFA1133AA805E420F0FCA643651.crl") returned 1 [0143.612] lstrcmpiA (lpString1="", lpString2="48B76449F3D5FEFA1133AA805E420F0FCA643651.crl") returned -1 [0143.612] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\CRLCache\\*.*") returned="*.*" [0143.612] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\CRLCache\\", lpString2="48B76449F3D5FEFA1133AA805E420F0FCA643651.crl" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\CRLCache\\48B76449F3D5FEFA1133AA805E420F0FCA643651.crl") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\CRLCache\\48B76449F3D5FEFA1133AA805E420F0FCA643651.crl" [0143.612] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\CRLCache\\48B76449F3D5FEFA1133AA805E420F0FCA643651.crl", pszSpec="*.zip") returned 0 [0143.612] lstrlenA (lpString="*.zip") returned 5 [0143.612] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\CRLCache\\48B76449F3D5FEFA1133AA805E420F0FCA643651.crl", pszSpec="*.rar") returned 0 [0143.612] lstrlenA (lpString="*.rar") returned 5 [0143.612] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\CRLCache\\48B76449F3D5FEFA1133AA805E420F0FCA643651.crl", pszSpec="*.7z") returned 0 [0143.612] lstrlenA (lpString="*.7z") returned 4 [0143.612] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\CRLCache\\48B76449F3D5FEFA1133AA805E420F0FCA643651.crl", pszSpec="*.tar") returned 0 [0143.612] lstrlenA (lpString="*.tar") returned 5 [0143.612] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\CRLCache\\48B76449F3D5FEFA1133AA805E420F0FCA643651.crl", pszSpec="*.gzip") returned 0 [0143.612] lstrlenA (lpString="*.gzip") returned 6 [0143.612] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\CRLCache\\48B76449F3D5FEFA1133AA805E420F0FCA643651.crl", pszSpec="*.jpg") returned 0 [0143.612] lstrlenA (lpString="*.jpg") returned 5 [0143.612] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\CRLCache\\48B76449F3D5FEFA1133AA805E420F0FCA643651.crl", pszSpec="*.jpeg") returned 0 [0143.612] lstrlenA (lpString="*.jpeg") returned 6 [0143.612] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\CRLCache\\48B76449F3D5FEFA1133AA805E420F0FCA643651.crl", pszSpec="*.psd") returned 0 [0143.612] lstrlenA (lpString="*.psd") returned 5 [0143.612] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\CRLCache\\48B76449F3D5FEFA1133AA805E420F0FCA643651.crl", pszSpec="*.cdr") returned 0 [0143.612] lstrlenA (lpString="*.cdr") returned 5 [0143.612] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\CRLCache\\48B76449F3D5FEFA1133AA805E420F0FCA643651.crl", pszSpec="*.dwg") returned 0 [0143.612] lstrlenA (lpString="*.dwg") returned 5 [0143.612] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\CRLCache\\48B76449F3D5FEFA1133AA805E420F0FCA643651.crl", pszSpec="*.max") returned 0 [0143.612] lstrlenA (lpString="*.max") returned 5 [0143.612] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\CRLCache\\48B76449F3D5FEFA1133AA805E420F0FCA643651.crl", pszSpec="*.bmp") returned 0 [0143.612] lstrlenA (lpString="*.bmp") returned 5 [0143.613] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\CRLCache\\48B76449F3D5FEFA1133AA805E420F0FCA643651.crl", pszSpec="*.gif") returned 0 [0143.613] lstrlenA (lpString="*.gif") returned 5 [0143.613] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\CRLCache\\48B76449F3D5FEFA1133AA805E420F0FCA643651.crl", pszSpec="*.png") returned 0 [0143.613] lstrlenA (lpString="*.png") returned 5 [0143.613] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\CRLCache\\48B76449F3D5FEFA1133AA805E420F0FCA643651.crl", pszSpec="*.doc") returned 0 [0143.613] lstrlenA (lpString="*.doc") returned 5 [0143.613] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\CRLCache\\48B76449F3D5FEFA1133AA805E420F0FCA643651.crl", pszSpec="*.docx") returned 0 [0143.613] lstrlenA (lpString="*.docx") returned 6 [0143.613] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\CRLCache\\48B76449F3D5FEFA1133AA805E420F0FCA643651.crl", pszSpec="*.xls") returned 0 [0143.613] lstrlenA (lpString="*.xls") returned 5 [0143.613] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\CRLCache\\48B76449F3D5FEFA1133AA805E420F0FCA643651.crl", pszSpec="*.xlsx") returned 0 [0143.613] lstrlenA (lpString="*.xlsx") returned 6 [0143.613] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\CRLCache\\48B76449F3D5FEFA1133AA805E420F0FCA643651.crl", pszSpec="*.ppt") returned 0 [0143.613] lstrlenA (lpString="*.ppt") returned 5 [0143.613] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\CRLCache\\48B76449F3D5FEFA1133AA805E420F0FCA643651.crl", pszSpec="*.pptx") returned 0 [0143.613] lstrlenA (lpString="*.pptx") returned 6 [0143.613] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\CRLCache\\48B76449F3D5FEFA1133AA805E420F0FCA643651.crl", pszSpec="*.txt") returned 0 [0143.613] lstrlenA (lpString="*.txt") returned 5 [0143.613] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\CRLCache\\48B76449F3D5FEFA1133AA805E420F0FCA643651.crl", pszSpec="*.pdf") returned 0 [0143.613] lstrlenA (lpString="*.pdf") returned 5 [0143.613] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\CRLCache\\48B76449F3D5FEFA1133AA805E420F0FCA643651.crl", pszSpec="*.djvu") returned 0 [0143.613] lstrlenA (lpString="*.djvu") returned 6 [0143.613] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\CRLCache\\48B76449F3D5FEFA1133AA805E420F0FCA643651.crl", pszSpec="*.htm") returned 0 [0143.613] lstrlenA (lpString="*.htm") returned 5 [0143.613] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\CRLCache\\48B76449F3D5FEFA1133AA805E420F0FCA643651.crl", pszSpec="*.html") returned 0 [0143.613] lstrlenA (lpString="*.html") returned 6 [0143.613] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\CRLCache\\48B76449F3D5FEFA1133AA805E420F0FCA643651.crl", pszSpec="*.mdb") returned 0 [0143.613] lstrlenA (lpString="*.mdb") returned 5 [0143.613] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\CRLCache\\48B76449F3D5FEFA1133AA805E420F0FCA643651.crl", pszSpec="*.cer") returned 0 [0143.613] lstrlenA (lpString="*.cer") returned 5 [0143.613] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\CRLCache\\48B76449F3D5FEFA1133AA805E420F0FCA643651.crl", pszSpec="*.p12") returned 0 [0143.613] lstrlenA (lpString="*.p12") returned 5 [0143.613] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\CRLCache\\48B76449F3D5FEFA1133AA805E420F0FCA643651.crl", pszSpec="*.pfx") returned 0 [0143.613] lstrlenA (lpString="*.pfx") returned 5 [0143.613] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\CRLCache\\48B76449F3D5FEFA1133AA805E420F0FCA643651.crl", pszSpec="*.kwm") returned 0 [0143.613] lstrlenA (lpString="*.kwm") returned 5 [0143.613] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\CRLCache\\48B76449F3D5FEFA1133AA805E420F0FCA643651.crl", pszSpec="*.pwm") returned 0 [0143.613] lstrlenA (lpString="*.pwm") returned 5 [0143.613] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\CRLCache\\48B76449F3D5FEFA1133AA805E420F0FCA643651.crl", pszSpec="*.1cd") returned 0 [0143.613] lstrlenA (lpString="*.1cd") returned 5 [0143.613] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\CRLCache\\48B76449F3D5FEFA1133AA805E420F0FCA643651.crl", pszSpec="*.md") returned 0 [0143.613] lstrlenA (lpString="*.md") returned 4 [0143.613] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\CRLCache\\48B76449F3D5FEFA1133AA805E420F0FCA643651.crl", pszSpec="*.mdf") returned 0 [0143.613] lstrlenA (lpString="*.mdf") returned 5 [0143.613] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\CRLCache\\48B76449F3D5FEFA1133AA805E420F0FCA643651.crl", pszSpec="*.dbf") returned 0 [0143.613] lstrlenA (lpString="*.dbf") returned 5 [0143.613] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\CRLCache\\48B76449F3D5FEFA1133AA805E420F0FCA643651.crl", pszSpec="*.odt") returned 0 [0143.614] lstrlenA (lpString="*.odt") returned 5 [0143.614] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\CRLCache\\48B76449F3D5FEFA1133AA805E420F0FCA643651.crl", pszSpec="*.vob") returned 0 [0143.614] lstrlenA (lpString="*.vob") returned 5 [0143.614] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\CRLCache\\48B76449F3D5FEFA1133AA805E420F0FCA643651.crl", pszSpec="*.ifo") returned 0 [0143.614] lstrlenA (lpString="*.ifo") returned 5 [0143.614] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\CRLCache\\48B76449F3D5FEFA1133AA805E420F0FCA643651.crl", pszSpec="*.lnk") returned 0 [0143.614] lstrlenA (lpString="*.lnk") returned 5 [0143.614] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\CRLCache\\48B76449F3D5FEFA1133AA805E420F0FCA643651.crl", pszSpec="*.torrent") returned 0 [0143.614] lstrlenA (lpString="*.torrent") returned 9 [0143.614] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\CRLCache\\48B76449F3D5FEFA1133AA805E420F0FCA643651.crl", pszSpec="*.mov") returned 0 [0143.614] lstrlenA (lpString="*.mov") returned 5 [0143.614] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\CRLCache\\48B76449F3D5FEFA1133AA805E420F0FCA643651.crl", pszSpec="*.m2v") returned 0 [0143.614] lstrlenA (lpString="*.m2v") returned 5 [0143.614] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\CRLCache\\48B76449F3D5FEFA1133AA805E420F0FCA643651.crl", pszSpec="*.3gp") returned 0 [0143.614] lstrlenA (lpString="*.3gp") returned 5 [0143.614] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\CRLCache\\48B76449F3D5FEFA1133AA805E420F0FCA643651.crl", pszSpec="*.mpeg") returned 0 [0143.614] lstrlenA (lpString="*.mpeg") returned 6 [0143.614] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\CRLCache\\48B76449F3D5FEFA1133AA805E420F0FCA643651.crl", pszSpec="*.mpg") returned 0 [0143.614] lstrlenA (lpString="*.mpg") returned 5 [0143.614] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\CRLCache\\48B76449F3D5FEFA1133AA805E420F0FCA643651.crl", pszSpec="*.flv") returned 0 [0143.614] lstrlenA (lpString="*.flv") returned 5 [0143.614] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\CRLCache\\48B76449F3D5FEFA1133AA805E420F0FCA643651.crl", pszSpec="*.avi") returned 0 [0143.614] lstrlenA (lpString="*.avi") returned 5 [0143.614] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\CRLCache\\48B76449F3D5FEFA1133AA805E420F0FCA643651.crl", pszSpec="*.mp4") returned 0 [0143.614] lstrlenA (lpString="*.mp4") returned 5 [0143.614] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\CRLCache\\48B76449F3D5FEFA1133AA805E420F0FCA643651.crl", pszSpec="*.wmv") returned 0 [0143.614] lstrlenA (lpString="*.wmv") returned 5 [0143.614] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\CRLCache\\48B76449F3D5FEFA1133AA805E420F0FCA643651.crl", pszSpec="*.divx") returned 0 [0143.614] lstrlenA (lpString="*.divx") returned 6 [0143.614] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\CRLCache\\48B76449F3D5FEFA1133AA805E420F0FCA643651.crl", pszSpec="*.mkv") returned 0 [0143.614] lstrlenA (lpString="*.mkv") returned 5 [0143.614] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\CRLCache\\48B76449F3D5FEFA1133AA805E420F0FCA643651.crl", pszSpec="*.mp3") returned 0 [0143.614] lstrlenA (lpString="*.mp3") returned 5 [0143.614] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\CRLCache\\48B76449F3D5FEFA1133AA805E420F0FCA643651.crl", pszSpec="*.wav") returned 0 [0143.614] lstrlenA (lpString="*.wav") returned 5 [0143.614] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\CRLCache\\48B76449F3D5FEFA1133AA805E420F0FCA643651.crl", pszSpec="*.flac") returned 0 [0143.614] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\CRLCache\\48B76449F3D5FEFA1133AA805E420F0FCA643651.crl", pszSpec="*.ape") returned 0 [0143.615] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\CRLCache\\48B76449F3D5FEFA1133AA805E420F0FCA643651.crl", pszSpec="*.wma") returned 0 [0143.615] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\CRLCache\\48B76449F3D5FEFA1133AA805E420F0FCA643651.crl", pszSpec="*.ac3") returned 0 [0143.615] FindNextFileA (in: hFindFile=0x5be360, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 1 [0143.615] PeekMessageA (in: lpMsg=0xaeb94, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaeb94) returned 0 [0143.615] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="A9B8213768ADC68AF64FCC6409E8BE414726687F.crl") returned 1 [0143.615] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="A9B8213768ADC68AF64FCC6409E8BE414726687F.crl") returned 1 [0143.615] lstrcmpiA (lpString1="", lpString2="A9B8213768ADC68AF64FCC6409E8BE414726687F.crl") returned -1 [0143.615] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\CRLCache\\48B76449F3D5FEFA1133AA805E420F0FCA643651.crl") returned="48B76449F3D5FEFA1133AA805E420F0FCA643651.crl" [0143.615] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\CRLCache\\", lpString2="A9B8213768ADC68AF64FCC6409E8BE414726687F.crl" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\CRLCache\\A9B8213768ADC68AF64FCC6409E8BE414726687F.crl") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\CRLCache\\A9B8213768ADC68AF64FCC6409E8BE414726687F.crl" [0143.615] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\CRLCache\\A9B8213768ADC68AF64FCC6409E8BE414726687F.crl", pszSpec="*.zip") returned 0 [0143.615] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\CRLCache\\A9B8213768ADC68AF64FCC6409E8BE414726687F.crl", pszSpec="*.rar") returned 0 [0143.615] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\CRLCache\\A9B8213768ADC68AF64FCC6409E8BE414726687F.crl", pszSpec="*.7z") returned 0 [0143.615] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\CRLCache\\A9B8213768ADC68AF64FCC6409E8BE414726687F.crl", pszSpec="*.tar") returned 0 [0143.615] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\CRLCache\\A9B8213768ADC68AF64FCC6409E8BE414726687F.crl", pszSpec="*.gzip") returned 0 [0143.615] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\CRLCache\\A9B8213768ADC68AF64FCC6409E8BE414726687F.crl", pszSpec="*.jpg") returned 0 [0143.615] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\CRLCache\\A9B8213768ADC68AF64FCC6409E8BE414726687F.crl", pszSpec="*.jpeg") returned 0 [0143.615] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\CRLCache\\A9B8213768ADC68AF64FCC6409E8BE414726687F.crl", pszSpec="*.psd") returned 0 [0143.615] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\CRLCache\\A9B8213768ADC68AF64FCC6409E8BE414726687F.crl", pszSpec="*.cdr") returned 0 [0143.615] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\CRLCache\\A9B8213768ADC68AF64FCC6409E8BE414726687F.crl", pszSpec="*.dwg") returned 0 [0143.615] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\CRLCache\\A9B8213768ADC68AF64FCC6409E8BE414726687F.crl", pszSpec="*.max") returned 0 [0143.615] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\CRLCache\\A9B8213768ADC68AF64FCC6409E8BE414726687F.crl", pszSpec="*.bmp") returned 0 [0143.615] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\CRLCache\\A9B8213768ADC68AF64FCC6409E8BE414726687F.crl", pszSpec="*.gif") returned 0 [0143.615] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\CRLCache\\A9B8213768ADC68AF64FCC6409E8BE414726687F.crl", pszSpec="*.png") returned 0 [0143.615] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\CRLCache\\A9B8213768ADC68AF64FCC6409E8BE414726687F.crl", pszSpec="*.doc") returned 0 [0143.615] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\CRLCache\\A9B8213768ADC68AF64FCC6409E8BE414726687F.crl", pszSpec="*.docx") returned 0 [0143.615] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\CRLCache\\A9B8213768ADC68AF64FCC6409E8BE414726687F.crl", pszSpec="*.xls") returned 0 [0143.615] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\CRLCache\\A9B8213768ADC68AF64FCC6409E8BE414726687F.crl", pszSpec="*.xlsx") returned 0 [0143.615] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\CRLCache\\A9B8213768ADC68AF64FCC6409E8BE414726687F.crl", pszSpec="*.ppt") returned 0 [0143.615] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\CRLCache\\A9B8213768ADC68AF64FCC6409E8BE414726687F.crl", pszSpec="*.pptx") returned 0 [0143.616] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\CRLCache\\A9B8213768ADC68AF64FCC6409E8BE414726687F.crl", pszSpec="*.txt") returned 0 [0143.616] FindNextFileA (in: hFindFile=0x5be360, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 0 [0143.616] FindClose (in: hFindFile=0x5be360 | out: hFindFile=0x5be360) returned 1 [0143.616] FindNextFileA (in: hFindFile=0x5be320, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 0 [0143.616] FindClose (in: hFindFile=0x5be320 | out: hFindFile=0x5be320) returned 1 [0143.616] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 0 [0143.616] FindClose (in: hFindFile=0x5be2e0 | out: hFindFile=0x5be2e0) returned 1 [0143.616] FindNextFileA (in: hFindFile=0x5be2a0, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0 [0143.616] FindClose (in: hFindFile=0x5be2a0 | out: hFindFile=0x5be2a0) returned 1 [0143.616] FindNextFileA (in: hFindFile=0x5be260, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0143.616] lstrcmpA (lpString1=".", lpString2="Flash Player") returned -1 [0143.616] lstrcmpA (lpString1="..", lpString2="Flash Player") returned -1 [0143.616] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\*.*") returned="*.*" [0143.616] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\", lpString2="Flash Player" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player" [0143.616] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0143.617] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0143.617] FindNextFileA (in: hFindFile=0x5be2a0, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0143.617] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0143.617] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0143.617] FindNextFileA (in: hFindFile=0x5be2a0, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0143.617] lstrcmpA (lpString1=".", lpString2="AssetCache") returned -1 [0143.617] lstrcmpA (lpString1="..", lpString2="AssetCache") returned -1 [0143.617] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\*.*") returned="*.*" [0143.617] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\", lpString2="AssetCache" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache" [0143.617] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\*.*", lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 0x5be2e0 [0143.617] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0143.617] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0143.617] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0143.617] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0143.617] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0143.617] lstrcmpA (lpString1=".", lpString2="D5NTRC6R") returned -1 [0143.617] lstrcmpA (lpString1="..", lpString2="D5NTRC6R") returned -1 [0143.617] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\*.*") returned="*.*" [0143.617] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\", lpString2="D5NTRC6R" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\D5NTRC6R") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\D5NTRC6R" [0143.618] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\D5NTRC6R\\*.*", lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 0x5be320 [0143.618] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0143.618] FindNextFileA (in: hFindFile=0x5be320, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0143.618] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0143.618] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0143.618] FindNextFileA (in: hFindFile=0x5be320, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 0 [0143.618] FindClose (in: hFindFile=0x5be320 | out: hFindFile=0x5be320) returned 1 [0143.618] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 0 [0143.618] FindClose (in: hFindFile=0x5be2e0 | out: hFindFile=0x5be2e0) returned 1 [0143.618] FindNextFileA (in: hFindFile=0x5be2a0, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0 [0143.618] FindClose (in: hFindFile=0x5be2a0 | out: hFindFile=0x5be2a0) returned 1 [0143.618] FindNextFileA (in: hFindFile=0x5be260, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0143.618] lstrcmpA (lpString1=".", lpString2="Headlights") returned -1 [0143.618] lstrcmpA (lpString1="..", lpString2="Headlights") returned -1 [0143.618] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\*.*") returned="*.*" [0143.619] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\", lpString2="Headlights" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Headlights") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Headlights" [0143.619] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Headlights\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0143.619] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0143.619] FindNextFileA (in: hFindFile=0x5be2a0, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0143.619] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0143.619] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0143.619] FindNextFileA (in: hFindFile=0x5be2a0, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0 [0143.619] FindClose (in: hFindFile=0x5be2a0 | out: hFindFile=0x5be2a0) returned 1 [0143.619] FindNextFileA (in: hFindFile=0x5be260, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0143.619] lstrcmpA (lpString1=".", lpString2="Linguistics") returned -1 [0143.619] lstrcmpA (lpString1="..", lpString2="Linguistics") returned -1 [0143.619] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\*.*") returned="*.*" [0143.619] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\", lpString2="Linguistics" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Linguistics") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Linguistics" [0143.619] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Linguistics\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0143.619] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0143.619] FindNextFileA (in: hFindFile=0x5be2a0, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0143.619] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0143.619] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0143.619] FindNextFileA (in: hFindFile=0x5be2a0, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0143.619] lstrcmpA (lpString1=".", lpString2="Dictionaries") returned -1 [0143.619] lstrcmpA (lpString1="..", lpString2="Dictionaries") returned -1 [0143.619] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Linguistics\\*.*") returned="*.*" [0143.619] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Linguistics\\", lpString2="Dictionaries" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Linguistics\\Dictionaries") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Linguistics\\Dictionaries" [0143.619] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Linguistics\\Dictionaries\\*.*", lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 0x5be2e0 [0143.619] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0143.620] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0143.620] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0143.620] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0143.620] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 0 [0143.620] FindClose (in: hFindFile=0x5be2e0 | out: hFindFile=0x5be2e0) returned 1 [0143.620] FindNextFileA (in: hFindFile=0x5be2a0, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0 [0143.620] FindClose (in: hFindFile=0x5be2a0 | out: hFindFile=0x5be2a0) returned 1 [0143.620] FindNextFileA (in: hFindFile=0x5be260, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0143.620] lstrcmpA (lpString1=".", lpString2="LogTransport2") returned -1 [0143.620] lstrcmpA (lpString1="..", lpString2="LogTransport2") returned -1 [0143.620] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\*.*") returned="*.*" [0143.620] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\", lpString2="LogTransport2" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\LogTransport2") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\LogTransport2" [0143.620] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\LogTransport2\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0143.620] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0143.620] FindNextFileA (in: hFindFile=0x5be2a0, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0143.620] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0143.620] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0143.620] FindNextFileA (in: hFindFile=0x5be2a0, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0 [0143.620] FindClose (in: hFindFile=0x5be2a0 | out: hFindFile=0x5be2a0) returned 1 [0143.620] FindNextFileA (in: hFindFile=0x5be260, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0 [0143.620] FindClose (in: hFindFile=0x5be260 | out: hFindFile=0x5be260) returned 1 [0143.620] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0143.620] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0143.620] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="ADZU Xia.wav") returned 1 [0143.620] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ADZU Xia.wav") returned 1 [0143.620] lstrcmpiA (lpString1="", lpString2="ADZU Xia.wav") returned -1 [0143.620] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\*.*") returned="*.*" [0143.620] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\", lpString2="ADZU Xia.wav" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ADZU Xia.wav") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ADZU Xia.wav" [0143.620] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ADZU Xia.wav" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ADZU Xia.wav") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ADZU Xia.wav" [0143.620] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ADZU Xia.wav" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ADZU Xia.wav") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ADZU Xia.wav" [0143.621] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ADZU Xia.wav", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ADZU Xia.wav.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ADZU Xia.wav." [0143.621] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ADZU Xia.wav.", lpString2="\xa0" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ADZU Xia.wav. ") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ADZU Xia.wav. " [0143.621] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ADZU Xia.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\adzu xia.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c [0143.621] GetFileSize (in: hFile=0x8c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x11a4f [0143.621] GetFileTime (in: hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xc6de0270, dwHighDateTime=0x1d4a93b), lpLastAccessTime=0x407536*(dwLowDateTime=0xb7b5f310, dwHighDateTime=0x1d4a8ec), lpLastWriteTime=0x40753e*(dwLowDateTime=0xb7b5f310, dwHighDateTime=0x1d4a8ec)) returned 1 [0143.621] SetFilePointer (in: hFile=0x8c, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0143.621] ReadFile (in: hFile=0x8c, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x119f5, lpOverlapped=0x0) returned 1 [0143.622] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ADZU Xia.wav") returned="ADZU Xia.wav" [0143.622] SetFilePointer (in: hFile=0x8c, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0143.622] WriteFile (in: hFile=0x8c, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x119f5, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x119f5, lpOverlapped=0x0) returned 1 [0143.622] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0143.623] CloseHandle (hObject=0x8c) returned 1 [0143.623] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ADZU Xia.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\adzu xia.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ADZU Xia.wav. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\adzu xia.wav. ")) returned 1 [0143.624] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0143.624] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0143.624] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="b8 M69G5_Lxg3QUS19y.m4a") returned 1 [0143.624] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="b8 M69G5_Lxg3QUS19y.m4a") returned 1 [0143.624] lstrcmpiA (lpString1="", lpString2="b8 M69G5_Lxg3QUS19y.m4a") returned -1 [0143.624] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ADZU Xia.wav") returned="ADZU Xia.wav" [0143.624] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\", lpString2="b8 M69G5_Lxg3QUS19y.m4a" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\b8 M69G5_Lxg3QUS19y.m4a") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\b8 M69G5_Lxg3QUS19y.m4a" [0143.624] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\b8 M69G5_Lxg3QUS19y.m4a", pszSpec="*.zip") returned 0 [0143.624] lstrlenA (lpString="*.zip") returned 5 [0143.624] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\b8 M69G5_Lxg3QUS19y.m4a", pszSpec="*.rar") returned 0 [0143.624] lstrlenA (lpString="*.rar") returned 5 [0143.624] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\b8 M69G5_Lxg3QUS19y.m4a", pszSpec="*.7z") returned 0 [0143.624] lstrlenA (lpString="*.7z") returned 4 [0143.624] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\b8 M69G5_Lxg3QUS19y.m4a", pszSpec="*.tar") returned 0 [0143.624] lstrlenA (lpString="*.tar") returned 5 [0143.624] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\b8 M69G5_Lxg3QUS19y.m4a", pszSpec="*.gzip") returned 0 [0143.624] lstrlenA (lpString="*.gzip") returned 6 [0143.624] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\b8 M69G5_Lxg3QUS19y.m4a", pszSpec="*.jpg") returned 0 [0143.624] lstrlenA (lpString="*.jpg") returned 5 [0143.624] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\b8 M69G5_Lxg3QUS19y.m4a", pszSpec="*.jpeg") returned 0 [0143.624] lstrlenA (lpString="*.jpeg") returned 6 [0143.624] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\b8 M69G5_Lxg3QUS19y.m4a", pszSpec="*.psd") returned 0 [0143.624] lstrlenA (lpString="*.psd") returned 5 [0143.624] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\b8 M69G5_Lxg3QUS19y.m4a", pszSpec="*.cdr") returned 0 [0143.624] lstrlenA (lpString="*.cdr") returned 5 [0143.624] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\b8 M69G5_Lxg3QUS19y.m4a", pszSpec="*.dwg") returned 0 [0143.624] lstrlenA (lpString="*.dwg") returned 5 [0143.624] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\b8 M69G5_Lxg3QUS19y.m4a", pszSpec="*.max") returned 0 [0143.624] lstrlenA (lpString="*.max") returned 5 [0143.624] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\b8 M69G5_Lxg3QUS19y.m4a", pszSpec="*.bmp") returned 0 [0143.624] lstrlenA (lpString="*.bmp") returned 5 [0143.624] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\b8 M69G5_Lxg3QUS19y.m4a", pszSpec="*.gif") returned 0 [0143.624] lstrlenA (lpString="*.gif") returned 5 [0143.624] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\b8 M69G5_Lxg3QUS19y.m4a", pszSpec="*.png") returned 0 [0143.624] lstrlenA (lpString="*.png") returned 5 [0143.624] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\b8 M69G5_Lxg3QUS19y.m4a", pszSpec="*.doc") returned 0 [0143.624] lstrlenA (lpString="*.doc") returned 5 [0143.624] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\b8 M69G5_Lxg3QUS19y.m4a", pszSpec="*.docx") returned 0 [0143.624] lstrlenA (lpString="*.docx") returned 6 [0143.624] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\b8 M69G5_Lxg3QUS19y.m4a", pszSpec="*.xls") returned 0 [0143.624] lstrlenA (lpString="*.xls") returned 5 [0143.624] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\b8 M69G5_Lxg3QUS19y.m4a", pszSpec="*.xlsx") returned 0 [0143.624] lstrlenA (lpString="*.xlsx") returned 6 [0143.624] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\b8 M69G5_Lxg3QUS19y.m4a", pszSpec="*.ppt") returned 0 [0143.625] lstrlenA (lpString="*.ppt") returned 5 [0143.625] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\b8 M69G5_Lxg3QUS19y.m4a", pszSpec="*.pptx") returned 0 [0143.625] lstrlenA (lpString="*.pptx") returned 6 [0143.625] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\b8 M69G5_Lxg3QUS19y.m4a", pszSpec="*.txt") returned 0 [0143.625] lstrlenA (lpString="*.txt") returned 5 [0143.625] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\b8 M69G5_Lxg3QUS19y.m4a", pszSpec="*.pdf") returned 0 [0143.625] lstrlenA (lpString="*.pdf") returned 5 [0143.625] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\b8 M69G5_Lxg3QUS19y.m4a", pszSpec="*.djvu") returned 0 [0143.625] lstrlenA (lpString="*.djvu") returned 6 [0143.625] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\b8 M69G5_Lxg3QUS19y.m4a", pszSpec="*.htm") returned 0 [0143.625] lstrlenA (lpString="*.htm") returned 5 [0143.625] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\b8 M69G5_Lxg3QUS19y.m4a", pszSpec="*.html") returned 0 [0143.625] lstrlenA (lpString="*.html") returned 6 [0143.625] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\b8 M69G5_Lxg3QUS19y.m4a", pszSpec="*.mdb") returned 0 [0143.625] lstrlenA (lpString="*.mdb") returned 5 [0143.625] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\b8 M69G5_Lxg3QUS19y.m4a", pszSpec="*.cer") returned 0 [0143.625] lstrlenA (lpString="*.cer") returned 5 [0143.625] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\b8 M69G5_Lxg3QUS19y.m4a", pszSpec="*.p12") returned 0 [0143.625] lstrlenA (lpString="*.p12") returned 5 [0143.625] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\b8 M69G5_Lxg3QUS19y.m4a", pszSpec="*.pfx") returned 0 [0143.625] lstrlenA (lpString="*.pfx") returned 5 [0143.625] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\b8 M69G5_Lxg3QUS19y.m4a", pszSpec="*.kwm") returned 0 [0143.625] lstrlenA (lpString="*.kwm") returned 5 [0143.625] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\b8 M69G5_Lxg3QUS19y.m4a", pszSpec="*.pwm") returned 0 [0143.625] lstrlenA (lpString="*.pwm") returned 5 [0143.625] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\b8 M69G5_Lxg3QUS19y.m4a", pszSpec="*.1cd") returned 0 [0143.625] lstrlenA (lpString="*.1cd") returned 5 [0143.625] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\b8 M69G5_Lxg3QUS19y.m4a", pszSpec="*.md") returned 0 [0143.625] lstrlenA (lpString="*.md") returned 4 [0143.625] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\b8 M69G5_Lxg3QUS19y.m4a", pszSpec="*.mdf") returned 0 [0143.625] lstrlenA (lpString="*.mdf") returned 5 [0143.625] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\b8 M69G5_Lxg3QUS19y.m4a", pszSpec="*.dbf") returned 0 [0143.625] lstrlenA (lpString="*.dbf") returned 5 [0143.625] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\b8 M69G5_Lxg3QUS19y.m4a", pszSpec="*.odt") returned 0 [0143.625] lstrlenA (lpString="*.odt") returned 5 [0143.625] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\b8 M69G5_Lxg3QUS19y.m4a", pszSpec="*.vob") returned 0 [0143.625] lstrlenA (lpString="*.vob") returned 5 [0143.625] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\b8 M69G5_Lxg3QUS19y.m4a", pszSpec="*.ifo") returned 0 [0143.625] lstrlenA (lpString="*.ifo") returned 5 [0143.625] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\b8 M69G5_Lxg3QUS19y.m4a", pszSpec="*.lnk") returned 0 [0143.625] lstrlenA (lpString="*.lnk") returned 5 [0143.625] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\b8 M69G5_Lxg3QUS19y.m4a", pszSpec="*.torrent") returned 0 [0143.625] lstrlenA (lpString="*.torrent") returned 9 [0143.625] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\b8 M69G5_Lxg3QUS19y.m4a", pszSpec="*.mov") returned 0 [0143.625] lstrlenA (lpString="*.mov") returned 5 [0143.625] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\b8 M69G5_Lxg3QUS19y.m4a", pszSpec="*.m2v") returned 0 [0143.625] lstrlenA (lpString="*.m2v") returned 5 [0143.625] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\b8 M69G5_Lxg3QUS19y.m4a", pszSpec="*.3gp") returned 0 [0143.626] lstrlenA (lpString="*.3gp") returned 5 [0143.626] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\b8 M69G5_Lxg3QUS19y.m4a", pszSpec="*.mpeg") returned 0 [0143.626] lstrlenA (lpString="*.mpeg") returned 6 [0143.626] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\b8 M69G5_Lxg3QUS19y.m4a", pszSpec="*.mpg") returned 0 [0143.626] lstrlenA (lpString="*.mpg") returned 5 [0143.626] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\b8 M69G5_Lxg3QUS19y.m4a", pszSpec="*.flv") returned 0 [0143.626] lstrlenA (lpString="*.flv") returned 5 [0143.626] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\b8 M69G5_Lxg3QUS19y.m4a", pszSpec="*.avi") returned 0 [0143.626] lstrlenA (lpString="*.avi") returned 5 [0143.626] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\b8 M69G5_Lxg3QUS19y.m4a", pszSpec="*.mp4") returned 0 [0143.626] lstrlenA (lpString="*.mp4") returned 5 [0143.626] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\b8 M69G5_Lxg3QUS19y.m4a", pszSpec="*.wmv") returned 0 [0143.626] lstrlenA (lpString="*.wmv") returned 5 [0143.626] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\b8 M69G5_Lxg3QUS19y.m4a", pszSpec="*.divx") returned 0 [0143.626] lstrlenA (lpString="*.divx") returned 6 [0143.626] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\b8 M69G5_Lxg3QUS19y.m4a", pszSpec="*.mkv") returned 0 [0143.626] lstrlenA (lpString="*.mkv") returned 5 [0143.626] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\b8 M69G5_Lxg3QUS19y.m4a", pszSpec="*.mp3") returned 0 [0143.626] lstrlenA (lpString="*.mp3") returned 5 [0143.626] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\b8 M69G5_Lxg3QUS19y.m4a", pszSpec="*.wav") returned 0 [0143.626] lstrlenA (lpString="*.wav") returned 5 [0143.626] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\b8 M69G5_Lxg3QUS19y.m4a", pszSpec="*.flac") returned 0 [0143.626] lstrlenA (lpString="*.flac") returned 6 [0143.626] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\b8 M69G5_Lxg3QUS19y.m4a", pszSpec="*.ape") returned 0 [0143.626] lstrlenA (lpString="*.ape") returned 5 [0143.626] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\b8 M69G5_Lxg3QUS19y.m4a", pszSpec="*.wma") returned 0 [0143.626] lstrlenA (lpString="*.wma") returned 5 [0143.626] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\b8 M69G5_Lxg3QUS19y.m4a", pszSpec="*.ac3") returned 0 [0143.626] lstrlenA (lpString="*.ac3") returned 5 [0143.626] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0143.626] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0143.626] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Byf0.mp3") returned 1 [0143.626] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Byf0.mp3") returned 1 [0143.626] lstrcmpiA (lpString1="", lpString2="Byf0.mp3") returned -1 [0143.626] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\b8 M69G5_Lxg3QUS19y.m4a") returned="b8 M69G5_Lxg3QUS19y.m4a" [0143.626] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\", lpString2="Byf0.mp3" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Byf0.mp3") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Byf0.mp3" [0143.626] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Byf0.mp3", pszSpec="*.zip") returned 0 [0143.626] lstrlenA (lpString="*.zip") returned 5 [0143.626] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Byf0.mp3", pszSpec="*.rar") returned 0 [0143.626] lstrlenA (lpString="*.rar") returned 5 [0143.626] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Byf0.mp3", pszSpec="*.7z") returned 0 [0143.626] lstrlenA (lpString="*.7z") returned 4 [0143.626] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Byf0.mp3", pszSpec="*.tar") returned 0 [0143.626] lstrlenA (lpString="*.tar") returned 5 [0143.626] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Byf0.mp3", pszSpec="*.gzip") returned 0 [0143.626] lstrlenA (lpString="*.gzip") returned 6 [0143.626] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Byf0.mp3", pszSpec="*.jpg") returned 0 [0143.627] lstrlenA (lpString="*.jpg") returned 5 [0143.627] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Byf0.mp3", pszSpec="*.jpeg") returned 0 [0143.627] lstrlenA (lpString="*.jpeg") returned 6 [0143.627] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Byf0.mp3", pszSpec="*.psd") returned 0 [0143.627] lstrlenA (lpString="*.psd") returned 5 [0143.627] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Byf0.mp3", pszSpec="*.cdr") returned 0 [0143.627] lstrlenA (lpString="*.cdr") returned 5 [0143.627] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Byf0.mp3", pszSpec="*.dwg") returned 0 [0143.627] lstrlenA (lpString="*.dwg") returned 5 [0143.627] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Byf0.mp3", pszSpec="*.max") returned 0 [0143.627] lstrlenA (lpString="*.max") returned 5 [0143.627] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Byf0.mp3", pszSpec="*.bmp") returned 0 [0143.627] lstrlenA (lpString="*.bmp") returned 5 [0143.627] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Byf0.mp3", pszSpec="*.gif") returned 0 [0143.627] lstrlenA (lpString="*.gif") returned 5 [0143.627] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Byf0.mp3", pszSpec="*.png") returned 0 [0143.627] lstrlenA (lpString="*.png") returned 5 [0143.627] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Byf0.mp3", pszSpec="*.doc") returned 0 [0143.627] lstrlenA (lpString="*.doc") returned 5 [0143.627] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Byf0.mp3", pszSpec="*.docx") returned 0 [0143.627] lstrlenA (lpString="*.docx") returned 6 [0143.627] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Byf0.mp3", pszSpec="*.xls") returned 0 [0143.627] lstrlenA (lpString="*.xls") returned 5 [0143.627] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Byf0.mp3", pszSpec="*.xlsx") returned 0 [0143.627] lstrlenA (lpString="*.xlsx") returned 6 [0143.627] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Byf0.mp3", pszSpec="*.ppt") returned 0 [0143.627] lstrlenA (lpString="*.ppt") returned 5 [0143.627] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Byf0.mp3", pszSpec="*.pptx") returned 0 [0143.627] lstrlenA (lpString="*.pptx") returned 6 [0143.627] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Byf0.mp3", pszSpec="*.txt") returned 0 [0143.627] lstrlenA (lpString="*.txt") returned 5 [0143.627] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Byf0.mp3", pszSpec="*.pdf") returned 0 [0143.627] lstrlenA (lpString="*.pdf") returned 5 [0143.627] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Byf0.mp3", pszSpec="*.djvu") returned 0 [0143.627] lstrlenA (lpString="*.djvu") returned 6 [0143.627] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Byf0.mp3", pszSpec="*.htm") returned 0 [0143.627] lstrlenA (lpString="*.htm") returned 5 [0143.627] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Byf0.mp3", pszSpec="*.html") returned 0 [0143.627] lstrlenA (lpString="*.html") returned 6 [0143.627] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Byf0.mp3", pszSpec="*.mdb") returned 0 [0143.627] lstrlenA (lpString="*.mdb") returned 5 [0143.627] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Byf0.mp3", pszSpec="*.cer") returned 0 [0143.627] lstrlenA (lpString="*.cer") returned 5 [0143.627] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Byf0.mp3", pszSpec="*.p12") returned 0 [0143.627] lstrlenA (lpString="*.p12") returned 5 [0143.627] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Byf0.mp3", pszSpec="*.pfx") returned 0 [0143.627] lstrlenA (lpString="*.pfx") returned 5 [0143.627] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Byf0.mp3", pszSpec="*.kwm") returned 0 [0143.628] lstrlenA (lpString="*.kwm") returned 5 [0143.628] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Byf0.mp3", pszSpec="*.pwm") returned 0 [0143.628] lstrlenA (lpString="*.pwm") returned 5 [0143.628] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Byf0.mp3", pszSpec="*.1cd") returned 0 [0143.628] lstrlenA (lpString="*.1cd") returned 5 [0143.628] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Byf0.mp3", pszSpec="*.md") returned 0 [0143.628] lstrlenA (lpString="*.md") returned 4 [0143.628] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Byf0.mp3", pszSpec="*.mdf") returned 0 [0143.628] lstrlenA (lpString="*.mdf") returned 5 [0143.628] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Byf0.mp3", pszSpec="*.dbf") returned 0 [0143.628] lstrlenA (lpString="*.dbf") returned 5 [0143.628] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Byf0.mp3", pszSpec="*.odt") returned 0 [0143.628] lstrlenA (lpString="*.odt") returned 5 [0143.628] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Byf0.mp3", pszSpec="*.vob") returned 0 [0143.628] lstrlenA (lpString="*.vob") returned 5 [0143.628] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Byf0.mp3", pszSpec="*.ifo") returned 0 [0143.628] lstrlenA (lpString="*.ifo") returned 5 [0143.628] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Byf0.mp3", pszSpec="*.lnk") returned 0 [0143.628] lstrlenA (lpString="*.lnk") returned 5 [0143.628] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Byf0.mp3", pszSpec="*.torrent") returned 0 [0143.628] lstrlenA (lpString="*.torrent") returned 9 [0143.628] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Byf0.mp3", pszSpec="*.mov") returned 0 [0143.628] lstrlenA (lpString="*.mov") returned 5 [0143.628] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Byf0.mp3", pszSpec="*.m2v") returned 0 [0143.628] lstrlenA (lpString="*.m2v") returned 5 [0143.628] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Byf0.mp3", pszSpec="*.3gp") returned 0 [0143.628] lstrlenA (lpString="*.3gp") returned 5 [0143.628] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Byf0.mp3", pszSpec="*.mpeg") returned 0 [0143.628] lstrlenA (lpString="*.mpeg") returned 6 [0143.628] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Byf0.mp3", pszSpec="*.mpg") returned 0 [0143.628] lstrlenA (lpString="*.mpg") returned 5 [0143.628] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Byf0.mp3", pszSpec="*.flv") returned 0 [0143.628] lstrlenA (lpString="*.flv") returned 5 [0143.628] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Byf0.mp3", pszSpec="*.avi") returned 0 [0143.628] lstrlenA (lpString="*.avi") returned 5 [0143.628] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Byf0.mp3", pszSpec="*.mp4") returned 0 [0143.628] lstrlenA (lpString="*.mp4") returned 5 [0143.628] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Byf0.mp3", pszSpec="*.wmv") returned 0 [0143.628] lstrlenA (lpString="*.wmv") returned 5 [0143.628] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Byf0.mp3", pszSpec="*.divx") returned 0 [0143.628] lstrlenA (lpString="*.divx") returned 6 [0143.628] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Byf0.mp3", pszSpec="*.mkv") returned 0 [0143.628] lstrlenA (lpString="*.mkv") returned 5 [0143.628] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Byf0.mp3", pszSpec="*.mp3") returned 1 [0143.628] lstrlenA (lpString="*.mp3") returned 5 [0143.628] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Byf0.mp3" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Byf0.mp3") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Byf0.mp3" [0143.628] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Byf0.mp3" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Byf0.mp3") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Byf0.mp3" [0143.628] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Byf0.mp3", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Byf0.mp3.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Byf0.mp3." [0143.629] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Byf0.mp3.", lpString2="\xa0" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Byf0.mp3. ") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Byf0.mp3. " [0143.629] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Byf0.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\byf0.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c [0143.629] GetFileSize (in: hFile=0x8c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x18dda [0143.629] GetFileTime (in: hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xe49ae110, dwHighDateTime=0x1d4a2b6), lpLastAccessTime=0x407536*(dwLowDateTime=0x563ff20, dwHighDateTime=0x1d4ae16), lpLastWriteTime=0x40753e*(dwLowDateTime=0x563ff20, dwHighDateTime=0x1d4ae16)) returned 1 [0143.629] SetFilePointer (in: hFile=0x8c, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0143.629] ReadFile (in: hFile=0x8c, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x18d80, lpOverlapped=0x0) returned 1 [0143.630] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Byf0.mp3") returned="Byf0.mp3" [0143.630] SetFilePointer (in: hFile=0x8c, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0143.630] WriteFile (in: hFile=0x8c, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x18d80, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x18d80, lpOverlapped=0x0) returned 1 [0143.631] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0143.631] CloseHandle (hObject=0x8c) returned 1 [0143.631] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Byf0.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\byf0.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Byf0.mp3. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\byf0.mp3. ")) returned 1 [0143.632] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0143.632] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0143.632] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="cNvIwI.wav") returned 1 [0143.632] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="cNvIwI.wav") returned 1 [0143.632] lstrcmpiA (lpString1="", lpString2="cNvIwI.wav") returned -1 [0143.632] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Byf0.mp3") returned="Byf0.mp3" [0143.632] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\", lpString2="cNvIwI.wav" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\cNvIwI.wav") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\cNvIwI.wav" [0143.632] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\cNvIwI.wav", pszSpec="*.zip") returned 0 [0143.632] lstrlenA (lpString="*.zip") returned 5 [0143.632] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\cNvIwI.wav", pszSpec="*.rar") returned 0 [0143.632] lstrlenA (lpString="*.rar") returned 5 [0143.632] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\cNvIwI.wav", pszSpec="*.7z") returned 0 [0143.632] lstrlenA (lpString="*.7z") returned 4 [0143.632] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\cNvIwI.wav", pszSpec="*.tar") returned 0 [0143.632] lstrlenA (lpString="*.tar") returned 5 [0143.632] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\cNvIwI.wav", pszSpec="*.gzip") returned 0 [0143.632] lstrlenA (lpString="*.gzip") returned 6 [0143.632] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\cNvIwI.wav", pszSpec="*.jpg") returned 0 [0143.632] lstrlenA (lpString="*.jpg") returned 5 [0143.632] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\cNvIwI.wav", pszSpec="*.jpeg") returned 0 [0143.632] lstrlenA (lpString="*.jpeg") returned 6 [0143.632] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\cNvIwI.wav", pszSpec="*.psd") returned 0 [0143.632] lstrlenA (lpString="*.psd") returned 5 [0143.632] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\cNvIwI.wav", pszSpec="*.cdr") returned 0 [0143.632] lstrlenA (lpString="*.cdr") returned 5 [0143.632] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\cNvIwI.wav", pszSpec="*.dwg") returned 0 [0143.632] lstrlenA (lpString="*.dwg") returned 5 [0143.632] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\cNvIwI.wav", pszSpec="*.max") returned 0 [0143.632] lstrlenA (lpString="*.max") returned 5 [0143.632] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\cNvIwI.wav", pszSpec="*.bmp") returned 0 [0143.632] lstrlenA (lpString="*.bmp") returned 5 [0143.632] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\cNvIwI.wav", pszSpec="*.gif") returned 0 [0143.632] lstrlenA (lpString="*.gif") returned 5 [0143.632] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\cNvIwI.wav", pszSpec="*.png") returned 0 [0143.632] lstrlenA (lpString="*.png") returned 5 [0143.632] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\cNvIwI.wav", pszSpec="*.doc") returned 0 [0143.632] lstrlenA (lpString="*.doc") returned 5 [0143.632] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\cNvIwI.wav", pszSpec="*.docx") returned 0 [0143.632] lstrlenA (lpString="*.docx") returned 6 [0143.632] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\cNvIwI.wav", pszSpec="*.xls") returned 0 [0143.633] lstrlenA (lpString="*.xls") returned 5 [0143.633] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\cNvIwI.wav", pszSpec="*.xlsx") returned 0 [0143.633] lstrlenA (lpString="*.xlsx") returned 6 [0143.633] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\cNvIwI.wav", pszSpec="*.ppt") returned 0 [0143.633] lstrlenA (lpString="*.ppt") returned 5 [0143.633] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\cNvIwI.wav", pszSpec="*.pptx") returned 0 [0143.633] lstrlenA (lpString="*.pptx") returned 6 [0143.633] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\cNvIwI.wav", pszSpec="*.txt") returned 0 [0143.633] lstrlenA (lpString="*.txt") returned 5 [0143.633] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\cNvIwI.wav", pszSpec="*.pdf") returned 0 [0143.633] lstrlenA (lpString="*.pdf") returned 5 [0143.633] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\cNvIwI.wav", pszSpec="*.djvu") returned 0 [0143.633] lstrlenA (lpString="*.djvu") returned 6 [0143.633] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\cNvIwI.wav", pszSpec="*.htm") returned 0 [0143.633] lstrlenA (lpString="*.htm") returned 5 [0143.633] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\cNvIwI.wav", pszSpec="*.html") returned 0 [0143.633] lstrlenA (lpString="*.html") returned 6 [0143.633] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\cNvIwI.wav", pszSpec="*.mdb") returned 0 [0143.633] lstrlenA (lpString="*.mdb") returned 5 [0143.633] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\cNvIwI.wav", pszSpec="*.cer") returned 0 [0143.633] lstrlenA (lpString="*.cer") returned 5 [0143.633] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\cNvIwI.wav", pszSpec="*.p12") returned 0 [0143.633] lstrlenA (lpString="*.p12") returned 5 [0143.633] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\cNvIwI.wav", pszSpec="*.pfx") returned 0 [0143.633] lstrlenA (lpString="*.pfx") returned 5 [0143.633] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\cNvIwI.wav", pszSpec="*.kwm") returned 0 [0143.633] lstrlenA (lpString="*.kwm") returned 5 [0143.633] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\cNvIwI.wav", pszSpec="*.pwm") returned 0 [0143.633] lstrlenA (lpString="*.pwm") returned 5 [0143.633] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\cNvIwI.wav", pszSpec="*.1cd") returned 0 [0143.633] lstrlenA (lpString="*.1cd") returned 5 [0143.633] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\cNvIwI.wav", pszSpec="*.md") returned 0 [0143.633] lstrlenA (lpString="*.md") returned 4 [0143.633] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\cNvIwI.wav", pszSpec="*.mdf") returned 0 [0143.633] lstrlenA (lpString="*.mdf") returned 5 [0143.633] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\cNvIwI.wav", pszSpec="*.dbf") returned 0 [0143.633] lstrlenA (lpString="*.dbf") returned 5 [0143.633] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\cNvIwI.wav", pszSpec="*.odt") returned 0 [0143.633] lstrlenA (lpString="*.odt") returned 5 [0143.633] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\cNvIwI.wav", pszSpec="*.vob") returned 0 [0143.633] lstrlenA (lpString="*.vob") returned 5 [0143.633] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\cNvIwI.wav", pszSpec="*.ifo") returned 0 [0143.633] lstrlenA (lpString="*.ifo") returned 5 [0143.633] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\cNvIwI.wav", pszSpec="*.lnk") returned 0 [0143.633] lstrlenA (lpString="*.lnk") returned 5 [0143.633] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\cNvIwI.wav", pszSpec="*.torrent") returned 0 [0143.633] lstrlenA (lpString="*.torrent") returned 9 [0143.633] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\cNvIwI.wav", pszSpec="*.mov") returned 0 [0143.633] lstrlenA (lpString="*.mov") returned 5 [0143.634] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\cNvIwI.wav", pszSpec="*.m2v") returned 0 [0143.634] lstrlenA (lpString="*.m2v") returned 5 [0143.634] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\cNvIwI.wav", pszSpec="*.3gp") returned 0 [0143.634] lstrlenA (lpString="*.3gp") returned 5 [0143.634] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\cNvIwI.wav", pszSpec="*.mpeg") returned 0 [0143.634] lstrlenA (lpString="*.mpeg") returned 6 [0143.634] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\cNvIwI.wav", pszSpec="*.mpg") returned 0 [0143.634] lstrlenA (lpString="*.mpg") returned 5 [0143.634] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\cNvIwI.wav", pszSpec="*.flv") returned 0 [0143.634] lstrlenA (lpString="*.flv") returned 5 [0143.634] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\cNvIwI.wav", pszSpec="*.avi") returned 0 [0143.634] lstrlenA (lpString="*.avi") returned 5 [0143.634] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\cNvIwI.wav", pszSpec="*.mp4") returned 0 [0143.634] lstrlenA (lpString="*.mp4") returned 5 [0143.634] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\cNvIwI.wav", pszSpec="*.wmv") returned 0 [0143.634] lstrlenA (lpString="*.wmv") returned 5 [0143.634] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\cNvIwI.wav", pszSpec="*.divx") returned 0 [0143.634] lstrlenA (lpString="*.divx") returned 6 [0143.634] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\cNvIwI.wav", pszSpec="*.mkv") returned 0 [0143.634] lstrlenA (lpString="*.mkv") returned 5 [0143.634] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\cNvIwI.wav", pszSpec="*.mp3") returned 0 [0143.634] lstrlenA (lpString="*.mp3") returned 5 [0143.634] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\cNvIwI.wav", pszSpec="*.wav") returned 1 [0143.634] lstrlenA (lpString="*.wav") returned 5 [0143.634] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\cNvIwI.wav" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\cNvIwI.wav") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\cNvIwI.wav" [0143.634] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\cNvIwI.wav" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\cNvIwI.wav") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\cNvIwI.wav" [0143.634] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\cNvIwI.wav", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\cNvIwI.wav.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\cNvIwI.wav." [0143.634] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\cNvIwI.wav.", lpString2="\xa0" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\cNvIwI.wav. ") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\cNvIwI.wav. " [0143.634] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\cNvIwI.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\cnviwi.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c [0143.635] GetFileSize (in: hFile=0x8c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x154f4 [0143.635] GetFileTime (in: hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xf362df20, dwHighDateTime=0x1d4adc6), lpLastAccessTime=0x407536*(dwLowDateTime=0xb3bdd5c0, dwHighDateTime=0x1d4a379), lpLastWriteTime=0x40753e*(dwLowDateTime=0xb3bdd5c0, dwHighDateTime=0x1d4a379)) returned 1 [0143.635] SetFilePointer (in: hFile=0x8c, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0143.635] ReadFile (in: hFile=0x8c, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x1549a, lpOverlapped=0x0) returned 1 [0143.635] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\cNvIwI.wav") returned="cNvIwI.wav" [0143.636] SetFilePointer (in: hFile=0x8c, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0143.636] WriteFile (in: hFile=0x8c, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x1549a, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x1549a, lpOverlapped=0x0) returned 1 [0143.636] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0143.636] CloseHandle (hObject=0x8c) returned 1 [0143.636] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\cNvIwI.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\cnviwi.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\cNvIwI.wav. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\cnviwi.wav. ")) returned 1 [0143.637] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0143.637] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0143.637] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="DYkEoFwFbe_YAtidZ.m4a") returned 1 [0143.637] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="DYkEoFwFbe_YAtidZ.m4a") returned 1 [0143.637] lstrcmpiA (lpString1="", lpString2="DYkEoFwFbe_YAtidZ.m4a") returned -1 [0143.637] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\cNvIwI.wav") returned="cNvIwI.wav" [0143.637] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\", lpString2="DYkEoFwFbe_YAtidZ.m4a" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\DYkEoFwFbe_YAtidZ.m4a") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\DYkEoFwFbe_YAtidZ.m4a" [0143.637] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\DYkEoFwFbe_YAtidZ.m4a", pszSpec="*.zip") returned 0 [0143.637] lstrlenA (lpString="*.zip") returned 5 [0143.637] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\DYkEoFwFbe_YAtidZ.m4a", pszSpec="*.rar") returned 0 [0143.637] lstrlenA (lpString="*.rar") returned 5 [0143.637] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\DYkEoFwFbe_YAtidZ.m4a", pszSpec="*.7z") returned 0 [0143.637] lstrlenA (lpString="*.7z") returned 4 [0143.637] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\DYkEoFwFbe_YAtidZ.m4a", pszSpec="*.tar") returned 0 [0143.637] lstrlenA (lpString="*.tar") returned 5 [0143.637] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\DYkEoFwFbe_YAtidZ.m4a", pszSpec="*.gzip") returned 0 [0143.637] lstrlenA (lpString="*.gzip") returned 6 [0143.637] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\DYkEoFwFbe_YAtidZ.m4a", pszSpec="*.jpg") returned 0 [0143.637] lstrlenA (lpString="*.jpg") returned 5 [0143.638] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\DYkEoFwFbe_YAtidZ.m4a", pszSpec="*.jpeg") returned 0 [0143.638] lstrlenA (lpString="*.jpeg") returned 6 [0143.638] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\DYkEoFwFbe_YAtidZ.m4a", pszSpec="*.psd") returned 0 [0143.638] lstrlenA (lpString="*.psd") returned 5 [0143.638] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\DYkEoFwFbe_YAtidZ.m4a", pszSpec="*.cdr") returned 0 [0143.638] lstrlenA (lpString="*.cdr") returned 5 [0143.638] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\DYkEoFwFbe_YAtidZ.m4a", pszSpec="*.dwg") returned 0 [0143.638] lstrlenA (lpString="*.dwg") returned 5 [0143.638] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\DYkEoFwFbe_YAtidZ.m4a", pszSpec="*.max") returned 0 [0143.638] lstrlenA (lpString="*.max") returned 5 [0143.638] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\DYkEoFwFbe_YAtidZ.m4a", pszSpec="*.bmp") returned 0 [0143.638] lstrlenA (lpString="*.bmp") returned 5 [0143.638] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\DYkEoFwFbe_YAtidZ.m4a", pszSpec="*.gif") returned 0 [0143.638] lstrlenA (lpString="*.gif") returned 5 [0143.638] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\DYkEoFwFbe_YAtidZ.m4a", pszSpec="*.png") returned 0 [0143.638] lstrlenA (lpString="*.png") returned 5 [0143.638] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\DYkEoFwFbe_YAtidZ.m4a", pszSpec="*.doc") returned 0 [0143.638] lstrlenA (lpString="*.doc") returned 5 [0143.638] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\DYkEoFwFbe_YAtidZ.m4a", pszSpec="*.docx") returned 0 [0143.638] lstrlenA (lpString="*.docx") returned 6 [0143.638] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\DYkEoFwFbe_YAtidZ.m4a", pszSpec="*.xls") returned 0 [0143.638] lstrlenA (lpString="*.xls") returned 5 [0143.638] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\DYkEoFwFbe_YAtidZ.m4a", pszSpec="*.xlsx") returned 0 [0143.638] lstrlenA (lpString="*.xlsx") returned 6 [0143.638] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\DYkEoFwFbe_YAtidZ.m4a", pszSpec="*.ppt") returned 0 [0143.638] lstrlenA (lpString="*.ppt") returned 5 [0143.638] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\DYkEoFwFbe_YAtidZ.m4a", pszSpec="*.pptx") returned 0 [0143.638] lstrlenA (lpString="*.pptx") returned 6 [0143.638] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\DYkEoFwFbe_YAtidZ.m4a", pszSpec="*.txt") returned 0 [0143.638] lstrlenA (lpString="*.txt") returned 5 [0143.638] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\DYkEoFwFbe_YAtidZ.m4a", pszSpec="*.pdf") returned 0 [0143.638] lstrlenA (lpString="*.pdf") returned 5 [0143.638] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\DYkEoFwFbe_YAtidZ.m4a", pszSpec="*.djvu") returned 0 [0143.638] lstrlenA (lpString="*.djvu") returned 6 [0143.638] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\DYkEoFwFbe_YAtidZ.m4a", pszSpec="*.htm") returned 0 [0143.638] lstrlenA (lpString="*.htm") returned 5 [0143.638] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\DYkEoFwFbe_YAtidZ.m4a", pszSpec="*.html") returned 0 [0143.638] lstrlenA (lpString="*.html") returned 6 [0143.638] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\DYkEoFwFbe_YAtidZ.m4a", pszSpec="*.mdb") returned 0 [0143.638] lstrlenA (lpString="*.mdb") returned 5 [0143.638] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\DYkEoFwFbe_YAtidZ.m4a", pszSpec="*.cer") returned 0 [0143.638] lstrlenA (lpString="*.cer") returned 5 [0143.638] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\DYkEoFwFbe_YAtidZ.m4a", pszSpec="*.p12") returned 0 [0143.638] lstrlenA (lpString="*.p12") returned 5 [0143.638] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\DYkEoFwFbe_YAtidZ.m4a", pszSpec="*.pfx") returned 0 [0143.638] lstrlenA (lpString="*.pfx") returned 5 [0143.638] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\DYkEoFwFbe_YAtidZ.m4a", pszSpec="*.kwm") returned 0 [0143.638] lstrlenA (lpString="*.kwm") returned 5 [0143.638] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\DYkEoFwFbe_YAtidZ.m4a", pszSpec="*.pwm") returned 0 [0143.639] lstrlenA (lpString="*.pwm") returned 5 [0143.639] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\DYkEoFwFbe_YAtidZ.m4a", pszSpec="*.1cd") returned 0 [0143.639] lstrlenA (lpString="*.1cd") returned 5 [0143.639] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\DYkEoFwFbe_YAtidZ.m4a", pszSpec="*.md") returned 0 [0143.639] lstrlenA (lpString="*.md") returned 4 [0143.639] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\DYkEoFwFbe_YAtidZ.m4a", pszSpec="*.mdf") returned 0 [0143.639] lstrlenA (lpString="*.mdf") returned 5 [0143.639] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\DYkEoFwFbe_YAtidZ.m4a", pszSpec="*.dbf") returned 0 [0143.639] lstrlenA (lpString="*.dbf") returned 5 [0143.639] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\DYkEoFwFbe_YAtidZ.m4a", pszSpec="*.odt") returned 0 [0143.639] lstrlenA (lpString="*.odt") returned 5 [0143.639] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\DYkEoFwFbe_YAtidZ.m4a", pszSpec="*.vob") returned 0 [0143.639] lstrlenA (lpString="*.vob") returned 5 [0143.639] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\DYkEoFwFbe_YAtidZ.m4a", pszSpec="*.ifo") returned 0 [0143.639] lstrlenA (lpString="*.ifo") returned 5 [0143.639] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\DYkEoFwFbe_YAtidZ.m4a", pszSpec="*.lnk") returned 0 [0143.639] lstrlenA (lpString="*.lnk") returned 5 [0143.639] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\DYkEoFwFbe_YAtidZ.m4a", pszSpec="*.torrent") returned 0 [0143.639] lstrlenA (lpString="*.torrent") returned 9 [0143.639] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\DYkEoFwFbe_YAtidZ.m4a", pszSpec="*.mov") returned 0 [0143.639] lstrlenA (lpString="*.mov") returned 5 [0143.639] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\DYkEoFwFbe_YAtidZ.m4a", pszSpec="*.m2v") returned 0 [0143.639] lstrlenA (lpString="*.m2v") returned 5 [0143.639] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\DYkEoFwFbe_YAtidZ.m4a", pszSpec="*.3gp") returned 0 [0143.639] lstrlenA (lpString="*.3gp") returned 5 [0143.639] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\DYkEoFwFbe_YAtidZ.m4a", pszSpec="*.mpeg") returned 0 [0143.639] lstrlenA (lpString="*.mpeg") returned 6 [0143.639] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\DYkEoFwFbe_YAtidZ.m4a", pszSpec="*.mpg") returned 0 [0143.639] lstrlenA (lpString="*.mpg") returned 5 [0143.639] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\DYkEoFwFbe_YAtidZ.m4a", pszSpec="*.flv") returned 0 [0143.639] lstrlenA (lpString="*.flv") returned 5 [0143.639] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\DYkEoFwFbe_YAtidZ.m4a", pszSpec="*.avi") returned 0 [0143.639] lstrlenA (lpString="*.avi") returned 5 [0143.639] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\DYkEoFwFbe_YAtidZ.m4a", pszSpec="*.mp4") returned 0 [0143.639] lstrlenA (lpString="*.mp4") returned 5 [0143.639] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\DYkEoFwFbe_YAtidZ.m4a", pszSpec="*.wmv") returned 0 [0143.639] lstrlenA (lpString="*.wmv") returned 5 [0143.639] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\DYkEoFwFbe_YAtidZ.m4a", pszSpec="*.divx") returned 0 [0143.639] lstrlenA (lpString="*.divx") returned 6 [0143.639] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\DYkEoFwFbe_YAtidZ.m4a", pszSpec="*.mkv") returned 0 [0143.639] lstrlenA (lpString="*.mkv") returned 5 [0143.639] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\DYkEoFwFbe_YAtidZ.m4a", pszSpec="*.mp3") returned 0 [0143.639] lstrlenA (lpString="*.mp3") returned 5 [0143.639] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\DYkEoFwFbe_YAtidZ.m4a", pszSpec="*.wav") returned 0 [0143.639] lstrlenA (lpString="*.wav") returned 5 [0143.639] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\DYkEoFwFbe_YAtidZ.m4a", pszSpec="*.flac") returned 0 [0143.639] lstrlenA (lpString="*.flac") returned 6 [0143.639] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\DYkEoFwFbe_YAtidZ.m4a", pszSpec="*.ape") returned 0 [0143.640] lstrlenA (lpString="*.ape") returned 5 [0143.640] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\DYkEoFwFbe_YAtidZ.m4a", pszSpec="*.wma") returned 0 [0143.640] lstrlenA (lpString="*.wma") returned 5 [0143.640] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\DYkEoFwFbe_YAtidZ.m4a", pszSpec="*.ac3") returned 0 [0143.640] lstrlenA (lpString="*.ac3") returned 5 [0143.640] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0143.640] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0143.640] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="eFx2ggY6 fTb-dEpbBp.m4a") returned -1 [0143.640] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="eFx2ggY6 fTb-dEpbBp.m4a") returned 1 [0143.640] lstrcmpiA (lpString1="", lpString2="eFx2ggY6 fTb-dEpbBp.m4a") returned -1 [0143.640] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\DYkEoFwFbe_YAtidZ.m4a") returned="DYkEoFwFbe_YAtidZ.m4a" [0143.640] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\", lpString2="eFx2ggY6 fTb-dEpbBp.m4a" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\eFx2ggY6 fTb-dEpbBp.m4a") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\eFx2ggY6 fTb-dEpbBp.m4a" [0143.640] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\eFx2ggY6 fTb-dEpbBp.m4a", pszSpec="*.zip") returned 0 [0143.640] lstrlenA (lpString="*.zip") returned 5 [0143.640] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\eFx2ggY6 fTb-dEpbBp.m4a", pszSpec="*.rar") returned 0 [0143.640] lstrlenA (lpString="*.rar") returned 5 [0143.640] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\eFx2ggY6 fTb-dEpbBp.m4a", pszSpec="*.7z") returned 0 [0143.640] lstrlenA (lpString="*.7z") returned 4 [0143.640] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\eFx2ggY6 fTb-dEpbBp.m4a", pszSpec="*.tar") returned 0 [0143.640] lstrlenA (lpString="*.tar") returned 5 [0143.640] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\eFx2ggY6 fTb-dEpbBp.m4a", pszSpec="*.gzip") returned 0 [0143.640] lstrlenA (lpString="*.gzip") returned 6 [0143.640] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\eFx2ggY6 fTb-dEpbBp.m4a", pszSpec="*.jpg") returned 0 [0143.640] lstrlenA (lpString="*.jpg") returned 5 [0143.640] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\eFx2ggY6 fTb-dEpbBp.m4a", pszSpec="*.jpeg") returned 0 [0143.640] lstrlenA (lpString="*.jpeg") returned 6 [0143.640] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\eFx2ggY6 fTb-dEpbBp.m4a", pszSpec="*.psd") returned 0 [0143.640] lstrlenA (lpString="*.psd") returned 5 [0143.640] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\eFx2ggY6 fTb-dEpbBp.m4a", pszSpec="*.cdr") returned 0 [0143.640] lstrlenA (lpString="*.cdr") returned 5 [0143.640] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\eFx2ggY6 fTb-dEpbBp.m4a", pszSpec="*.dwg") returned 0 [0143.640] lstrlenA (lpString="*.dwg") returned 5 [0143.640] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\eFx2ggY6 fTb-dEpbBp.m4a", pszSpec="*.max") returned 0 [0143.640] lstrlenA (lpString="*.max") returned 5 [0143.640] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\eFx2ggY6 fTb-dEpbBp.m4a", pszSpec="*.bmp") returned 0 [0143.640] lstrlenA (lpString="*.bmp") returned 5 [0143.640] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\eFx2ggY6 fTb-dEpbBp.m4a", pszSpec="*.gif") returned 0 [0143.640] lstrlenA (lpString="*.gif") returned 5 [0143.640] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\eFx2ggY6 fTb-dEpbBp.m4a", pszSpec="*.png") returned 0 [0143.640] lstrlenA (lpString="*.png") returned 5 [0143.640] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\eFx2ggY6 fTb-dEpbBp.m4a", pszSpec="*.doc") returned 0 [0143.640] lstrlenA (lpString="*.doc") returned 5 [0143.640] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\eFx2ggY6 fTb-dEpbBp.m4a", pszSpec="*.docx") returned 0 [0143.640] lstrlenA (lpString="*.docx") returned 6 [0143.640] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\eFx2ggY6 fTb-dEpbBp.m4a", pszSpec="*.xls") returned 0 [0143.640] lstrlenA (lpString="*.xls") returned 5 [0143.640] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\eFx2ggY6 fTb-dEpbBp.m4a", pszSpec="*.xlsx") returned 0 [0143.640] lstrlenA (lpString="*.xlsx") returned 6 [0143.640] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\eFx2ggY6 fTb-dEpbBp.m4a", pszSpec="*.ppt") returned 0 [0143.641] lstrlenA (lpString="*.ppt") returned 5 [0143.641] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\eFx2ggY6 fTb-dEpbBp.m4a", pszSpec="*.pptx") returned 0 [0143.641] lstrlenA (lpString="*.pptx") returned 6 [0143.641] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\eFx2ggY6 fTb-dEpbBp.m4a", pszSpec="*.txt") returned 0 [0143.641] lstrlenA (lpString="*.txt") returned 5 [0143.641] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\eFx2ggY6 fTb-dEpbBp.m4a", pszSpec="*.pdf") returned 0 [0143.641] lstrlenA (lpString="*.pdf") returned 5 [0143.641] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\eFx2ggY6 fTb-dEpbBp.m4a", pszSpec="*.djvu") returned 0 [0143.641] lstrlenA (lpString="*.djvu") returned 6 [0143.641] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\eFx2ggY6 fTb-dEpbBp.m4a", pszSpec="*.htm") returned 0 [0143.641] lstrlenA (lpString="*.htm") returned 5 [0143.641] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\eFx2ggY6 fTb-dEpbBp.m4a", pszSpec="*.html") returned 0 [0143.641] lstrlenA (lpString="*.html") returned 6 [0143.641] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\eFx2ggY6 fTb-dEpbBp.m4a", pszSpec="*.mdb") returned 0 [0143.641] lstrlenA (lpString="*.mdb") returned 5 [0143.641] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\eFx2ggY6 fTb-dEpbBp.m4a", pszSpec="*.cer") returned 0 [0143.641] lstrlenA (lpString="*.cer") returned 5 [0143.641] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\eFx2ggY6 fTb-dEpbBp.m4a", pszSpec="*.p12") returned 0 [0143.641] lstrlenA (lpString="*.p12") returned 5 [0143.641] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\eFx2ggY6 fTb-dEpbBp.m4a", pszSpec="*.pfx") returned 0 [0143.641] lstrlenA (lpString="*.pfx") returned 5 [0143.641] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\eFx2ggY6 fTb-dEpbBp.m4a", pszSpec="*.kwm") returned 0 [0143.641] lstrlenA (lpString="*.kwm") returned 5 [0143.641] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\eFx2ggY6 fTb-dEpbBp.m4a", pszSpec="*.pwm") returned 0 [0143.641] lstrlenA (lpString="*.pwm") returned 5 [0143.641] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\eFx2ggY6 fTb-dEpbBp.m4a", pszSpec="*.1cd") returned 0 [0143.641] lstrlenA (lpString="*.1cd") returned 5 [0143.641] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\eFx2ggY6 fTb-dEpbBp.m4a", pszSpec="*.md") returned 0 [0143.641] lstrlenA (lpString="*.md") returned 4 [0143.641] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\eFx2ggY6 fTb-dEpbBp.m4a", pszSpec="*.mdf") returned 0 [0143.641] lstrlenA (lpString="*.mdf") returned 5 [0143.641] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\eFx2ggY6 fTb-dEpbBp.m4a", pszSpec="*.dbf") returned 0 [0143.641] lstrlenA (lpString="*.dbf") returned 5 [0143.641] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\eFx2ggY6 fTb-dEpbBp.m4a", pszSpec="*.odt") returned 0 [0143.641] lstrlenA (lpString="*.odt") returned 5 [0143.641] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\eFx2ggY6 fTb-dEpbBp.m4a", pszSpec="*.vob") returned 0 [0143.641] lstrlenA (lpString="*.vob") returned 5 [0143.641] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\eFx2ggY6 fTb-dEpbBp.m4a", pszSpec="*.ifo") returned 0 [0143.641] lstrlenA (lpString="*.ifo") returned 5 [0143.641] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\eFx2ggY6 fTb-dEpbBp.m4a", pszSpec="*.lnk") returned 0 [0143.641] lstrlenA (lpString="*.lnk") returned 5 [0143.641] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\eFx2ggY6 fTb-dEpbBp.m4a", pszSpec="*.torrent") returned 0 [0143.641] lstrlenA (lpString="*.torrent") returned 9 [0143.641] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\eFx2ggY6 fTb-dEpbBp.m4a", pszSpec="*.mov") returned 0 [0143.641] lstrlenA (lpString="*.mov") returned 5 [0143.641] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\eFx2ggY6 fTb-dEpbBp.m4a", pszSpec="*.m2v") returned 0 [0143.641] lstrlenA (lpString="*.m2v") returned 5 [0143.641] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\eFx2ggY6 fTb-dEpbBp.m4a", pszSpec="*.3gp") returned 0 [0143.641] lstrlenA (lpString="*.3gp") returned 5 [0143.642] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\eFx2ggY6 fTb-dEpbBp.m4a", pszSpec="*.mpeg") returned 0 [0143.642] lstrlenA (lpString="*.mpeg") returned 6 [0143.642] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\eFx2ggY6 fTb-dEpbBp.m4a", pszSpec="*.mpg") returned 0 [0143.642] lstrlenA (lpString="*.mpg") returned 5 [0143.642] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\eFx2ggY6 fTb-dEpbBp.m4a", pszSpec="*.flv") returned 0 [0143.642] lstrlenA (lpString="*.flv") returned 5 [0143.642] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\eFx2ggY6 fTb-dEpbBp.m4a", pszSpec="*.avi") returned 0 [0143.642] lstrlenA (lpString="*.avi") returned 5 [0143.642] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\eFx2ggY6 fTb-dEpbBp.m4a", pszSpec="*.mp4") returned 0 [0143.642] lstrlenA (lpString="*.mp4") returned 5 [0143.642] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\eFx2ggY6 fTb-dEpbBp.m4a", pszSpec="*.wmv") returned 0 [0143.642] lstrlenA (lpString="*.wmv") returned 5 [0143.642] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\eFx2ggY6 fTb-dEpbBp.m4a", pszSpec="*.divx") returned 0 [0143.642] lstrlenA (lpString="*.divx") returned 6 [0143.642] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\eFx2ggY6 fTb-dEpbBp.m4a", pszSpec="*.mkv") returned 0 [0143.642] lstrlenA (lpString="*.mkv") returned 5 [0143.642] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\eFx2ggY6 fTb-dEpbBp.m4a", pszSpec="*.mp3") returned 0 [0143.642] lstrlenA (lpString="*.mp3") returned 5 [0143.642] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\eFx2ggY6 fTb-dEpbBp.m4a", pszSpec="*.wav") returned 0 [0143.642] lstrlenA (lpString="*.wav") returned 5 [0143.642] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\eFx2ggY6 fTb-dEpbBp.m4a", pszSpec="*.flac") returned 0 [0143.642] lstrlenA (lpString="*.flac") returned 6 [0143.642] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\eFx2ggY6 fTb-dEpbBp.m4a", pszSpec="*.ape") returned 0 [0143.642] lstrlenA (lpString="*.ape") returned 5 [0143.642] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\eFx2ggY6 fTb-dEpbBp.m4a", pszSpec="*.wma") returned 0 [0143.642] lstrlenA (lpString="*.wma") returned 5 [0143.642] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\eFx2ggY6 fTb-dEpbBp.m4a", pszSpec="*.ac3") returned 0 [0143.642] lstrlenA (lpString="*.ac3") returned 5 [0143.642] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0143.642] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0143.642] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="hLC ue0oFXbc.mp3") returned -1 [0143.642] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="hLC ue0oFXbc.mp3") returned 1 [0143.642] lstrcmpiA (lpString1="", lpString2="hLC ue0oFXbc.mp3") returned -1 [0143.642] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\eFx2ggY6 fTb-dEpbBp.m4a") returned="eFx2ggY6 fTb-dEpbBp.m4a" [0143.642] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\", lpString2="hLC ue0oFXbc.mp3" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\hLC ue0oFXbc.mp3") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\hLC ue0oFXbc.mp3" [0143.642] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\hLC ue0oFXbc.mp3", pszSpec="*.zip") returned 0 [0143.642] lstrlenA (lpString="*.zip") returned 5 [0143.642] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\hLC ue0oFXbc.mp3", pszSpec="*.rar") returned 0 [0143.642] lstrlenA (lpString="*.rar") returned 5 [0143.642] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\hLC ue0oFXbc.mp3", pszSpec="*.7z") returned 0 [0143.642] lstrlenA (lpString="*.7z") returned 4 [0143.642] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\hLC ue0oFXbc.mp3", pszSpec="*.tar") returned 0 [0143.642] lstrlenA (lpString="*.tar") returned 5 [0143.642] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\hLC ue0oFXbc.mp3", pszSpec="*.gzip") returned 0 [0143.642] lstrlenA (lpString="*.gzip") returned 6 [0143.642] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\hLC ue0oFXbc.mp3", pszSpec="*.jpg") returned 0 [0143.642] lstrlenA (lpString="*.jpg") returned 5 [0143.642] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\hLC ue0oFXbc.mp3", pszSpec="*.jpeg") returned 0 [0143.643] lstrlenA (lpString="*.jpeg") returned 6 [0143.643] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\hLC ue0oFXbc.mp3", pszSpec="*.psd") returned 0 [0143.643] lstrlenA (lpString="*.psd") returned 5 [0143.643] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\hLC ue0oFXbc.mp3", pszSpec="*.cdr") returned 0 [0143.643] lstrlenA (lpString="*.cdr") returned 5 [0143.643] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\hLC ue0oFXbc.mp3", pszSpec="*.dwg") returned 0 [0143.643] lstrlenA (lpString="*.dwg") returned 5 [0143.643] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\hLC ue0oFXbc.mp3", pszSpec="*.max") returned 0 [0143.643] lstrlenA (lpString="*.max") returned 5 [0143.643] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\hLC ue0oFXbc.mp3", pszSpec="*.bmp") returned 0 [0143.643] lstrlenA (lpString="*.bmp") returned 5 [0143.643] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\hLC ue0oFXbc.mp3", pszSpec="*.gif") returned 0 [0143.643] lstrlenA (lpString="*.gif") returned 5 [0143.643] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\hLC ue0oFXbc.mp3", pszSpec="*.png") returned 0 [0143.643] lstrlenA (lpString="*.png") returned 5 [0143.643] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\hLC ue0oFXbc.mp3", pszSpec="*.doc") returned 0 [0143.643] lstrlenA (lpString="*.doc") returned 5 [0143.643] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\hLC ue0oFXbc.mp3", pszSpec="*.docx") returned 0 [0143.643] lstrlenA (lpString="*.docx") returned 6 [0143.643] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\hLC ue0oFXbc.mp3", pszSpec="*.xls") returned 0 [0143.643] lstrlenA (lpString="*.xls") returned 5 [0143.643] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\hLC ue0oFXbc.mp3", pszSpec="*.xlsx") returned 0 [0143.643] lstrlenA (lpString="*.xlsx") returned 6 [0143.643] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\hLC ue0oFXbc.mp3", pszSpec="*.ppt") returned 0 [0143.643] lstrlenA (lpString="*.ppt") returned 5 [0143.643] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\hLC ue0oFXbc.mp3", pszSpec="*.pptx") returned 0 [0143.643] lstrlenA (lpString="*.pptx") returned 6 [0143.643] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\hLC ue0oFXbc.mp3", pszSpec="*.txt") returned 0 [0143.643] lstrlenA (lpString="*.txt") returned 5 [0143.643] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\hLC ue0oFXbc.mp3", pszSpec="*.pdf") returned 0 [0143.643] lstrlenA (lpString="*.pdf") returned 5 [0143.643] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\hLC ue0oFXbc.mp3", pszSpec="*.djvu") returned 0 [0143.643] lstrlenA (lpString="*.djvu") returned 6 [0143.643] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\hLC ue0oFXbc.mp3", pszSpec="*.htm") returned 0 [0143.643] lstrlenA (lpString="*.htm") returned 5 [0143.643] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\hLC ue0oFXbc.mp3", pszSpec="*.html") returned 0 [0143.643] lstrlenA (lpString="*.html") returned 6 [0143.643] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\hLC ue0oFXbc.mp3", pszSpec="*.mdb") returned 0 [0143.643] lstrlenA (lpString="*.mdb") returned 5 [0143.643] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\hLC ue0oFXbc.mp3", pszSpec="*.cer") returned 0 [0143.643] lstrlenA (lpString="*.cer") returned 5 [0143.643] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\hLC ue0oFXbc.mp3", pszSpec="*.p12") returned 0 [0143.643] lstrlenA (lpString="*.p12") returned 5 [0143.643] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\hLC ue0oFXbc.mp3", pszSpec="*.pfx") returned 0 [0143.643] lstrlenA (lpString="*.pfx") returned 5 [0143.643] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\hLC ue0oFXbc.mp3", pszSpec="*.kwm") returned 0 [0143.643] lstrlenA (lpString="*.kwm") returned 5 [0143.643] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\hLC ue0oFXbc.mp3", pszSpec="*.pwm") returned 0 [0143.643] lstrlenA (lpString="*.pwm") returned 5 [0143.644] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\hLC ue0oFXbc.mp3", pszSpec="*.1cd") returned 0 [0143.644] lstrlenA (lpString="*.1cd") returned 5 [0143.644] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\hLC ue0oFXbc.mp3", pszSpec="*.md") returned 0 [0143.644] lstrlenA (lpString="*.md") returned 4 [0143.644] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\hLC ue0oFXbc.mp3", pszSpec="*.mdf") returned 0 [0143.644] lstrlenA (lpString="*.mdf") returned 5 [0143.644] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\hLC ue0oFXbc.mp3", pszSpec="*.dbf") returned 0 [0143.644] lstrlenA (lpString="*.dbf") returned 5 [0143.644] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\hLC ue0oFXbc.mp3", pszSpec="*.odt") returned 0 [0143.644] lstrlenA (lpString="*.odt") returned 5 [0143.644] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\hLC ue0oFXbc.mp3", pszSpec="*.vob") returned 0 [0143.644] lstrlenA (lpString="*.vob") returned 5 [0143.644] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\hLC ue0oFXbc.mp3", pszSpec="*.ifo") returned 0 [0143.644] lstrlenA (lpString="*.ifo") returned 5 [0143.644] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\hLC ue0oFXbc.mp3", pszSpec="*.lnk") returned 0 [0143.644] lstrlenA (lpString="*.lnk") returned 5 [0143.644] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\hLC ue0oFXbc.mp3", pszSpec="*.torrent") returned 0 [0143.644] lstrlenA (lpString="*.torrent") returned 9 [0143.644] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\hLC ue0oFXbc.mp3", pszSpec="*.mov") returned 0 [0143.644] lstrlenA (lpString="*.mov") returned 5 [0143.644] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\hLC ue0oFXbc.mp3", pszSpec="*.m2v") returned 0 [0143.644] lstrlenA (lpString="*.m2v") returned 5 [0143.644] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\hLC ue0oFXbc.mp3", pszSpec="*.3gp") returned 0 [0143.644] lstrlenA (lpString="*.3gp") returned 5 [0143.644] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\hLC ue0oFXbc.mp3", pszSpec="*.mpeg") returned 0 [0143.644] lstrlenA (lpString="*.mpeg") returned 6 [0143.644] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\hLC ue0oFXbc.mp3", pszSpec="*.mpg") returned 0 [0143.644] lstrlenA (lpString="*.mpg") returned 5 [0143.644] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\hLC ue0oFXbc.mp3", pszSpec="*.flv") returned 0 [0143.644] lstrlenA (lpString="*.flv") returned 5 [0143.644] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\hLC ue0oFXbc.mp3", pszSpec="*.avi") returned 0 [0143.644] lstrlenA (lpString="*.avi") returned 5 [0143.644] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\hLC ue0oFXbc.mp3", pszSpec="*.mp4") returned 0 [0143.644] lstrlenA (lpString="*.mp4") returned 5 [0143.644] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\hLC ue0oFXbc.mp3", pszSpec="*.wmv") returned 0 [0143.644] lstrlenA (lpString="*.wmv") returned 5 [0143.644] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\hLC ue0oFXbc.mp3", pszSpec="*.divx") returned 0 [0143.644] lstrlenA (lpString="*.divx") returned 6 [0143.644] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\hLC ue0oFXbc.mp3", pszSpec="*.mkv") returned 0 [0143.644] lstrlenA (lpString="*.mkv") returned 5 [0143.644] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\hLC ue0oFXbc.mp3", pszSpec="*.mp3") returned 1 [0143.644] lstrlenA (lpString="*.mp3") returned 5 [0143.644] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\hLC ue0oFXbc.mp3" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\hLC ue0oFXbc.mp3") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\hLC ue0oFXbc.mp3" [0143.644] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\hLC ue0oFXbc.mp3" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\hLC ue0oFXbc.mp3") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\hLC ue0oFXbc.mp3" [0143.644] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\hLC ue0oFXbc.mp3", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\hLC ue0oFXbc.mp3.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\hLC ue0oFXbc.mp3." [0143.644] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\hLC ue0oFXbc.mp3.", lpString2="\xa0" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\hLC ue0oFXbc.mp3. ") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\hLC ue0oFXbc.mp3. " [0143.645] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\hLC ue0oFXbc.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\hlc ue0ofxbc.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c [0143.645] GetFileSize (in: hFile=0x8c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x16b17 [0143.645] GetFileTime (in: hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x44157dc0, dwHighDateTime=0x1d4a9de), lpLastAccessTime=0x407536*(dwLowDateTime=0x10ab96b0, dwHighDateTime=0x1d4adba), lpLastWriteTime=0x40753e*(dwLowDateTime=0x10ab96b0, dwHighDateTime=0x1d4adba)) returned 1 [0143.645] SetFilePointer (in: hFile=0x8c, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0143.645] ReadFile (in: hFile=0x8c, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x16abd, lpOverlapped=0x0) returned 1 [0143.646] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\hLC ue0oFXbc.mp3") returned="hLC ue0oFXbc.mp3" [0143.646] SetFilePointer (in: hFile=0x8c, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0143.646] WriteFile (in: hFile=0x8c, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x16abd, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x16abd, lpOverlapped=0x0) returned 1 [0143.647] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0143.647] CloseHandle (hObject=0x8c) returned 1 [0143.647] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\hLC ue0oFXbc.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\hlc ue0ofxbc.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\hLC ue0oFXbc.mp3. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\hlc ue0ofxbc.mp3. ")) returned 1 [0143.648] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0143.648] lstrcmpA (lpString1=".", lpString2="Identities") returned -1 [0143.648] lstrcmpA (lpString1="..", lpString2="Identities") returned -1 [0143.648] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\hLC ue0oFXbc.mp3") returned="hLC ue0oFXbc.mp3" [0143.648] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\", lpString2="Identities" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Identities") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Identities" [0143.648] lstrlenA (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Identities") returned 56 [0143.648] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Identities\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0143.648] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0143.648] FindNextFileA (in: hFindFile=0x5be260, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0143.648] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0143.648] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0143.648] FindNextFileA (in: hFindFile=0x5be260, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0143.648] lstrcmpA (lpString1=".", lpString2="{31810C36-5D23-4CCE-A3B4-316DED195C38}") returned -1 [0143.648] lstrcmpA (lpString1="..", lpString2="{31810C36-5D23-4CCE-A3B4-316DED195C38}") returned -1 [0143.648] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Identities\\*.*") returned="*.*" [0143.648] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Identities\\", lpString2="{31810C36-5D23-4CCE-A3B4-316DED195C38}" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Identities\\{31810C36-5D23-4CCE-A3B4-316DED195C38}") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Identities\\{31810C36-5D23-4CCE-A3B4-316DED195C38}" [0143.648] lstrlenA (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Identities\\{31810C36-5D23-4CCE-A3B4-316DED195C38}") returned 95 [0143.648] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Identities\\{31810C36-5D23-4CCE-A3B4-316DED195C38}\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0143.649] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0143.649] FindNextFileA (in: hFindFile=0x5be2a0, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0143.649] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0143.649] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0143.649] FindNextFileA (in: hFindFile=0x5be2a0, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0 [0143.649] FindClose (in: hFindFile=0x5be2a0 | out: hFindFile=0x5be2a0) returned 1 [0143.649] FindNextFileA (in: hFindFile=0x5be260, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0 [0143.649] FindClose (in: hFindFile=0x5be260 | out: hFindFile=0x5be260) returned 1 [0143.649] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0143.649] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0143.649] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="IeSyooX.mp4") returned -1 [0143.649] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="IeSyooX.mp4") returned -1 [0143.649] lstrcmpiA (lpString1="", lpString2="IeSyooX.mp4") returned -1 [0143.649] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\*.*") returned="*.*" [0143.649] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\", lpString2="IeSyooX.mp4" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\IeSyooX.mp4") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\IeSyooX.mp4" [0143.649] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\IeSyooX.mp4", pszSpec="*.zip") returned 0 [0143.649] lstrlenA (lpString="*.zip") returned 5 [0143.649] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\IeSyooX.mp4", pszSpec="*.rar") returned 0 [0143.649] lstrlenA (lpString="*.rar") returned 5 [0143.649] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\IeSyooX.mp4", pszSpec="*.7z") returned 0 [0143.649] lstrlenA (lpString="*.7z") returned 4 [0143.649] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\IeSyooX.mp4", pszSpec="*.tar") returned 0 [0143.649] lstrlenA (lpString="*.tar") returned 5 [0143.649] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\IeSyooX.mp4", pszSpec="*.gzip") returned 0 [0143.649] lstrlenA (lpString="*.gzip") returned 6 [0143.649] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\IeSyooX.mp4", pszSpec="*.jpg") returned 0 [0143.649] lstrlenA (lpString="*.jpg") returned 5 [0143.649] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\IeSyooX.mp4", pszSpec="*.jpeg") returned 0 [0143.649] lstrlenA (lpString="*.jpeg") returned 6 [0143.649] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\IeSyooX.mp4", pszSpec="*.psd") returned 0 [0143.649] lstrlenA (lpString="*.psd") returned 5 [0143.649] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\IeSyooX.mp4", pszSpec="*.cdr") returned 0 [0143.649] lstrlenA (lpString="*.cdr") returned 5 [0143.649] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\IeSyooX.mp4", pszSpec="*.dwg") returned 0 [0143.649] lstrlenA (lpString="*.dwg") returned 5 [0143.649] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\IeSyooX.mp4", pszSpec="*.max") returned 0 [0143.649] lstrlenA (lpString="*.max") returned 5 [0143.649] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\IeSyooX.mp4", pszSpec="*.bmp") returned 0 [0143.650] lstrlenA (lpString="*.bmp") returned 5 [0143.650] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\IeSyooX.mp4", pszSpec="*.gif") returned 0 [0143.650] lstrlenA (lpString="*.gif") returned 5 [0143.650] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\IeSyooX.mp4", pszSpec="*.png") returned 0 [0143.650] lstrlenA (lpString="*.png") returned 5 [0143.650] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\IeSyooX.mp4", pszSpec="*.doc") returned 0 [0143.650] lstrlenA (lpString="*.doc") returned 5 [0143.650] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\IeSyooX.mp4", pszSpec="*.docx") returned 0 [0143.650] lstrlenA (lpString="*.docx") returned 6 [0143.650] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\IeSyooX.mp4", pszSpec="*.xls") returned 0 [0143.650] lstrlenA (lpString="*.xls") returned 5 [0143.650] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\IeSyooX.mp4", pszSpec="*.xlsx") returned 0 [0143.650] lstrlenA (lpString="*.xlsx") returned 6 [0143.650] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\IeSyooX.mp4", pszSpec="*.ppt") returned 0 [0143.650] lstrlenA (lpString="*.ppt") returned 5 [0143.650] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\IeSyooX.mp4", pszSpec="*.pptx") returned 0 [0143.650] lstrlenA (lpString="*.pptx") returned 6 [0143.650] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\IeSyooX.mp4", pszSpec="*.txt") returned 0 [0143.650] lstrlenA (lpString="*.txt") returned 5 [0143.650] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\IeSyooX.mp4", pszSpec="*.pdf") returned 0 [0143.650] lstrlenA (lpString="*.pdf") returned 5 [0143.650] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\IeSyooX.mp4", pszSpec="*.djvu") returned 0 [0143.650] lstrlenA (lpString="*.djvu") returned 6 [0143.650] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\IeSyooX.mp4", pszSpec="*.htm") returned 0 [0143.650] lstrlenA (lpString="*.htm") returned 5 [0143.650] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\IeSyooX.mp4", pszSpec="*.html") returned 0 [0143.650] lstrlenA (lpString="*.html") returned 6 [0143.650] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\IeSyooX.mp4", pszSpec="*.mdb") returned 0 [0143.650] lstrlenA (lpString="*.mdb") returned 5 [0143.650] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\IeSyooX.mp4", pszSpec="*.cer") returned 0 [0143.650] lstrlenA (lpString="*.cer") returned 5 [0143.650] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\IeSyooX.mp4", pszSpec="*.p12") returned 0 [0143.650] lstrlenA (lpString="*.p12") returned 5 [0143.650] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\IeSyooX.mp4", pszSpec="*.pfx") returned 0 [0143.650] lstrlenA (lpString="*.pfx") returned 5 [0143.650] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\IeSyooX.mp4", pszSpec="*.kwm") returned 0 [0143.650] lstrlenA (lpString="*.kwm") returned 5 [0143.650] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\IeSyooX.mp4", pszSpec="*.pwm") returned 0 [0143.650] lstrlenA (lpString="*.pwm") returned 5 [0143.650] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\IeSyooX.mp4", pszSpec="*.1cd") returned 0 [0143.650] lstrlenA (lpString="*.1cd") returned 5 [0143.650] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\IeSyooX.mp4", pszSpec="*.md") returned 0 [0143.650] lstrlenA (lpString="*.md") returned 4 [0143.650] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\IeSyooX.mp4", pszSpec="*.mdf") returned 0 [0143.650] lstrlenA (lpString="*.mdf") returned 5 [0143.650] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\IeSyooX.mp4", pszSpec="*.dbf") returned 0 [0143.650] lstrlenA (lpString="*.dbf") returned 5 [0143.650] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\IeSyooX.mp4", pszSpec="*.odt") returned 0 [0143.650] lstrlenA (lpString="*.odt") returned 5 [0143.650] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\IeSyooX.mp4", pszSpec="*.vob") returned 0 [0143.651] lstrlenA (lpString="*.vob") returned 5 [0143.651] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\IeSyooX.mp4", pszSpec="*.ifo") returned 0 [0143.651] lstrlenA (lpString="*.ifo") returned 5 [0143.651] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\IeSyooX.mp4", pszSpec="*.lnk") returned 0 [0143.651] lstrlenA (lpString="*.lnk") returned 5 [0143.651] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\IeSyooX.mp4", pszSpec="*.torrent") returned 0 [0143.651] lstrlenA (lpString="*.torrent") returned 9 [0143.651] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\IeSyooX.mp4", pszSpec="*.mov") returned 0 [0143.651] lstrlenA (lpString="*.mov") returned 5 [0143.651] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\IeSyooX.mp4", pszSpec="*.m2v") returned 0 [0143.651] lstrlenA (lpString="*.m2v") returned 5 [0143.651] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\IeSyooX.mp4", pszSpec="*.3gp") returned 0 [0143.651] lstrlenA (lpString="*.3gp") returned 5 [0143.651] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\IeSyooX.mp4", pszSpec="*.mpeg") returned 0 [0143.651] lstrlenA (lpString="*.mpeg") returned 6 [0143.651] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\IeSyooX.mp4", pszSpec="*.mpg") returned 0 [0143.651] lstrlenA (lpString="*.mpg") returned 5 [0143.651] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\IeSyooX.mp4", pszSpec="*.flv") returned 0 [0143.651] lstrlenA (lpString="*.flv") returned 5 [0143.651] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\IeSyooX.mp4", pszSpec="*.avi") returned 0 [0143.651] lstrlenA (lpString="*.avi") returned 5 [0143.651] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\IeSyooX.mp4", pszSpec="*.mp4") returned 1 [0143.651] lstrlenA (lpString="*.mp4") returned 5 [0143.651] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\IeSyooX.mp4" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\IeSyooX.mp4") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\IeSyooX.mp4" [0143.651] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\IeSyooX.mp4" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\IeSyooX.mp4") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\IeSyooX.mp4" [0143.651] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\IeSyooX.mp4", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\IeSyooX.mp4.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\IeSyooX.mp4." [0143.651] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\IeSyooX.mp4.", lpString2="\xa0" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\IeSyooX.mp4. ") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\IeSyooX.mp4. " [0143.651] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\IeSyooX.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\iesyoox.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c [0143.652] GetFileSize (in: hFile=0x8c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1bac [0143.652] GetFileTime (in: hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0x7aaff980, dwHighDateTime=0x1d4a20b), lpLastAccessTime=0x407536*(dwLowDateTime=0x116806f0, dwHighDateTime=0x1d4a0d7), lpLastWriteTime=0x40753e*(dwLowDateTime=0x116806f0, dwHighDateTime=0x1d4a0d7)) returned 1 [0143.652] SetFilePointer (in: hFile=0x8c, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0143.652] ReadFile (in: hFile=0x8c, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x1b52, lpOverlapped=0x0) returned 1 [0143.652] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\IeSyooX.mp4") returned="IeSyooX.mp4" [0143.652] SetFilePointer (in: hFile=0x8c, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0143.652] WriteFile (in: hFile=0x8c, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x1b52, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x1b52, lpOverlapped=0x0) returned 1 [0143.653] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0143.653] CloseHandle (hObject=0x8c) returned 1 [0143.653] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\IeSyooX.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\iesyoox.mp4"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\IeSyooX.mp4. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\iesyoox.mp4. ")) returned 1 [0143.654] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0143.654] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0143.654] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="IggGPX4PHUrf4OK.mp3") returned -1 [0143.654] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="IggGPX4PHUrf4OK.mp3") returned -1 [0143.654] lstrcmpiA (lpString1="", lpString2="IggGPX4PHUrf4OK.mp3") returned -1 [0143.654] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\IeSyooX.mp4") returned="IeSyooX.mp4" [0143.654] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\", lpString2="IggGPX4PHUrf4OK.mp3" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\IggGPX4PHUrf4OK.mp3") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\IggGPX4PHUrf4OK.mp3" [0143.654] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\IggGPX4PHUrf4OK.mp3", pszSpec="*.zip") returned 0 [0143.654] lstrlenA (lpString="*.zip") returned 5 [0143.654] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\IggGPX4PHUrf4OK.mp3", pszSpec="*.rar") returned 0 [0143.654] lstrlenA (lpString="*.rar") returned 5 [0143.654] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\IggGPX4PHUrf4OK.mp3", pszSpec="*.7z") returned 0 [0143.654] lstrlenA (lpString="*.7z") returned 4 [0143.654] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\IggGPX4PHUrf4OK.mp3", pszSpec="*.tar") returned 0 [0143.654] lstrlenA (lpString="*.tar") returned 5 [0143.654] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\IggGPX4PHUrf4OK.mp3", pszSpec="*.gzip") returned 0 [0143.654] lstrlenA (lpString="*.gzip") returned 6 [0143.654] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\IggGPX4PHUrf4OK.mp3", pszSpec="*.jpg") returned 0 [0143.654] lstrlenA (lpString="*.jpg") returned 5 [0143.654] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\IggGPX4PHUrf4OK.mp3", pszSpec="*.jpeg") returned 0 [0143.654] lstrlenA (lpString="*.jpeg") returned 6 [0143.654] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\IggGPX4PHUrf4OK.mp3", pszSpec="*.psd") returned 0 [0143.654] lstrlenA (lpString="*.psd") returned 5 [0143.654] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\IggGPX4PHUrf4OK.mp3", pszSpec="*.cdr") returned 0 [0143.654] lstrlenA (lpString="*.cdr") returned 5 [0143.654] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\IggGPX4PHUrf4OK.mp3", pszSpec="*.dwg") returned 0 [0143.654] lstrlenA (lpString="*.dwg") returned 5 [0143.654] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\IggGPX4PHUrf4OK.mp3", pszSpec="*.max") returned 0 [0143.654] lstrlenA (lpString="*.max") returned 5 [0143.655] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\IggGPX4PHUrf4OK.mp3", pszSpec="*.bmp") returned 0 [0143.655] lstrlenA (lpString="*.bmp") returned 5 [0143.655] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\IggGPX4PHUrf4OK.mp3", pszSpec="*.gif") returned 0 [0143.655] lstrlenA (lpString="*.gif") returned 5 [0143.655] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\IggGPX4PHUrf4OK.mp3", pszSpec="*.png") returned 0 [0143.655] lstrlenA (lpString="*.png") returned 5 [0143.655] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\IggGPX4PHUrf4OK.mp3", pszSpec="*.doc") returned 0 [0143.655] lstrlenA (lpString="*.doc") returned 5 [0143.655] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\IggGPX4PHUrf4OK.mp3", pszSpec="*.docx") returned 0 [0143.655] lstrlenA (lpString="*.docx") returned 6 [0143.655] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\IggGPX4PHUrf4OK.mp3", pszSpec="*.xls") returned 0 [0143.655] lstrlenA (lpString="*.xls") returned 5 [0143.655] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\IggGPX4PHUrf4OK.mp3", pszSpec="*.xlsx") returned 0 [0143.655] lstrlenA (lpString="*.xlsx") returned 6 [0143.655] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\IggGPX4PHUrf4OK.mp3", pszSpec="*.ppt") returned 0 [0143.655] lstrlenA (lpString="*.ppt") returned 5 [0143.655] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\IggGPX4PHUrf4OK.mp3", pszSpec="*.pptx") returned 0 [0143.655] lstrlenA (lpString="*.pptx") returned 6 [0143.655] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\IggGPX4PHUrf4OK.mp3", pszSpec="*.txt") returned 0 [0143.655] lstrlenA (lpString="*.txt") returned 5 [0143.655] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\IggGPX4PHUrf4OK.mp3", pszSpec="*.pdf") returned 0 [0143.655] lstrlenA (lpString="*.pdf") returned 5 [0143.655] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\IggGPX4PHUrf4OK.mp3", pszSpec="*.djvu") returned 0 [0143.655] lstrlenA (lpString="*.djvu") returned 6 [0143.655] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\IggGPX4PHUrf4OK.mp3", pszSpec="*.htm") returned 0 [0143.655] lstrlenA (lpString="*.htm") returned 5 [0143.655] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\IggGPX4PHUrf4OK.mp3", pszSpec="*.html") returned 0 [0143.655] lstrlenA (lpString="*.html") returned 6 [0143.655] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\IggGPX4PHUrf4OK.mp3", pszSpec="*.mdb") returned 0 [0143.655] lstrlenA (lpString="*.mdb") returned 5 [0143.655] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\IggGPX4PHUrf4OK.mp3", pszSpec="*.cer") returned 0 [0143.655] lstrlenA (lpString="*.cer") returned 5 [0143.655] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\IggGPX4PHUrf4OK.mp3", pszSpec="*.p12") returned 0 [0143.655] lstrlenA (lpString="*.p12") returned 5 [0143.655] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\IggGPX4PHUrf4OK.mp3", pszSpec="*.pfx") returned 0 [0143.655] lstrlenA (lpString="*.pfx") returned 5 [0143.655] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\IggGPX4PHUrf4OK.mp3", pszSpec="*.kwm") returned 0 [0143.655] lstrlenA (lpString="*.kwm") returned 5 [0143.655] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\IggGPX4PHUrf4OK.mp3", pszSpec="*.pwm") returned 0 [0143.655] lstrlenA (lpString="*.pwm") returned 5 [0143.655] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\IggGPX4PHUrf4OK.mp3", pszSpec="*.1cd") returned 0 [0143.655] lstrlenA (lpString="*.1cd") returned 5 [0143.655] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\IggGPX4PHUrf4OK.mp3", pszSpec="*.md") returned 0 [0143.655] lstrlenA (lpString="*.md") returned 4 [0143.655] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\IggGPX4PHUrf4OK.mp3", pszSpec="*.mdf") returned 0 [0143.655] lstrlenA (lpString="*.mdf") returned 5 [0143.655] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\IggGPX4PHUrf4OK.mp3", pszSpec="*.dbf") returned 0 [0143.656] lstrlenA (lpString="*.dbf") returned 5 [0143.656] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\IggGPX4PHUrf4OK.mp3", pszSpec="*.odt") returned 0 [0143.656] lstrlenA (lpString="*.odt") returned 5 [0143.656] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\IggGPX4PHUrf4OK.mp3", pszSpec="*.vob") returned 0 [0143.656] lstrlenA (lpString="*.vob") returned 5 [0143.656] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\IggGPX4PHUrf4OK.mp3", pszSpec="*.ifo") returned 0 [0143.656] lstrlenA (lpString="*.ifo") returned 5 [0143.656] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\IggGPX4PHUrf4OK.mp3", pszSpec="*.lnk") returned 0 [0143.656] lstrlenA (lpString="*.lnk") returned 5 [0143.656] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\IggGPX4PHUrf4OK.mp3", pszSpec="*.torrent") returned 0 [0143.656] lstrlenA (lpString="*.torrent") returned 9 [0143.656] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\IggGPX4PHUrf4OK.mp3", pszSpec="*.mov") returned 0 [0143.656] lstrlenA (lpString="*.mov") returned 5 [0143.656] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\IggGPX4PHUrf4OK.mp3", pszSpec="*.m2v") returned 0 [0143.656] lstrlenA (lpString="*.m2v") returned 5 [0143.656] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\IggGPX4PHUrf4OK.mp3", pszSpec="*.3gp") returned 0 [0143.656] lstrlenA (lpString="*.3gp") returned 5 [0143.656] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\IggGPX4PHUrf4OK.mp3", pszSpec="*.mpeg") returned 0 [0143.656] lstrlenA (lpString="*.mpeg") returned 6 [0143.656] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\IggGPX4PHUrf4OK.mp3", pszSpec="*.mpg") returned 0 [0143.656] lstrlenA (lpString="*.mpg") returned 5 [0143.656] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\IggGPX4PHUrf4OK.mp3", pszSpec="*.flv") returned 0 [0143.656] lstrlenA (lpString="*.flv") returned 5 [0143.656] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\IggGPX4PHUrf4OK.mp3", pszSpec="*.avi") returned 0 [0143.656] lstrlenA (lpString="*.avi") returned 5 [0143.656] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\IggGPX4PHUrf4OK.mp3", pszSpec="*.mp4") returned 0 [0143.656] lstrlenA (lpString="*.mp4") returned 5 [0143.656] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\IggGPX4PHUrf4OK.mp3", pszSpec="*.wmv") returned 0 [0143.656] lstrlenA (lpString="*.wmv") returned 5 [0143.656] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\IggGPX4PHUrf4OK.mp3", pszSpec="*.divx") returned 0 [0143.656] lstrlenA (lpString="*.divx") returned 6 [0143.656] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\IggGPX4PHUrf4OK.mp3", pszSpec="*.mkv") returned 0 [0143.656] lstrlenA (lpString="*.mkv") returned 5 [0143.656] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\IggGPX4PHUrf4OK.mp3", pszSpec="*.mp3") returned 1 [0143.656] lstrlenA (lpString="*.mp3") returned 5 [0143.656] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\IggGPX4PHUrf4OK.mp3" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\IggGPX4PHUrf4OK.mp3") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\IggGPX4PHUrf4OK.mp3" [0143.656] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\IggGPX4PHUrf4OK.mp3" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\IggGPX4PHUrf4OK.mp3") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\IggGPX4PHUrf4OK.mp3" [0143.656] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\IggGPX4PHUrf4OK.mp3", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\IggGPX4PHUrf4OK.mp3.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\IggGPX4PHUrf4OK.mp3." [0143.656] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\IggGPX4PHUrf4OK.mp3.", lpString2="\xa0" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\IggGPX4PHUrf4OK.mp3. ") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\IggGPX4PHUrf4OK.mp3. " [0143.656] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\IggGPX4PHUrf4OK.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\igggpx4phurf4ok.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c [0143.657] GetFileSize (in: hFile=0x8c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x12ff4 [0143.657] GetFileTime (in: hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xfbd99550, dwHighDateTime=0x1d4ad1b), lpLastAccessTime=0x407536*(dwLowDateTime=0x1e89db50, dwHighDateTime=0x1d4a853), lpLastWriteTime=0x40753e*(dwLowDateTime=0x1e89db50, dwHighDateTime=0x1d4a853)) returned 1 [0143.657] SetFilePointer (in: hFile=0x8c, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0143.657] ReadFile (in: hFile=0x8c, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x12f9a, lpOverlapped=0x0) returned 1 [0143.658] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\IggGPX4PHUrf4OK.mp3") returned="IggGPX4PHUrf4OK.mp3" [0143.658] SetFilePointer (in: hFile=0x8c, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0143.658] WriteFile (in: hFile=0x8c, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x12f9a, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x12f9a, lpOverlapped=0x0) returned 1 [0143.659] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0143.659] CloseHandle (hObject=0x8c) returned 1 [0143.659] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\IggGPX4PHUrf4OK.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\igggpx4phurf4ok.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\IggGPX4PHUrf4OK.mp3. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\igggpx4phurf4ok.mp3. ")) returned 1 [0143.662] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0143.662] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0143.662] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Iu3OQowEiC-X0.gif") returned -1 [0143.662] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Iu3OQowEiC-X0.gif") returned -1 [0143.662] lstrcmpiA (lpString1="", lpString2="Iu3OQowEiC-X0.gif") returned -1 [0143.662] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\IggGPX4PHUrf4OK.mp3") returned="IggGPX4PHUrf4OK.mp3" [0143.662] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\", lpString2="Iu3OQowEiC-X0.gif" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Iu3OQowEiC-X0.gif") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Iu3OQowEiC-X0.gif" [0143.662] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Iu3OQowEiC-X0.gif", pszSpec="*.zip") returned 0 [0143.662] lstrlenA (lpString="*.zip") returned 5 [0143.662] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Iu3OQowEiC-X0.gif", pszSpec="*.rar") returned 0 [0143.662] lstrlenA (lpString="*.rar") returned 5 [0143.663] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Iu3OQowEiC-X0.gif", pszSpec="*.7z") returned 0 [0143.663] lstrlenA (lpString="*.7z") returned 4 [0143.663] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Iu3OQowEiC-X0.gif", pszSpec="*.tar") returned 0 [0143.663] lstrlenA (lpString="*.tar") returned 5 [0143.663] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Iu3OQowEiC-X0.gif", pszSpec="*.gzip") returned 0 [0143.663] lstrlenA (lpString="*.gzip") returned 6 [0143.663] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Iu3OQowEiC-X0.gif", pszSpec="*.jpg") returned 0 [0143.663] lstrlenA (lpString="*.jpg") returned 5 [0143.663] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Iu3OQowEiC-X0.gif", pszSpec="*.jpeg") returned 0 [0143.663] lstrlenA (lpString="*.jpeg") returned 6 [0143.663] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Iu3OQowEiC-X0.gif", pszSpec="*.psd") returned 0 [0143.663] lstrlenA (lpString="*.psd") returned 5 [0143.663] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Iu3OQowEiC-X0.gif", pszSpec="*.cdr") returned 0 [0143.663] lstrlenA (lpString="*.cdr") returned 5 [0143.663] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Iu3OQowEiC-X0.gif", pszSpec="*.dwg") returned 0 [0143.663] lstrlenA (lpString="*.dwg") returned 5 [0143.663] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Iu3OQowEiC-X0.gif", pszSpec="*.max") returned 0 [0143.663] lstrlenA (lpString="*.max") returned 5 [0143.663] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Iu3OQowEiC-X0.gif", pszSpec="*.bmp") returned 0 [0143.663] lstrlenA (lpString="*.bmp") returned 5 [0143.663] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Iu3OQowEiC-X0.gif", pszSpec="*.gif") returned 1 [0143.663] lstrlenA (lpString="*.gif") returned 5 [0143.663] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Iu3OQowEiC-X0.gif" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Iu3OQowEiC-X0.gif") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Iu3OQowEiC-X0.gif" [0143.663] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Iu3OQowEiC-X0.gif" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Iu3OQowEiC-X0.gif") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Iu3OQowEiC-X0.gif" [0143.663] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Iu3OQowEiC-X0.gif", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Iu3OQowEiC-X0.gif.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Iu3OQowEiC-X0.gif." [0143.663] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Iu3OQowEiC-X0.gif.", lpString2="\xa0" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Iu3OQowEiC-X0.gif. ") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Iu3OQowEiC-X0.gif. " [0143.663] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Iu3OQowEiC-X0.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\iu3oqoweic-x0.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c [0143.664] GetFileSize (in: hFile=0x8c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x6efd [0143.664] GetFileTime (in: hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xe60da300, dwHighDateTime=0x1d4a99d), lpLastAccessTime=0x407536*(dwLowDateTime=0xb6498480, dwHighDateTime=0x1d4aade), lpLastWriteTime=0x40753e*(dwLowDateTime=0xb6498480, dwHighDateTime=0x1d4aade)) returned 1 [0143.664] SetFilePointer (in: hFile=0x8c, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0143.664] ReadFile (in: hFile=0x8c, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x6ea3, lpOverlapped=0x0) returned 1 [0143.665] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Iu3OQowEiC-X0.gif") returned="Iu3OQowEiC-X0.gif" [0143.665] SetFilePointer (in: hFile=0x8c, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0143.665] WriteFile (in: hFile=0x8c, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x6ea3, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x6ea3, lpOverlapped=0x0) returned 1 [0143.665] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0143.665] CloseHandle (hObject=0x8c) returned 1 [0143.665] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Iu3OQowEiC-X0.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\iu3oqoweic-x0.gif"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Iu3OQowEiC-X0.gif. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\iu3oqoweic-x0.gif. ")) returned 1 [0143.666] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0143.666] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0143.666] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="j0f5kjIhQC-OCrO.jpg") returned -1 [0143.666] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="j0f5kjIhQC-OCrO.jpg") returned -1 [0143.666] lstrcmpiA (lpString1="", lpString2="j0f5kjIhQC-OCrO.jpg") returned -1 [0143.666] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Iu3OQowEiC-X0.gif") returned="Iu3OQowEiC-X0.gif" [0143.666] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\", lpString2="j0f5kjIhQC-OCrO.jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\j0f5kjIhQC-OCrO.jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\j0f5kjIhQC-OCrO.jpg" [0143.666] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\j0f5kjIhQC-OCrO.jpg", pszSpec="*.zip") returned 0 [0143.667] lstrlenA (lpString="*.zip") returned 5 [0143.667] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\j0f5kjIhQC-OCrO.jpg", pszSpec="*.rar") returned 0 [0143.667] lstrlenA (lpString="*.rar") returned 5 [0143.667] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\j0f5kjIhQC-OCrO.jpg", pszSpec="*.7z") returned 0 [0143.667] lstrlenA (lpString="*.7z") returned 4 [0143.667] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\j0f5kjIhQC-OCrO.jpg", pszSpec="*.tar") returned 0 [0143.667] lstrlenA (lpString="*.tar") returned 5 [0143.667] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\j0f5kjIhQC-OCrO.jpg", pszSpec="*.gzip") returned 0 [0143.667] lstrlenA (lpString="*.gzip") returned 6 [0143.667] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\j0f5kjIhQC-OCrO.jpg", pszSpec="*.jpg") returned 1 [0143.667] lstrlenA (lpString="*.jpg") returned 5 [0143.667] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\j0f5kjIhQC-OCrO.jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\j0f5kjIhQC-OCrO.jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\j0f5kjIhQC-OCrO.jpg" [0143.667] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\j0f5kjIhQC-OCrO.jpg" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\j0f5kjIhQC-OCrO.jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\j0f5kjIhQC-OCrO.jpg" [0143.667] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\j0f5kjIhQC-OCrO.jpg", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\j0f5kjIhQC-OCrO.jpg.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\j0f5kjIhQC-OCrO.jpg." [0143.667] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\j0f5kjIhQC-OCrO.jpg.", lpString2="\xa0" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\j0f5kjIhQC-OCrO.jpg. ") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\j0f5kjIhQC-OCrO.jpg. " [0143.667] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\j0f5kjIhQC-OCrO.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\j0f5kjihqc-ocro.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c [0143.667] GetFileSize (in: hFile=0x8c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x18538 [0143.667] GetFileTime (in: hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xee512f80, dwHighDateTime=0x1d4a184), lpLastAccessTime=0x407536*(dwLowDateTime=0xade62580, dwHighDateTime=0x1d4a194), lpLastWriteTime=0x40753e*(dwLowDateTime=0xade62580, dwHighDateTime=0x1d4a194)) returned 1 [0143.668] SetFilePointer (in: hFile=0x8c, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0143.668] ReadFile (in: hFile=0x8c, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x184de, lpOverlapped=0x0) returned 1 [0143.668] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\j0f5kjIhQC-OCrO.jpg") returned="j0f5kjIhQC-OCrO.jpg" [0143.669] SetFilePointer (in: hFile=0x8c, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0143.669] WriteFile (in: hFile=0x8c, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x184de, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x184de, lpOverlapped=0x0) returned 1 [0143.669] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0143.669] CloseHandle (hObject=0x8c) returned 1 [0143.669] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\j0f5kjIhQC-OCrO.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\j0f5kjihqc-ocro.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\j0f5kjIhQC-OCrO.jpg. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\j0f5kjihqc-ocro.jpg. ")) returned 1 [0143.670] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0143.670] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0143.670] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Lmgb8I1a1f1Z7viJR.flv") returned -1 [0143.670] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Lmgb8I1a1f1Z7viJR.flv") returned -1 [0143.670] lstrcmpiA (lpString1="", lpString2="Lmgb8I1a1f1Z7viJR.flv") returned -1 [0143.670] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\j0f5kjIhQC-OCrO.jpg") returned="j0f5kjIhQC-OCrO.jpg" [0143.670] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\", lpString2="Lmgb8I1a1f1Z7viJR.flv" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Lmgb8I1a1f1Z7viJR.flv") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Lmgb8I1a1f1Z7viJR.flv" [0143.670] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Lmgb8I1a1f1Z7viJR.flv", pszSpec="*.zip") returned 0 [0143.670] lstrlenA (lpString="*.zip") returned 5 [0143.670] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Lmgb8I1a1f1Z7viJR.flv", pszSpec="*.rar") returned 0 [0143.670] lstrlenA (lpString="*.rar") returned 5 [0143.670] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Lmgb8I1a1f1Z7viJR.flv", pszSpec="*.7z") returned 0 [0143.670] lstrlenA (lpString="*.7z") returned 4 [0143.670] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Lmgb8I1a1f1Z7viJR.flv", pszSpec="*.tar") returned 0 [0143.670] lstrlenA (lpString="*.tar") returned 5 [0143.670] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Lmgb8I1a1f1Z7viJR.flv", pszSpec="*.gzip") returned 0 [0143.671] lstrlenA (lpString="*.gzip") returned 6 [0143.671] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Lmgb8I1a1f1Z7viJR.flv", pszSpec="*.jpg") returned 0 [0143.671] lstrlenA (lpString="*.jpg") returned 5 [0143.671] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Lmgb8I1a1f1Z7viJR.flv", pszSpec="*.jpeg") returned 0 [0143.671] lstrlenA (lpString="*.jpeg") returned 6 [0143.671] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Lmgb8I1a1f1Z7viJR.flv", pszSpec="*.psd") returned 0 [0143.671] lstrlenA (lpString="*.psd") returned 5 [0143.671] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Lmgb8I1a1f1Z7viJR.flv", pszSpec="*.cdr") returned 0 [0143.671] lstrlenA (lpString="*.cdr") returned 5 [0143.671] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Lmgb8I1a1f1Z7viJR.flv", pszSpec="*.dwg") returned 0 [0143.671] lstrlenA (lpString="*.dwg") returned 5 [0143.671] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Lmgb8I1a1f1Z7viJR.flv", pszSpec="*.max") returned 0 [0143.671] lstrlenA (lpString="*.max") returned 5 [0143.671] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Lmgb8I1a1f1Z7viJR.flv", pszSpec="*.bmp") returned 0 [0143.671] lstrlenA (lpString="*.bmp") returned 5 [0143.671] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Lmgb8I1a1f1Z7viJR.flv", pszSpec="*.gif") returned 0 [0143.671] lstrlenA (lpString="*.gif") returned 5 [0143.671] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Lmgb8I1a1f1Z7viJR.flv", pszSpec="*.png") returned 0 [0143.671] lstrlenA (lpString="*.png") returned 5 [0143.671] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Lmgb8I1a1f1Z7viJR.flv", pszSpec="*.doc") returned 0 [0143.671] lstrlenA (lpString="*.doc") returned 5 [0143.671] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Lmgb8I1a1f1Z7viJR.flv", pszSpec="*.docx") returned 0 [0143.671] lstrlenA (lpString="*.docx") returned 6 [0143.671] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Lmgb8I1a1f1Z7viJR.flv", pszSpec="*.xls") returned 0 [0143.671] lstrlenA (lpString="*.xls") returned 5 [0143.671] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Lmgb8I1a1f1Z7viJR.flv", pszSpec="*.xlsx") returned 0 [0143.671] lstrlenA (lpString="*.xlsx") returned 6 [0143.671] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Lmgb8I1a1f1Z7viJR.flv", pszSpec="*.ppt") returned 0 [0143.671] lstrlenA (lpString="*.ppt") returned 5 [0143.671] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Lmgb8I1a1f1Z7viJR.flv", pszSpec="*.pptx") returned 0 [0143.671] lstrlenA (lpString="*.pptx") returned 6 [0143.671] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Lmgb8I1a1f1Z7viJR.flv", pszSpec="*.txt") returned 0 [0143.671] lstrlenA (lpString="*.txt") returned 5 [0143.671] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Lmgb8I1a1f1Z7viJR.flv", pszSpec="*.pdf") returned 0 [0143.671] lstrlenA (lpString="*.pdf") returned 5 [0143.671] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Lmgb8I1a1f1Z7viJR.flv", pszSpec="*.djvu") returned 0 [0143.671] lstrlenA (lpString="*.djvu") returned 6 [0143.671] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Lmgb8I1a1f1Z7viJR.flv", pszSpec="*.htm") returned 0 [0143.671] lstrlenA (lpString="*.htm") returned 5 [0143.671] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Lmgb8I1a1f1Z7viJR.flv", pszSpec="*.html") returned 0 [0143.671] lstrlenA (lpString="*.html") returned 6 [0143.671] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Lmgb8I1a1f1Z7viJR.flv", pszSpec="*.mdb") returned 0 [0143.671] lstrlenA (lpString="*.mdb") returned 5 [0143.671] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Lmgb8I1a1f1Z7viJR.flv", pszSpec="*.cer") returned 0 [0143.671] lstrlenA (lpString="*.cer") returned 5 [0143.671] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Lmgb8I1a1f1Z7viJR.flv", pszSpec="*.p12") returned 0 [0143.671] lstrlenA (lpString="*.p12") returned 5 [0143.671] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Lmgb8I1a1f1Z7viJR.flv", pszSpec="*.pfx") returned 0 [0143.671] lstrlenA (lpString="*.pfx") returned 5 [0143.672] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Lmgb8I1a1f1Z7viJR.flv", pszSpec="*.kwm") returned 0 [0143.672] lstrlenA (lpString="*.kwm") returned 5 [0143.672] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Lmgb8I1a1f1Z7viJR.flv", pszSpec="*.pwm") returned 0 [0143.672] lstrlenA (lpString="*.pwm") returned 5 [0143.672] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Lmgb8I1a1f1Z7viJR.flv", pszSpec="*.1cd") returned 0 [0143.672] lstrlenA (lpString="*.1cd") returned 5 [0143.672] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Lmgb8I1a1f1Z7viJR.flv", pszSpec="*.md") returned 0 [0143.672] lstrlenA (lpString="*.md") returned 4 [0143.672] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Lmgb8I1a1f1Z7viJR.flv", pszSpec="*.mdf") returned 0 [0143.672] lstrlenA (lpString="*.mdf") returned 5 [0143.672] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Lmgb8I1a1f1Z7viJR.flv", pszSpec="*.dbf") returned 0 [0143.672] lstrlenA (lpString="*.dbf") returned 5 [0143.672] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Lmgb8I1a1f1Z7viJR.flv", pszSpec="*.odt") returned 0 [0143.672] lstrlenA (lpString="*.odt") returned 5 [0143.672] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Lmgb8I1a1f1Z7viJR.flv", pszSpec="*.vob") returned 0 [0143.672] lstrlenA (lpString="*.vob") returned 5 [0143.672] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Lmgb8I1a1f1Z7viJR.flv", pszSpec="*.ifo") returned 0 [0143.672] lstrlenA (lpString="*.ifo") returned 5 [0143.672] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Lmgb8I1a1f1Z7viJR.flv", pszSpec="*.lnk") returned 0 [0143.672] lstrlenA (lpString="*.lnk") returned 5 [0143.672] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Lmgb8I1a1f1Z7viJR.flv", pszSpec="*.torrent") returned 0 [0143.672] lstrlenA (lpString="*.torrent") returned 9 [0143.672] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Lmgb8I1a1f1Z7viJR.flv", pszSpec="*.mov") returned 0 [0143.672] lstrlenA (lpString="*.mov") returned 5 [0143.672] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Lmgb8I1a1f1Z7viJR.flv", pszSpec="*.m2v") returned 0 [0143.672] lstrlenA (lpString="*.m2v") returned 5 [0143.672] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Lmgb8I1a1f1Z7viJR.flv", pszSpec="*.3gp") returned 0 [0143.672] lstrlenA (lpString="*.3gp") returned 5 [0143.672] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Lmgb8I1a1f1Z7viJR.flv", pszSpec="*.mpeg") returned 0 [0143.672] lstrlenA (lpString="*.mpeg") returned 6 [0143.672] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Lmgb8I1a1f1Z7viJR.flv", pszSpec="*.mpg") returned 0 [0143.672] lstrlenA (lpString="*.mpg") returned 5 [0143.672] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Lmgb8I1a1f1Z7viJR.flv", pszSpec="*.flv") returned 1 [0143.672] lstrlenA (lpString="*.flv") returned 5 [0143.672] lstrcpyA (in: lpString1=0x404950, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Lmgb8I1a1f1Z7viJR.flv" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Lmgb8I1a1f1Z7viJR.flv") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Lmgb8I1a1f1Z7viJR.flv" [0143.672] lstrcpyA (in: lpString1=0x405b50, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Lmgb8I1a1f1Z7viJR.flv" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Lmgb8I1a1f1Z7viJR.flv") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Lmgb8I1a1f1Z7viJR.flv" [0143.672] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Lmgb8I1a1f1Z7viJR.flv", lpString2="." | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Lmgb8I1a1f1Z7viJR.flv.") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Lmgb8I1a1f1Z7viJR.flv." [0143.672] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Lmgb8I1a1f1Z7viJR.flv.", lpString2="\xa0" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Lmgb8I1a1f1Z7viJR.flv. ") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Lmgb8I1a1f1Z7viJR.flv. " [0143.672] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Lmgb8I1a1f1Z7viJR.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\lmgb8i1a1f1z7vijr.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8c [0143.673] GetFileSize (in: hFile=0x8c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x185a2 [0143.673] GetFileTime (in: hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e | out: lpCreationTime=0x40752e*(dwLowDateTime=0xce59bad0, dwHighDateTime=0x1d49ea0), lpLastAccessTime=0x407536*(dwLowDateTime=0xaa42fb30, dwHighDateTime=0x1d4add6), lpLastWriteTime=0x40753e*(dwLowDateTime=0xaa42fb30, dwHighDateTime=0x1d4add6)) returned 1 [0143.673] SetFilePointer (in: hFile=0x8c, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0143.673] ReadFile (in: hFile=0x8c, lpBuffer=0x1ef0020, nNumberOfBytesToRead=0x1ad28d, lpNumberOfBytesRead=0x40655d, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesRead=0x40655d*=0x18548, lpOverlapped=0x0) returned 1 [0143.674] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Lmgb8I1a1f1Z7viJR.flv") returned="Lmgb8I1a1f1Z7viJR.flv" [0143.674] SetFilePointer (in: hFile=0x8c, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0143.674] WriteFile (in: hFile=0x8c, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x18548, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x18548, lpOverlapped=0x0) returned 1 [0143.674] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0143.674] CloseHandle (hObject=0x8c) returned 1 [0143.674] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Lmgb8I1a1f1Z7viJR.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\lmgb8i1a1f1z7vijr.flv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Lmgb8I1a1f1Z7viJR.flv. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\lmgb8i1a1f1z7vijr.flv. ")) returned 1 [0143.675] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0143.675] lstrcmpA (lpString1=".", lpString2="Macromedia") returned -1 [0143.675] lstrcmpA (lpString1="..", lpString2="Macromedia") returned -1 [0143.675] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Lmgb8I1a1f1Z7viJR.flv") returned="Lmgb8I1a1f1Z7viJR.flv" [0143.675] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\", lpString2="Macromedia" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia" [0143.676] lstrlenA (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia") returned 56 [0143.676] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0143.676] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0143.676] FindNextFileA (in: hFindFile=0x5be260, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0143.676] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0143.676] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0143.676] FindNextFileA (in: hFindFile=0x5be260, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0143.676] lstrcmpA (lpString1=".", lpString2="Flash Player") returned -1 [0143.676] lstrcmpA (lpString1="..", lpString2="Flash Player") returned -1 [0143.676] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\*.*") returned="*.*" [0143.676] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\", lpString2="Flash Player" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player" [0143.676] lstrlenA (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player") returned 69 [0143.676] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0143.676] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0143.676] FindNextFileA (in: hFindFile=0x5be2a0, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0143.676] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0143.676] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0143.676] FindNextFileA (in: hFindFile=0x5be2a0, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0143.676] lstrcmpA (lpString1=".", lpString2="#SharedObjects") returned 1 [0143.676] lstrcmpA (lpString1="..", lpString2="#SharedObjects") returned 1 [0143.676] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\*.*") returned="*.*" [0143.676] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\", lpString2="#SharedObjects" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects" [0143.676] lstrlenA (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects") returned 84 [0143.676] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\*.*", lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 0x5be2e0 [0143.677] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0143.677] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0143.677] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0143.677] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0143.677] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0143.677] lstrcmpA (lpString1=".", lpString2="P7Y3F7QB") returned -1 [0143.677] lstrcmpA (lpString1="..", lpString2="P7Y3F7QB") returned -1 [0143.677] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\*.*") returned="*.*" [0143.677] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\", lpString2="P7Y3F7QB" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\P7Y3F7QB") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\P7Y3F7QB" [0143.677] lstrlenA (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\P7Y3F7QB") returned 93 [0143.677] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\P7Y3F7QB\\*.*", lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 0x5be320 [0143.678] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0143.678] FindNextFileA (in: hFindFile=0x5be320, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0143.678] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0143.678] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0143.678] FindNextFileA (in: hFindFile=0x5be320, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 0 [0143.678] FindClose (in: hFindFile=0x5be320 | out: hFindFile=0x5be320) returned 1 [0143.678] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 0 [0143.678] FindClose (in: hFindFile=0x5be2e0 | out: hFindFile=0x5be2e0) returned 1 [0143.678] FindNextFileA (in: hFindFile=0x5be2a0, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0143.678] lstrcmpA (lpString1=".", lpString2="macromedia.com") returned -1 [0143.678] lstrcmpA (lpString1="..", lpString2="macromedia.com") returned -1 [0143.678] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\*.*") returned="*.*" [0143.678] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\", lpString2="macromedia.com" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com" [0143.678] lstrlenA (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com") returned 84 [0143.678] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\*.*", lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 0x5be2e0 [0143.678] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0143.678] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0143.678] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0143.678] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0143.678] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0143.678] lstrcmpA (lpString1=".", lpString2="support") returned -1 [0143.678] lstrcmpA (lpString1="..", lpString2="support") returned -1 [0143.678] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\*.*") returned="*.*" [0143.678] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\", lpString2="support" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support" [0143.678] lstrlenA (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support") returned 92 [0143.678] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\*.*", lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 0x5be320 [0143.679] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0143.679] FindNextFileA (in: hFindFile=0x5be320, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0143.679] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0143.679] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0143.679] FindNextFileA (in: hFindFile=0x5be320, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0143.679] lstrcmpA (lpString1=".", lpString2="flashplayer") returned -1 [0143.679] lstrcmpA (lpString1="..", lpString2="flashplayer") returned -1 [0143.679] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\*.*") returned="*.*" [0143.679] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\", lpString2="flashplayer" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer" [0143.679] lstrlenA (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer") returned 104 [0143.679] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\*.*", lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 0x5be360 [0143.680] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0143.680] FindNextFileA (in: hFindFile=0x5be360, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 1 [0143.680] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0143.680] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0143.680] FindNextFileA (in: hFindFile=0x5be360, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 1 [0143.680] lstrcmpA (lpString1=".", lpString2="sys") returned -1 [0143.680] lstrcmpA (lpString1="..", lpString2="sys") returned -1 [0143.680] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\*.*") returned="*.*" [0143.680] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\", lpString2="sys" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys" [0143.680] lstrlenA (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys") returned 108 [0143.680] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\*.*", lpFindFileData=0xaea68 | out: lpFindFileData=0xaea68) returned 0x5be3a0 [0143.680] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0143.680] FindNextFileA (in: hFindFile=0x5be3a0, lpFindFileData=0xaea68 | out: lpFindFileData=0xaea68) returned 1 [0143.680] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0143.680] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0143.680] FindNextFileA (in: hFindFile=0x5be3a0, lpFindFileData=0xaea68 | out: lpFindFileData=0xaea68) returned 1 [0143.680] PeekMessageA (in: lpMsg=0xaea44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaea44) returned 0 [0143.680] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="settings.sol") returned -1 [0143.680] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="settings.sol") returned -1 [0143.680] lstrcmpiA (lpString1="", lpString2="settings.sol") returned -1 [0143.681] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\*.*") returned="*.*" [0143.681] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\", lpString2="settings.sol" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\settings.sol") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\settings.sol" [0143.681] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\settings.sol", pszSpec="*.zip") returned 0 [0143.681] lstrlenA (lpString="*.zip") returned 5 [0143.681] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\settings.sol", pszSpec="*.rar") returned 0 [0143.681] lstrlenA (lpString="*.rar") returned 5 [0143.681] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\settings.sol", pszSpec="*.7z") returned 0 [0143.681] lstrlenA (lpString="*.7z") returned 4 [0143.681] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\settings.sol", pszSpec="*.tar") returned 0 [0143.681] lstrlenA (lpString="*.tar") returned 5 [0143.681] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\settings.sol", pszSpec="*.gzip") returned 0 [0143.681] lstrlenA (lpString="*.gzip") returned 6 [0143.681] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\settings.sol", pszSpec="*.jpg") returned 0 [0143.681] lstrlenA (lpString="*.jpg") returned 5 [0143.681] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\settings.sol", pszSpec="*.jpeg") returned 0 [0143.681] lstrlenA (lpString="*.jpeg") returned 6 [0143.681] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\settings.sol", pszSpec="*.psd") returned 0 [0143.681] lstrlenA (lpString="*.psd") returned 5 [0143.681] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\settings.sol", pszSpec="*.cdr") returned 0 [0143.681] lstrlenA (lpString="*.cdr") returned 5 [0143.681] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\settings.sol", pszSpec="*.dwg") returned 0 [0143.681] lstrlenA (lpString="*.dwg") returned 5 [0143.681] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\settings.sol", pszSpec="*.max") returned 0 [0143.681] lstrlenA (lpString="*.max") returned 5 [0143.681] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\settings.sol", pszSpec="*.bmp") returned 0 [0143.681] lstrlenA (lpString="*.bmp") returned 5 [0143.681] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\settings.sol", pszSpec="*.gif") returned 0 [0143.681] lstrlenA (lpString="*.gif") returned 5 [0143.681] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\settings.sol", pszSpec="*.png") returned 0 [0143.681] lstrlenA (lpString="*.png") returned 5 [0143.681] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\settings.sol", pszSpec="*.doc") returned 0 [0143.681] lstrlenA (lpString="*.doc") returned 5 [0143.681] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\settings.sol", pszSpec="*.docx") returned 0 [0143.681] lstrlenA (lpString="*.docx") returned 6 [0143.681] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\settings.sol", pszSpec="*.xls") returned 0 [0143.681] lstrlenA (lpString="*.xls") returned 5 [0143.681] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\settings.sol", pszSpec="*.xlsx") returned 0 [0143.681] lstrlenA (lpString="*.xlsx") returned 6 [0143.681] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\settings.sol", pszSpec="*.ppt") returned 0 [0143.681] lstrlenA (lpString="*.ppt") returned 5 [0143.681] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\settings.sol", pszSpec="*.pptx") returned 0 [0143.681] lstrlenA (lpString="*.pptx") returned 6 [0143.682] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\settings.sol", pszSpec="*.txt") returned 0 [0143.682] lstrlenA (lpString="*.txt") returned 5 [0143.682] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\settings.sol", pszSpec="*.pdf") returned 0 [0143.682] lstrlenA (lpString="*.pdf") returned 5 [0143.682] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\settings.sol", pszSpec="*.djvu") returned 0 [0143.682] lstrlenA (lpString="*.djvu") returned 6 [0143.682] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\settings.sol", pszSpec="*.htm") returned 0 [0143.682] lstrlenA (lpString="*.htm") returned 5 [0143.682] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\settings.sol", pszSpec="*.html") returned 0 [0143.682] lstrlenA (lpString="*.html") returned 6 [0143.682] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\settings.sol", pszSpec="*.mdb") returned 0 [0143.682] lstrlenA (lpString="*.mdb") returned 5 [0143.682] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\settings.sol", pszSpec="*.cer") returned 0 [0143.682] lstrlenA (lpString="*.cer") returned 5 [0143.682] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\settings.sol", pszSpec="*.p12") returned 0 [0143.682] lstrlenA (lpString="*.p12") returned 5 [0143.682] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\settings.sol", pszSpec="*.pfx") returned 0 [0143.682] lstrlenA (lpString="*.pfx") returned 5 [0143.682] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\settings.sol", pszSpec="*.kwm") returned 0 [0143.682] lstrlenA (lpString="*.kwm") returned 5 [0143.682] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\settings.sol", pszSpec="*.pwm") returned 0 [0143.682] lstrlenA (lpString="*.pwm") returned 5 [0143.682] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\settings.sol", pszSpec="*.1cd") returned 0 [0143.682] lstrlenA (lpString="*.1cd") returned 5 [0143.682] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\settings.sol", pszSpec="*.md") returned 0 [0143.682] lstrlenA (lpString="*.md") returned 4 [0143.682] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\settings.sol", pszSpec="*.mdf") returned 0 [0143.682] lstrlenA (lpString="*.mdf") returned 5 [0143.682] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\settings.sol", pszSpec="*.dbf") returned 0 [0143.682] lstrlenA (lpString="*.dbf") returned 5 [0143.682] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\settings.sol", pszSpec="*.odt") returned 0 [0143.682] lstrlenA (lpString="*.odt") returned 5 [0143.682] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\settings.sol", pszSpec="*.vob") returned 0 [0143.682] lstrlenA (lpString="*.vob") returned 5 [0143.682] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\settings.sol", pszSpec="*.ifo") returned 0 [0143.682] lstrlenA (lpString="*.ifo") returned 5 [0143.682] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\settings.sol", pszSpec="*.lnk") returned 0 [0143.682] lstrlenA (lpString="*.lnk") returned 5 [0143.682] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\settings.sol", pszSpec="*.torrent") returned 0 [0143.682] lstrlenA (lpString="*.torrent") returned 9 [0143.682] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\settings.sol", pszSpec="*.mov") returned 0 [0143.682] lstrlenA (lpString="*.mov") returned 5 [0143.682] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\settings.sol", pszSpec="*.m2v") returned 0 [0143.682] lstrlenA (lpString="*.m2v") returned 5 [0143.682] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\settings.sol", pszSpec="*.3gp") returned 0 [0143.682] lstrlenA (lpString="*.3gp") returned 5 [0143.682] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\settings.sol", pszSpec="*.mpeg") returned 0 [0143.682] lstrlenA (lpString="*.mpeg") returned 6 [0143.683] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\settings.sol", pszSpec="*.mpg") returned 0 [0143.683] lstrlenA (lpString="*.mpg") returned 5 [0143.683] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\settings.sol", pszSpec="*.flv") returned 0 [0143.683] lstrlenA (lpString="*.flv") returned 5 [0143.683] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\settings.sol", pszSpec="*.avi") returned 0 [0143.683] lstrlenA (lpString="*.avi") returned 5 [0143.683] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\settings.sol", pszSpec="*.mp4") returned 0 [0143.683] lstrlenA (lpString="*.mp4") returned 5 [0143.683] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\settings.sol", pszSpec="*.wmv") returned 0 [0143.683] lstrlenA (lpString="*.wmv") returned 5 [0143.683] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\settings.sol", pszSpec="*.divx") returned 0 [0143.683] lstrlenA (lpString="*.divx") returned 6 [0143.683] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\settings.sol", pszSpec="*.mkv") returned 0 [0143.683] lstrlenA (lpString="*.mkv") returned 5 [0143.683] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\settings.sol", pszSpec="*.mp3") returned 0 [0143.683] lstrlenA (lpString="*.mp3") returned 5 [0143.683] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\settings.sol", pszSpec="*.wav") returned 0 [0143.683] lstrlenA (lpString="*.wav") returned 5 [0143.683] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\settings.sol", pszSpec="*.flac") returned 0 [0143.683] lstrlenA (lpString="*.flac") returned 6 [0143.683] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\settings.sol", pszSpec="*.ape") returned 0 [0143.683] lstrlenA (lpString="*.ape") returned 5 [0143.683] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\settings.sol", pszSpec="*.wma") returned 0 [0143.683] lstrlenA (lpString="*.wma") returned 5 [0143.683] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\settings.sol", pszSpec="*.ac3") returned 0 [0143.683] lstrlenA (lpString="*.ac3") returned 5 [0143.683] FindNextFileA (in: hFindFile=0x5be3a0, lpFindFileData=0xaea68 | out: lpFindFileData=0xaea68) returned 0 [0143.683] FindClose (in: hFindFile=0x5be3a0 | out: hFindFile=0x5be3a0) returned 1 [0143.683] FindNextFileA (in: hFindFile=0x5be360, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 0 [0143.683] FindClose (in: hFindFile=0x5be360 | out: hFindFile=0x5be360) returned 1 [0143.683] FindNextFileA (in: hFindFile=0x5be320, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 0 [0143.683] FindClose (in: hFindFile=0x5be320 | out: hFindFile=0x5be320) returned 1 [0143.683] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 0 [0143.683] FindClose (in: hFindFile=0x5be2e0 | out: hFindFile=0x5be2e0) returned 1 [0143.683] FindNextFileA (in: hFindFile=0x5be2a0, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0 [0143.683] FindClose (in: hFindFile=0x5be2a0 | out: hFindFile=0x5be2a0) returned 1 [0143.683] FindNextFileA (in: hFindFile=0x5be260, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0 [0143.683] FindClose (in: hFindFile=0x5be260 | out: hFindFile=0x5be260) returned 1 [0143.684] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0143.684] lstrcmpA (lpString1=".", lpString2="Microsoft") returned -1 [0143.684] lstrcmpA (lpString1="..", lpString2="Microsoft") returned -1 [0143.684] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\*.*") returned="*.*" [0143.684] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\", lpString2="Microsoft" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft" [0143.684] lstrlenA (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft") returned 55 [0143.684] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0143.684] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0143.684] FindNextFileA (in: hFindFile=0x5be260, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0143.684] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0143.684] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0143.684] FindNextFileA (in: hFindFile=0x5be260, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0143.684] lstrcmpA (lpString1=".", lpString2="AddIns") returned -1 [0143.684] lstrcmpA (lpString1="..", lpString2="AddIns") returned -1 [0143.684] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\*.*") returned="*.*" [0143.684] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\", lpString2="AddIns" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\AddIns") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\AddIns" [0143.684] lstrlenA (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\AddIns") returned 62 [0143.684] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\AddIns\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0143.685] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0143.685] FindNextFileA (in: hFindFile=0x5be2a0, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0143.685] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0143.685] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0143.685] FindNextFileA (in: hFindFile=0x5be2a0, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0 [0143.685] FindClose (in: hFindFile=0x5be2a0 | out: hFindFile=0x5be2a0) returned 1 [0143.685] FindNextFileA (in: hFindFile=0x5be260, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0143.685] lstrcmpA (lpString1=".", lpString2="Credentials") returned -1 [0143.685] lstrcmpA (lpString1="..", lpString2="Credentials") returned -1 [0143.685] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\*.*") returned="*.*" [0143.685] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\", lpString2="Credentials" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Credentials") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Credentials" [0143.685] lstrlenA (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Credentials") returned 67 [0143.685] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Credentials\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0143.685] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0143.685] FindNextFileA (in: hFindFile=0x5be2a0, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0143.685] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0143.685] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0143.685] FindNextFileA (in: hFindFile=0x5be2a0, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0 [0143.685] FindClose (in: hFindFile=0x5be2a0 | out: hFindFile=0x5be2a0) returned 1 [0143.686] FindNextFileA (in: hFindFile=0x5be260, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0143.686] lstrcmpA (lpString1=".", lpString2="Crypto") returned -1 [0143.686] lstrcmpA (lpString1="..", lpString2="Crypto") returned -1 [0143.686] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\*.*") returned="*.*" [0143.686] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\", lpString2="Crypto" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto" [0143.686] lstrlenA (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto") returned 62 [0143.686] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0143.686] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0143.686] FindNextFileA (in: hFindFile=0x5be2a0, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0143.686] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0143.686] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0143.686] FindNextFileA (in: hFindFile=0x5be2a0, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0143.686] lstrcmpA (lpString1=".", lpString2="RSA") returned -1 [0143.686] lstrcmpA (lpString1="..", lpString2="RSA") returned -1 [0143.686] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\*.*") returned="*.*" [0143.686] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\", lpString2="RSA" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA" [0143.686] lstrlenA (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA") returned 66 [0143.686] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\*.*", lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 0x5be2e0 [0143.686] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0143.686] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0143.686] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0143.686] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0143.686] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0143.686] lstrcmpA (lpString1=".", lpString2="S-1-5-21-3388679973-3930757225-3770151564-1000") returned -1 [0143.686] lstrcmpA (lpString1="..", lpString2="S-1-5-21-3388679973-3930757225-3770151564-1000") returned -1 [0143.687] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\*.*") returned="*.*" [0143.687] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\", lpString2="S-1-5-21-3388679973-3930757225-3770151564-1000" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000" [0143.687] lstrlenA (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000") returned 113 [0143.687] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\*.*", lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 0x5be320 [0143.812] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0143.812] FindNextFileA (in: hFindFile=0x5be320, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0143.812] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0143.812] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0143.812] FindNextFileA (in: hFindFile=0x5be320, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0143.812] PeekMessageA (in: lpMsg=0xaece4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaece4) returned 0 [0143.812] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="83aa4cc77f591dfc2374580bbd95f6ba_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f") returned 1 [0143.812] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="83aa4cc77f591dfc2374580bbd95f6ba_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f") returned 1 [0143.812] lstrcmpiA (lpString1="", lpString2="83aa4cc77f591dfc2374580bbd95f6ba_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f") returned -1 [0143.812] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\*.*") returned="*.*" [0143.812] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\", lpString2="83aa4cc77f591dfc2374580bbd95f6ba_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\83aa4cc77f591dfc2374580bbd95f6ba_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\83aa4cc77f591dfc2374580bbd95f6ba_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f" [0143.812] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\83aa4cc77f591dfc2374580bbd95f6ba_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.zip") returned 0 [0143.813] lstrlenA (lpString="*.zip") returned 5 [0143.813] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\83aa4cc77f591dfc2374580bbd95f6ba_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.rar") returned 0 [0143.813] lstrlenA (lpString="*.rar") returned 5 [0143.813] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\83aa4cc77f591dfc2374580bbd95f6ba_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.7z") returned 0 [0143.813] lstrlenA (lpString="*.7z") returned 4 [0143.813] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\83aa4cc77f591dfc2374580bbd95f6ba_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.tar") returned 0 [0143.813] lstrlenA (lpString="*.tar") returned 5 [0143.813] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\83aa4cc77f591dfc2374580bbd95f6ba_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.gzip") returned 0 [0143.813] lstrlenA (lpString="*.gzip") returned 6 [0143.813] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\83aa4cc77f591dfc2374580bbd95f6ba_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.jpg") returned 0 [0143.813] lstrlenA (lpString="*.jpg") returned 5 [0143.813] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\83aa4cc77f591dfc2374580bbd95f6ba_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.jpeg") returned 0 [0143.813] lstrlenA (lpString="*.jpeg") returned 6 [0143.813] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\83aa4cc77f591dfc2374580bbd95f6ba_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.psd") returned 0 [0143.813] lstrlenA (lpString="*.psd") returned 5 [0143.813] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\83aa4cc77f591dfc2374580bbd95f6ba_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.cdr") returned 0 [0143.813] lstrlenA (lpString="*.cdr") returned 5 [0143.813] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\83aa4cc77f591dfc2374580bbd95f6ba_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.dwg") returned 0 [0143.813] lstrlenA (lpString="*.dwg") returned 5 [0143.813] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\83aa4cc77f591dfc2374580bbd95f6ba_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.max") returned 0 [0143.813] lstrlenA (lpString="*.max") returned 5 [0143.813] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\83aa4cc77f591dfc2374580bbd95f6ba_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.bmp") returned 0 [0143.813] lstrlenA (lpString="*.bmp") returned 5 [0143.813] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\83aa4cc77f591dfc2374580bbd95f6ba_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.gif") returned 0 [0143.813] lstrlenA (lpString="*.gif") returned 5 [0143.814] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\83aa4cc77f591dfc2374580bbd95f6ba_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.png") returned 0 [0143.814] lstrlenA (lpString="*.png") returned 5 [0143.814] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\83aa4cc77f591dfc2374580bbd95f6ba_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.doc") returned 0 [0143.814] lstrlenA (lpString="*.doc") returned 5 [0143.814] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\83aa4cc77f591dfc2374580bbd95f6ba_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.docx") returned 0 [0143.814] lstrlenA (lpString="*.docx") returned 6 [0143.814] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\83aa4cc77f591dfc2374580bbd95f6ba_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.xls") returned 0 [0143.814] lstrlenA (lpString="*.xls") returned 5 [0143.814] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\83aa4cc77f591dfc2374580bbd95f6ba_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.xlsx") returned 0 [0143.814] lstrlenA (lpString="*.xlsx") returned 6 [0143.814] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\83aa4cc77f591dfc2374580bbd95f6ba_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.ppt") returned 0 [0143.814] lstrlenA (lpString="*.ppt") returned 5 [0143.814] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\83aa4cc77f591dfc2374580bbd95f6ba_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.pptx") returned 0 [0143.814] lstrlenA (lpString="*.pptx") returned 6 [0143.814] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\83aa4cc77f591dfc2374580bbd95f6ba_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.txt") returned 0 [0143.814] lstrlenA (lpString="*.txt") returned 5 [0143.814] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\83aa4cc77f591dfc2374580bbd95f6ba_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.pdf") returned 0 [0143.814] lstrlenA (lpString="*.pdf") returned 5 [0143.814] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\83aa4cc77f591dfc2374580bbd95f6ba_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.djvu") returned 0 [0143.814] lstrlenA (lpString="*.djvu") returned 6 [0143.814] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\83aa4cc77f591dfc2374580bbd95f6ba_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.htm") returned 0 [0143.814] lstrlenA (lpString="*.htm") returned 5 [0143.814] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\83aa4cc77f591dfc2374580bbd95f6ba_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.html") returned 0 [0143.814] lstrlenA (lpString="*.html") returned 6 [0143.814] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\83aa4cc77f591dfc2374580bbd95f6ba_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.mdb") returned 0 [0143.814] lstrlenA (lpString="*.mdb") returned 5 [0143.814] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\83aa4cc77f591dfc2374580bbd95f6ba_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.cer") returned 0 [0143.814] lstrlenA (lpString="*.cer") returned 5 [0143.814] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\83aa4cc77f591dfc2374580bbd95f6ba_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.p12") returned 0 [0143.814] lstrlenA (lpString="*.p12") returned 5 [0143.815] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\83aa4cc77f591dfc2374580bbd95f6ba_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.pfx") returned 0 [0143.815] lstrlenA (lpString="*.pfx") returned 5 [0143.815] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\83aa4cc77f591dfc2374580bbd95f6ba_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.kwm") returned 0 [0143.815] lstrlenA (lpString="*.kwm") returned 5 [0143.815] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\83aa4cc77f591dfc2374580bbd95f6ba_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.pwm") returned 0 [0143.815] lstrlenA (lpString="*.pwm") returned 5 [0143.815] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\83aa4cc77f591dfc2374580bbd95f6ba_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.1cd") returned 0 [0143.815] lstrlenA (lpString="*.1cd") returned 5 [0143.815] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\83aa4cc77f591dfc2374580bbd95f6ba_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.md") returned 0 [0143.815] lstrlenA (lpString="*.md") returned 4 [0143.815] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\83aa4cc77f591dfc2374580bbd95f6ba_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.mdf") returned 0 [0143.815] lstrlenA (lpString="*.mdf") returned 5 [0143.815] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\83aa4cc77f591dfc2374580bbd95f6ba_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.dbf") returned 0 [0143.815] lstrlenA (lpString="*.dbf") returned 5 [0143.815] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\83aa4cc77f591dfc2374580bbd95f6ba_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.odt") returned 0 [0143.815] lstrlenA (lpString="*.odt") returned 5 [0143.815] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\83aa4cc77f591dfc2374580bbd95f6ba_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.vob") returned 0 [0143.815] lstrlenA (lpString="*.vob") returned 5 [0143.815] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\83aa4cc77f591dfc2374580bbd95f6ba_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.ifo") returned 0 [0143.815] lstrlenA (lpString="*.ifo") returned 5 [0143.815] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\83aa4cc77f591dfc2374580bbd95f6ba_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.lnk") returned 0 [0143.815] lstrlenA (lpString="*.lnk") returned 5 [0143.815] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\83aa4cc77f591dfc2374580bbd95f6ba_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.torrent") returned 0 [0143.815] lstrlenA (lpString="*.torrent") returned 9 [0143.815] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\83aa4cc77f591dfc2374580bbd95f6ba_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.mov") returned 0 [0143.815] lstrlenA (lpString="*.mov") returned 5 [0143.815] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\83aa4cc77f591dfc2374580bbd95f6ba_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.m2v") returned 0 [0143.815] lstrlenA (lpString="*.m2v") returned 5 [0143.815] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\83aa4cc77f591dfc2374580bbd95f6ba_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.3gp") returned 0 [0143.816] lstrlenA (lpString="*.3gp") returned 5 [0143.816] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\83aa4cc77f591dfc2374580bbd95f6ba_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.mpeg") returned 0 [0143.816] lstrlenA (lpString="*.mpeg") returned 6 [0143.816] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\83aa4cc77f591dfc2374580bbd95f6ba_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.mpg") returned 0 [0143.816] lstrlenA (lpString="*.mpg") returned 5 [0143.816] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\83aa4cc77f591dfc2374580bbd95f6ba_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.flv") returned 0 [0143.816] lstrlenA (lpString="*.flv") returned 5 [0143.816] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\83aa4cc77f591dfc2374580bbd95f6ba_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.avi") returned 0 [0143.816] lstrlenA (lpString="*.avi") returned 5 [0143.816] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\83aa4cc77f591dfc2374580bbd95f6ba_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.mp4") returned 0 [0143.816] lstrlenA (lpString="*.mp4") returned 5 [0143.816] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\83aa4cc77f591dfc2374580bbd95f6ba_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.wmv") returned 0 [0143.816] lstrlenA (lpString="*.wmv") returned 5 [0143.816] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\83aa4cc77f591dfc2374580bbd95f6ba_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.divx") returned 0 [0143.816] lstrlenA (lpString="*.divx") returned 6 [0143.816] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\83aa4cc77f591dfc2374580bbd95f6ba_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.mkv") returned 0 [0143.816] lstrlenA (lpString="*.mkv") returned 5 [0143.816] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\83aa4cc77f591dfc2374580bbd95f6ba_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.mp3") returned 0 [0143.816] lstrlenA (lpString="*.mp3") returned 5 [0143.816] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\83aa4cc77f591dfc2374580bbd95f6ba_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.wav") returned 0 [0143.816] lstrlenA (lpString="*.wav") returned 5 [0143.816] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\83aa4cc77f591dfc2374580bbd95f6ba_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.flac") returned 0 [0143.816] lstrlenA (lpString="*.flac") returned 6 [0143.816] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\83aa4cc77f591dfc2374580bbd95f6ba_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.ape") returned 0 [0143.816] lstrlenA (lpString="*.ape") returned 5 [0143.816] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\83aa4cc77f591dfc2374580bbd95f6ba_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.wma") returned 0 [0143.816] lstrlenA (lpString="*.wma") returned 5 [0143.816] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\83aa4cc77f591dfc2374580bbd95f6ba_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.ac3") returned 0 [0143.816] lstrlenA (lpString="*.ac3") returned 5 [0143.817] FindNextFileA (in: hFindFile=0x5be320, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0143.817] PeekMessageA (in: lpMsg=0xaece4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaece4) returned 0 [0143.817] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="932a2db58c237abd381d22df4c63a04a_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f") returned 1 [0143.817] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="932a2db58c237abd381d22df4c63a04a_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f") returned 1 [0143.817] lstrcmpiA (lpString1="", lpString2="932a2db58c237abd381d22df4c63a04a_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f") returned -1 [0143.817] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\83aa4cc77f591dfc2374580bbd95f6ba_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f") returned="83aa4cc77f591dfc2374580bbd95f6ba_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f" [0143.817] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\", lpString2="932a2db58c237abd381d22df4c63a04a_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\932a2db58c237abd381d22df4c63a04a_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\932a2db58c237abd381d22df4c63a04a_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f" [0143.817] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\932a2db58c237abd381d22df4c63a04a_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.zip") returned 0 [0143.817] lstrlenA (lpString="*.zip") returned 5 [0143.817] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\932a2db58c237abd381d22df4c63a04a_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.rar") returned 0 [0143.817] lstrlenA (lpString="*.rar") returned 5 [0143.817] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\932a2db58c237abd381d22df4c63a04a_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.7z") returned 0 [0143.817] lstrlenA (lpString="*.7z") returned 4 [0143.817] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\932a2db58c237abd381d22df4c63a04a_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.tar") returned 0 [0143.817] lstrlenA (lpString="*.tar") returned 5 [0143.817] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\932a2db58c237abd381d22df4c63a04a_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.gzip") returned 0 [0143.817] lstrlenA (lpString="*.gzip") returned 6 [0143.817] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\932a2db58c237abd381d22df4c63a04a_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.jpg") returned 0 [0143.817] lstrlenA (lpString="*.jpg") returned 5 [0143.817] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\932a2db58c237abd381d22df4c63a04a_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.jpeg") returned 0 [0143.817] lstrlenA (lpString="*.jpeg") returned 6 [0143.817] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\932a2db58c237abd381d22df4c63a04a_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.psd") returned 0 [0143.817] lstrlenA (lpString="*.psd") returned 5 [0143.818] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\932a2db58c237abd381d22df4c63a04a_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.cdr") returned 0 [0143.818] lstrlenA (lpString="*.cdr") returned 5 [0143.818] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\932a2db58c237abd381d22df4c63a04a_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.dwg") returned 0 [0143.818] lstrlenA (lpString="*.dwg") returned 5 [0143.818] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\932a2db58c237abd381d22df4c63a04a_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.max") returned 0 [0143.818] lstrlenA (lpString="*.max") returned 5 [0143.818] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\932a2db58c237abd381d22df4c63a04a_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.bmp") returned 0 [0143.818] lstrlenA (lpString="*.bmp") returned 5 [0143.818] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\932a2db58c237abd381d22df4c63a04a_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.gif") returned 0 [0143.818] lstrlenA (lpString="*.gif") returned 5 [0143.818] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\932a2db58c237abd381d22df4c63a04a_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.png") returned 0 [0143.818] lstrlenA (lpString="*.png") returned 5 [0143.818] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\932a2db58c237abd381d22df4c63a04a_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.doc") returned 0 [0143.818] lstrlenA (lpString="*.doc") returned 5 [0143.818] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\932a2db58c237abd381d22df4c63a04a_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.docx") returned 0 [0143.818] lstrlenA (lpString="*.docx") returned 6 [0143.818] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\932a2db58c237abd381d22df4c63a04a_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.xls") returned 0 [0143.818] lstrlenA (lpString="*.xls") returned 5 [0143.818] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\932a2db58c237abd381d22df4c63a04a_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.xlsx") returned 0 [0143.818] lstrlenA (lpString="*.xlsx") returned 6 [0143.818] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\932a2db58c237abd381d22df4c63a04a_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.ppt") returned 0 [0143.818] lstrlenA (lpString="*.ppt") returned 5 [0143.818] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\932a2db58c237abd381d22df4c63a04a_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.pptx") returned 0 [0143.818] lstrlenA (lpString="*.pptx") returned 6 [0143.818] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\932a2db58c237abd381d22df4c63a04a_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.txt") returned 0 [0143.818] lstrlenA (lpString="*.txt") returned 5 [0143.818] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\932a2db58c237abd381d22df4c63a04a_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.pdf") returned 0 [0143.818] lstrlenA (lpString="*.pdf") returned 5 [0143.818] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\932a2db58c237abd381d22df4c63a04a_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.djvu") returned 0 [0143.818] lstrlenA (lpString="*.djvu") returned 6 [0143.819] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\932a2db58c237abd381d22df4c63a04a_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.htm") returned 0 [0143.819] lstrlenA (lpString="*.htm") returned 5 [0143.819] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\932a2db58c237abd381d22df4c63a04a_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.html") returned 0 [0143.819] lstrlenA (lpString="*.html") returned 6 [0143.819] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\932a2db58c237abd381d22df4c63a04a_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.mdb") returned 0 [0143.819] lstrlenA (lpString="*.mdb") returned 5 [0143.819] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\932a2db58c237abd381d22df4c63a04a_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.cer") returned 0 [0143.819] lstrlenA (lpString="*.cer") returned 5 [0143.819] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\932a2db58c237abd381d22df4c63a04a_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.p12") returned 0 [0143.819] lstrlenA (lpString="*.p12") returned 5 [0143.819] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\932a2db58c237abd381d22df4c63a04a_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.pfx") returned 0 [0143.819] lstrlenA (lpString="*.pfx") returned 5 [0143.819] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\932a2db58c237abd381d22df4c63a04a_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.kwm") returned 0 [0143.819] lstrlenA (lpString="*.kwm") returned 5 [0143.819] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\932a2db58c237abd381d22df4c63a04a_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.pwm") returned 0 [0143.819] lstrlenA (lpString="*.pwm") returned 5 [0143.819] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\932a2db58c237abd381d22df4c63a04a_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.1cd") returned 0 [0143.819] lstrlenA (lpString="*.1cd") returned 5 [0143.819] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\932a2db58c237abd381d22df4c63a04a_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.md") returned 0 [0143.819] lstrlenA (lpString="*.md") returned 4 [0143.819] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\932a2db58c237abd381d22df4c63a04a_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.mdf") returned 0 [0143.819] lstrlenA (lpString="*.mdf") returned 5 [0143.819] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\932a2db58c237abd381d22df4c63a04a_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.dbf") returned 0 [0143.819] lstrlenA (lpString="*.dbf") returned 5 [0143.819] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\932a2db58c237abd381d22df4c63a04a_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.odt") returned 0 [0143.819] lstrlenA (lpString="*.odt") returned 5 [0143.819] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\932a2db58c237abd381d22df4c63a04a_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.vob") returned 0 [0143.819] lstrlenA (lpString="*.vob") returned 5 [0143.820] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\932a2db58c237abd381d22df4c63a04a_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.ifo") returned 0 [0143.820] lstrlenA (lpString="*.ifo") returned 5 [0143.820] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\932a2db58c237abd381d22df4c63a04a_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.lnk") returned 0 [0143.820] lstrlenA (lpString="*.lnk") returned 5 [0143.820] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\932a2db58c237abd381d22df4c63a04a_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.torrent") returned 0 [0143.820] lstrlenA (lpString="*.torrent") returned 9 [0143.820] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\932a2db58c237abd381d22df4c63a04a_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.mov") returned 0 [0143.820] lstrlenA (lpString="*.mov") returned 5 [0143.820] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\932a2db58c237abd381d22df4c63a04a_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.m2v") returned 0 [0143.820] lstrlenA (lpString="*.m2v") returned 5 [0143.820] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\932a2db58c237abd381d22df4c63a04a_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.3gp") returned 0 [0143.820] lstrlenA (lpString="*.3gp") returned 5 [0143.820] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\932a2db58c237abd381d22df4c63a04a_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.mpeg") returned 0 [0143.820] lstrlenA (lpString="*.mpeg") returned 6 [0143.820] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\932a2db58c237abd381d22df4c63a04a_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.mpg") returned 0 [0143.820] lstrlenA (lpString="*.mpg") returned 5 [0143.820] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\932a2db58c237abd381d22df4c63a04a_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.flv") returned 0 [0143.820] lstrlenA (lpString="*.flv") returned 5 [0143.820] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\932a2db58c237abd381d22df4c63a04a_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.avi") returned 0 [0143.820] lstrlenA (lpString="*.avi") returned 5 [0143.820] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\932a2db58c237abd381d22df4c63a04a_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.mp4") returned 0 [0143.820] lstrlenA (lpString="*.mp4") returned 5 [0143.820] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\932a2db58c237abd381d22df4c63a04a_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.wmv") returned 0 [0143.820] lstrlenA (lpString="*.wmv") returned 5 [0143.820] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\932a2db58c237abd381d22df4c63a04a_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.divx") returned 0 [0143.820] lstrlenA (lpString="*.divx") returned 6 [0143.820] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\932a2db58c237abd381d22df4c63a04a_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.mkv") returned 0 [0143.820] lstrlenA (lpString="*.mkv") returned 5 [0143.821] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\932a2db58c237abd381d22df4c63a04a_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.mp3") returned 0 [0143.821] lstrlenA (lpString="*.mp3") returned 5 [0143.821] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\932a2db58c237abd381d22df4c63a04a_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.wav") returned 0 [0143.821] lstrlenA (lpString="*.wav") returned 5 [0143.821] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\932a2db58c237abd381d22df4c63a04a_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.flac") returned 0 [0143.821] lstrlenA (lpString="*.flac") returned 6 [0143.821] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\932a2db58c237abd381d22df4c63a04a_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.ape") returned 0 [0143.821] lstrlenA (lpString="*.ape") returned 5 [0143.821] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\932a2db58c237abd381d22df4c63a04a_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.wma") returned 0 [0143.821] lstrlenA (lpString="*.wma") returned 5 [0143.821] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\932a2db58c237abd381d22df4c63a04a_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.ac3") returned 0 [0143.821] lstrlenA (lpString="*.ac3") returned 5 [0143.821] FindNextFileA (in: hFindFile=0x5be320, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0143.821] PeekMessageA (in: lpMsg=0xaece4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaece4) returned 0 [0143.821] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="fda992c8d564f97e48410a19a2e459f6_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f") returned -1 [0143.821] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="fda992c8d564f97e48410a19a2e459f6_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f") returned 1 [0143.821] lstrcmpiA (lpString1="", lpString2="fda992c8d564f97e48410a19a2e459f6_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f") returned -1 [0143.821] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\932a2db58c237abd381d22df4c63a04a_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f") returned="932a2db58c237abd381d22df4c63a04a_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f" [0143.821] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\", lpString2="fda992c8d564f97e48410a19a2e459f6_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\fda992c8d564f97e48410a19a2e459f6_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\fda992c8d564f97e48410a19a2e459f6_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f" [0143.821] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\fda992c8d564f97e48410a19a2e459f6_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.zip") returned 0 [0143.821] lstrlenA (lpString="*.zip") returned 5 [0143.821] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\fda992c8d564f97e48410a19a2e459f6_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.rar") returned 0 [0143.821] lstrlenA (lpString="*.rar") returned 5 [0143.821] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\fda992c8d564f97e48410a19a2e459f6_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.7z") returned 0 [0143.821] lstrlenA (lpString="*.7z") returned 4 [0143.822] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\fda992c8d564f97e48410a19a2e459f6_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.tar") returned 0 [0143.822] lstrlenA (lpString="*.tar") returned 5 [0143.822] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\fda992c8d564f97e48410a19a2e459f6_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.gzip") returned 0 [0143.822] lstrlenA (lpString="*.gzip") returned 6 [0143.822] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\fda992c8d564f97e48410a19a2e459f6_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.jpg") returned 0 [0143.822] lstrlenA (lpString="*.jpg") returned 5 [0143.822] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\fda992c8d564f97e48410a19a2e459f6_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.jpeg") returned 0 [0143.822] lstrlenA (lpString="*.jpeg") returned 6 [0143.822] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\fda992c8d564f97e48410a19a2e459f6_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.psd") returned 0 [0143.822] lstrlenA (lpString="*.psd") returned 5 [0143.822] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\fda992c8d564f97e48410a19a2e459f6_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.cdr") returned 0 [0143.822] lstrlenA (lpString="*.cdr") returned 5 [0143.822] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\fda992c8d564f97e48410a19a2e459f6_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.dwg") returned 0 [0143.822] lstrlenA (lpString="*.dwg") returned 5 [0143.822] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\fda992c8d564f97e48410a19a2e459f6_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.max") returned 0 [0143.822] lstrlenA (lpString="*.max") returned 5 [0143.822] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\fda992c8d564f97e48410a19a2e459f6_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.bmp") returned 0 [0143.822] lstrlenA (lpString="*.bmp") returned 5 [0143.822] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\fda992c8d564f97e48410a19a2e459f6_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.gif") returned 0 [0143.822] lstrlenA (lpString="*.gif") returned 5 [0143.822] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\fda992c8d564f97e48410a19a2e459f6_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.png") returned 0 [0143.822] lstrlenA (lpString="*.png") returned 5 [0143.822] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\fda992c8d564f97e48410a19a2e459f6_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.doc") returned 0 [0143.822] lstrlenA (lpString="*.doc") returned 5 [0143.822] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\fda992c8d564f97e48410a19a2e459f6_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.docx") returned 0 [0143.822] lstrlenA (lpString="*.docx") returned 6 [0143.822] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\fda992c8d564f97e48410a19a2e459f6_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.xls") returned 0 [0143.822] lstrlenA (lpString="*.xls") returned 5 [0143.822] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\fda992c8d564f97e48410a19a2e459f6_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.xlsx") returned 0 [0143.823] lstrlenA (lpString="*.xlsx") returned 6 [0143.823] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\fda992c8d564f97e48410a19a2e459f6_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.ppt") returned 0 [0143.823] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\fda992c8d564f97e48410a19a2e459f6_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.pptx") returned 0 [0143.823] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\fda992c8d564f97e48410a19a2e459f6_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.txt") returned 0 [0143.823] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\fda992c8d564f97e48410a19a2e459f6_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.pdf") returned 0 [0143.823] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\fda992c8d564f97e48410a19a2e459f6_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.djvu") returned 0 [0143.823] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\fda992c8d564f97e48410a19a2e459f6_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.htm") returned 0 [0143.823] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\fda992c8d564f97e48410a19a2e459f6_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.html") returned 0 [0143.823] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\fda992c8d564f97e48410a19a2e459f6_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.mdb") returned 0 [0143.823] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\fda992c8d564f97e48410a19a2e459f6_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.cer") returned 0 [0143.823] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\fda992c8d564f97e48410a19a2e459f6_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.p12") returned 0 [0143.823] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\fda992c8d564f97e48410a19a2e459f6_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.pfx") returned 0 [0143.823] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\fda992c8d564f97e48410a19a2e459f6_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.kwm") returned 0 [0143.823] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\fda992c8d564f97e48410a19a2e459f6_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.pwm") returned 0 [0143.823] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\fda992c8d564f97e48410a19a2e459f6_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.1cd") returned 0 [0143.824] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\fda992c8d564f97e48410a19a2e459f6_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.md") returned 0 [0143.824] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\fda992c8d564f97e48410a19a2e459f6_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.mdf") returned 0 [0143.824] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\fda992c8d564f97e48410a19a2e459f6_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.dbf") returned 0 [0143.824] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\fda992c8d564f97e48410a19a2e459f6_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.odt") returned 0 [0143.824] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\fda992c8d564f97e48410a19a2e459f6_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.vob") returned 0 [0143.824] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\fda992c8d564f97e48410a19a2e459f6_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.ifo") returned 0 [0143.824] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\fda992c8d564f97e48410a19a2e459f6_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.lnk") returned 0 [0143.824] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\fda992c8d564f97e48410a19a2e459f6_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.torrent") returned 0 [0143.824] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\fda992c8d564f97e48410a19a2e459f6_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.mov") returned 0 [0143.824] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\fda992c8d564f97e48410a19a2e459f6_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.m2v") returned 0 [0143.824] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\fda992c8d564f97e48410a19a2e459f6_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.3gp") returned 0 [0143.824] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\fda992c8d564f97e48410a19a2e459f6_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.mpeg") returned 0 [0143.824] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\fda992c8d564f97e48410a19a2e459f6_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.mpg") returned 0 [0143.824] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\fda992c8d564f97e48410a19a2e459f6_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.flv") returned 0 [0143.824] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\fda992c8d564f97e48410a19a2e459f6_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.avi") returned 0 [0143.824] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\fda992c8d564f97e48410a19a2e459f6_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.mp4") returned 0 [0143.824] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\fda992c8d564f97e48410a19a2e459f6_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.wmv") returned 0 [0143.825] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\fda992c8d564f97e48410a19a2e459f6_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.divx") returned 0 [0143.825] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\fda992c8d564f97e48410a19a2e459f6_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.mkv") returned 0 [0143.825] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\fda992c8d564f97e48410a19a2e459f6_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.mp3") returned 0 [0143.825] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\fda992c8d564f97e48410a19a2e459f6_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.wav") returned 0 [0143.825] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\fda992c8d564f97e48410a19a2e459f6_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.flac") returned 0 [0143.825] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\fda992c8d564f97e48410a19a2e459f6_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.ape") returned 0 [0143.825] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\fda992c8d564f97e48410a19a2e459f6_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.wma") returned 0 [0143.825] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\fda992c8d564f97e48410a19a2e459f6_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", pszSpec="*.ac3") returned 0 [0143.825] FindNextFileA (in: hFindFile=0x5be320, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 0 [0143.825] FindClose (in: hFindFile=0x5be320 | out: hFindFile=0x5be320) returned 1 [0143.826] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 0 [0143.826] FindClose (in: hFindFile=0x5be2e0 | out: hFindFile=0x5be2e0) returned 1 [0143.826] FindNextFileA (in: hFindFile=0x5be2a0, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0 [0143.826] FindClose (in: hFindFile=0x5be2a0 | out: hFindFile=0x5be2a0) returned 1 [0143.826] FindNextFileA (in: hFindFile=0x5be260, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0143.826] lstrcmpA (lpString1=".", lpString2="Document Building Blocks") returned -1 [0143.826] lstrcmpA (lpString1="..", lpString2="Document Building Blocks") returned -1 [0143.826] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\*.*") returned="*.*" [0143.827] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\", lpString2="Document Building Blocks" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks" [0143.827] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0143.828] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0143.828] FindNextFileA (in: hFindFile=0x5be2a0, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0143.828] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0143.828] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0143.828] FindNextFileA (in: hFindFile=0x5be2a0, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0143.828] lstrcmpA (lpString1=".", lpString2="1033") returned -1 [0143.828] lstrcmpA (lpString1="..", lpString2="1033") returned -1 [0143.828] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\*.*") returned="*.*" [0143.828] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\", lpString2="1033" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033" [0143.828] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\*.*", lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 0x5be2e0 [0143.828] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0143.828] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0143.828] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0143.829] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0143.829] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0143.829] lstrcmpA (lpString1=".", lpString2="14") returned -1 [0143.829] lstrcmpA (lpString1="..", lpString2="14") returned -1 [0143.829] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\*.*") returned="*.*" [0143.829] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\", lpString2="14" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\14") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\14" [0143.829] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\14\\*.*", lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 0x5be320 [0143.829] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0143.830] FindNextFileA (in: hFindFile=0x5be320, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0143.830] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0143.830] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0143.830] FindNextFileA (in: hFindFile=0x5be320, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0143.830] PeekMessageA (in: lpMsg=0xaece4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaece4) returned 0 [0143.830] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Built-In Building Blocks.dotx") returned 1 [0143.830] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Built-In Building Blocks.dotx") returned 1 [0143.830] lstrcmpiA (lpString1="", lpString2="Built-In Building Blocks.dotx") returned -1 [0143.830] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\14\\*.*") returned="*.*" [0143.830] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\14\\", lpString2="Built-In Building Blocks.dotx" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\14\\Built-In Building Blocks.dotx") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\14\\Built-In Building Blocks.dotx" [0143.830] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\14\\Built-In Building Blocks.dotx", pszSpec="*.zip") returned 0 [0143.830] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\14\\Built-In Building Blocks.dotx", pszSpec="*.rar") returned 0 [0143.830] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\14\\Built-In Building Blocks.dotx", pszSpec="*.7z") returned 0 [0143.830] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\14\\Built-In Building Blocks.dotx", pszSpec="*.tar") returned 0 [0143.830] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\14\\Built-In Building Blocks.dotx", pszSpec="*.gzip") returned 0 [0143.830] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\14\\Built-In Building Blocks.dotx", pszSpec="*.jpg") returned 0 [0143.830] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\14\\Built-In Building Blocks.dotx", pszSpec="*.jpeg") returned 0 [0143.830] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\14\\Built-In Building Blocks.dotx", pszSpec="*.psd") returned 0 [0143.830] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\14\\Built-In Building Blocks.dotx", pszSpec="*.cdr") returned 0 [0143.830] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\14\\Built-In Building Blocks.dotx", pszSpec="*.dwg") returned 0 [0143.830] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\14\\Built-In Building Blocks.dotx", pszSpec="*.max") returned 0 [0143.830] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\14\\Built-In Building Blocks.dotx", pszSpec="*.bmp") returned 0 [0143.830] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\14\\Built-In Building Blocks.dotx", pszSpec="*.gif") returned 0 [0143.830] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\14\\Built-In Building Blocks.dotx", pszSpec="*.png") returned 0 [0143.830] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\14\\Built-In Building Blocks.dotx", pszSpec="*.doc") returned 0 [0143.830] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\14\\Built-In Building Blocks.dotx", pszSpec="*.docx") returned 0 [0143.830] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\14\\Built-In Building Blocks.dotx", pszSpec="*.xls") returned 0 [0143.831] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\14\\Built-In Building Blocks.dotx", pszSpec="*.xlsx") returned 0 [0143.831] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\14\\Built-In Building Blocks.dotx", pszSpec="*.ppt") returned 0 [0143.831] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\14\\Built-In Building Blocks.dotx", pszSpec="*.pptx") returned 0 [0143.831] PathMatchSpecA (pszFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\14\\Built-In Building Blocks.dotx", pszSpec="*.txt") returned 0 [0143.831] FindNextFileA (in: hFindFile=0x5be320, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 0 [0143.831] FindClose (in: hFindFile=0x5be320 | out: hFindFile=0x5be320) returned 1 [0143.831] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 0 [0143.831] FindClose (in: hFindFile=0x5be2e0 | out: hFindFile=0x5be2e0) returned 1 [0143.831] FindNextFileA (in: hFindFile=0x5be2a0, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0 [0143.831] FindClose (in: hFindFile=0x5be2a0 | out: hFindFile=0x5be2a0) returned 1 [0143.831] FindNextFileA (in: hFindFile=0x5be260, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0143.831] lstrcmpA (lpString1=".", lpString2="Excel") returned -1 [0143.831] lstrcmpA (lpString1="..", lpString2="Excel") returned -1 [0143.831] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\*.*") returned="*.*" [0143.831] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\", lpString2="Excel" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Excel") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Excel" [0143.831] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Excel\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0143.832] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0143.832] FindNextFileA (in: hFindFile=0x5be2a0, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0143.832] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0143.832] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0143.832] FindNextFileA (in: hFindFile=0x5be2a0, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0143.832] lstrcmpA (lpString1=".", lpString2="XLSTART") returned -1 [0143.832] lstrcmpA (lpString1="..", lpString2="XLSTART") returned -1 [0143.832] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Excel\\*.*") returned="*.*" [0143.832] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Excel\\", lpString2="XLSTART" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Excel\\XLSTART") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Excel\\XLSTART" [0143.832] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Excel\\XLSTART\\*.*", lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 0x5be2e0 [0143.832] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0143.832] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0143.833] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0143.833] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0143.833] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 0 [0143.833] FindClose (in: hFindFile=0x5be2e0 | out: hFindFile=0x5be2e0) returned 1 [0143.833] FindNextFileA (in: hFindFile=0x5be2a0, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0 [0143.833] FindClose (in: hFindFile=0x5be2a0 | out: hFindFile=0x5be2a0) returned 1 [0143.833] FindNextFileA (in: hFindFile=0x5be260, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0143.833] lstrcmpA (lpString1=".", lpString2="IME12") returned -1 [0143.833] lstrcmpA (lpString1="..", lpString2="IME12") returned -1 [0143.833] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\*.*") returned="*.*" [0143.833] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\", lpString2="IME12" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IME12") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IME12" [0143.833] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IME12\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0143.833] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0143.833] FindNextFileA (in: hFindFile=0x5be2a0, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0143.833] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0143.833] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0143.833] FindNextFileA (in: hFindFile=0x5be2a0, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0 [0143.833] FindClose (in: hFindFile=0x5be2a0 | out: hFindFile=0x5be2a0) returned 1 [0143.833] FindNextFileA (in: hFindFile=0x5be260, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0143.833] lstrcmpA (lpString1=".", lpString2="IMJP12") returned -1 [0143.833] lstrcmpA (lpString1="..", lpString2="IMJP12") returned -1 [0143.833] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\*.*") returned="*.*" [0143.834] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\", lpString2="IMJP12" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IMJP12") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IMJP12" [0143.834] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IMJP12\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0143.834] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0143.834] FindNextFileA (in: hFindFile=0x5be2a0, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0143.834] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0143.834] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0143.834] FindNextFileA (in: hFindFile=0x5be2a0, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0 [0143.834] FindClose (in: hFindFile=0x5be2a0 | out: hFindFile=0x5be2a0) returned 1 [0143.834] FindNextFileA (in: hFindFile=0x5be260, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0143.834] lstrcmpA (lpString1=".", lpString2="IMJP8_1") returned -1 [0143.834] lstrcmpA (lpString1="..", lpString2="IMJP8_1") returned -1 [0143.834] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\*.*") returned="*.*" [0143.834] lstrcatA (in: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\", lpString2="IMJP8_1" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IMJP8_1") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IMJP8_1" [0143.834] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IMJP8_1\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0143.835] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0143.835] FindNextFileA (in: hFindFile=0x5be2a0, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0143.835] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0143.835] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0143.835] FindNextFileA (in: hFindFile=0x5be2a0, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0 [0143.835] FindClose (in: hFindFile=0x5be2a0 | out: hFindFile=0x5be2a0) returned 1 [0143.837] FindNextFileA (in: hFindFile=0x5be260, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0143.837] lstrcmpA (lpString1=".", lpString2="IMJP9_0") returned -1 [0143.837] lstrcmpA (lpString1="..", lpString2="IMJP9_0") returned -1 [0143.837] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\*.*") returned="*.*" [0143.837] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IMJP9_0\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0143.838] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0143.838] FindNextFileA (in: hFindFile=0x5be2a0, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0143.838] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0143.838] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0143.838] FindNextFileA (in: hFindFile=0x5be2a0, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0 [0143.838] FindClose (in: hFindFile=0x5be2a0 | out: hFindFile=0x5be2a0) returned 1 [0143.838] FindNextFileA (in: hFindFile=0x5be260, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0143.838] lstrcmpA (lpString1=".", lpString2="Internet Explorer") returned -1 [0143.838] lstrcmpA (lpString1="..", lpString2="Internet Explorer") returned -1 [0143.838] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\*.*") returned="*.*" [0143.838] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0143.838] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0143.838] FindNextFileA (in: hFindFile=0x5be2a0, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0143.838] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0143.839] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0143.839] FindNextFileA (in: hFindFile=0x5be2a0, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0143.839] lstrcmpA (lpString1=".", lpString2="Quick Launch") returned -1 [0143.839] lstrcmpA (lpString1="..", lpString2="Quick Launch") returned -1 [0143.839] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\*.*") returned="*.*" [0143.839] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\*.*", lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 0x5be2e0 [0143.839] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0143.839] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0143.839] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0143.839] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0143.839] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0143.839] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0143.839] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="desktop.ini") returned 1 [0143.839] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="desktop.ini") returned 1 [0143.839] lstrcmpiA (lpString1="", lpString2="desktop.ini") returned -1 [0143.839] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\*.*") returned="*.*" [0143.839] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0143.839] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0143.839] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Google Chrome.lnk") returned -1 [0143.839] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Google Chrome.lnk") returned 1 [0143.839] lstrcmpiA (lpString1="", lpString2="Google Chrome.lnk") returned -1 [0143.839] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\desktop.ini") returned="desktop.ini" [0143.929] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Google Chrome.lnk") returned="Google Chrome.lnk" [0143.929] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0143.929] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x88f, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x88f, lpOverlapped=0x0) returned 1 [0143.929] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0143.930] CloseHandle (hObject=0x98) returned 1 [0143.930] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Google Chrome.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\google chrome.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Google Chrome.lnk. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\google chrome.lnk. ")) returned 1 [0143.931] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0143.931] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0143.931] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Launch Internet Explorer Browser.lnk") returned -1 [0143.931] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Launch Internet Explorer Browser.lnk") returned -1 [0143.931] lstrcmpiA (lpString1="", lpString2="Launch Internet Explorer Browser.lnk") returned -1 [0143.931] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Google Chrome.lnk") returned="Google Chrome.lnk" [0144.031] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Launch Internet Explorer Browser.lnk") returned="Launch Internet Explorer Browser.lnk" [0144.031] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0144.031] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0x54d, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0x54d, lpOverlapped=0x0) returned 1 [0144.032] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0144.032] CloseHandle (hObject=0x98) returned 1 [0144.032] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Launch Internet Explorer Browser.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\launch internet explorer browser.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Launch Internet Explorer Browser.lnk. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\launch internet explorer browser.lnk. ")) returned 1 [0144.035] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0144.035] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0144.035] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Shows Desktop.lnk") returned -1 [0144.035] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Shows Desktop.lnk") returned -1 [0144.035] lstrcmpiA (lpString1="", lpString2="Shows Desktop.lnk") returned -1 [0144.035] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Launch Internet Explorer Browser.lnk") returned="Launch Internet Explorer Browser.lnk" [0144.037] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Shows Desktop.lnk") returned="Shows Desktop.lnk" [0144.037] SetFilePointer (in: hFile=0x98, lDistanceToMove=90, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5a [0144.037] WriteFile (in: hFile=0x98, lpBuffer=0x1ef0020*, nNumberOfBytesToWrite=0xc8, lpNumberOfBytesWritten=0x406561, lpOverlapped=0x0 | out: lpBuffer=0x1ef0020*, lpNumberOfBytesWritten=0x406561*=0xc8, lpOverlapped=0x0) returned 1 [0144.038] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0144.038] CloseHandle (hObject=0x98) returned 1 [0144.038] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Shows Desktop.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\shows desktop.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Shows Desktop.lnk. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\shows desktop.lnk. ")) returned 1 [0144.040] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0144.040] lstrcmpA (lpString1=".", lpString2="User Pinned") returned -1 [0144.040] lstrcmpA (lpString1="..", lpString2="User Pinned") returned -1 [0144.040] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Shows Desktop.lnk") returned="Shows Desktop.lnk" [0144.040] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\*.*", lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 0x5be320 [0144.040] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0144.040] FindNextFileA (in: hFindFile=0x5be320, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0144.040] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0144.040] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0144.040] FindNextFileA (in: hFindFile=0x5be320, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0144.040] lstrcmpA (lpString1=".", lpString2="ImplicitAppShortcuts") returned -1 [0144.040] lstrcmpA (lpString1="..", lpString2="ImplicitAppShortcuts") returned -1 [0144.040] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\*.*") returned="*.*" [0144.040] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\ImplicitAppShortcuts\\*.*", lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 0x5be360 [0144.041] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0144.041] FindNextFileA (in: hFindFile=0x5be360, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 1 [0144.041] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0144.041] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0144.041] FindNextFileA (in: hFindFile=0x5be360, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 0 [0144.041] FindClose (in: hFindFile=0x5be360 | out: hFindFile=0x5be360) returned 1 [0144.041] FindNextFileA (in: hFindFile=0x5be320, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0144.041] lstrcmpA (lpString1=".", lpString2="TaskBar") returned -1 [0144.041] lstrcmpA (lpString1="..", lpString2="TaskBar") returned -1 [0144.041] PathFindFileNameA (pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\*.*") returned="*.*" [0144.041] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\*.*", lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 0x5be360 [0144.042] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0144.042] FindNextFileA (in: hFindFile=0x5be360, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 1 [0144.042] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0144.042] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0144.042] FindNextFileA (in: hFindFile=0x5be360, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 1 [0144.042] PeekMessageA (in: lpMsg=0xaeb94, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaeb94) returned 0 [0144.042] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="desktop.ini") returned 1 [0144.042] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="desktop.ini") returned 1 [0144.042] lstrcmpiA (lpString1="", lpString2="desktop.ini") returned -1 [0144.042] FindNextFileA (in: hFindFile=0x5be360, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 1 [0144.042] PeekMessageA (in: lpMsg=0xaeb94, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaeb94) returned 0 [0144.042] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Google Chrome.lnk") returned -1 [0144.042] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Google Chrome.lnk") returned 1 [0144.042] lstrcmpiA (lpString1="", lpString2="Google Chrome.lnk") returned -1 [0144.044] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0144.045] CloseHandle (hObject=0xa0) returned 1 [0144.045] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Google Chrome.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\google chrome.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Google Chrome.lnk. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\google chrome.lnk. ")) returned 1 [0144.047] FindNextFileA (in: hFindFile=0x5be360, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 1 [0144.047] PeekMessageA (in: lpMsg=0xaeb94, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaeb94) returned 0 [0144.047] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Internet Explorer (2).lnk") returned -1 [0144.047] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Internet Explorer (2).lnk") returned -1 [0144.047] lstrcmpiA (lpString1="", lpString2="Internet Explorer (2).lnk") returned -1 [0144.048] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0144.048] CloseHandle (hObject=0xa0) returned 1 [0144.048] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Internet Explorer (2).lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\internet explorer (2).lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Internet Explorer (2).lnk. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\internet explorer (2).lnk. ")) returned 1 [0144.050] FindNextFileA (in: hFindFile=0x5be360, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 1 [0144.050] PeekMessageA (in: lpMsg=0xaeb94, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaeb94) returned 0 [0144.050] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Internet Explorer.lnk") returned -1 [0144.050] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Internet Explorer.lnk") returned -1 [0144.050] lstrcmpiA (lpString1="", lpString2="Internet Explorer.lnk") returned -1 [0144.151] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0144.151] CloseHandle (hObject=0xa0) returned 1 [0144.151] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Internet Explorer.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\internet explorer.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Internet Explorer.lnk. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\internet explorer.lnk. ")) returned 1 [0144.153] FindNextFileA (in: hFindFile=0x5be360, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 1 [0144.153] PeekMessageA (in: lpMsg=0xaeb94, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaeb94) returned 0 [0144.153] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Mozilla Firefox.lnk") returned -1 [0144.153] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Mozilla Firefox.lnk") returned -1 [0144.153] lstrcmpiA (lpString1="", lpString2="Mozilla Firefox.lnk") returned -1 [0144.154] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0144.154] CloseHandle (hObject=0xa0) returned 1 [0144.154] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Mozilla Firefox.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\mozilla firefox.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Mozilla Firefox.lnk. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\mozilla firefox.lnk. ")) returned 1 [0144.156] FindNextFileA (in: hFindFile=0x5be360, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 1 [0144.156] PeekMessageA (in: lpMsg=0xaeb94, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaeb94) returned 0 [0144.156] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Windows Explorer (2).lnk") returned -1 [0144.156] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Windows Explorer (2).lnk") returned -1 [0144.157] lstrcmpiA (lpString1="", lpString2="Windows Explorer (2).lnk") returned -1 [0144.159] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0144.159] CloseHandle (hObject=0xa0) returned 1 [0144.159] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Explorer (2).lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\windows explorer (2).lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Explorer (2).lnk. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\windows explorer (2).lnk. ")) returned 1 [0144.162] FindNextFileA (in: hFindFile=0x5be360, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 1 [0144.162] PeekMessageA (in: lpMsg=0xaeb94, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaeb94) returned 0 [0144.162] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Windows Explorer.lnk") returned -1 [0144.162] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Windows Explorer.lnk") returned -1 [0144.162] lstrcmpiA (lpString1="", lpString2="Windows Explorer.lnk") returned -1 [0144.251] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0144.251] CloseHandle (hObject=0xa0) returned 1 [0144.251] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Explorer.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\windows explorer.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Explorer.lnk. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\windows explorer.lnk. ")) returned 1 [0144.253] FindNextFileA (in: hFindFile=0x5be360, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 1 [0144.253] PeekMessageA (in: lpMsg=0xaeb94, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaeb94) returned 0 [0144.253] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Windows Media Player (2).lnk") returned -1 [0144.253] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Windows Media Player (2).lnk") returned -1 [0144.253] lstrcmpiA (lpString1="", lpString2="Windows Media Player (2).lnk") returned -1 [0144.256] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0144.256] CloseHandle (hObject=0xa0) returned 1 [0144.256] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Media Player (2).lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\windows media player (2).lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Media Player (2).lnk. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\windows media player (2).lnk. ")) returned 1 [0144.258] FindNextFileA (in: hFindFile=0x5be360, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 1 [0144.258] PeekMessageA (in: lpMsg=0xaeb94, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaeb94) returned 0 [0144.258] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Windows Media Player.lnk") returned -1 [0144.258] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Windows Media Player.lnk") returned -1 [0144.258] lstrcmpiA (lpString1="", lpString2="Windows Media Player.lnk") returned -1 [0144.260] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0144.260] CloseHandle (hObject=0xa0) returned 1 [0144.261] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Media Player.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\windows media player.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Media Player.lnk. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\windows media player.lnk. ")) returned 1 [0144.263] FindNextFileA (in: hFindFile=0x5be360, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 0 [0144.263] FindClose (in: hFindFile=0x5be360 | out: hFindFile=0x5be360) returned 1 [0144.263] FindNextFileA (in: hFindFile=0x5be320, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 0 [0144.263] FindClose (in: hFindFile=0x5be320 | out: hFindFile=0x5be320) returned 1 [0144.263] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0144.263] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0144.263] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Window Switcher.lnk") returned -1 [0144.263] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Window Switcher.lnk") returned -1 [0144.263] lstrcmpiA (lpString1="", lpString2="Window Switcher.lnk") returned -1 [0144.266] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0144.266] CloseHandle (hObject=0x98) returned 1 [0144.266] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Window Switcher.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\window switcher.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Window Switcher.lnk. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\window switcher.lnk. ")) returned 1 [0144.268] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 0 [0144.268] FindClose (in: hFindFile=0x5be2e0 | out: hFindFile=0x5be2e0) returned 1 [0144.271] FindNextFileA (in: hFindFile=0x5be2a0, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0144.271] lstrcmpA (lpString1=".", lpString2="UserData") returned -1 [0144.271] lstrcmpA (lpString1="..", lpString2="UserData") returned -1 [0144.271] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\*.*", lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 0x5be2e0 [0144.278] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0144.278] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0144.278] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0144.278] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0144.278] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0144.278] lstrcmpA (lpString1=".", lpString2="Low") returned -1 [0144.278] lstrcmpA (lpString1="..", lpString2="Low") returned -1 [0144.278] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\*.*", lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 0x5be320 [0144.278] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0144.278] FindNextFileA (in: hFindFile=0x5be320, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0144.278] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0144.278] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0144.278] FindNextFileA (in: hFindFile=0x5be320, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0144.278] lstrcmpA (lpString1=".", lpString2="65UX3YG0") returned -1 [0144.278] lstrcmpA (lpString1="..", lpString2="65UX3YG0") returned -1 [0144.278] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\65UX3YG0\\*.*", lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 0x5be360 [0144.285] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0144.285] FindNextFileA (in: hFindFile=0x5be360, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 1 [0144.285] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0144.285] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0144.285] FindNextFileA (in: hFindFile=0x5be360, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 0 [0144.285] FindClose (in: hFindFile=0x5be360 | out: hFindFile=0x5be360) returned 1 [0144.285] FindNextFileA (in: hFindFile=0x5be320, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0144.285] lstrcmpA (lpString1=".", lpString2="AY721QDR") returned -1 [0144.285] lstrcmpA (lpString1="..", lpString2="AY721QDR") returned -1 [0144.285] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\AY721QDR\\*.*", lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 0x5be360 [0144.285] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0144.285] FindNextFileA (in: hFindFile=0x5be360, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 1 [0144.285] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0144.285] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0144.285] FindNextFileA (in: hFindFile=0x5be360, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 0 [0144.285] FindClose (in: hFindFile=0x5be360 | out: hFindFile=0x5be360) returned 1 [0144.285] FindNextFileA (in: hFindFile=0x5be320, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0144.286] lstrcmpA (lpString1=".", lpString2="DZBKZBIC") returned -1 [0144.286] lstrcmpA (lpString1="..", lpString2="DZBKZBIC") returned -1 [0144.286] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\DZBKZBIC\\*.*", lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 0x5be360 [0144.286] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0144.286] FindNextFileA (in: hFindFile=0x5be360, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 1 [0144.286] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0144.286] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0144.286] FindNextFileA (in: hFindFile=0x5be360, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 0 [0144.286] FindClose (in: hFindFile=0x5be360 | out: hFindFile=0x5be360) returned 1 [0144.286] FindNextFileA (in: hFindFile=0x5be320, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0144.286] PeekMessageA (in: lpMsg=0xaece4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaece4) returned 0 [0144.286] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="index.dat") returned -1 [0144.286] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="index.dat") returned -1 [0144.286] lstrcmpiA (lpString1="", lpString2="index.dat") returned -1 [0144.286] FindNextFileA (in: hFindFile=0x5be320, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0144.286] lstrcmpA (lpString1=".", lpString2="VRLZOZ0E") returned -1 [0144.286] lstrcmpA (lpString1="..", lpString2="VRLZOZ0E") returned -1 [0144.286] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\VRLZOZ0E\\*.*", lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 0x5be360 [0144.287] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0144.287] FindNextFileA (in: hFindFile=0x5be360, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 1 [0144.287] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0144.287] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0144.287] FindNextFileA (in: hFindFile=0x5be360, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 0 [0144.287] FindClose (in: hFindFile=0x5be360 | out: hFindFile=0x5be360) returned 1 [0144.287] FindNextFileA (in: hFindFile=0x5be320, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 0 [0144.287] FindClose (in: hFindFile=0x5be320 | out: hFindFile=0x5be320) returned 1 [0144.287] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 0 [0144.287] FindClose (in: hFindFile=0x5be2e0 | out: hFindFile=0x5be2e0) returned 1 [0144.287] FindNextFileA (in: hFindFile=0x5be2a0, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0 [0144.287] FindClose (in: hFindFile=0x5be2a0 | out: hFindFile=0x5be2a0) returned 1 [0144.287] FindNextFileA (in: hFindFile=0x5be260, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0144.287] lstrcmpA (lpString1=".", lpString2="MMC") returned -1 [0144.287] lstrcmpA (lpString1="..", lpString2="MMC") returned -1 [0144.287] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MMC\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0144.288] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0144.288] FindNextFileA (in: hFindFile=0x5be2a0, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0144.288] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0144.288] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0144.288] FindNextFileA (in: hFindFile=0x5be2a0, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0 [0144.288] FindClose (in: hFindFile=0x5be2a0 | out: hFindFile=0x5be2a0) returned 1 [0144.288] FindNextFileA (in: hFindFile=0x5be260, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0144.288] lstrcmpA (lpString1=".", lpString2="MS Project") returned -1 [0144.288] lstrcmpA (lpString1="..", lpString2="MS Project") returned -1 [0144.288] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0144.289] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0144.289] FindNextFileA (in: hFindFile=0x5be2a0, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0144.289] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0144.289] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0144.289] FindNextFileA (in: hFindFile=0x5be2a0, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0144.289] lstrcmpA (lpString1=".", lpString2="14") returned -1 [0144.289] lstrcmpA (lpString1="..", lpString2="14") returned -1 [0144.289] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\14\\*.*", lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 0x5be2e0 [0144.291] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0144.291] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0144.291] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0144.291] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0144.291] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0144.291] lstrcmpA (lpString1=".", lpString2="1033") returned -1 [0144.291] lstrcmpA (lpString1="..", lpString2="1033") returned -1 [0144.291] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\14\\1033\\*.*", lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 0x5be320 [0144.292] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0144.293] FindNextFileA (in: hFindFile=0x5be320, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0144.293] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0144.293] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0144.293] FindNextFileA (in: hFindFile=0x5be320, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0144.293] PeekMessageA (in: lpMsg=0xaece4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaece4) returned 0 [0144.293] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Global.MPT") returned -1 [0144.293] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Global.MPT") returned 1 [0144.293] lstrcmpiA (lpString1="", lpString2="Global.MPT") returned -1 [0144.293] FindNextFileA (in: hFindFile=0x5be320, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 0 [0144.293] FindClose (in: hFindFile=0x5be320 | out: hFindFile=0x5be320) returned 1 [0144.293] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 0 [0144.293] FindClose (in: hFindFile=0x5be2e0 | out: hFindFile=0x5be2e0) returned 1 [0144.293] FindNextFileA (in: hFindFile=0x5be2a0, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0 [0144.293] FindClose (in: hFindFile=0x5be2a0 | out: hFindFile=0x5be2a0) returned 1 [0144.293] FindNextFileA (in: hFindFile=0x5be260, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0144.293] lstrcmpA (lpString1=".", lpString2="Network") returned -1 [0144.293] lstrcmpA (lpString1="..", lpString2="Network") returned -1 [0144.293] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0144.294] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0144.294] FindNextFileA (in: hFindFile=0x5be2a0, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0144.294] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0144.294] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0144.294] FindNextFileA (in: hFindFile=0x5be2a0, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0144.294] lstrcmpA (lpString1=".", lpString2="Connections") returned -1 [0144.294] lstrcmpA (lpString1="..", lpString2="Connections") returned -1 [0144.294] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\*.*", lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 0x5be2e0 [0144.294] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0144.294] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0144.294] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0144.295] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0144.295] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0144.295] lstrcmpA (lpString1=".", lpString2="Pbk") returned -1 [0144.295] lstrcmpA (lpString1="..", lpString2="Pbk") returned -1 [0144.295] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\*.*", lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 0x5be320 [0144.295] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0144.295] FindNextFileA (in: hFindFile=0x5be320, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0144.295] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0144.295] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0144.295] FindNextFileA (in: hFindFile=0x5be320, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0144.295] lstrcmpA (lpString1=".", lpString2="_hiddenPbk") returned -1 [0144.295] lstrcmpA (lpString1="..", lpString2="_hiddenPbk") returned -1 [0144.295] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\*.*", lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 0x5be360 [0144.295] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0144.295] FindNextFileA (in: hFindFile=0x5be360, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 1 [0144.295] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0144.295] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0144.295] FindNextFileA (in: hFindFile=0x5be360, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 1 [0144.296] PeekMessageA (in: lpMsg=0xaeb94, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaeb94) returned 0 [0144.296] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="rasphone.pbk") returned -1 [0144.296] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="rasphone.pbk") returned -1 [0144.296] lstrcmpiA (lpString1="", lpString2="rasphone.pbk") returned -1 [0144.296] FindNextFileA (in: hFindFile=0x5be360, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 0 [0144.296] FindClose (in: hFindFile=0x5be360 | out: hFindFile=0x5be360) returned 1 [0144.296] FindNextFileA (in: hFindFile=0x5be320, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 0 [0144.296] FindClose (in: hFindFile=0x5be320 | out: hFindFile=0x5be320) returned 1 [0144.296] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 0 [0144.296] FindClose (in: hFindFile=0x5be2e0 | out: hFindFile=0x5be2e0) returned 1 [0144.296] FindNextFileA (in: hFindFile=0x5be2a0, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0 [0144.296] FindClose (in: hFindFile=0x5be2a0 | out: hFindFile=0x5be2a0) returned 1 [0144.296] FindNextFileA (in: hFindFile=0x5be260, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0144.296] lstrcmpA (lpString1=".", lpString2="Office") returned -1 [0144.296] lstrcmpA (lpString1="..", lpString2="Office") returned -1 [0144.296] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0145.017] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0145.017] FindNextFileA (in: hFindFile=0x5be2a0, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0145.017] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0145.017] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0145.017] FindNextFileA (in: hFindFile=0x5be2a0, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0145.017] PeekMessageA (in: lpMsg=0xaef84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaef84) returned 0 [0145.017] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="MSO1033.acl") returned -1 [0145.017] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="MSO1033.acl") returned -1 [0145.017] lstrcmpiA (lpString1="", lpString2="MSO1033.acl") returned -1 [0145.017] FindNextFileA (in: hFindFile=0x5be2a0, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0145.017] lstrcmpA (lpString1=".", lpString2="Recent") returned -1 [0145.017] lstrcmpA (lpString1="..", lpString2="Recent") returned -1 [0145.017] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent\\*.*", lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 0x5be2e0 [0145.018] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0145.018] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0145.018] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0145.018] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0145.018] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0145.018] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0145.018] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Global.LNK") returned -1 [0145.020] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Global.LNK") returned 1 [0145.020] lstrcmpiA (lpString1="", lpString2="Global.LNK") returned -1 [0145.082] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0145.082] CloseHandle (hObject=0x98) returned 1 [0145.082] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent\\Global.LNK" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\office\\recent\\global.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent\\Global.LNK. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\office\\recent\\global.lnk. ")) returned 1 [0145.083] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0145.083] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0145.083] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="index.dat") returned -1 [0145.083] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="index.dat") returned -1 [0145.083] lstrcmpiA (lpString1="", lpString2="index.dat") returned -1 [0145.084] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0145.084] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0145.084] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Templates.LNK") returned -1 [0145.084] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Templates.LNK") returned -1 [0145.084] lstrcmpiA (lpString1="", lpString2="Templates.LNK") returned -1 [0145.168] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0145.169] CloseHandle (hObject=0x98) returned 1 [0145.169] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent\\Templates.LNK" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\office\\recent\\templates.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent\\Templates.LNK. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\office\\recent\\templates.lnk. ")) returned 1 [0145.170] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 0 [0145.170] FindClose (in: hFindFile=0x5be2e0 | out: hFindFile=0x5be2e0) returned 1 [0145.170] FindNextFileA (in: hFindFile=0x5be2a0, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0 [0145.170] FindClose (in: hFindFile=0x5be2a0 | out: hFindFile=0x5be2a0) returned 1 [0145.170] FindNextFileA (in: hFindFile=0x5be260, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0145.170] lstrcmpA (lpString1=".", lpString2="Outlook") returned -1 [0145.170] lstrcmpA (lpString1="..", lpString2="Outlook") returned -1 [0145.170] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0145.171] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0145.171] FindNextFileA (in: hFindFile=0x5be2a0, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0145.171] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0145.171] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0145.171] FindNextFileA (in: hFindFile=0x5be2a0, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0145.171] PeekMessageA (in: lpMsg=0xaef84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaef84) returned 0 [0145.171] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Outlook.srs") returned -1 [0145.171] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Outlook.srs") returned -1 [0145.171] lstrcmpiA (lpString1="", lpString2="Outlook.srs") returned -1 [0145.171] FindNextFileA (in: hFindFile=0x5be2a0, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0145.172] PeekMessageA (in: lpMsg=0xaef84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaef84) returned 0 [0145.172] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Outlook.xml") returned -1 [0145.172] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Outlook.xml") returned -1 [0145.172] lstrcmpiA (lpString1="", lpString2="Outlook.xml") returned -1 [0145.172] FindNextFileA (in: hFindFile=0x5be2a0, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0 [0145.172] FindClose (in: hFindFile=0x5be2a0 | out: hFindFile=0x5be2a0) returned 1 [0145.172] FindNextFileA (in: hFindFile=0x5be260, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0145.172] lstrcmpA (lpString1=".", lpString2="PowerPoint") returned -1 [0145.172] lstrcmpA (lpString1="..", lpString2="PowerPoint") returned -1 [0145.172] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\PowerPoint\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0145.175] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0145.175] FindNextFileA (in: hFindFile=0x5be2a0, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0145.175] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0145.175] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0145.175] FindNextFileA (in: hFindFile=0x5be2a0, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0 [0145.175] FindClose (in: hFindFile=0x5be2a0 | out: hFindFile=0x5be2a0) returned 1 [0145.175] FindNextFileA (in: hFindFile=0x5be260, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0145.175] lstrcmpA (lpString1=".", lpString2="Proof") returned -1 [0145.175] lstrcmpA (lpString1="..", lpString2="Proof") returned -1 [0145.175] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Proof\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0145.179] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0145.179] FindNextFileA (in: hFindFile=0x5be2a0, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0145.179] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0145.179] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0145.179] FindNextFileA (in: hFindFile=0x5be2a0, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0 [0145.179] FindClose (in: hFindFile=0x5be2a0 | out: hFindFile=0x5be2a0) returned 1 [0145.179] FindNextFileA (in: hFindFile=0x5be260, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0145.179] lstrcmpA (lpString1=".", lpString2="Protect") returned -1 [0145.179] lstrcmpA (lpString1="..", lpString2="Protect") returned -1 [0145.179] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0145.180] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0145.180] FindNextFileA (in: hFindFile=0x5be2a0, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0145.180] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0145.180] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0145.180] FindNextFileA (in: hFindFile=0x5be2a0, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0145.180] PeekMessageA (in: lpMsg=0xaef84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaef84) returned 0 [0145.180] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="CREDHIST") returned 1 [0145.180] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="CREDHIST") returned 1 [0145.180] lstrcmpiA (lpString1="", lpString2="CREDHIST") returned -1 [0145.180] FindNextFileA (in: hFindFile=0x5be2a0, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0145.181] lstrcmpA (lpString1=".", lpString2="S-1-5-21-3111613574-2524581245-2586426736-500") returned -1 [0145.181] lstrcmpA (lpString1="..", lpString2="S-1-5-21-3111613574-2524581245-2586426736-500") returned -1 [0145.181] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3111613574-2524581245-2586426736-500\\*.*", lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 0x5be2e0 [0145.192] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0145.192] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0145.192] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0145.192] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0145.192] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0145.192] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0145.192] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="be5b4fbd-cb99-45f5-9462-5f896dd3a6b9") returned 1 [0145.192] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="be5b4fbd-cb99-45f5-9462-5f896dd3a6b9") returned 1 [0145.192] lstrcmpiA (lpString1="", lpString2="be5b4fbd-cb99-45f5-9462-5f896dd3a6b9") returned -1 [0145.192] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0145.192] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0145.192] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Preferred") returned -1 [0145.192] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Preferred") returned -1 [0145.192] lstrcmpiA (lpString1="", lpString2="Preferred") returned -1 [0145.193] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 0 [0145.193] FindClose (in: hFindFile=0x5be2e0 | out: hFindFile=0x5be2e0) returned 1 [0145.193] FindNextFileA (in: hFindFile=0x5be2a0, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0145.193] lstrcmpA (lpString1=".", lpString2="S-1-5-21-3388679973-3930757225-3770151564-1000") returned -1 [0145.193] lstrcmpA (lpString1="..", lpString2="S-1-5-21-3388679973-3930757225-3770151564-1000") returned -1 [0145.193] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\*.*", lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 0x5be2e0 [0145.193] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0145.193] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0145.193] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0145.193] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0145.193] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0145.193] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0145.193] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="02540a10-7eb7-4b20-a8c7-470f8986389c") returned 1 [0145.193] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="02540a10-7eb7-4b20-a8c7-470f8986389c") returned 1 [0145.193] lstrcmpiA (lpString1="", lpString2="02540a10-7eb7-4b20-a8c7-470f8986389c") returned -1 [0145.193] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0145.194] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0145.194] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="0e15476d-d8fe-46ca-8099-ebdcf80f637c") returned 1 [0145.194] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="0e15476d-d8fe-46ca-8099-ebdcf80f637c") returned 1 [0145.194] lstrcmpiA (lpString1="", lpString2="0e15476d-d8fe-46ca-8099-ebdcf80f637c") returned -1 [0145.194] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0145.194] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0145.194] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="102a7bc8-3f85-4bb4-840a-38257d2965d2") returned 1 [0145.194] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="102a7bc8-3f85-4bb4-840a-38257d2965d2") returned 1 [0145.194] lstrcmpiA (lpString1="", lpString2="102a7bc8-3f85-4bb4-840a-38257d2965d2") returned -1 [0145.194] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0145.194] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0145.194] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="2be989a0-16a1-424b-9211-51aa3bb43e5d") returned 1 [0145.194] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="2be989a0-16a1-424b-9211-51aa3bb43e5d") returned 1 [0145.194] lstrcmpiA (lpString1="", lpString2="2be989a0-16a1-424b-9211-51aa3bb43e5d") returned -1 [0145.194] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0145.194] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0145.194] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="fbbe72db-afd8-443b-88dd-64b20388700d") returned -1 [0145.194] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="fbbe72db-afd8-443b-88dd-64b20388700d") returned 1 [0145.194] lstrcmpiA (lpString1="", lpString2="fbbe72db-afd8-443b-88dd-64b20388700d") returned -1 [0145.194] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0145.194] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0145.194] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Preferred") returned -1 [0145.194] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Preferred") returned -1 [0145.194] lstrcmpiA (lpString1="", lpString2="Preferred") returned -1 [0145.194] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 0 [0145.194] FindClose (in: hFindFile=0x5be2e0 | out: hFindFile=0x5be2e0) returned 1 [0145.194] FindNextFileA (in: hFindFile=0x5be2a0, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0145.194] PeekMessageA (in: lpMsg=0xaef84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaef84) returned 0 [0145.194] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="SYNCHIST") returned -1 [0145.194] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="SYNCHIST") returned -1 [0145.194] lstrcmpiA (lpString1="", lpString2="SYNCHIST") returned -1 [0145.194] FindNextFileA (in: hFindFile=0x5be2a0, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0 [0145.194] FindClose (in: hFindFile=0x5be2a0 | out: hFindFile=0x5be2a0) returned 1 [0145.194] FindNextFileA (in: hFindFile=0x5be260, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0145.194] lstrcmpA (lpString1=".", lpString2="Publisher") returned -1 [0145.194] lstrcmpA (lpString1="..", lpString2="Publisher") returned -1 [0145.195] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0145.198] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0145.198] FindNextFileA (in: hFindFile=0x5be2a0, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0145.198] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0145.198] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0145.198] FindNextFileA (in: hFindFile=0x5be2a0, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0 [0145.198] FindClose (in: hFindFile=0x5be2a0 | out: hFindFile=0x5be2a0) returned 1 [0145.198] FindNextFileA (in: hFindFile=0x5be260, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0145.198] lstrcmpA (lpString1=".", lpString2="Publisher Building Blocks") returned -1 [0145.198] lstrcmpA (lpString1="..", lpString2="Publisher Building Blocks") returned -1 [0145.198] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0145.431] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0145.431] FindNextFileA (in: hFindFile=0x5be2a0, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0145.431] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0145.431] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0145.431] FindNextFileA (in: hFindFile=0x5be2a0, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0145.431] PeekMessageA (in: lpMsg=0xaef84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaef84) returned 0 [0145.431] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="ContentStore.xml") returned 1 [0145.431] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="ContentStore.xml") returned 1 [0145.431] lstrcmpiA (lpString1="", lpString2="ContentStore.xml") returned -1 [0145.432] FindNextFileA (in: hFindFile=0x5be2a0, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0 [0145.432] FindClose (in: hFindFile=0x5be2a0 | out: hFindFile=0x5be2a0) returned 1 [0145.432] FindNextFileA (in: hFindFile=0x5be260, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0145.432] lstrcmpA (lpString1=".", lpString2="Speech") returned -1 [0145.432] lstrcmpA (lpString1="..", lpString2="Speech") returned -1 [0145.432] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Speech\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0145.433] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0145.433] FindNextFileA (in: hFindFile=0x5be2a0, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0145.433] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0145.433] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0145.433] FindNextFileA (in: hFindFile=0x5be2a0, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0 [0145.433] FindClose (in: hFindFile=0x5be2a0 | out: hFindFile=0x5be2a0) returned 1 [0145.433] FindNextFileA (in: hFindFile=0x5be260, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0145.433] lstrcmpA (lpString1=".", lpString2="SystemCertificates") returned -1 [0145.433] lstrcmpA (lpString1="..", lpString2="SystemCertificates") returned -1 [0145.433] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0145.434] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0145.434] FindNextFileA (in: hFindFile=0x5be2a0, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0145.434] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0145.434] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0145.434] FindNextFileA (in: hFindFile=0x5be2a0, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0145.434] lstrcmpA (lpString1=".", lpString2="My") returned -1 [0145.434] lstrcmpA (lpString1="..", lpString2="My") returned -1 [0145.434] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\*.*", lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 0x5be2e0 [0145.435] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0145.435] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0145.435] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0145.435] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0145.435] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0145.435] lstrcmpA (lpString1=".", lpString2="Certificates") returned -1 [0145.435] lstrcmpA (lpString1="..", lpString2="Certificates") returned -1 [0145.435] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\Certificates\\*.*", lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 0x5be320 [0145.435] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0145.435] FindNextFileA (in: hFindFile=0x5be320, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0145.435] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0145.435] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0145.435] FindNextFileA (in: hFindFile=0x5be320, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 0 [0145.436] FindClose (in: hFindFile=0x5be320 | out: hFindFile=0x5be320) returned 1 [0145.436] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0145.436] lstrcmpA (lpString1=".", lpString2="CRLs") returned -1 [0145.436] lstrcmpA (lpString1="..", lpString2="CRLs") returned -1 [0145.436] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CRLs\\*.*", lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 0x5be320 [0145.436] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0145.436] FindNextFileA (in: hFindFile=0x5be320, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0145.436] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0145.436] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0145.436] FindNextFileA (in: hFindFile=0x5be320, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 0 [0145.436] FindClose (in: hFindFile=0x5be320 | out: hFindFile=0x5be320) returned 1 [0145.436] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0145.436] lstrcmpA (lpString1=".", lpString2="CTLs") returned -1 [0145.436] lstrcmpA (lpString1="..", lpString2="CTLs") returned -1 [0145.436] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CTLs\\*.*", lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 0x5be320 [0145.436] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0145.436] FindNextFileA (in: hFindFile=0x5be320, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0145.436] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0145.436] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0145.436] FindNextFileA (in: hFindFile=0x5be320, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 0 [0145.436] FindClose (in: hFindFile=0x5be320 | out: hFindFile=0x5be320) returned 1 [0145.436] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 0 [0145.436] FindClose (in: hFindFile=0x5be2e0 | out: hFindFile=0x5be2e0) returned 1 [0145.436] FindNextFileA (in: hFindFile=0x5be2a0, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0 [0145.437] FindClose (in: hFindFile=0x5be2a0 | out: hFindFile=0x5be2a0) returned 1 [0145.437] FindNextFileA (in: hFindFile=0x5be260, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0145.437] lstrcmpA (lpString1=".", lpString2="Templates") returned -1 [0145.437] lstrcmpA (lpString1="..", lpString2="Templates") returned -1 [0145.437] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Templates\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0145.437] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0145.437] FindNextFileA (in: hFindFile=0x5be2a0, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0145.438] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0145.438] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0145.438] FindNextFileA (in: hFindFile=0x5be2a0, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0145.438] PeekMessageA (in: lpMsg=0xaef84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaef84) returned 0 [0145.438] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Normal.dotm") returned -1 [0145.438] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Normal.dotm") returned -1 [0145.438] lstrcmpiA (lpString1="", lpString2="Normal.dotm") returned -1 [0145.438] FindNextFileA (in: hFindFile=0x5be2a0, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0 [0145.438] FindClose (in: hFindFile=0x5be2a0 | out: hFindFile=0x5be2a0) returned 1 [0145.438] FindNextFileA (in: hFindFile=0x5be260, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0145.438] lstrcmpA (lpString1=".", lpString2="UProof") returned -1 [0145.438] lstrcmpA (lpString1="..", lpString2="UProof") returned -1 [0145.438] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\UProof\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0145.441] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0145.441] FindNextFileA (in: hFindFile=0x5be2a0, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0145.441] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0145.441] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0145.441] FindNextFileA (in: hFindFile=0x5be2a0, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0145.441] PeekMessageA (in: lpMsg=0xaef84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaef84) returned 0 [0145.441] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="CUSTOM.DIC") returned 1 [0145.441] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="CUSTOM.DIC") returned 1 [0145.441] lstrcmpiA (lpString1="", lpString2="CUSTOM.DIC") returned -1 [0145.441] FindNextFileA (in: hFindFile=0x5be2a0, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0 [0145.441] FindClose (in: hFindFile=0x5be2a0 | out: hFindFile=0x5be2a0) returned 1 [0145.441] FindNextFileA (in: hFindFile=0x5be260, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0145.441] lstrcmpA (lpString1=".", lpString2="Windows") returned -1 [0145.441] lstrcmpA (lpString1="..", lpString2="Windows") returned -1 [0145.441] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0145.441] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0145.441] FindNextFileA (in: hFindFile=0x5be2a0, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0145.441] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0145.441] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0145.441] FindNextFileA (in: hFindFile=0x5be2a0, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0145.441] lstrcmpA (lpString1=".", lpString2="Cookies") returned -1 [0145.441] lstrcmpA (lpString1="..", lpString2="Cookies") returned -1 [0145.441] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\*.*", lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 0x5be2e0 [0145.442] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0145.442] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0145.442] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0145.442] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0145.442] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0145.442] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0145.442] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="5p5nrgjn0js_halpmcxz@adobe[1].txt") returned 1 [0145.442] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="5p5nrgjn0js_halpmcxz@adobe[1].txt") returned 1 [0145.442] lstrcmpiA (lpString1="", lpString2="5p5nrgjn0js_halpmcxz@adobe[1].txt") returned -1 [0145.442] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0145.443] CloseHandle (hObject=0x98) returned 1 [0145.443] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@adobe[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@adobe[1].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@adobe[1].txt. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@adobe[1].txt. ")) returned 1 [0145.445] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0145.445] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0145.445] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="5p5nrgjn0js_halpmcxz@adobe[3].txt") returned 1 [0145.445] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="5p5nrgjn0js_halpmcxz@adobe[3].txt") returned 1 [0145.445] lstrcmpiA (lpString1="", lpString2="5p5nrgjn0js_halpmcxz@adobe[3].txt") returned -1 [0145.446] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0145.446] CloseHandle (hObject=0x98) returned 1 [0145.446] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@adobe[3].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@adobe[3].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@adobe[3].txt. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@adobe[3].txt. ")) returned 1 [0145.449] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0145.449] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0145.449] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="5p5nrgjn0js_halpmcxz@demdex[1].txt") returned 1 [0145.449] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="5p5nrgjn0js_halpmcxz@demdex[1].txt") returned 1 [0145.449] lstrcmpiA (lpString1="", lpString2="5p5nrgjn0js_halpmcxz@demdex[1].txt") returned -1 [0145.454] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0145.454] CloseHandle (hObject=0x98) returned 1 [0145.454] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@demdex[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@demdex[1].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@demdex[1].txt. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@demdex[1].txt. ")) returned 1 [0145.456] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0145.456] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0145.456] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="5p5nrgjn0js_halpmcxz@dpm.demdex[2].txt") returned 1 [0145.456] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="5p5nrgjn0js_halpmcxz@dpm.demdex[2].txt") returned 1 [0145.456] lstrcmpiA (lpString1="", lpString2="5p5nrgjn0js_halpmcxz@dpm.demdex[2].txt") returned -1 [0145.457] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0145.457] CloseHandle (hObject=0x98) returned 1 [0145.457] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@dpm.demdex[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@dpm.demdex[2].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@dpm.demdex[2].txt. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@dpm.demdex[2].txt. ")) returned 1 [0145.458] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0145.458] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0145.458] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="5p5nrgjn0js_halpmcxz@everesttech[1].txt") returned 1 [0145.458] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="5p5nrgjn0js_halpmcxz@everesttech[1].txt") returned 1 [0145.458] lstrcmpiA (lpString1="", lpString2="5p5nrgjn0js_halpmcxz@everesttech[1].txt") returned -1 [0145.461] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0145.461] CloseHandle (hObject=0x98) returned 1 [0145.461] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@everesttech[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@everesttech[1].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@everesttech[1].txt. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@everesttech[1].txt. ")) returned 1 [0145.464] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0145.464] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0145.464] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="5p5nrgjn0js_halpmcxz@google[2].txt") returned 1 [0145.464] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="5p5nrgjn0js_halpmcxz@google[2].txt") returned 1 [0145.464] lstrcmpiA (lpString1="", lpString2="5p5nrgjn0js_halpmcxz@google[2].txt") returned -1 [0145.466] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0145.467] CloseHandle (hObject=0x98) returned 1 [0145.467] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@google[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@google[2].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@google[2].txt. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@google[2].txt. ")) returned 1 [0145.469] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0145.469] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0145.469] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="5p5nrgjn0js_halpmcxz@ml314[1].txt") returned 1 [0145.469] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="5p5nrgjn0js_halpmcxz@ml314[1].txt") returned 1 [0145.469] lstrcmpiA (lpString1="", lpString2="5p5nrgjn0js_halpmcxz@ml314[1].txt") returned -1 [0145.469] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0145.469] CloseHandle (hObject=0x98) returned 1 [0145.469] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@ml314[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@ml314[1].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@ml314[1].txt. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@ml314[1].txt. ")) returned 1 [0145.470] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0145.470] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0145.470] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="5p5nrgjn0js_halpmcxz@rlcdn[2].txt") returned 1 [0145.470] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="5p5nrgjn0js_halpmcxz@rlcdn[2].txt") returned 1 [0145.470] lstrcmpiA (lpString1="", lpString2="5p5nrgjn0js_halpmcxz@rlcdn[2].txt") returned -1 [0145.472] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0145.473] CloseHandle (hObject=0x98) returned 1 [0145.473] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@rlcdn[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@rlcdn[2].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@rlcdn[2].txt. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@rlcdn[2].txt. ")) returned 1 [0145.474] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0145.474] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0145.474] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="index.dat") returned -1 [0145.474] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="index.dat") returned -1 [0145.474] lstrcmpiA (lpString1="", lpString2="index.dat") returned -1 [0145.474] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0145.474] lstrcmpA (lpString1=".", lpString2="Low") returned -1 [0145.474] lstrcmpA (lpString1="..", lpString2="Low") returned -1 [0145.474] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\*.*", lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 0x5be320 [0145.485] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0145.485] FindNextFileA (in: hFindFile=0x5be320, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0145.611] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0145.611] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0145.611] FindNextFileA (in: hFindFile=0x5be320, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0145.611] PeekMessageA (in: lpMsg=0xaece4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaece4) returned 0 [0145.612] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="5p5nrgjn0js_halpmcxz@ad13.adfarm1.adition[1].txt") returned 1 [0145.612] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="5p5nrgjn0js_halpmcxz@ad13.adfarm1.adition[1].txt") returned 1 [0145.612] lstrcmpiA (lpString1="", lpString2="5p5nrgjn0js_halpmcxz@ad13.adfarm1.adition[1].txt") returned -1 [0145.614] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0145.614] CloseHandle (hObject=0x9c) returned 1 [0145.615] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@ad13.adfarm1.adition[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@ad13.adfarm1.adition[1].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@ad13.adfarm1.adition[1].txt. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@ad13.adfarm1.adition[1].txt. ")) returned 1 [0145.617] FindNextFileA (in: hFindFile=0x5be320, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0145.617] PeekMessageA (in: lpMsg=0xaece4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaece4) returned 0 [0145.617] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="5p5nrgjn0js_halpmcxz@adfarm1.adition[2].txt") returned 1 [0145.617] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="5p5nrgjn0js_halpmcxz@adfarm1.adition[2].txt") returned 1 [0145.617] lstrcmpiA (lpString1="", lpString2="5p5nrgjn0js_halpmcxz@adfarm1.adition[2].txt") returned -1 [0145.620] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0145.620] CloseHandle (hObject=0x9c) returned 1 [0145.621] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adfarm1.adition[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adfarm1.adition[2].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adfarm1.adition[2].txt. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adfarm1.adition[2].txt. ")) returned 1 [0145.622] FindNextFileA (in: hFindFile=0x5be320, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0145.623] PeekMessageA (in: lpMsg=0xaece4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaece4) returned 0 [0145.623] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="5p5nrgjn0js_halpmcxz@adformdsp[1].txt") returned 1 [0145.623] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="5p5nrgjn0js_halpmcxz@adformdsp[1].txt") returned 1 [0145.623] lstrcmpiA (lpString1="", lpString2="5p5nrgjn0js_halpmcxz@adformdsp[1].txt") returned -1 [0145.626] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0145.626] CloseHandle (hObject=0x9c) returned 1 [0145.626] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adformdsp[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adformdsp[1].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adformdsp[1].txt. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adformdsp[1].txt. ")) returned 1 [0145.628] FindNextFileA (in: hFindFile=0x5be320, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0145.628] PeekMessageA (in: lpMsg=0xaece4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaece4) returned 0 [0145.628] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="5p5nrgjn0js_halpmcxz@adform[1].txt") returned 1 [0145.628] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="5p5nrgjn0js_halpmcxz@adform[1].txt") returned 1 [0145.628] lstrcmpiA (lpString1="", lpString2="5p5nrgjn0js_halpmcxz@adform[1].txt") returned -1 [0145.630] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0145.630] CloseHandle (hObject=0x9c) returned 1 [0145.631] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adform[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adform[1].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adform[1].txt. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adform[1].txt. ")) returned 1 [0145.632] FindNextFileA (in: hFindFile=0x5be320, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0145.632] PeekMessageA (in: lpMsg=0xaece4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaece4) returned 0 [0145.632] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="5p5nrgjn0js_halpmcxz@adnxs[1].txt") returned 1 [0145.632] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="5p5nrgjn0js_halpmcxz@adnxs[1].txt") returned 1 [0145.632] lstrcmpiA (lpString1="", lpString2="5p5nrgjn0js_halpmcxz@adnxs[1].txt") returned -1 [0145.642] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0145.642] CloseHandle (hObject=0x9c) returned 1 [0145.643] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adnxs[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adnxs[1].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adnxs[1].txt. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adnxs[1].txt. ")) returned 1 [0145.644] FindNextFileA (in: hFindFile=0x5be320, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0145.644] PeekMessageA (in: lpMsg=0xaece4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaece4) returned 0 [0145.644] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="5p5nrgjn0js_halpmcxz@adtech[2].txt") returned 1 [0145.644] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="5p5nrgjn0js_halpmcxz@adtech[2].txt") returned 1 [0145.644] lstrcmpiA (lpString1="", lpString2="5p5nrgjn0js_halpmcxz@adtech[2].txt") returned -1 [0145.645] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0145.645] CloseHandle (hObject=0x9c) returned 1 [0145.645] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adtech[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adtech[2].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adtech[2].txt. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adtech[2].txt. ")) returned 1 [0145.646] FindNextFileA (in: hFindFile=0x5be320, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0145.646] PeekMessageA (in: lpMsg=0xaece4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaece4) returned 0 [0145.646] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="5p5nrgjn0js_halpmcxz@adtr02[1].txt") returned 1 [0145.646] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="5p5nrgjn0js_halpmcxz@adtr02[1].txt") returned 1 [0145.646] lstrcmpiA (lpString1="", lpString2="5p5nrgjn0js_halpmcxz@adtr02[1].txt") returned -1 [0145.646] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0145.646] CloseHandle (hObject=0x9c) returned 1 [0145.646] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adtr02[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adtr02[1].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adtr02[1].txt. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adtr02[1].txt. ")) returned 1 [0145.647] FindNextFileA (in: hFindFile=0x5be320, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0145.647] PeekMessageA (in: lpMsg=0xaece4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaece4) returned 0 [0145.647] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="5p5nrgjn0js_halpmcxz@advertising[1].txt") returned 1 [0145.647] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="5p5nrgjn0js_halpmcxz@advertising[1].txt") returned 1 [0145.647] lstrcmpiA (lpString1="", lpString2="5p5nrgjn0js_halpmcxz@advertising[1].txt") returned -1 [0145.648] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0145.648] CloseHandle (hObject=0x9c) returned 1 [0145.648] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@advertising[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@advertising[1].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@advertising[1].txt. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@advertising[1].txt. ")) returned 1 [0145.649] FindNextFileA (in: hFindFile=0x5be320, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0145.649] PeekMessageA (in: lpMsg=0xaece4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaece4) returned 0 [0145.649] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="5p5nrgjn0js_halpmcxz@api.bing[2].txt") returned 1 [0145.649] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="5p5nrgjn0js_halpmcxz@api.bing[2].txt") returned 1 [0145.649] lstrcmpiA (lpString1="", lpString2="5p5nrgjn0js_halpmcxz@api.bing[2].txt") returned -1 [0145.650] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0145.650] CloseHandle (hObject=0x9c) returned 1 [0145.650] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@api.bing[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@api.bing[2].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@api.bing[2].txt. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@api.bing[2].txt. ")) returned 1 [0145.651] FindNextFileA (in: hFindFile=0x5be320, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0145.651] PeekMessageA (in: lpMsg=0xaece4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaece4) returned 0 [0145.651] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="5p5nrgjn0js_halpmcxz@at.atwola[1].txt") returned 1 [0145.651] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="5p5nrgjn0js_halpmcxz@at.atwola[1].txt") returned 1 [0145.651] lstrcmpiA (lpString1="", lpString2="5p5nrgjn0js_halpmcxz@at.atwola[1].txt") returned -1 [0145.652] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0145.652] CloseHandle (hObject=0x9c) returned 1 [0145.652] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@at.atwola[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@at.atwola[1].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@at.atwola[1].txt. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@at.atwola[1].txt. ")) returned 1 [0145.653] FindNextFileA (in: hFindFile=0x5be320, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0145.653] PeekMessageA (in: lpMsg=0xaece4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaece4) returned 0 [0145.653] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="5p5nrgjn0js_halpmcxz@bing[1].txt") returned 1 [0145.653] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="5p5nrgjn0js_halpmcxz@bing[1].txt") returned 1 [0145.653] lstrcmpiA (lpString1="", lpString2="5p5nrgjn0js_halpmcxz@bing[1].txt") returned -1 [0145.653] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0145.653] CloseHandle (hObject=0x9c) returned 1 [0145.654] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@bing[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@bing[1].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@bing[1].txt. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@bing[1].txt. ")) returned 1 [0145.654] FindNextFileA (in: hFindFile=0x5be320, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0145.654] PeekMessageA (in: lpMsg=0xaece4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaece4) returned 0 [0145.654] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="5p5nrgjn0js_halpmcxz@c.bing[1].txt") returned 1 [0145.654] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="5p5nrgjn0js_halpmcxz@c.bing[1].txt") returned 1 [0145.654] lstrcmpiA (lpString1="", lpString2="5p5nrgjn0js_halpmcxz@c.bing[1].txt") returned -1 [0145.655] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0145.656] CloseHandle (hObject=0x9c) returned 1 [0145.656] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@c.bing[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@c.bing[1].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@c.bing[1].txt. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@c.bing[1].txt. ")) returned 1 [0145.657] FindNextFileA (in: hFindFile=0x5be320, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0145.657] PeekMessageA (in: lpMsg=0xaece4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaece4) returned 0 [0145.657] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="5p5nrgjn0js_halpmcxz@c.msn[1].txt") returned 1 [0145.657] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="5p5nrgjn0js_halpmcxz@c.msn[1].txt") returned 1 [0145.657] lstrcmpiA (lpString1="", lpString2="5p5nrgjn0js_halpmcxz@c.msn[1].txt") returned -1 [0145.658] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0145.658] CloseHandle (hObject=0x9c) returned 1 [0145.658] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@c.msn[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@c.msn[1].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@c.msn[1].txt. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@c.msn[1].txt. ")) returned 1 [0145.659] FindNextFileA (in: hFindFile=0x5be320, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0145.659] PeekMessageA (in: lpMsg=0xaece4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaece4) returned 0 [0145.659] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="5p5nrgjn0js_halpmcxz@doubleclick[2].txt") returned 1 [0145.659] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="5p5nrgjn0js_halpmcxz@doubleclick[2].txt") returned 1 [0145.659] lstrcmpiA (lpString1="", lpString2="5p5nrgjn0js_halpmcxz@doubleclick[2].txt") returned -1 [0145.660] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0145.660] CloseHandle (hObject=0x9c) returned 1 [0145.660] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@doubleclick[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@doubleclick[2].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@doubleclick[2].txt. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@doubleclick[2].txt. ")) returned 1 [0145.661] FindNextFileA (in: hFindFile=0x5be320, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0145.661] PeekMessageA (in: lpMsg=0xaece4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaece4) returned 0 [0145.661] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="5p5nrgjn0js_halpmcxz@google[1].txt") returned 1 [0145.661] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="5p5nrgjn0js_halpmcxz@google[1].txt") returned 1 [0145.661] lstrcmpiA (lpString1="", lpString2="5p5nrgjn0js_halpmcxz@google[1].txt") returned -1 [0145.662] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0145.662] CloseHandle (hObject=0x9c) returned 1 [0145.662] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@google[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@google[1].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@google[1].txt. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@google[1].txt. ")) returned 1 [0145.663] FindNextFileA (in: hFindFile=0x5be320, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0145.663] PeekMessageA (in: lpMsg=0xaece4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaece4) returned 0 [0145.663] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="5p5nrgjn0js_halpmcxz@google[3].txt") returned 1 [0145.663] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="5p5nrgjn0js_halpmcxz@google[3].txt") returned 1 [0145.663] lstrcmpiA (lpString1="", lpString2="5p5nrgjn0js_halpmcxz@google[3].txt") returned -1 [0145.663] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0145.663] CloseHandle (hObject=0x9c) returned 1 [0145.664] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@google[3].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@google[3].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@google[3].txt. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@google[3].txt. ")) returned 1 [0145.664] FindNextFileA (in: hFindFile=0x5be320, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0145.664] PeekMessageA (in: lpMsg=0xaece4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaece4) returned 0 [0145.664] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="5p5nrgjn0js_halpmcxz@google[4].txt") returned 1 [0145.664] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="5p5nrgjn0js_halpmcxz@google[4].txt") returned 1 [0145.664] lstrcmpiA (lpString1="", lpString2="5p5nrgjn0js_halpmcxz@google[4].txt") returned -1 [0145.665] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0145.665] CloseHandle (hObject=0x9c) returned 1 [0145.665] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@google[4].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@google[4].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@google[4].txt. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@google[4].txt. ")) returned 1 [0145.665] FindNextFileA (in: hFindFile=0x5be320, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0145.665] PeekMessageA (in: lpMsg=0xaece4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaece4) returned 0 [0145.666] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="5p5nrgjn0js_halpmcxz@linkedin[1].txt") returned 1 [0145.666] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="5p5nrgjn0js_halpmcxz@linkedin[1].txt") returned 1 [0145.666] lstrcmpiA (lpString1="", lpString2="5p5nrgjn0js_halpmcxz@linkedin[1].txt") returned -1 [0145.666] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0145.666] CloseHandle (hObject=0x9c) returned 1 [0145.666] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@linkedin[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@linkedin[1].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@linkedin[1].txt. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@linkedin[1].txt. ")) returned 1 [0145.667] FindNextFileA (in: hFindFile=0x5be320, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0145.667] PeekMessageA (in: lpMsg=0xaece4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaece4) returned 0 [0145.667] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="5p5nrgjn0js_halpmcxz@m.exactag[1].txt") returned 1 [0145.667] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="5p5nrgjn0js_halpmcxz@m.exactag[1].txt") returned 1 [0145.667] lstrcmpiA (lpString1="", lpString2="5p5nrgjn0js_halpmcxz@m.exactag[1].txt") returned -1 [0145.668] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0145.668] CloseHandle (hObject=0x9c) returned 1 [0145.668] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@m.exactag[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@m.exactag[1].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@m.exactag[1].txt. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@m.exactag[1].txt. ")) returned 1 [0145.668] FindNextFileA (in: hFindFile=0x5be320, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0145.668] PeekMessageA (in: lpMsg=0xaece4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaece4) returned 0 [0145.668] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="5p5nrgjn0js_halpmcxz@msn[1].txt") returned 1 [0145.668] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="5p5nrgjn0js_halpmcxz@msn[1].txt") returned 1 [0145.668] lstrcmpiA (lpString1="", lpString2="5p5nrgjn0js_halpmcxz@msn[1].txt") returned -1 [0145.670] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0145.670] CloseHandle (hObject=0x9c) returned 1 [0145.670] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@msn[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@msn[1].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@msn[1].txt. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@msn[1].txt. ")) returned 1 [0145.670] FindNextFileA (in: hFindFile=0x5be320, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0145.670] PeekMessageA (in: lpMsg=0xaece4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaece4) returned 0 [0145.670] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="5p5nrgjn0js_halpmcxz@scorecardresearch[2].txt") returned 1 [0145.670] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="5p5nrgjn0js_halpmcxz@scorecardresearch[2].txt") returned 1 [0145.670] lstrcmpiA (lpString1="", lpString2="5p5nrgjn0js_halpmcxz@scorecardresearch[2].txt") returned -1 [0145.671] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0145.671] CloseHandle (hObject=0x9c) returned 1 [0145.671] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@scorecardresearch[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@scorecardresearch[2].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@scorecardresearch[2].txt. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@scorecardresearch[2].txt. ")) returned 1 [0145.672] FindNextFileA (in: hFindFile=0x5be320, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0145.672] PeekMessageA (in: lpMsg=0xaece4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaece4) returned 0 [0145.672] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="5p5nrgjn0js_halpmcxz@server.adformdsp[1].txt") returned 1 [0145.672] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="5p5nrgjn0js_halpmcxz@server.adformdsp[1].txt") returned 1 [0145.672] lstrcmpiA (lpString1="", lpString2="5p5nrgjn0js_halpmcxz@server.adformdsp[1].txt") returned -1 [0145.673] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0145.673] CloseHandle (hObject=0x9c) returned 1 [0145.673] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@server.adformdsp[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@server.adformdsp[1].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@server.adformdsp[1].txt. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@server.adformdsp[1].txt. ")) returned 1 [0145.674] FindNextFileA (in: hFindFile=0x5be320, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0145.674] PeekMessageA (in: lpMsg=0xaece4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaece4) returned 0 [0145.674] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="5p5nrgjn0js_halpmcxz@skadtec[1].txt") returned 1 [0145.674] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="5p5nrgjn0js_halpmcxz@skadtec[1].txt") returned 1 [0145.674] lstrcmpiA (lpString1="", lpString2="5p5nrgjn0js_halpmcxz@skadtec[1].txt") returned -1 [0145.675] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0145.675] CloseHandle (hObject=0x9c) returned 1 [0145.675] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@skadtec[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@skadtec[1].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@skadtec[1].txt. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@skadtec[1].txt. ")) returned 1 [0145.675] FindNextFileA (in: hFindFile=0x5be320, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0145.675] PeekMessageA (in: lpMsg=0xaece4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaece4) returned 0 [0145.675] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="5p5nrgjn0js_halpmcxz@track.adform[2].txt") returned 1 [0145.675] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="5p5nrgjn0js_halpmcxz@track.adform[2].txt") returned 1 [0145.676] lstrcmpiA (lpString1="", lpString2="5p5nrgjn0js_halpmcxz@track.adform[2].txt") returned -1 [0145.676] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0145.676] CloseHandle (hObject=0x9c) returned 1 [0145.676] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@track.adform[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@track.adform[2].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@track.adform[2].txt. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@track.adform[2].txt. ")) returned 1 [0145.677] FindNextFileA (in: hFindFile=0x5be320, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0145.677] PeekMessageA (in: lpMsg=0xaece4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaece4) returned 0 [0145.677] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="5p5nrgjn0js_halpmcxz@www.bing[2].txt") returned 1 [0145.677] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="5p5nrgjn0js_halpmcxz@www.bing[2].txt") returned 1 [0145.677] lstrcmpiA (lpString1="", lpString2="5p5nrgjn0js_halpmcxz@www.bing[2].txt") returned -1 [0145.678] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0145.678] CloseHandle (hObject=0x9c) returned 1 [0145.678] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@www.bing[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@www.bing[2].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@www.bing[2].txt. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@www.bing[2].txt. ")) returned 1 [0145.678] FindNextFileA (in: hFindFile=0x5be320, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0145.678] PeekMessageA (in: lpMsg=0xaece4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaece4) returned 0 [0145.678] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="5p5nrgjn0js_halpmcxz@www.linkedin[1].txt") returned 1 [0145.678] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="5p5nrgjn0js_halpmcxz@www.linkedin[1].txt") returned 1 [0145.678] lstrcmpiA (lpString1="", lpString2="5p5nrgjn0js_halpmcxz@www.linkedin[1].txt") returned -1 [0145.679] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0145.679] CloseHandle (hObject=0x9c) returned 1 [0145.679] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@www.linkedin[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@www.linkedin[1].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@www.linkedin[1].txt. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@www.linkedin[1].txt. ")) returned 1 [0145.680] FindNextFileA (in: hFindFile=0x5be320, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0145.680] PeekMessageA (in: lpMsg=0xaece4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaece4) returned 0 [0145.680] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="5p5nrgjn0js_halpmcxz@www.msn[2].txt") returned 1 [0145.680] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="5p5nrgjn0js_halpmcxz@www.msn[2].txt") returned 1 [0145.680] lstrcmpiA (lpString1="", lpString2="5p5nrgjn0js_halpmcxz@www.msn[2].txt") returned -1 [0145.918] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0145.918] CloseHandle (hObject=0x9c) returned 1 [0145.918] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@www.msn[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@www.msn[2].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@www.msn[2].txt. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@www.msn[2].txt. ")) returned 1 [0145.920] FindNextFileA (in: hFindFile=0x5be320, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0145.920] PeekMessageA (in: lpMsg=0xaece4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaece4) returned 0 [0145.920] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="index.dat") returned -1 [0145.920] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="index.dat") returned -1 [0145.920] lstrcmpiA (lpString1="", lpString2="index.dat") returned -1 [0145.920] FindNextFileA (in: hFindFile=0x5be320, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 0 [0145.920] FindClose (in: hFindFile=0x5be320 | out: hFindFile=0x5be320) returned 1 [0145.920] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 0 [0145.920] FindClose (in: hFindFile=0x5be2e0 | out: hFindFile=0x5be2e0) returned 1 [0145.920] FindNextFileA (in: hFindFile=0x5be2a0, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0145.920] lstrcmpA (lpString1=".", lpString2="IECompatCache") returned -1 [0145.920] lstrcmpA (lpString1="..", lpString2="IECompatCache") returned -1 [0145.920] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\IECompatCache\\*.*", lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 0x5be2e0 [0145.920] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0145.920] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0145.920] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0145.920] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0145.920] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0145.920] lstrcmpA (lpString1=".", lpString2="Low") returned -1 [0145.920] lstrcmpA (lpString1="..", lpString2="Low") returned -1 [0145.920] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\IECompatCache\\Low\\*.*", lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 0x5be320 [0145.921] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0145.921] FindNextFileA (in: hFindFile=0x5be320, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0145.921] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0145.921] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0145.921] FindNextFileA (in: hFindFile=0x5be320, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 0 [0145.921] FindClose (in: hFindFile=0x5be320 | out: hFindFile=0x5be320) returned 1 [0145.921] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 0 [0145.921] FindClose (in: hFindFile=0x5be2e0 | out: hFindFile=0x5be2e0) returned 1 [0145.921] FindNextFileA (in: hFindFile=0x5be2a0, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0145.921] lstrcmpA (lpString1=".", lpString2="IETldCache") returned -1 [0145.921] lstrcmpA (lpString1="..", lpString2="IETldCache") returned -1 [0145.921] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\*.*", lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 0x5be2e0 [0145.921] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0145.921] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0145.921] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0145.921] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0145.921] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0145.921] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0145.921] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="index.dat") returned -1 [0145.921] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="index.dat") returned -1 [0145.921] lstrcmpiA (lpString1="", lpString2="index.dat") returned -1 [0145.921] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0145.921] lstrcmpA (lpString1=".", lpString2="Low") returned -1 [0145.921] lstrcmpA (lpString1="..", lpString2="Low") returned -1 [0145.921] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\Low\\*.*", lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 0x5be320 [0145.922] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0145.922] FindNextFileA (in: hFindFile=0x5be320, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0145.922] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0145.922] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0145.922] FindNextFileA (in: hFindFile=0x5be320, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0145.922] PeekMessageA (in: lpMsg=0xaece4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaece4) returned 0 [0145.922] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="index.dat") returned -1 [0145.922] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="index.dat") returned -1 [0145.922] lstrcmpiA (lpString1="", lpString2="index.dat") returned -1 [0145.922] FindNextFileA (in: hFindFile=0x5be320, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 0 [0145.922] FindClose (in: hFindFile=0x5be320 | out: hFindFile=0x5be320) returned 1 [0145.922] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 0 [0145.922] FindClose (in: hFindFile=0x5be2e0 | out: hFindFile=0x5be2e0) returned 1 [0145.922] FindNextFileA (in: hFindFile=0x5be2a0, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0145.922] lstrcmpA (lpString1=".", lpString2="Libraries") returned -1 [0145.922] lstrcmpA (lpString1="..", lpString2="Libraries") returned -1 [0145.922] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\*.*", lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 0x5be2e0 [0145.922] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0145.922] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0145.922] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0145.922] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0145.922] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0145.922] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0145.922] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="desktop.ini") returned 1 [0145.922] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="desktop.ini") returned 1 [0145.922] lstrcmpiA (lpString1="", lpString2="desktop.ini") returned -1 [0145.922] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0145.923] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0145.923] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Documents.library-ms") returned 1 [0145.923] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Documents.library-ms") returned 1 [0145.923] lstrcmpiA (lpString1="", lpString2="Documents.library-ms") returned -1 [0145.923] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0145.923] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0145.923] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Music.library-ms") returned -1 [0145.923] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Music.library-ms") returned -1 [0145.923] lstrcmpiA (lpString1="", lpString2="Music.library-ms") returned -1 [0145.923] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0145.923] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0145.923] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Pictures.library-ms") returned -1 [0145.923] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Pictures.library-ms") returned -1 [0145.923] lstrcmpiA (lpString1="", lpString2="Pictures.library-ms") returned -1 [0145.923] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0145.923] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0145.923] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="Videos.library-ms") returned -1 [0145.923] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="Videos.library-ms") returned -1 [0145.923] lstrcmpiA (lpString1="", lpString2="Videos.library-ms") returned -1 [0145.923] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 0 [0145.923] FindClose (in: hFindFile=0x5be2e0 | out: hFindFile=0x5be2e0) returned 1 [0145.923] FindNextFileA (in: hFindFile=0x5be2a0, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0145.923] lstrcmpA (lpString1=".", lpString2="Network Shortcuts") returned -1 [0145.923] lstrcmpA (lpString1="..", lpString2="Network Shortcuts") returned -1 [0145.923] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Network Shortcuts\\*.*", lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 0x5be2e0 [0145.924] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0145.924] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0145.924] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0145.924] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0145.924] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 0 [0145.924] FindClose (in: hFindFile=0x5be2e0 | out: hFindFile=0x5be2e0) returned 1 [0145.924] FindNextFileA (in: hFindFile=0x5be2a0, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0145.924] lstrcmpA (lpString1=".", lpString2="Printer Shortcuts") returned -1 [0145.924] lstrcmpA (lpString1="..", lpString2="Printer Shortcuts") returned -1 [0145.924] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Printer Shortcuts\\*.*", lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 0x5be2e0 [0145.924] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0145.924] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0145.924] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0145.924] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0145.924] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 0 [0145.924] FindClose (in: hFindFile=0x5be2e0 | out: hFindFile=0x5be2e0) returned 1 [0145.924] FindNextFileA (in: hFindFile=0x5be2a0, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0145.924] lstrcmpA (lpString1=".", lpString2="PrivacIE") returned -1 [0145.925] lstrcmpA (lpString1="..", lpString2="PrivacIE") returned -1 [0145.925] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\*.*", lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 0x5be2e0 [0145.925] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0145.925] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0145.925] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0145.925] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0145.925] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0145.925] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0145.925] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="index.dat") returned -1 [0145.925] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="index.dat") returned -1 [0145.925] lstrcmpiA (lpString1="", lpString2="index.dat") returned -1 [0145.925] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0145.925] lstrcmpA (lpString1=".", lpString2="Low") returned -1 [0145.925] lstrcmpA (lpString1="..", lpString2="Low") returned -1 [0145.925] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\Low\\*.*", lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 0x5be320 [0145.926] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0145.926] FindNextFileA (in: hFindFile=0x5be320, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0145.926] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0145.926] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0145.926] FindNextFileA (in: hFindFile=0x5be320, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0145.926] PeekMessageA (in: lpMsg=0xaece4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaece4) returned 0 [0145.926] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="index.dat") returned -1 [0145.926] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="index.dat") returned -1 [0145.926] lstrcmpiA (lpString1="", lpString2="index.dat") returned -1 [0145.926] FindNextFileA (in: hFindFile=0x5be320, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 0 [0145.926] FindClose (in: hFindFile=0x5be320 | out: hFindFile=0x5be320) returned 1 [0145.926] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 0 [0145.926] FindClose (in: hFindFile=0x5be2e0 | out: hFindFile=0x5be2e0) returned 1 [0145.926] FindNextFileA (in: hFindFile=0x5be2a0, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0145.926] lstrcmpA (lpString1=".", lpString2="Recent") returned -1 [0145.926] lstrcmpA (lpString1="..", lpString2="Recent") returned -1 [0145.926] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\*.*", lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 0x5be2e0 [0145.926] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0145.926] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0145.927] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0145.927] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0145.927] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0145.927] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0145.927] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="-ad v8qJXko5PBvD.mkv.lnk") returned 1 [0145.927] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="-ad v8qJXko5PBvD.mkv.lnk") returned 1 [0145.927] lstrcmpiA (lpString1="", lpString2="-ad v8qJXko5PBvD.mkv.lnk") returned -1 [0145.928] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0145.928] CloseHandle (hObject=0x98) returned 1 [0145.928] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-ad v8qJXko5PBvD.mkv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\-ad v8qjxko5pbvd.mkv.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-ad v8qJXko5PBvD.mkv.lnk. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\-ad v8qjxko5pbvd.mkv.lnk. ")) returned 1 [0145.930] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0145.930] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0145.930] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="-tnNfBex7mqgiThQ.lnk") returned -1 [0145.930] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="-tnNfBex7mqgiThQ.lnk") returned -1 [0145.930] lstrcmpiA (lpString1="", lpString2="-tnNfBex7mqgiThQ.lnk") returned -1 [0145.931] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0145.931] CloseHandle (hObject=0x98) returned 1 [0145.931] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-tnNfBex7mqgiThQ.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\-tnnfbex7mqgithq.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-tnNfBex7mqgiThQ.lnk. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\-tnnfbex7mqgithq.lnk. ")) returned 1 [0145.932] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0145.932] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0145.932] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="0fie7MvEycUEykcbBu.lnk") returned 1 [0145.933] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="0fie7MvEycUEykcbBu.lnk") returned 1 [0145.933] lstrcmpiA (lpString1="", lpString2="0fie7MvEycUEykcbBu.lnk") returned -1 [0145.933] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0145.934] CloseHandle (hObject=0x98) returned 1 [0145.934] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\0fie7MvEycUEykcbBu.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\0fie7mveycueykcbbu.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\0fie7MvEycUEykcbBu.lnk. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\0fie7mveycueykcbbu.lnk. ")) returned 1 [0145.935] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0145.935] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0145.935] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="0Hi8oEKPbZG3U4d2x.lnk") returned 1 [0145.935] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="0Hi8oEKPbZG3U4d2x.lnk") returned 1 [0145.935] lstrcmpiA (lpString1="", lpString2="0Hi8oEKPbZG3U4d2x.lnk") returned -1 [0145.936] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0145.936] CloseHandle (hObject=0x98) returned 1 [0145.936] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\0Hi8oEKPbZG3U4d2x.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\0hi8oekpbzg3u4d2x.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\0Hi8oEKPbZG3U4d2x.lnk. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\0hi8oekpbzg3u4d2x.lnk. ")) returned 1 [0145.937] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0145.937] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0145.938] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="0xU5G.lnk") returned 1 [0145.938] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="0xU5G.lnk") returned 1 [0145.938] lstrcmpiA (lpString1="", lpString2="0xU5G.lnk") returned -1 [0145.939] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0145.939] CloseHandle (hObject=0x98) returned 1 [0145.939] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\0xU5G.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\0xu5g.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\0xU5G.lnk. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\0xu5g.lnk. ")) returned 1 [0145.941] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0145.941] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0145.941] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="0YILzG.lnk") returned 1 [0145.941] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="0YILzG.lnk") returned 1 [0145.941] lstrcmpiA (lpString1="", lpString2="0YILzG.lnk") returned -1 [0145.942] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0145.942] CloseHandle (hObject=0x98) returned 1 [0145.942] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\0YILzG.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\0yilzg.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\0YILzG.lnk. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\0yilzg.lnk. ")) returned 1 [0145.943] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0145.943] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0145.943] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="15R26OlnzJjUVs6G6.lnk") returned 1 [0145.943] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="15R26OlnzJjUVs6G6.lnk") returned 1 [0145.943] lstrcmpiA (lpString1="", lpString2="15R26OlnzJjUVs6G6.lnk") returned -1 [0145.944] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0145.944] CloseHandle (hObject=0x98) returned 1 [0145.944] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\15R26OlnzJjUVs6G6.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\15r26olnzjjuvs6g6.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\15R26OlnzJjUVs6G6.lnk. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\15r26olnzjjuvs6g6.lnk. ")) returned 1 [0145.945] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0145.945] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0145.945] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="193Ls.lnk") returned 1 [0145.945] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="193Ls.lnk") returned 1 [0145.945] lstrcmpiA (lpString1="", lpString2="193Ls.lnk") returned -1 [0145.946] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0145.946] CloseHandle (hObject=0x98) returned 1 [0145.946] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\193Ls.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\193ls.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\193Ls.lnk. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\193ls.lnk. ")) returned 1 [0145.947] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0145.948] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0145.948] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="1RN39nFJiwKC.lnk") returned 1 [0145.948] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="1RN39nFJiwKC.lnk") returned 1 [0145.948] lstrcmpiA (lpString1="", lpString2="1RN39nFJiwKC.lnk") returned -1 [0145.949] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0145.949] CloseHandle (hObject=0x98) returned 1 [0145.949] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\1RN39nFJiwKC.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\1rn39nfjiwkc.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\1RN39nFJiwKC.lnk. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\1rn39nfjiwkc.lnk. ")) returned 1 [0145.951] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0145.951] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0145.951] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="1_tFjjnncfM146Ye.lnk") returned 1 [0145.951] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="1_tFjjnncfM146Ye.lnk") returned 1 [0145.951] lstrcmpiA (lpString1="", lpString2="1_tFjjnncfM146Ye.lnk") returned -1 [0145.952] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0145.952] CloseHandle (hObject=0x98) returned 1 [0145.952] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\1_tFjjnncfM146Ye.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\1_tfjjnncfm146ye.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\1_tFjjnncfM146Ye.lnk. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\1_tfjjnncfm146ye.lnk. ")) returned 1 [0145.953] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0145.953] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0145.953] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="2bsanz3dRmlbjQf_Wfn.lnk") returned 1 [0145.953] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="2bsanz3dRmlbjQf_Wfn.lnk") returned 1 [0145.953] lstrcmpiA (lpString1="", lpString2="2bsanz3dRmlbjQf_Wfn.lnk") returned -1 [0145.954] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0145.958] CloseHandle (hObject=0x98) returned 1 [0145.958] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2bsanz3dRmlbjQf_Wfn.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\2bsanz3drmlbjqf_wfn.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2bsanz3dRmlbjQf_Wfn.lnk. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\2bsanz3drmlbjqf_wfn.lnk. ")) returned 1 [0145.960] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0145.960] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0145.960] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="3yEM63.lnk") returned 1 [0145.960] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="3yEM63.lnk") returned 1 [0145.960] lstrcmpiA (lpString1="", lpString2="3yEM63.lnk") returned -1 [0145.961] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0145.961] CloseHandle (hObject=0x98) returned 1 [0145.961] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\3yEM63.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\3yem63.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\3yEM63.lnk. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\3yem63.lnk. ")) returned 1 [0145.962] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0145.962] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0145.963] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="4jabiI9_S3U_N_Mveh.lnk") returned 1 [0145.963] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="4jabiI9_S3U_N_Mveh.lnk") returned 1 [0145.963] lstrcmpiA (lpString1="", lpString2="4jabiI9_S3U_N_Mveh.lnk") returned -1 [0145.963] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0145.963] CloseHandle (hObject=0x98) returned 1 [0145.963] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\4jabiI9_S3U_N_Mveh.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\4jabii9_s3u_n_mveh.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\4jabiI9_S3U_N_Mveh.lnk. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\4jabii9_s3u_n_mveh.lnk. ")) returned 1 [0145.964] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0145.964] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0145.964] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="4t li.lnk") returned 1 [0145.964] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="4t li.lnk") returned 1 [0145.964] lstrcmpiA (lpString1="", lpString2="4t li.lnk") returned -1 [0145.965] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0145.965] CloseHandle (hObject=0x98) returned 1 [0145.965] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\4t li.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\4t li.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\4t li.lnk. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\4t li.lnk. ")) returned 1 [0145.966] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0145.966] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0145.966] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="53r SvwxlErdM_283n.lnk") returned 1 [0145.966] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="53r SvwxlErdM_283n.lnk") returned 1 [0145.966] lstrcmpiA (lpString1="", lpString2="53r SvwxlErdM_283n.lnk") returned -1 [0145.967] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0145.967] CloseHandle (hObject=0x98) returned 1 [0145.967] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\53r SvwxlErdM_283n.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\53r svwxlerdm_283n.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\53r SvwxlErdM_283n.lnk. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\53r svwxlerdm_283n.lnk. ")) returned 1 [0145.968] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0145.968] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0145.968] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="5nyCGZFEbR.lnk") returned 1 [0145.968] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="5nyCGZFEbR.lnk") returned 1 [0145.968] lstrcmpiA (lpString1="", lpString2="5nyCGZFEbR.lnk") returned -1 [0145.968] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0145.969] CloseHandle (hObject=0x98) returned 1 [0145.969] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\5nyCGZFEbR.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\5nycgzfebr.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\5nyCGZFEbR.lnk. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\5nycgzfebr.lnk. ")) returned 1 [0145.969] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0145.969] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0145.969] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="5o_0ov2PrpTq-Hs.lnk") returned 1 [0145.969] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="5o_0ov2PrpTq-Hs.lnk") returned 1 [0145.969] lstrcmpiA (lpString1="", lpString2="5o_0ov2PrpTq-Hs.lnk") returned -1 [0145.970] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0145.970] CloseHandle (hObject=0x98) returned 1 [0145.970] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\5o_0ov2PrpTq-Hs.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\5o_0ov2prptq-hs.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\5o_0ov2PrpTq-Hs.lnk. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\5o_0ov2prptq-hs.lnk. ")) returned 1 [0145.971] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0145.971] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0145.971] lstrcmpiA (lpString1="\xca\xc0\xca\x20\xd0\xc0\xd1\xd8\xc8\xd4\xd0\xce\xc2\xc0\xd2\xdc\x20\xd4\xc0\xc9\xcb\xdb\x2e\x74\x78\x74", lpString2="60JBa6.flv.lnk") returned 1 [0145.971] lstrcmpiA (lpString1="HOW TO DECRYPT FILES.txt", lpString2="60JBa6.flv.lnk") returned 1 [0145.971] lstrcmpiA (lpString1="", lpString2="60JBa6.flv.lnk") returned -1 [0145.972] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0145.972] CloseHandle (hObject=0x98) returned 1 [0145.972] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\60JBa6.flv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\60jba6.flv.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\60JBa6.flv.lnk. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\60jba6.flv.lnk. ")) returned 1 [0145.972] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0145.972] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0145.973] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0145.973] CloseHandle (hObject=0x98) returned 1 [0145.973] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\64VXuX.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\64vxux.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\64VXuX.lnk. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\64vxux.lnk. ")) returned 1 [0145.974] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0145.974] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0145.975] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0145.975] CloseHandle (hObject=0x98) returned 1 [0145.975] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6uXHe5 X6AO0_U_pl.flv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\6uxhe5 x6ao0_u_pl.flv.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6uXHe5 X6AO0_U_pl.flv.lnk. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\6uxhe5 x6ao0_u_pl.flv.lnk. ")) returned 1 [0145.975] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0145.975] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0145.976] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0145.976] CloseHandle (hObject=0x98) returned 1 [0145.976] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6uZldM.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\6uzldm.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6uZldM.lnk. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\6uzldm.lnk. ")) returned 1 [0145.978] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0145.978] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0145.979] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0145.979] CloseHandle (hObject=0x98) returned 1 [0145.979] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\7 QBiPQwdYoYoC.flv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\7 qbipqwdyoyoc.flv.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\7 QBiPQwdYoYoC.flv.lnk. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\7 qbipqwdyoyoc.flv.lnk. ")) returned 1 [0145.980] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0145.980] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0145.981] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0145.981] CloseHandle (hObject=0x98) returned 1 [0145.981] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\7DHNurxjXK.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\7dhnurxjxk.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\7DHNurxjXK.lnk. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\7dhnurxjxk.lnk. ")) returned 1 [0145.982] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0145.982] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0145.983] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0145.983] CloseHandle (hObject=0x98) returned 1 [0145.983] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\7whz1Vn5TZzaCukZlM.mkv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\7whz1vn5tzzacukzlm.mkv.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\7whz1Vn5TZzaCukZlM.mkv.lnk. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\7whz1vn5tzzacukzlm.mkv.lnk. ")) returned 1 [0145.984] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0145.984] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0145.985] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0145.985] CloseHandle (hObject=0x98) returned 1 [0145.985] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\82kn_GJnK77zOElf.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\82kn_gjnk77zoelf.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\82kn_GJnK77zOElf.lnk. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\82kn_gjnk77zoelf.lnk. ")) returned 1 [0145.986] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0145.986] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0145.987] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0145.987] CloseHandle (hObject=0x98) returned 1 [0145.987] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\89FoRDNId-.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\89fordnid-.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\89FoRDNId-.lnk. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\89fordnid-.lnk. ")) returned 1 [0145.988] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0145.988] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0145.988] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0145.988] CloseHandle (hObject=0x98) returned 1 [0145.988] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\8O9Ij3Qj.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\8o9ij3qj.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\8O9Ij3Qj.lnk. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\8o9ij3qj.lnk. ")) returned 1 [0145.989] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0145.989] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0145.990] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0145.990] CloseHandle (hObject=0x98) returned 1 [0145.990] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\9dk-99.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\9dk-99.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\9dk-99.lnk. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\9dk-99.lnk. ")) returned 1 [0145.991] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0145.991] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0145.991] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0145.991] CloseHandle (hObject=0x98) returned 1 [0145.991] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\9SpDS7OruKmntE.mkv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\9spds7orukmnte.mkv.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\9SpDS7OruKmntE.mkv.lnk. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\9spds7orukmnte.mkv.lnk. ")) returned 1 [0145.992] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0145.992] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0145.993] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0145.993] CloseHandle (hObject=0x98) returned 1 [0145.993] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\A3r09Z6nlT.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\a3r09z6nlt.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\A3r09Z6nlT.lnk. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\a3r09z6nlt.lnk. ")) returned 1 [0145.994] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0145.994] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0145.994] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0145.995] CloseHandle (hObject=0x98) returned 1 [0145.995] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\a6HBeB5duKFJVHD.mkv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\a6hbeb5dukfjvhd.mkv.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\a6HBeB5duKFJVHD.mkv.lnk. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\a6hbeb5dukfjvhd.mkv.lnk. ")) returned 1 [0145.995] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0145.995] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0145.996] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0145.996] CloseHandle (hObject=0x98) returned 1 [0145.996] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AdGZSRwkjFa4ek.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\adgzsrwkjfa4ek.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AdGZSRwkjFa4ek.lnk. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\adgzsrwkjfa4ek.lnk. ")) returned 1 [0145.997] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0145.997] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0145.998] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0145.998] CloseHandle (hObject=0x98) returned 1 [0145.998] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AiQSU bki.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\aiqsu bki.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AiQSU bki.lnk. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\aiqsu bki.lnk. ")) returned 1 [0145.999] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0145.999] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0145.999] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0145.999] CloseHandle (hObject=0x98) returned 1 [0145.999] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\aSXrcW1Lgbdq.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\asxrcw1lgbdq.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\aSXrcW1Lgbdq.lnk. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\asxrcw1lgbdq.lnk. ")) returned 1 [0146.000] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0146.000] lstrcmpA (lpString1=".", lpString2="AutomaticDestinations") returned -1 [0146.000] lstrcmpA (lpString1="..", lpString2="AutomaticDestinations") returned -1 [0146.000] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\*.*", lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 0x5be320 [0146.000] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0146.000] FindNextFileA (in: hFindFile=0x5be320, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0146.000] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0146.001] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0146.001] FindNextFileA (in: hFindFile=0x5be320, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0146.001] PeekMessageA (in: lpMsg=0xaece4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaece4) returned 0 [0146.001] FindNextFileA (in: hFindFile=0x5be320, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0146.001] PeekMessageA (in: lpMsg=0xaece4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaece4) returned 0 [0146.001] FindNextFileA (in: hFindFile=0x5be320, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0146.001] PeekMessageA (in: lpMsg=0xaece4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaece4) returned 0 [0146.001] FindNextFileA (in: hFindFile=0x5be320, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 0 [0146.001] FindClose (in: hFindFile=0x5be320 | out: hFindFile=0x5be320) returned 1 [0146.001] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0146.001] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0146.003] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0146.003] CloseHandle (hObject=0x98) returned 1 [0146.003] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\BB4fcg7KB.ots.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\bb4fcg7kb.ots.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\BB4fcg7KB.ots.lnk. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\bb4fcg7kb.ots.lnk. ")) returned 1 [0146.004] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0146.004] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0146.004] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0146.005] CloseHandle (hObject=0x98) returned 1 [0146.005] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\bHx_T9GNKL1OT.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\bhx_t9gnkl1ot.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\bHx_T9GNKL1OT.lnk. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\bhx_t9gnkl1ot.lnk. ")) returned 1 [0146.005] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0146.005] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0146.006] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0146.006] CloseHandle (hObject=0x98) returned 1 [0146.006] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\bKK.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\bkk.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\bKK.lnk. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\bkk.lnk. ")) returned 1 [0146.007] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0146.007] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0146.008] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0146.008] CloseHandle (hObject=0x98) returned 1 [0146.008] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\BPyZbr8Oh6BW.mkv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\bpyzbr8oh6bw.mkv.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\BPyZbr8Oh6BW.mkv.lnk. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\bpyzbr8oh6bw.mkv.lnk. ")) returned 1 [0146.009] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0146.009] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0146.009] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0146.009] CloseHandle (hObject=0x98) returned 1 [0146.010] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\BQlQYsk2Dks.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\bqlqysk2dks.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\BQlQYsk2Dks.lnk. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\bqlqysk2dks.lnk. ")) returned 1 [0146.010] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0146.010] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0146.011] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0146.011] CloseHandle (hObject=0x98) returned 1 [0146.011] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CBI_3.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\cbi_3.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CBI_3.lnk. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\cbi_3.lnk. ")) returned 1 [0146.012] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0146.012] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0146.013] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0146.013] CloseHandle (hObject=0x98) returned 1 [0146.013] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\cjwwU48s.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\cjwwu48s.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\cjwwU48s.lnk. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\cjwwu48s.lnk. ")) returned 1 [0146.014] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0146.014] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0146.014] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0146.014] CloseHandle (hObject=0x98) returned 1 [0146.014] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Ct-UuWUq2GKbwky.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ct-uuwuq2gkbwky.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Ct-UuWUq2GKbwky.lnk. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ct-uuwuq2gkbwky.lnk. ")) returned 1 [0146.015] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0146.015] lstrcmpA (lpString1=".", lpString2="CustomDestinations") returned -1 [0146.015] lstrcmpA (lpString1="..", lpString2="CustomDestinations") returned -1 [0146.015] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\*.*", lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 0x5be320 [0146.016] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0146.016] FindNextFileA (in: hFindFile=0x5be320, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0146.016] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0146.016] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0146.016] FindNextFileA (in: hFindFile=0x5be320, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0146.016] PeekMessageA (in: lpMsg=0xaece4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaece4) returned 0 [0146.016] FindNextFileA (in: hFindFile=0x5be320, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0146.016] PeekMessageA (in: lpMsg=0xaece4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaece4) returned 0 [0146.016] FindNextFileA (in: hFindFile=0x5be320, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0146.016] PeekMessageA (in: lpMsg=0xaece4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaece4) returned 0 [0146.016] FindNextFileA (in: hFindFile=0x5be320, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0146.016] PeekMessageA (in: lpMsg=0xaece4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaece4) returned 0 [0146.016] FindNextFileA (in: hFindFile=0x5be320, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0146.016] PeekMessageA (in: lpMsg=0xaece4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaece4) returned 0 [0146.016] FindNextFileA (in: hFindFile=0x5be320, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0146.016] PeekMessageA (in: lpMsg=0xaece4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaece4) returned 0 [0146.017] FindNextFileA (in: hFindFile=0x5be320, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0146.017] PeekMessageA (in: lpMsg=0xaece4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaece4) returned 0 [0146.017] FindNextFileA (in: hFindFile=0x5be320, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 0 [0146.017] FindClose (in: hFindFile=0x5be320 | out: hFindFile=0x5be320) returned 1 [0146.017] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0146.017] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0146.018] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0146.018] CloseHandle (hObject=0x98) returned 1 [0146.018] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\d Phmic.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\d phmic.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\d Phmic.lnk. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\d phmic.lnk. ")) returned 1 [0146.019] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0146.019] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0146.019] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0146.019] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0146.019] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0146.020] CloseHandle (hObject=0x98) returned 1 [0146.020] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\DV8a0q-.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\dv8a0q-.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\DV8a0q-.lnk. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\dv8a0q-.lnk. ")) returned 1 [0146.020] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0146.020] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0146.021] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0146.021] CloseHandle (hObject=0x98) returned 1 [0146.021] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\eK1Cx1C.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ek1cx1c.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\eK1Cx1C.lnk. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ek1cx1c.lnk. ")) returned 1 [0146.022] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0146.022] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0146.022] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0146.022] CloseHandle (hObject=0x98) returned 1 [0146.022] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\fIwoj0KgTcI7.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\fiwoj0kgtci7.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\fIwoj0KgTcI7.lnk. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\fiwoj0kgtci7.lnk. ")) returned 1 [0146.023] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0146.023] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0146.024] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0146.024] CloseHandle (hObject=0x98) returned 1 [0146.024] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\fjli4uzIstTI9x.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\fjli4uzistti9x.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\fjli4uzIstTI9x.lnk. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\fjli4uzistti9x.lnk. ")) returned 1 [0146.025] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0146.025] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0146.025] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0146.025] CloseHandle (hObject=0x98) returned 1 [0146.025] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\FQ3Upfz1amfQZ2xNxp1Q.mkv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\fq3upfz1amfqz2xnxp1q.mkv.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\FQ3Upfz1amfQZ2xNxp1Q.mkv.lnk. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\fq3upfz1amfqz2xnxp1q.mkv.lnk. ")) returned 1 [0146.026] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0146.026] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0146.027] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0146.027] CloseHandle (hObject=0x98) returned 1 [0146.027] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\fsk_.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\fsk_.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\fsk_.lnk. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\fsk_.lnk. ")) returned 1 [0146.028] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0146.028] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0146.029] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0146.029] CloseHandle (hObject=0x98) returned 1 [0146.029] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\fxdBRP49R7q6PRxfRu.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\fxdbrp49r7q6prxfru.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\fxdBRP49R7q6PRxfRu.lnk. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\fxdbrp49r7q6prxfru.lnk. ")) returned 1 [0146.030] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0146.030] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0146.030] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0146.030] CloseHandle (hObject=0x98) returned 1 [0146.031] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\FYQTd_zPNzA9s2.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\fyqtd_zpnza9s2.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\FYQTd_zPNzA9s2.lnk. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\fyqtd_zpnza9s2.lnk. ")) returned 1 [0146.031] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0146.031] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0146.032] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0146.032] CloseHandle (hObject=0x98) returned 1 [0146.032] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\G1MLA2tK-JJG5d3fLkfZ.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\g1mla2tk-jjg5d3flkfz.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\G1MLA2tK-JJG5d3fLkfZ.lnk. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\g1mla2tk-jjg5d3flkfz.lnk. ")) returned 1 [0146.033] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0146.033] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0146.033] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0146.033] CloseHandle (hObject=0x98) returned 1 [0146.033] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gwFpPFGy1QM.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\gwfppfgy1qm.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gwFpPFGy1QM.lnk. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\gwfppfgy1qm.lnk. ")) returned 1 [0146.034] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0146.034] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0146.035] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0146.036] CloseHandle (hObject=0x98) returned 1 [0146.036] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HAn69yxr nLWNq02.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\han69yxr nlwnq02.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HAn69yxr nLWNq02.lnk. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\han69yxr nlwnq02.lnk. ")) returned 1 [0146.038] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0146.038] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0146.039] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0146.039] CloseHandle (hObject=0x98) returned 1 [0146.039] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HC7Y5SE-m.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\hc7y5se-m.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HC7Y5SE-m.lnk. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\hc7y5se-m.lnk. ")) returned 1 [0146.043] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0146.043] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0146.044] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0146.044] CloseHandle (hObject=0x98) returned 1 [0146.045] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\i24JjAXVDjI.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\i24jjaxvdji.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\i24JjAXVDjI.lnk. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\i24jjaxvdji.lnk. ")) returned 1 [0146.047] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0146.047] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0146.047] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0146.048] CloseHandle (hObject=0x98) returned 1 [0146.048] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ia9.flv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ia9.flv.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ia9.flv.lnk. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ia9.flv.lnk. ")) returned 1 [0146.050] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0146.050] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0146.051] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0146.051] CloseHandle (hObject=0x98) returned 1 [0146.051] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\INYp.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\inyp.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\INYp.lnk. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\inyp.lnk. ")) returned 1 [0146.053] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0146.053] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0146.053] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0146.053] CloseHandle (hObject=0x98) returned 1 [0146.053] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Iu3OQowEiC-X0.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\iu3oqoweic-x0.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Iu3OQowEiC-X0.lnk. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\iu3oqoweic-x0.lnk. ")) returned 1 [0146.056] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0146.056] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0146.057] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0146.057] CloseHandle (hObject=0x98) returned 1 [0146.058] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Iuybio5Cn-um8.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\iuybio5cn-um8.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Iuybio5Cn-um8.lnk. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\iuybio5cn-um8.lnk. ")) returned 1 [0146.059] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0146.059] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0146.059] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0146.060] CloseHandle (hObject=0x98) returned 1 [0146.060] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Ji0g1ikEO3UGmO154xM.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ji0g1ikeo3ugmo154xm.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Ji0g1ikEO3UGmO154xM.lnk. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ji0g1ikeo3ugmo154xm.lnk. ")) returned 1 [0146.060] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0146.060] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0146.061] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0146.061] CloseHandle (hObject=0x98) returned 1 [0146.061] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\JjkXYh.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\jjkxyh.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\JjkXYh.lnk. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\jjkxyh.lnk. ")) returned 1 [0146.062] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0146.062] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0146.063] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0146.063] CloseHandle (hObject=0x98) returned 1 [0146.063] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\jQmdt.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\jqmdt.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\jQmdt.lnk. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\jqmdt.lnk. ")) returned 1 [0146.064] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0146.064] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0146.064] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0146.064] CloseHandle (hObject=0x98) returned 1 [0146.065] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\k2fUYx_jT2wvJj0aN.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\k2fuyx_jt2wvjj0an.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\k2fUYx_jT2wvJj0aN.lnk. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\k2fuyx_jt2wvjj0an.lnk. ")) returned 1 [0146.066] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0146.066] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0146.066] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0146.066] CloseHandle (hObject=0x98) returned 1 [0146.066] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\K7ld6Txng.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\k7ld6txng.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\K7ld6Txng.lnk. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\k7ld6txng.lnk. ")) returned 1 [0146.069] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0146.069] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0146.070] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0146.070] CloseHandle (hObject=0x98) returned 1 [0146.070] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\KK-cwaVz_9GpQhswtqeq.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\kk-cwavz_9gpqhswtqeq.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\KK-cwaVz_9GpQhswtqeq.lnk. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\kk-cwavz_9gpqhswtqeq.lnk. ")) returned 1 [0146.072] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0146.072] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0146.073] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0146.073] CloseHandle (hObject=0x98) returned 1 [0146.073] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\kXEhU3Sozs.mkv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\kxehu3sozs.mkv.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\kXEhU3Sozs.mkv.lnk. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\kxehu3sozs.mkv.lnk. ")) returned 1 [0146.073] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0146.074] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0146.074] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0146.074] CloseHandle (hObject=0x98) returned 1 [0146.074] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\l225SHbbchPUIQpFP_1q.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\l225shbbchpuiqpfp_1q.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\l225SHbbchPUIQpFP_1q.lnk. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\l225shbbchpuiqpfp_1q.lnk. ")) returned 1 [0146.075] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0146.075] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0146.076] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0146.076] CloseHandle (hObject=0x98) returned 1 [0146.076] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LBvmQHI29Sf73eBGQfg3.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\lbvmqhi29sf73ebgqfg3.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LBvmQHI29Sf73eBGQfg3.lnk. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\lbvmqhi29sf73ebgqfg3.lnk. ")) returned 1 [0146.076] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0146.076] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0146.077] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0146.077] CloseHandle (hObject=0x98) returned 1 [0146.077] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\lFoeLgWwfglH2CDts.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\lfoelgwwfglh2cdts.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\lFoeLgWwfglH2CDts.lnk. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\lfoelgwwfglh2cdts.lnk. ")) returned 1 [0146.078] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0146.078] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0146.079] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0146.079] CloseHandle (hObject=0x98) returned 1 [0146.079] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LKzHE.mkv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\lkzhe.mkv.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LKzHE.mkv.lnk. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\lkzhe.mkv.lnk. ")) returned 1 [0146.080] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0146.080] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0146.080] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0146.080] CloseHandle (hObject=0x98) returned 1 [0146.081] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Lmgb8I1a1f1Z7viJR.flv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\lmgb8i1a1f1z7vijr.flv.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Lmgb8I1a1f1Z7viJR.flv.lnk. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\lmgb8i1a1f1z7vijr.flv.lnk. ")) returned 1 [0146.081] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0146.081] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0146.082] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0146.082] CloseHandle (hObject=0x98) returned 1 [0146.082] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\lXUA3o.mkv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\lxua3o.mkv.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\lXUA3o.mkv.lnk. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\lxua3o.mkv.lnk. ")) returned 1 [0146.083] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0146.083] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0146.084] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0146.084] CloseHandle (hObject=0x98) returned 1 [0146.084] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\maVSd7.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\mavsd7.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\maVSd7.lnk. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\mavsd7.lnk. ")) returned 1 [0146.084] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0146.084] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0146.085] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0146.085] CloseHandle (hObject=0x98) returned 1 [0146.085] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\memi.flv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\memi.flv.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\memi.flv.lnk. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\memi.flv.lnk. ")) returned 1 [0146.086] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0146.086] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0146.087] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0146.087] CloseHandle (hObject=0x98) returned 1 [0146.087] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\MpL0k.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\mpl0k.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\MpL0k.lnk. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\mpl0k.lnk. ")) returned 1 [0146.087] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0146.087] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0146.088] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0146.088] CloseHandle (hObject=0x98) returned 1 [0146.088] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\MtvTIZBT_GK.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\mtvtizbt_gk.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\MtvTIZBT_GK.lnk. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\mtvtizbt_gk.lnk. ")) returned 1 [0146.089] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0146.089] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0146.090] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0146.090] CloseHandle (hObject=0x98) returned 1 [0146.090] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\MX2NbigS.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\mx2nbigs.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\MX2NbigS.lnk. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\mx2nbigs.lnk. ")) returned 1 [0146.091] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0146.091] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0146.091] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0146.091] CloseHandle (hObject=0x98) returned 1 [0146.092] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\MX5A.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\mx5a.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\MX5A.lnk. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\mx5a.lnk. ")) returned 1 [0146.093] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0146.093] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0146.093] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0146.093] CloseHandle (hObject=0x98) returned 1 [0146.093] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\My Music.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\my music.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\My Music.lnk. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\my music.lnk. ")) returned 1 [0146.094] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0146.094] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0146.096] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0146.096] CloseHandle (hObject=0x98) returned 1 [0146.096] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\My Pictures.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\my pictures.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\My Pictures.lnk. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\my pictures.lnk. ")) returned 1 [0146.097] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0146.097] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0146.097] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0146.097] CloseHandle (hObject=0x98) returned 1 [0146.097] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\My Videos.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\my videos.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\My Videos.lnk. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\my videos.lnk. ")) returned 1 [0146.098] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0146.098] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0146.099] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0146.099] CloseHandle (hObject=0x98) returned 1 [0146.099] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\NPHmzD.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\nphmzd.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\NPHmzD.lnk. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\nphmzd.lnk. ")) returned 1 [0146.100] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0146.100] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0146.101] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0146.101] CloseHandle (hObject=0x98) returned 1 [0146.101] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\NqD7fCROKdtbnhxQ.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\nqd7fcrokdtbnhxq.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\NqD7fCROKdtbnhxQ.lnk. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\nqd7fcrokdtbnhxq.lnk. ")) returned 1 [0146.102] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0146.102] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0146.103] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0146.103] CloseHandle (hObject=0x98) returned 1 [0146.103] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\O8PwumL4GjXI.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\o8pwuml4gjxi.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\O8PwumL4GjXI.lnk. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\o8pwuml4gjxi.lnk. ")) returned 1 [0146.104] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0146.104] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0146.104] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0146.105] CloseHandle (hObject=0x98) returned 1 [0146.105] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Oe3m1hdBKm.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\oe3m1hdbkm.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Oe3m1hdBKm.lnk. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\oe3m1hdbkm.lnk. ")) returned 1 [0146.105] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0146.105] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0146.106] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0146.106] CloseHandle (hObject=0x98) returned 1 [0146.106] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\OLBiPCcFxbCYM3.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\olbipccfxbcym3.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\OLBiPCcFxbCYM3.lnk. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\olbipccfxbcym3.lnk. ")) returned 1 [0146.107] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0146.107] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0146.108] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0146.108] CloseHandle (hObject=0x98) returned 1 [0146.108] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\olzW.mkv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\olzw.mkv.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\olzW.mkv.lnk. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\olzw.mkv.lnk. ")) returned 1 [0146.109] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0146.109] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0146.109] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0146.109] CloseHandle (hObject=0x98) returned 1 [0146.109] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\oNgwfeg0B0m5r5MP Z9c.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ongwfeg0b0m5r5mp z9c.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\oNgwfeg0B0m5r5MP Z9c.lnk. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ongwfeg0b0m5r5mp z9c.lnk. ")) returned 1 [0146.110] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0146.110] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0146.111] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0146.111] CloseHandle (hObject=0x98) returned 1 [0146.111] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\oqLv__d.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\oqlv__d.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\oqLv__d.lnk. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\oqlv__d.lnk. ")) returned 1 [0146.112] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0146.112] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0146.113] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0146.113] CloseHandle (hObject=0x98) returned 1 [0146.113] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\OuHZTTRujXxG.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ouhzttrujxxg.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\OuHZTTRujXxG.lnk. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ouhzttrujxxg.lnk. ")) returned 1 [0146.114] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0146.114] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0146.114] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0146.114] CloseHandle (hObject=0x98) returned 1 [0146.114] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\P-frcIM.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\p-frcim.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\P-frcIM.lnk. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\p-frcim.lnk. ")) returned 1 [0146.115] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0146.115] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0146.116] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0146.116] CloseHandle (hObject=0x98) returned 1 [0146.116] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\p2X1Y0f7.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\p2x1y0f7.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\p2X1Y0f7.lnk. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\p2x1y0f7.lnk. ")) returned 1 [0146.117] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0146.117] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0146.117] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0146.118] CloseHandle (hObject=0x98) returned 1 [0146.118] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\pBHs Vi.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\pbhs vi.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\pBHs Vi.lnk. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\pbhs vi.lnk. ")) returned 1 [0146.119] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0146.119] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0146.119] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0146.119] CloseHandle (hObject=0x98) returned 1 [0146.119] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\pbO0A0mgpSWW6ibdP.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\pbo0a0mgpsww6ibdp.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\pbO0A0mgpSWW6ibdP.lnk. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\pbo0a0mgpsww6ibdp.lnk. ")) returned 1 [0146.120] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0146.120] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0146.121] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0146.121] CloseHandle (hObject=0x98) returned 1 [0146.121] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\qrmPbyt.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\qrmpbyt.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\qrmPbyt.lnk. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\qrmpbyt.lnk. ")) returned 1 [0146.122] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0146.122] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0146.122] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0146.123] CloseHandle (hObject=0x98) returned 1 [0146.123] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\qx-nX3ACqrIIK2v_KWvi.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\qx-nx3acqriik2v_kwvi.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\qx-nX3ACqrIIK2v_KWvi.lnk. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\qx-nx3acqriik2v_kwvi.lnk. ")) returned 1 [0146.125] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0146.125] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0146.125] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0146.126] CloseHandle (hObject=0x98) returned 1 [0146.126] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\r6hJ9K.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\r6hj9k.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\r6hJ9K.lnk. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\r6hj9k.lnk. ")) returned 1 [0146.126] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0146.126] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0146.127] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0146.127] CloseHandle (hObject=0x98) returned 1 [0146.127] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Roaming.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\roaming.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Roaming.lnk. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\roaming.lnk. ")) returned 1 [0146.128] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0146.128] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0146.129] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0146.129] CloseHandle (hObject=0x98) returned 1 [0146.129] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\RPoMw4_I2m75LE208So.flv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\rpomw4_i2m75le208so.flv.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\RPoMw4_I2m75LE208So.flv.lnk. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\rpomw4_i2m75le208so.flv.lnk. ")) returned 1 [0146.130] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0146.130] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0146.130] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0146.130] CloseHandle (hObject=0x98) returned 1 [0146.130] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\RqW1BdC.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\rqw1bdc.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\RqW1BdC.lnk. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\rqw1bdc.lnk. ")) returned 1 [0146.131] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0146.131] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0146.132] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0146.132] CloseHandle (hObject=0x98) returned 1 [0146.132] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ru1UnhxBxWJc.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ru1unhxbxwjc.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ru1UnhxBxWJc.lnk. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ru1unhxbxwjc.lnk. ")) returned 1 [0146.133] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0146.133] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0146.133] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0146.133] CloseHandle (hObject=0x98) returned 1 [0146.133] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Ry5Vpzka0XeWLa.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ry5vpzka0xewla.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Ry5Vpzka0XeWLa.lnk. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ry5vpzka0xewla.lnk. ")) returned 1 [0146.134] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0146.134] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0146.135] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0146.135] CloseHandle (hObject=0x98) returned 1 [0146.135] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\SCt_wghu6xy 6XODAiS.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\sct_wghu6xy 6xodais.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\SCt_wghu6xy 6XODAiS.lnk. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\sct_wghu6xy 6xodais.lnk. ")) returned 1 [0146.136] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0146.136] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0146.137] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0146.137] CloseHandle (hObject=0x98) returned 1 [0146.137] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\sGEuCdxh5qxdq.flv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\sgeucdxh5qxdq.flv.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\sGEuCdxh5qxdq.flv.lnk. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\sgeucdxh5qxdq.flv.lnk. ")) returned 1 [0146.138] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0146.138] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0146.139] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0146.139] CloseHandle (hObject=0x98) returned 1 [0146.139] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\sHp6mWDb.flv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\shp6mwdb.flv.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\sHp6mWDb.flv.lnk. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\shp6mwdb.flv.lnk. ")) returned 1 [0146.140] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0146.140] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0146.141] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0146.141] CloseHandle (hObject=0x98) returned 1 [0146.141] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\SiaB.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\siab.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\SiaB.lnk. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\siab.lnk. ")) returned 1 [0146.143] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0146.143] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0146.144] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0146.144] CloseHandle (hObject=0x98) returned 1 [0146.144] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Sy ET.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\sy et.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Sy ET.lnk. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\sy et.lnk. ")) returned 1 [0146.145] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0146.145] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0146.146] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0146.146] CloseHandle (hObject=0x98) returned 1 [0146.146] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\SY61.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\sy61.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\SY61.lnk. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\sy61.lnk. ")) returned 1 [0146.147] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0146.147] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0146.148] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0146.148] CloseHandle (hObject=0x98) returned 1 [0146.148] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\SZiFFy.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\sziffy.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\SZiFFy.lnk. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\sziffy.lnk. ")) returned 1 [0146.149] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0146.149] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0146.150] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0146.150] CloseHandle (hObject=0x98) returned 1 [0146.150] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\T83bYfV.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\t83byfv.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\T83bYfV.lnk. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\t83byfv.lnk. ")) returned 1 [0146.151] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0146.151] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0146.152] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0146.152] CloseHandle (hObject=0x98) returned 1 [0146.152] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\tahS0bO.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\tahs0bo.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\tahS0bO.lnk. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\tahs0bo.lnk. ")) returned 1 [0146.153] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0146.153] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0146.154] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0146.154] CloseHandle (hObject=0x98) returned 1 [0146.154] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\TEP K9pgsvupx0kaO.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\tep k9pgsvupx0kao.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\TEP K9pgsvupx0kaO.lnk. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\tep k9pgsvupx0kao.lnk. ")) returned 1 [0146.154] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0146.154] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0146.155] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0146.155] CloseHandle (hObject=0x98) returned 1 [0146.155] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Thye.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\thye.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Thye.lnk. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\thye.lnk. ")) returned 1 [0146.156] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0146.156] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0146.157] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0146.157] CloseHandle (hObject=0x98) returned 1 [0146.157] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\u5MkXTTAQEUi9.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\u5mkxttaqeui9.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\u5MkXTTAQEUi9.lnk. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\u5mkxttaqeui9.lnk. ")) returned 1 [0146.158] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0146.158] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0146.159] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0146.159] CloseHandle (hObject=0x98) returned 1 [0146.159] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\UbJGde3.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ubjgde3.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\UbJGde3.lnk. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ubjgde3.lnk. ")) returned 1 [0146.161] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0146.161] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0146.162] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0146.162] CloseHandle (hObject=0x98) returned 1 [0146.162] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ucTy8ph.ots.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ucty8ph.ots.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ucTy8ph.ots.lnk. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ucty8ph.ots.lnk. ")) returned 1 [0146.164] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0146.164] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0146.164] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0146.164] CloseHandle (hObject=0x98) returned 1 [0146.164] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\uIdQZzg2ULcVrGTQrM3S.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\uidqzzg2ulcvrgtqrm3s.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\uIdQZzg2ULcVrGTQrM3S.lnk. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\uidqzzg2ulcvrgtqrm3s.lnk. ")) returned 1 [0146.166] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0146.166] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0146.166] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0146.166] CloseHandle (hObject=0x98) returned 1 [0146.166] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\UOiuwW7bPx7_Ya0Hv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\uoiuww7bpx7_ya0hv.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\UOiuwW7bPx7_Ya0Hv.lnk. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\uoiuww7bpx7_ya0hv.lnk. ")) returned 1 [0146.168] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0146.169] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0146.170] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0146.170] CloseHandle (hObject=0x98) returned 1 [0146.170] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Usus-WgPkxXuFZy.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\usus-wgpkxxufzy.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Usus-WgPkxXuFZy.lnk. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\usus-wgpkxxufzy.lnk. ")) returned 1 [0146.172] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0146.172] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0146.173] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0146.173] CloseHandle (hObject=0x98) returned 1 [0146.173] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\v2RQpQ7cS0cMnw9I1w.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\v2rqpq7cs0cmnw9i1w.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\v2RQpQ7cS0cMnw9I1w.lnk. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\v2rqpq7cs0cmnw9i1w.lnk. ")) returned 1 [0146.176] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0146.176] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0146.176] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0146.176] CloseHandle (hObject=0x98) returned 1 [0146.177] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\V7WG XLVxEVN2.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\v7wg xlvxevn2.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\V7WG XLVxEVN2.lnk. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\v7wg xlvxevn2.lnk. ")) returned 1 [0146.178] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0146.178] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0146.179] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0146.179] CloseHandle (hObject=0x98) returned 1 [0146.179] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\VSOlyv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\vsolyv.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\VSOlyv.lnk. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\vsolyv.lnk. ")) returned 1 [0146.180] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0146.180] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0146.181] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0146.181] CloseHandle (hObject=0x98) returned 1 [0146.181] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vWbva3C.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\vwbva3c.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vWbva3C.lnk. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\vwbva3c.lnk. ")) returned 1 [0146.182] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0146.182] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0146.183] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0146.183] CloseHandle (hObject=0x98) returned 1 [0146.183] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\w057SDnXc.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\w057sdnxc.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\w057SDnXc.lnk. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\w057sdnxc.lnk. ")) returned 1 [0146.184] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0146.184] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0146.184] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0146.185] CloseHandle (hObject=0x98) returned 1 [0146.185] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\W7UAmvB2 E fkwuz6p.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\w7uamvb2 e fkwuz6p.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\W7UAmvB2 E fkwuz6p.lnk. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\w7uamvb2 e fkwuz6p.lnk. ")) returned 1 [0146.186] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0146.186] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0146.186] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0146.186] CloseHandle (hObject=0x98) returned 1 [0146.186] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\wZsP5WOuFrAXCQy.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\wzsp5woufraxcqy.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\wZsP5WOuFrAXCQy.lnk. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\wzsp5woufraxcqy.lnk. ")) returned 1 [0146.187] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0146.187] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0146.188] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0146.188] CloseHandle (hObject=0x98) returned 1 [0146.188] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xa70y5ONjqb.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\xa70y5onjqb.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xa70y5ONjqb.lnk. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\xa70y5onjqb.lnk. ")) returned 1 [0146.189] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0146.189] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0146.190] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0146.190] CloseHandle (hObject=0x98) returned 1 [0146.190] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XHLFFW769C.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\xhlffw769c.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XHLFFW769C.lnk. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\xhlffw769c.lnk. ")) returned 1 [0146.191] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0146.191] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0146.191] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0146.191] CloseHandle (hObject=0x98) returned 1 [0146.191] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XqD28X.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\xqd28x.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XqD28X.lnk. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\xqd28x.lnk. ")) returned 1 [0146.192] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0146.192] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0146.193] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0146.193] CloseHandle (hObject=0x98) returned 1 [0146.193] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\y6k81R7.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\y6k81r7.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\y6k81R7.lnk. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\y6k81r7.lnk. ")) returned 1 [0146.193] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0146.193] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0146.194] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0146.194] CloseHandle (hObject=0x98) returned 1 [0146.194] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\yFP08WiDdI.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\yfp08widdi.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\yFP08WiDdI.lnk. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\yfp08widdi.lnk. ")) returned 1 [0146.195] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0146.195] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0146.196] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0146.196] CloseHandle (hObject=0x98) returned 1 [0146.196] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\YGTP.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ygtp.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\YGTP.lnk. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ygtp.lnk. ")) returned 1 [0146.197] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0146.197] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0146.197] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0146.197] CloseHandle (hObject=0x98) returned 1 [0146.197] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Z-A8vsmAvp1Yjts.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\z-a8vsmavp1yjts.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Z-A8vsmAvp1Yjts.lnk. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\z-a8vsmavp1yjts.lnk. ")) returned 1 [0146.198] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0146.198] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0146.199] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0146.199] CloseHandle (hObject=0x98) returned 1 [0146.199] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ZHw7Jzq1d6tCJ1b8G.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\zhw7jzq1d6tcj1b8g.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ZHw7Jzq1d6tCJ1b8G.lnk. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\zhw7jzq1d6tcj1b8g.lnk. ")) returned 1 [0146.201] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0146.201] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0146.201] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0146.201] CloseHandle (hObject=0x98) returned 1 [0146.201] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\zXQx6kKEDSq65trnA.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\zxqx6kkedsq65trna.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\zXQx6kKEDSq65trnA.lnk. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\zxqx6kkedsq65trna.lnk. ")) returned 1 [0146.202] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0146.202] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0146.203] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0146.203] CloseHandle (hObject=0x98) returned 1 [0146.203] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_6Z9kZAKn3.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\_6z9kzakn3.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_6Z9kZAKn3.lnk. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\_6z9kzakn3.lnk. ")) returned 1 [0146.204] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0146.204] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0146.204] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0146.204] CloseHandle (hObject=0x98) returned 1 [0146.205] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_lIyXa.flv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\_liyxa.flv.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_lIyXa.flv.lnk. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\_liyxa.flv.lnk. ")) returned 1 [0146.205] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0146.205] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0146.206] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0146.206] CloseHandle (hObject=0x98) returned 1 [0146.206] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_sH86PEt1vIfrcLsgF7.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\_sh86pet1vifrclsgf7.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_sH86PEt1vIfrcLsgF7.lnk. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\_sh86pet1vifrclsgf7.lnk. ")) returned 1 [0146.207] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 0 [0146.207] FindClose (in: hFindFile=0x5be2e0 | out: hFindFile=0x5be2e0) returned 1 [0146.207] FindNextFileA (in: hFindFile=0x5be2a0, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0146.207] lstrcmpA (lpString1=".", lpString2="SendTo") returned -1 [0146.207] lstrcmpA (lpString1="..", lpString2="SendTo") returned -1 [0146.207] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\*.*", lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 0x5be2e0 [0146.669] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0146.669] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0146.669] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0146.669] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0146.669] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0146.669] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0146.670] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0146.670] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0146.670] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0146.670] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0146.670] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0146.670] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0146.670] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0146.670] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0146.700] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0146.700] CloseHandle (hObject=0x98) returned 1 [0146.700] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Fax Recipient.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\sendto\\fax recipient.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Fax Recipient.lnk. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\sendto\\fax recipient.lnk. ")) returned 1 [0146.701] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0146.701] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0146.701] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 0 [0146.701] FindClose (in: hFindFile=0x5be2e0 | out: hFindFile=0x5be2e0) returned 1 [0146.701] FindNextFileA (in: hFindFile=0x5be2a0, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0146.701] lstrcmpA (lpString1=".", lpString2="Start Menu") returned -1 [0146.701] lstrcmpA (lpString1="..", lpString2="Start Menu") returned -1 [0146.702] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\*.*", lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 0x5be2e0 [0146.702] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0146.702] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0146.702] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0146.702] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0146.702] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0146.702] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0146.702] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0146.702] lstrcmpA (lpString1=".", lpString2="Programs") returned -1 [0146.702] lstrcmpA (lpString1="..", lpString2="Programs") returned -1 [0146.702] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\*.*", lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 0x5be320 [0146.702] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0146.702] FindNextFileA (in: hFindFile=0x5be320, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0146.702] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0146.702] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0146.702] FindNextFileA (in: hFindFile=0x5be320, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0146.702] lstrcmpA (lpString1=".", lpString2="Accessories") returned -1 [0146.702] lstrcmpA (lpString1="..", lpString2="Accessories") returned -1 [0146.702] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\*.*", lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 0x5be360 [0146.702] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0146.702] FindNextFileA (in: hFindFile=0x5be360, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 1 [0146.702] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0146.702] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0146.702] FindNextFileA (in: hFindFile=0x5be360, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 1 [0146.702] lstrcmpA (lpString1=".", lpString2="Accessibility") returned -1 [0146.703] lstrcmpA (lpString1="..", lpString2="Accessibility") returned -1 [0146.703] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\*.*", lpFindFileData=0xaea68 | out: lpFindFileData=0xaea68) returned 0x5be3a0 [0146.703] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0146.703] FindNextFileA (in: hFindFile=0x5be3a0, lpFindFileData=0xaea68 | out: lpFindFileData=0xaea68) returned 1 [0146.703] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0146.703] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0146.703] FindNextFileA (in: hFindFile=0x5be3a0, lpFindFileData=0xaea68 | out: lpFindFileData=0xaea68) returned 1 [0146.703] PeekMessageA (in: lpMsg=0xaea44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaea44) returned 0 [0146.703] FindNextFileA (in: hFindFile=0x5be3a0, lpFindFileData=0xaea68 | out: lpFindFileData=0xaea68) returned 1 [0146.703] PeekMessageA (in: lpMsg=0xaea44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaea44) returned 0 [0146.749] SetFileTime (hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0146.750] CloseHandle (hObject=0xa4) returned 1 [0146.750] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Ease of Access.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\ease of access.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Ease of Access.lnk. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\ease of access.lnk. ")) returned 1 [0146.751] FindNextFileA (in: hFindFile=0x5be3a0, lpFindFileData=0xaea68 | out: lpFindFileData=0xaea68) returned 1 [0146.751] PeekMessageA (in: lpMsg=0xaea44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaea44) returned 0 [0146.913] SetFileTime (hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0146.913] CloseHandle (hObject=0xa4) returned 1 [0146.913] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Magnify.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\magnify.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Magnify.lnk. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\magnify.lnk. ")) returned 1 [0146.915] FindNextFileA (in: hFindFile=0x5be3a0, lpFindFileData=0xaea68 | out: lpFindFileData=0xaea68) returned 1 [0146.915] PeekMessageA (in: lpMsg=0xaea44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaea44) returned 0 [0147.011] SetFileTime (hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0147.011] CloseHandle (hObject=0xa4) returned 1 [0147.012] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Narrator.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\narrator.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Narrator.lnk. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\narrator.lnk. ")) returned 1 [0147.013] FindNextFileA (in: hFindFile=0x5be3a0, lpFindFileData=0xaea68 | out: lpFindFileData=0xaea68) returned 1 [0147.013] PeekMessageA (in: lpMsg=0xaea44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaea44) returned 0 [0147.016] SetFileTime (hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0147.016] CloseHandle (hObject=0xa4) returned 1 [0147.016] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\On-Screen Keyboard.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\on-screen keyboard.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\On-Screen Keyboard.lnk. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\on-screen keyboard.lnk. ")) returned 1 [0147.017] FindNextFileA (in: hFindFile=0x5be3a0, lpFindFileData=0xaea68 | out: lpFindFileData=0xaea68) returned 0 [0147.017] FindClose (in: hFindFile=0x5be3a0 | out: hFindFile=0x5be3a0) returned 1 [0147.018] FindNextFileA (in: hFindFile=0x5be360, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 1 [0147.018] PeekMessageA (in: lpMsg=0xaeb94, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaeb94) returned 0 [0147.020] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0147.020] CloseHandle (hObject=0xa0) returned 1 [0147.020] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Command Prompt.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\command prompt.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Command Prompt.lnk. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\command prompt.lnk. ")) returned 1 [0147.021] FindNextFileA (in: hFindFile=0x5be360, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 1 [0147.021] PeekMessageA (in: lpMsg=0xaeb94, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaeb94) returned 0 [0147.021] FindNextFileA (in: hFindFile=0x5be360, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 1 [0147.021] PeekMessageA (in: lpMsg=0xaeb94, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaeb94) returned 0 [0147.078] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0147.078] CloseHandle (hObject=0xa0) returned 1 [0147.078] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Notepad.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\notepad.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Notepad.lnk. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\notepad.lnk. ")) returned 1 [0147.080] FindNextFileA (in: hFindFile=0x5be360, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 1 [0147.080] PeekMessageA (in: lpMsg=0xaeb94, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaeb94) returned 0 [0147.082] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0147.082] CloseHandle (hObject=0xa0) returned 1 [0147.082] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Run.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\run.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Run.lnk. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\run.lnk. ")) returned 1 [0147.083] FindNextFileA (in: hFindFile=0x5be360, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 1 [0147.083] lstrcmpA (lpString1=".", lpString2="System Tools") returned -1 [0147.084] lstrcmpA (lpString1="..", lpString2="System Tools") returned -1 [0147.084] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\*.*", lpFindFileData=0xaea68 | out: lpFindFileData=0xaea68) returned 0x5be3a0 [0147.084] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0147.084] FindNextFileA (in: hFindFile=0x5be3a0, lpFindFileData=0xaea68 | out: lpFindFileData=0xaea68) returned 1 [0147.084] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0147.084] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0147.084] FindNextFileA (in: hFindFile=0x5be3a0, lpFindFileData=0xaea68 | out: lpFindFileData=0xaea68) returned 1 [0147.084] PeekMessageA (in: lpMsg=0xaea44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaea44) returned 0 [0147.085] SetFileTime (hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0147.085] CloseHandle (hObject=0xa4) returned 1 [0147.085] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\computer.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\computer.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\computer.lnk. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\computer.lnk. ")) returned 1 [0147.086] FindNextFileA (in: hFindFile=0x5be3a0, lpFindFileData=0xaea68 | out: lpFindFileData=0xaea68) returned 1 [0147.086] PeekMessageA (in: lpMsg=0xaea44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaea44) returned 0 [0147.087] SetFileTime (hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0147.087] CloseHandle (hObject=0xa4) returned 1 [0147.088] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Control Panel.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\control panel.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Control Panel.lnk. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\control panel.lnk. ")) returned 1 [0147.089] FindNextFileA (in: hFindFile=0x5be3a0, lpFindFileData=0xaea68 | out: lpFindFileData=0xaea68) returned 1 [0147.089] PeekMessageA (in: lpMsg=0xaea44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaea44) returned 0 [0147.089] FindNextFileA (in: hFindFile=0x5be3a0, lpFindFileData=0xaea68 | out: lpFindFileData=0xaea68) returned 1 [0147.089] PeekMessageA (in: lpMsg=0xaea44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaea44) returned 0 [0147.091] SetFileTime (hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0147.091] CloseHandle (hObject=0xa4) returned 1 [0147.091] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Internet Explorer (No Add-ons).lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\internet explorer (no add-ons).lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Internet Explorer (No Add-ons).lnk. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\internet explorer (no add-ons).lnk. ")) returned 1 [0147.092] FindNextFileA (in: hFindFile=0x5be3a0, lpFindFileData=0xaea68 | out: lpFindFileData=0xaea68) returned 1 [0147.092] PeekMessageA (in: lpMsg=0xaea44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaea44) returned 0 [0147.093] SetFileTime (hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0147.093] CloseHandle (hObject=0xa4) returned 1 [0147.093] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Private Character Editor.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\private character editor.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Private Character Editor.lnk. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\private character editor.lnk. ")) returned 1 [0147.094] FindNextFileA (in: hFindFile=0x5be3a0, lpFindFileData=0xaea68 | out: lpFindFileData=0xaea68) returned 0 [0147.094] FindClose (in: hFindFile=0x5be3a0 | out: hFindFile=0x5be3a0) returned 1 [0147.095] FindNextFileA (in: hFindFile=0x5be360, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 1 [0147.095] PeekMessageA (in: lpMsg=0xaeb94, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaeb94) returned 0 [0147.096] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0147.096] CloseHandle (hObject=0xa0) returned 1 [0147.096] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows Explorer.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\windows explorer.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows Explorer.lnk. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\windows explorer.lnk. ")) returned 1 [0147.098] FindNextFileA (in: hFindFile=0x5be360, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 0 [0147.098] FindClose (in: hFindFile=0x5be360 | out: hFindFile=0x5be360) returned 1 [0147.098] FindNextFileA (in: hFindFile=0x5be320, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0147.098] lstrcmpA (lpString1=".", lpString2="Administrative Tools") returned -1 [0147.098] lstrcmpA (lpString1="..", lpString2="Administrative Tools") returned -1 [0147.098] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\*.*", lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 0x5be360 [0147.098] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0147.098] FindNextFileA (in: hFindFile=0x5be360, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 1 [0147.098] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0147.098] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0147.098] FindNextFileA (in: hFindFile=0x5be360, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 1 [0147.098] PeekMessageA (in: lpMsg=0xaeb94, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaeb94) returned 0 [0147.098] FindNextFileA (in: hFindFile=0x5be360, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 0 [0147.099] FindClose (in: hFindFile=0x5be360 | out: hFindFile=0x5be360) returned 1 [0147.099] FindNextFileA (in: hFindFile=0x5be320, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0147.099] PeekMessageA (in: lpMsg=0xaece4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaece4) returned 0 [0147.099] FindNextFileA (in: hFindFile=0x5be320, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0147.099] PeekMessageA (in: lpMsg=0xaece4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaece4) returned 0 [0147.111] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0147.111] CloseHandle (hObject=0x9c) returned 1 [0147.111] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Internet Explorer (64-bit).lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\internet explorer (64-bit).lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Internet Explorer (64-bit).lnk. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\internet explorer (64-bit).lnk. ")) returned 1 [0147.113] FindNextFileA (in: hFindFile=0x5be320, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0147.113] PeekMessageA (in: lpMsg=0xaece4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaece4) returned 0 [0147.115] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0147.115] CloseHandle (hObject=0x9c) returned 1 [0147.115] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Internet Explorer.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\internet explorer.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Internet Explorer.lnk. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\internet explorer.lnk. ")) returned 1 [0147.117] FindNextFileA (in: hFindFile=0x5be320, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0147.117] lstrcmpA (lpString1=".", lpString2="Maintenance") returned -1 [0147.117] lstrcmpA (lpString1="..", lpString2="Maintenance") returned -1 [0147.117] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\*.*", lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 0x5be360 [0147.117] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0147.117] FindNextFileA (in: hFindFile=0x5be360, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 1 [0147.117] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0147.117] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0147.117] FindNextFileA (in: hFindFile=0x5be360, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 1 [0147.117] PeekMessageA (in: lpMsg=0xaeb94, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaeb94) returned 0 [0147.117] FindNextFileA (in: hFindFile=0x5be360, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 1 [0147.117] PeekMessageA (in: lpMsg=0xaeb94, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaeb94) returned 0 [0147.118] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0147.118] CloseHandle (hObject=0xa0) returned 1 [0147.118] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Help.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\maintenance\\help.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Help.lnk. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\maintenance\\help.lnk. ")) returned 1 [0147.120] FindNextFileA (in: hFindFile=0x5be360, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 0 [0147.120] FindClose (in: hFindFile=0x5be360 | out: hFindFile=0x5be360) returned 1 [0147.120] FindNextFileA (in: hFindFile=0x5be320, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0147.120] lstrcmpA (lpString1=".", lpString2="Startup") returned -1 [0147.120] lstrcmpA (lpString1="..", lpString2="Startup") returned -1 [0147.120] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\*.*", lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 0x5be360 [0147.120] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0147.120] FindNextFileA (in: hFindFile=0x5be360, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 1 [0147.120] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0147.120] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0147.120] FindNextFileA (in: hFindFile=0x5be360, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 1 [0147.120] PeekMessageA (in: lpMsg=0xaeb94, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaeb94) returned 0 [0147.120] FindNextFileA (in: hFindFile=0x5be360, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 0 [0147.121] FindClose (in: hFindFile=0x5be360 | out: hFindFile=0x5be360) returned 1 [0147.121] FindNextFileA (in: hFindFile=0x5be320, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 0 [0147.121] FindClose (in: hFindFile=0x5be320 | out: hFindFile=0x5be320) returned 1 [0147.121] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 0 [0147.121] FindClose (in: hFindFile=0x5be2e0 | out: hFindFile=0x5be2e0) returned 1 [0147.121] FindNextFileA (in: hFindFile=0x5be2a0, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0147.121] lstrcmpA (lpString1=".", lpString2="Templates") returned -1 [0147.121] lstrcmpA (lpString1="..", lpString2="Templates") returned -1 [0147.121] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\*.*", lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 0x5be2e0 [0147.121] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0147.121] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0147.121] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0147.121] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0147.121] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 0 [0147.121] FindClose (in: hFindFile=0x5be2e0 | out: hFindFile=0x5be2e0) returned 1 [0147.121] FindNextFileA (in: hFindFile=0x5be2a0, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0147.121] lstrcmpA (lpString1=".", lpString2="Themes") returned -1 [0147.121] lstrcmpA (lpString1="..", lpString2="Themes") returned -1 [0147.121] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\*.*", lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 0x5be2e0 [0147.122] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0147.122] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0147.122] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0147.122] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0147.122] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0147.122] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0147.129] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0147.129] CloseHandle (hObject=0x98) returned 1 [0147.129] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\TranscodedWallpaper.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\themes\\transcodedwallpaper.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\TranscodedWallpaper.jpg. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\themes\\transcodedwallpaper.jpg. ")) returned 1 [0147.131] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 0 [0147.131] FindClose (in: hFindFile=0x5be2e0 | out: hFindFile=0x5be2e0) returned 1 [0147.131] FindNextFileA (in: hFindFile=0x5be2a0, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0 [0147.131] FindClose (in: hFindFile=0x5be2a0 | out: hFindFile=0x5be2a0) returned 1 [0147.131] FindNextFileA (in: hFindFile=0x5be260, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0147.131] lstrcmpA (lpString1=".", lpString2="Word") returned -1 [0147.131] lstrcmpA (lpString1="..", lpString2="Word") returned -1 [0147.131] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Word\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0147.388] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0147.388] FindNextFileA (in: hFindFile=0x5be2a0, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0147.388] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0147.388] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0147.388] FindNextFileA (in: hFindFile=0x5be2a0, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0147.388] lstrcmpA (lpString1=".", lpString2="STARTUP") returned -1 [0147.388] lstrcmpA (lpString1="..", lpString2="STARTUP") returned -1 [0147.388] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Word\\STARTUP\\*.*", lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 0x5be2e0 [0147.389] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0147.389] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0147.389] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0147.389] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0147.389] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 0 [0147.389] FindClose (in: hFindFile=0x5be2e0 | out: hFindFile=0x5be2e0) returned 1 [0147.389] FindNextFileA (in: hFindFile=0x5be2a0, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0 [0147.389] FindClose (in: hFindFile=0x5be2a0 | out: hFindFile=0x5be2a0) returned 1 [0147.389] FindNextFileA (in: hFindFile=0x5be260, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0 [0147.389] FindClose (in: hFindFile=0x5be260 | out: hFindFile=0x5be260) returned 1 [0147.389] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0147.389] lstrcmpA (lpString1=".", lpString2="Mozilla") returned -1 [0147.389] lstrcmpA (lpString1="..", lpString2="Mozilla") returned -1 [0147.389] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0147.389] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0147.389] FindNextFileA (in: hFindFile=0x5be260, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0147.389] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0147.389] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0147.389] FindNextFileA (in: hFindFile=0x5be260, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0147.389] lstrcmpA (lpString1=".", lpString2="Extensions") returned -1 [0147.389] lstrcmpA (lpString1="..", lpString2="Extensions") returned -1 [0147.390] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Extensions\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0147.390] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0147.390] FindNextFileA (in: hFindFile=0x5be2a0, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0147.390] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0147.390] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0147.390] FindNextFileA (in: hFindFile=0x5be2a0, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0 [0147.390] FindClose (in: hFindFile=0x5be2a0 | out: hFindFile=0x5be2a0) returned 1 [0147.390] FindNextFileA (in: hFindFile=0x5be260, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0147.390] lstrcmpA (lpString1=".", lpString2="Firefox") returned -1 [0147.390] lstrcmpA (lpString1="..", lpString2="Firefox") returned -1 [0147.390] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0147.391] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0147.391] FindNextFileA (in: hFindFile=0x5be2a0, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0147.391] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0147.391] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0147.391] FindNextFileA (in: hFindFile=0x5be2a0, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0147.391] lstrcmpA (lpString1=".", lpString2="Crash Reports") returned -1 [0147.391] lstrcmpA (lpString1="..", lpString2="Crash Reports") returned -1 [0147.391] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\*.*", lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 0x5be2e0 [0147.392] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0147.392] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0147.392] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0147.392] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0147.392] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0147.392] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0147.392] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 0 [0147.392] FindClose (in: hFindFile=0x5be2e0 | out: hFindFile=0x5be2e0) returned 1 [0147.392] FindNextFileA (in: hFindFile=0x5be2a0, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0147.392] lstrcmpA (lpString1=".", lpString2="Profiles") returned -1 [0147.392] lstrcmpA (lpString1="..", lpString2="Profiles") returned -1 [0147.392] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\*.*", lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 0x5be2e0 [0147.393] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0147.393] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0147.393] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0147.393] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0147.393] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 1 [0147.393] lstrcmpA (lpString1=".", lpString2="silmbjec.default") returned -1 [0147.393] lstrcmpA (lpString1="..", lpString2="silmbjec.default") returned -1 [0147.393] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\*.*", lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 0x5be320 [0147.405] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0147.405] FindNextFileA (in: hFindFile=0x5be320, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0147.406] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0147.406] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0147.406] FindNextFileA (in: hFindFile=0x5be320, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0147.407] PeekMessageA (in: lpMsg=0xaece4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaece4) returned 0 [0147.407] FindNextFileA (in: hFindFile=0x5be320, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0147.407] lstrcmpA (lpString1=".", lpString2="bookmarkbackups") returned -1 [0147.407] lstrcmpA (lpString1="..", lpString2="bookmarkbackups") returned -1 [0147.407] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\bookmarkbackups\\*.*", lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 0x5be360 [0147.408] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0147.408] FindNextFileA (in: hFindFile=0x5be360, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 1 [0147.408] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0147.409] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0147.409] FindNextFileA (in: hFindFile=0x5be360, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 1 [0147.409] PeekMessageA (in: lpMsg=0xaeb94, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaeb94) returned 0 [0147.409] FindNextFileA (in: hFindFile=0x5be360, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 1 [0147.409] PeekMessageA (in: lpMsg=0xaeb94, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaeb94) returned 0 [0147.409] FindNextFileA (in: hFindFile=0x5be360, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 0 [0147.409] FindClose (in: hFindFile=0x5be360 | out: hFindFile=0x5be360) returned 1 [0147.409] FindNextFileA (in: hFindFile=0x5be320, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0147.409] PeekMessageA (in: lpMsg=0xaece4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaece4) returned 0 [0147.409] FindNextFileA (in: hFindFile=0x5be320, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0147.409] PeekMessageA (in: lpMsg=0xaece4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaece4) returned 0 [0147.409] FindNextFileA (in: hFindFile=0x5be320, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0147.410] PeekMessageA (in: lpMsg=0xaece4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaece4) returned 0 [0147.410] FindNextFileA (in: hFindFile=0x5be320, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0147.410] PeekMessageA (in: lpMsg=0xaece4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaece4) returned 0 [0147.410] FindNextFileA (in: hFindFile=0x5be320, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0147.410] PeekMessageA (in: lpMsg=0xaece4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaece4) returned 0 [0147.410] FindNextFileA (in: hFindFile=0x5be320, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0147.410] PeekMessageA (in: lpMsg=0xaece4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaece4) returned 0 [0147.410] FindNextFileA (in: hFindFile=0x5be320, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0147.410] PeekMessageA (in: lpMsg=0xaece4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaece4) returned 0 [0147.410] FindNextFileA (in: hFindFile=0x5be320, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0147.410] lstrcmpA (lpString1=".", lpString2="indexedDB") returned -1 [0147.410] lstrcmpA (lpString1="..", lpString2="indexedDB") returned -1 [0147.410] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\*.*", lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 0x5be360 [0147.411] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0147.411] FindNextFileA (in: hFindFile=0x5be360, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 1 [0147.411] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0147.411] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0147.411] FindNextFileA (in: hFindFile=0x5be360, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 1 [0147.411] lstrcmpA (lpString1=".", lpString2="moz-safe-about+home") returned -1 [0147.411] lstrcmpA (lpString1="..", lpString2="moz-safe-about+home") returned -1 [0147.411] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\moz-safe-about+home\\*.*", lpFindFileData=0xaea68 | out: lpFindFileData=0xaea68) returned 0x5be3a0 [0147.411] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0147.411] FindNextFileA (in: hFindFile=0x5be3a0, lpFindFileData=0xaea68 | out: lpFindFileData=0xaea68) returned 1 [0147.411] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0147.411] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0147.411] FindNextFileA (in: hFindFile=0x5be3a0, lpFindFileData=0xaea68 | out: lpFindFileData=0xaea68) returned 1 [0147.411] PeekMessageA (in: lpMsg=0xaea44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaea44) returned 0 [0147.411] FindNextFileA (in: hFindFile=0x5be3a0, lpFindFileData=0xaea68 | out: lpFindFileData=0xaea68) returned 1 [0147.411] lstrcmpA (lpString1=".", lpString2="idb") returned -1 [0147.411] lstrcmpA (lpString1="..", lpString2="idb") returned -1 [0147.411] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\moz-safe-about+home\\idb\\*.*", lpFindFileData=0xae918 | out: lpFindFileData=0xae918) returned 0x5be3e0 [0147.637] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0147.637] FindNextFileA (in: hFindFile=0x5be3e0, lpFindFileData=0xae918 | out: lpFindFileData=0xae918) returned 1 [0147.637] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0147.637] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0147.637] FindNextFileA (in: hFindFile=0x5be3e0, lpFindFileData=0xae918 | out: lpFindFileData=0xae918) returned 1 [0147.637] lstrcmpA (lpString1=".", lpString2="818200132aebmoouht") returned -1 [0147.637] lstrcmpA (lpString1="..", lpString2="818200132aebmoouht") returned -1 [0147.637] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\moz-safe-about+home\\idb\\818200132aebmoouht\\*.*", lpFindFileData=0xae7c8 | out: lpFindFileData=0xae7c8) returned 0x5be420 [0147.638] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0147.638] FindNextFileA (in: hFindFile=0x5be420, lpFindFileData=0xae7c8 | out: lpFindFileData=0xae7c8) returned 1 [0147.638] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0147.638] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0147.638] FindNextFileA (in: hFindFile=0x5be420, lpFindFileData=0xae7c8 | out: lpFindFileData=0xae7c8) returned 0 [0147.638] FindClose (in: hFindFile=0x5be420 | out: hFindFile=0x5be420) returned 1 [0147.638] FindNextFileA (in: hFindFile=0x5be3e0, lpFindFileData=0xae918 | out: lpFindFileData=0xae918) returned 1 [0147.638] PeekMessageA (in: lpMsg=0xae8f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xae8f4) returned 0 [0147.638] FindNextFileA (in: hFindFile=0x5be3e0, lpFindFileData=0xae918 | out: lpFindFileData=0xae918) returned 0 [0147.638] FindClose (in: hFindFile=0x5be3e0 | out: hFindFile=0x5be3e0) returned 1 [0147.638] FindNextFileA (in: hFindFile=0x5be3a0, lpFindFileData=0xaea68 | out: lpFindFileData=0xaea68) returned 0 [0147.638] FindClose (in: hFindFile=0x5be3a0 | out: hFindFile=0x5be3a0) returned 1 [0147.638] FindNextFileA (in: hFindFile=0x5be360, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 0 [0147.638] FindClose (in: hFindFile=0x5be360 | out: hFindFile=0x5be360) returned 1 [0147.638] FindNextFileA (in: hFindFile=0x5be320, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0147.638] PeekMessageA (in: lpMsg=0xaece4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaece4) returned 0 [0147.638] FindNextFileA (in: hFindFile=0x5be320, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0147.638] PeekMessageA (in: lpMsg=0xaece4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaece4) returned 0 [0147.638] FindNextFileA (in: hFindFile=0x5be320, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0147.638] PeekMessageA (in: lpMsg=0xaece4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaece4) returned 0 [0147.639] FindNextFileA (in: hFindFile=0x5be320, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0147.639] PeekMessageA (in: lpMsg=0xaece4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaece4) returned 0 [0147.639] FindNextFileA (in: hFindFile=0x5be320, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0147.639] lstrcmpA (lpString1=".", lpString2="minidumps") returned -1 [0147.639] lstrcmpA (lpString1="..", lpString2="minidumps") returned -1 [0147.639] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\minidumps\\*.*", lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 0x5be360 [0147.640] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0147.640] FindNextFileA (in: hFindFile=0x5be360, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 1 [0147.640] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0147.640] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0147.640] FindNextFileA (in: hFindFile=0x5be360, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 0 [0147.640] FindClose (in: hFindFile=0x5be360 | out: hFindFile=0x5be360) returned 1 [0147.640] FindNextFileA (in: hFindFile=0x5be320, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0147.640] PeekMessageA (in: lpMsg=0xaece4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaece4) returned 0 [0147.640] FindNextFileA (in: hFindFile=0x5be320, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0147.640] PeekMessageA (in: lpMsg=0xaece4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaece4) returned 0 [0147.640] FindNextFileA (in: hFindFile=0x5be320, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0147.640] PeekMessageA (in: lpMsg=0xaece4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaece4) returned 0 [0147.640] FindNextFileA (in: hFindFile=0x5be320, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0147.640] PeekMessageA (in: lpMsg=0xaece4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaece4) returned 0 [0147.640] FindNextFileA (in: hFindFile=0x5be320, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0147.640] PeekMessageA (in: lpMsg=0xaece4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaece4) returned 0 [0147.640] FindNextFileA (in: hFindFile=0x5be320, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0147.640] PeekMessageA (in: lpMsg=0xaece4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaece4) returned 0 [0147.641] FindNextFileA (in: hFindFile=0x5be320, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0147.641] PeekMessageA (in: lpMsg=0xaece4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaece4) returned 0 [0147.641] FindNextFileA (in: hFindFile=0x5be320, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0147.641] PeekMessageA (in: lpMsg=0xaece4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaece4) returned 0 [0147.641] FindNextFileA (in: hFindFile=0x5be320, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0147.641] PeekMessageA (in: lpMsg=0xaece4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaece4) returned 0 [0147.641] FindNextFileA (in: hFindFile=0x5be320, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0147.641] PeekMessageA (in: lpMsg=0xaece4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaece4) returned 0 [0147.641] FindNextFileA (in: hFindFile=0x5be320, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0147.641] PeekMessageA (in: lpMsg=0xaece4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaece4) returned 0 [0147.641] FindNextFileA (in: hFindFile=0x5be320, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0147.641] lstrcmpA (lpString1=".", lpString2="webapps") returned -1 [0147.641] lstrcmpA (lpString1="..", lpString2="webapps") returned -1 [0147.641] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\webapps\\*.*", lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 0x5be360 [0147.642] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0147.642] FindNextFileA (in: hFindFile=0x5be360, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 1 [0147.642] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0147.642] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0147.642] FindNextFileA (in: hFindFile=0x5be360, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 1 [0147.642] PeekMessageA (in: lpMsg=0xaeb94, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaeb94) returned 0 [0147.642] FindNextFileA (in: hFindFile=0x5be360, lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 0 [0147.642] FindClose (in: hFindFile=0x5be360 | out: hFindFile=0x5be360) returned 1 [0147.642] FindNextFileA (in: hFindFile=0x5be320, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 1 [0147.642] PeekMessageA (in: lpMsg=0xaece4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaece4) returned 0 [0147.642] FindNextFileA (in: hFindFile=0x5be320, lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 0 [0147.642] FindClose (in: hFindFile=0x5be320 | out: hFindFile=0x5be320) returned 1 [0147.642] FindNextFileA (in: hFindFile=0x5be2e0, lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 0 [0147.642] FindClose (in: hFindFile=0x5be2e0 | out: hFindFile=0x5be2e0) returned 1 [0147.642] FindNextFileA (in: hFindFile=0x5be2a0, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 1 [0147.642] PeekMessageA (in: lpMsg=0xaef84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaef84) returned 0 [0147.642] FindNextFileA (in: hFindFile=0x5be2a0, lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0 [0147.642] FindClose (in: hFindFile=0x5be2a0 | out: hFindFile=0x5be2a0) returned 1 [0147.642] FindNextFileA (in: hFindFile=0x5be260, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0 [0147.642] FindClose (in: hFindFile=0x5be260 | out: hFindFile=0x5be260) returned 1 [0147.642] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0147.642] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0147.643] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0147.643] CloseHandle (hObject=0x8c) returned 1 [0147.643] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\MtvTIZBT_GK.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mtvtizbt_gk.bmp"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\MtvTIZBT_GK.bmp. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mtvtizbt_gk.bmp. ")) returned 1 [0147.645] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0147.645] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0147.646] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0147.646] CloseHandle (hObject=0x8c) returned 1 [0147.646] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\MX5A.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mx5a.bmp"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\MX5A.bmp. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mx5a.bmp. ")) returned 1 [0147.647] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0147.647] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0147.647] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0147.647] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0147.648] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0147.648] CloseHandle (hObject=0x8c) returned 1 [0147.648] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\pE4wnjNN.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\pe4wnjnn.flv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\pE4wnjNN.flv. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\pe4wnjnn.flv. ")) returned 1 [0147.649] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0147.649] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0147.650] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0147.650] CloseHandle (hObject=0x8c) returned 1 [0147.650] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\PsM9Syf2DIK.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\psm9syf2dik.avi"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\PsM9Syf2DIK.avi. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\psm9syf2dik.avi. ")) returned 1 [0147.651] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0147.651] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0147.653] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0147.653] CloseHandle (hObject=0x8c) returned 1 [0147.653] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Q1dwx1p.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\q1dwx1p.avi"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Q1dwx1p.avi. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\q1dwx1p.avi. ")) returned 1 [0147.654] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0147.654] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0147.655] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0147.655] CloseHandle (hObject=0x8c) returned 1 [0147.655] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\q6lx xCwxHpC.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\q6lx xcwxhpc.mp4"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\q6lx xCwxHpC.mp4. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\q6lx xcwxhpc.mp4. ")) returned 1 [0147.656] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0147.656] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0147.657] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0147.657] CloseHandle (hObject=0x8c) returned 1 [0147.657] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Qmhfyk jojH2.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\qmhfyk jojh2.avi"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Qmhfyk jojH2.avi. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\qmhfyk jojh2.avi. ")) returned 1 [0147.658] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0147.658] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0147.659] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0147.659] CloseHandle (hObject=0x8c) returned 1 [0147.659] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\r6hJ9K.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\r6hj9k.docx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\r6hJ9K.docx. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\r6hj9k.docx. ")) returned 1 [0147.661] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0147.661] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0147.662] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0147.662] CloseHandle (hObject=0x8c) returned 1 [0147.662] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ru1UnhxBxWJc.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\ru1unhxbxwjc.docx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ru1UnhxBxWJc.docx. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\ru1unhxbxwjc.docx. ")) returned 1 [0147.664] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0147.664] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0147.665] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0147.665] CloseHandle (hObject=0x8c) returned 1 [0147.665] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Sy ET.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\sy et.gif"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Sy ET.gif. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\sy et.gif. ")) returned 1 [0147.667] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0147.667] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0147.669] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0147.669] CloseHandle (hObject=0x8c) returned 1 [0147.669] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\tahS0bO.xls" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\tahs0bo.xls"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\tahS0bO.xls. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\tahs0bo.xls. ")) returned 1 [0147.671] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0147.671] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0147.671] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0147.671] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0147.671] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0147.671] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0147.672] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0147.672] CloseHandle (hObject=0x8c) returned 1 [0147.673] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\VyJBao0stZ.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\vyjbao0stz.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\VyJBao0stZ.mp3. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\vyjbao0stz.mp3. ")) returned 1 [0147.674] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0147.674] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0147.675] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0147.675] CloseHandle (hObject=0x8c) returned 1 [0147.675] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\wZsP5WOuFrAXCQy.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\wzsp5woufraxcqy.gif"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\wZsP5WOuFrAXCQy.gif. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\wzsp5woufraxcqy.gif. ")) returned 1 [0147.677] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0147.677] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0147.678] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0147.679] CloseHandle (hObject=0x8c) returned 1 [0147.679] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\y6k81R7.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\y6k81r7.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\y6k81R7.jpg. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\y6k81r7.jpg. ")) returned 1 [0147.680] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0147.680] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0147.681] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0147.681] CloseHandle (hObject=0x8c) returned 1 [0147.682] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\y9iI jSaK44McsH.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\y9ii jsak44mcsh.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\y9iI jSaK44McsH.wav. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\y9ii jsak44mcsh.wav. ")) returned 1 [0147.683] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0 [0147.683] FindClose (in: hFindFile=0x5be160 | out: hFindFile=0x5be160) returned 1 [0147.683] FindNextFileA (in: hFindFile=0x5be220, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 0 [0147.683] FindClose (in: hFindFile=0x5be220 | out: hFindFile=0x5be220) returned 1 [0147.683] FindNextFileA (in: hFindFile=0x5be1e0, lpFindFileData=0xaf4e8 | out: lpFindFileData=0xaf4e8) returned 1 [0147.683] lstrcmpA (lpString1=".", lpString2="Application Data") returned -1 [0147.683] lstrcmpA (lpString1="..", lpString2="Application Data") returned -1 [0147.683] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Application Data\\*.*", lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 0xffffffff [0147.684] FindNextFileA (in: hFindFile=0x5be1e0, lpFindFileData=0xaf4e8 | out: lpFindFileData=0xaf4e8) returned 1 [0147.684] lstrcmpA (lpString1=".", lpString2="Contacts") returned -1 [0147.684] lstrcmpA (lpString1="..", lpString2="Contacts") returned -1 [0147.684] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\*.*", lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 0x5be220 [0147.684] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0147.684] FindNextFileA (in: hFindFile=0x5be220, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0147.684] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0147.684] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0147.684] FindNextFileA (in: hFindFile=0x5be220, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0147.684] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0147.684] FindNextFileA (in: hFindFile=0x5be220, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0147.684] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0147.684] FindNextFileA (in: hFindFile=0x5be220, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0147.684] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0147.684] FindNextFileA (in: hFindFile=0x5be220, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0147.684] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0147.685] FindNextFileA (in: hFindFile=0x5be220, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0147.685] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0147.685] FindNextFileA (in: hFindFile=0x5be220, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0147.685] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0147.685] FindNextFileA (in: hFindFile=0x5be220, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0147.685] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0147.685] FindNextFileA (in: hFindFile=0x5be220, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 0 [0147.685] FindClose (in: hFindFile=0x5be220 | out: hFindFile=0x5be220) returned 1 [0147.685] FindNextFileA (in: hFindFile=0x5be1e0, lpFindFileData=0xaf4e8 | out: lpFindFileData=0xaf4e8) returned 1 [0147.685] lstrcmpA (lpString1=".", lpString2="Cookies") returned -1 [0147.685] lstrcmpA (lpString1="..", lpString2="Cookies") returned -1 [0147.685] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Cookies\\*.*", lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 0xffffffff [0147.685] FindNextFileA (in: hFindFile=0x5be1e0, lpFindFileData=0xaf4e8 | out: lpFindFileData=0xaf4e8) returned 1 [0147.685] lstrcmpA (lpString1=".", lpString2="Desktop") returned -1 [0147.685] lstrcmpA (lpString1="..", lpString2="Desktop") returned -1 [0147.685] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.*", lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 0x5be220 [0147.685] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0147.685] FindNextFileA (in: hFindFile=0x5be220, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0147.685] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0147.685] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0147.685] FindNextFileA (in: hFindFile=0x5be220, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0147.685] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0147.685] FindNextFileA (in: hFindFile=0x5be220, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0147.685] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0147.698] SetFileTime (hFile=0x88, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0147.698] CloseHandle (hObject=0x88) returned 1 [0147.698] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\aNw1.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\anw1.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\aNw1.wav. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\anw1.wav. ")) returned 1 [0147.700] FindNextFileA (in: hFindFile=0x5be220, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0147.700] lstrcmpA (lpString1=".", lpString2="Ct-UuWUq2GKbwky") returned -1 [0147.700] lstrcmpA (lpString1="..", lpString2="Ct-UuWUq2GKbwky") returned -1 [0147.700] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Ct-UuWUq2GKbwky\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be160 [0147.700] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0147.700] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0147.700] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0147.701] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0147.701] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0147.701] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0147.702] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0147.702] CloseHandle (hObject=0x8c) returned 1 [0147.702] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Ct-UuWUq2GKbwky\\f2 65Olu6rLtqt.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ct-uuwuq2gkbwky\\f2 65olu6rltqt.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Ct-UuWUq2GKbwky\\f2 65Olu6rLtqt.jpg. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ct-uuwuq2gkbwky\\f2 65olu6rltqt.jpg. ")) returned 1 [0147.703] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0147.703] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0147.703] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0147.703] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0147.704] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0147.704] CloseHandle (hObject=0x8c) returned 1 [0147.704] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Ct-UuWUq2GKbwky\\k2fUYx_jT2wvJj0aN.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ct-uuwuq2gkbwky\\k2fuyx_jt2wvjj0an.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Ct-UuWUq2GKbwky\\k2fUYx_jT2wvJj0aN.jpg. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ct-uuwuq2gkbwky\\k2fuyx_jt2wvjj0an.jpg. ")) returned 1 [0147.706] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0147.706] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0147.707] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0147.707] CloseHandle (hObject=0x8c) returned 1 [0147.707] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Ct-UuWUq2GKbwky\\m8dA5k xQM9ceyHDvl9R.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ct-uuwuq2gkbwky\\m8da5k xqm9ceyhdvl9r.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Ct-UuWUq2GKbwky\\m8dA5k xQM9ceyHDvl9R.mp3. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ct-uuwuq2gkbwky\\m8da5k xqm9ceyhdvl9r.mp3. ")) returned 1 [0147.708] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0147.708] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0147.709] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0147.709] CloseHandle (hObject=0x8c) returned 1 [0147.709] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Ct-UuWUq2GKbwky\\Z HSwj.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ct-uuwuq2gkbwky\\z hswj.avi"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Ct-UuWUq2GKbwky\\Z HSwj.avi. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ct-uuwuq2gkbwky\\z hswj.avi. ")) returned 1 [0147.711] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0 [0147.711] FindClose (in: hFindFile=0x5be160 | out: hFindFile=0x5be160) returned 1 [0147.711] FindNextFileA (in: hFindFile=0x5be220, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0147.711] lstrcmpA (lpString1=".", lpString2="d Phmic") returned -1 [0147.711] lstrcmpA (lpString1="..", lpString2="d Phmic") returned -1 [0147.711] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\d Phmic\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be160 [0147.711] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0147.711] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0147.711] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0147.711] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0147.711] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0147.711] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0147.712] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0147.713] CloseHandle (hObject=0x8c) returned 1 [0147.713] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\d Phmic\\53r SvwxlErdM_283n.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\d phmic\\53r svwxlerdm_283n.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\d Phmic\\53r SvwxlErdM_283n.jpg. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\d phmic\\53r svwxlerdm_283n.jpg. ")) returned 1 [0147.715] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0147.715] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0147.717] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0147.717] CloseHandle (hObject=0x8c) returned 1 [0147.717] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\d Phmic\\Ai40IEb_.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\d phmic\\ai40ieb_.mp4"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\d Phmic\\Ai40IEb_.mp4. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\d phmic\\ai40ieb_.mp4. ")) returned 1 [0147.719] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0147.719] lstrcmpA (lpString1=".", lpString2="BQlQYsk2Dks") returned -1 [0147.719] lstrcmpA (lpString1="..", lpString2="BQlQYsk2Dks") returned -1 [0147.719] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\d Phmic\\BQlQYsk2Dks\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0147.719] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0147.719] FindNextFileA (in: hFindFile=0x5be260, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0147.719] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0147.719] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0147.719] FindNextFileA (in: hFindFile=0x5be260, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0147.719] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0147.720] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0147.720] CloseHandle (hObject=0x90) returned 1 [0147.720] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\d Phmic\\BQlQYsk2Dks\\01o0hZUnyq8ifOdE.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\d phmic\\bqlqysk2dks\\01o0hzunyq8ifode.mp4"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\d Phmic\\BQlQYsk2Dks\\01o0hZUnyq8ifOdE.mp4. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\d phmic\\bqlqysk2dks\\01o0hzunyq8ifode.mp4. ")) returned 1 [0147.722] FindNextFileA (in: hFindFile=0x5be260, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0147.722] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0147.723] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0147.723] CloseHandle (hObject=0x90) returned 1 [0147.723] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\d Phmic\\BQlQYsk2Dks\\K7ld6Txng.xls" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\d phmic\\bqlqysk2dks\\k7ld6txng.xls"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\d Phmic\\BQlQYsk2Dks\\K7ld6Txng.xls. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\d phmic\\bqlqysk2dks\\k7ld6txng.xls. ")) returned 1 [0147.725] FindNextFileA (in: hFindFile=0x5be260, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0147.725] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0147.726] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0147.726] CloseHandle (hObject=0x90) returned 1 [0147.726] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\d Phmic\\BQlQYsk2Dks\\VquuB8hE2ijs7dkNa.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\d phmic\\bqlqysk2dks\\vquub8he2ijs7dkna.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\d Phmic\\BQlQYsk2Dks\\VquuB8hE2ijs7dkNa.jpg. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\d phmic\\bqlqysk2dks\\vquub8he2ijs7dkna.jpg. ")) returned 1 [0147.727] FindNextFileA (in: hFindFile=0x5be260, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0 [0147.727] FindClose (in: hFindFile=0x5be260 | out: hFindFile=0x5be260) returned 1 [0147.727] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0147.727] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0147.727] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0 [0147.727] FindClose (in: hFindFile=0x5be160 | out: hFindFile=0x5be160) returned 1 [0147.727] FindNextFileA (in: hFindFile=0x5be220, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0147.727] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0147.727] FindNextFileA (in: hFindFile=0x5be220, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0147.727] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0147.728] SetFileTime (hFile=0x88, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0147.729] CloseHandle (hObject=0x88) returned 1 [0147.729] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\FDbq8fHF5s0hmP3yZVW.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\fdbq8fhf5s0hmp3yzvw.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\FDbq8fHF5s0hmP3yZVW.mp3. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\fdbq8fhf5s0hmp3yzvw.mp3. ")) returned 1 [0147.732] FindNextFileA (in: hFindFile=0x5be220, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0147.732] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0147.733] SetFileTime (hFile=0x88, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0147.734] CloseHandle (hObject=0x88) returned 1 [0147.734] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\FQ3Upfz1amfQZ2xNxp1Q.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\fq3upfz1amfqz2xnxp1q.mkv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\FQ3Upfz1amfQZ2xNxp1Q.mkv. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\fq3upfz1amfqz2xnxp1q.mkv. ")) returned 1 [0147.737] FindNextFileA (in: hFindFile=0x5be220, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0147.737] lstrcmpA (lpString1=".", lpString2="G1MLA2tK-JJG5d3fLkfZ") returned -1 [0147.737] lstrcmpA (lpString1="..", lpString2="G1MLA2tK-JJG5d3fLkfZ") returned -1 [0147.737] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\G1MLA2tK-JJG5d3fLkfZ\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be160 [0147.737] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0147.737] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0147.737] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0147.737] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0147.737] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0147.737] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0147.738] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0147.739] CloseHandle (hObject=0x8c) returned 1 [0147.739] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\G1MLA2tK-JJG5d3fLkfZ\\qx-nX3ACqrIIK2v_KWvi.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\g1mla2tk-jjg5d3flkfz\\qx-nx3acqriik2v_kwvi.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\G1MLA2tK-JJG5d3fLkfZ\\qx-nX3ACqrIIK2v_KWvi.jpg. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\g1mla2tk-jjg5d3flkfz\\qx-nx3acqriik2v_kwvi.jpg. ")) returned 1 [0147.741] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0147.741] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0147.741] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0147.741] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0147.742] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0147.742] CloseHandle (hObject=0x8c) returned 1 [0147.742] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\G1MLA2tK-JJG5d3fLkfZ\\VPz5j7y Usb2n.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\g1mla2tk-jjg5d3flkfz\\vpz5j7y usb2n.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\G1MLA2tK-JJG5d3fLkfZ\\VPz5j7y Usb2n.wav. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\g1mla2tk-jjg5d3flkfz\\vpz5j7y usb2n.wav. ")) returned 1 [0147.744] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0 [0147.744] FindClose (in: hFindFile=0x5be160 | out: hFindFile=0x5be160) returned 1 [0147.744] FindNextFileA (in: hFindFile=0x5be220, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0147.744] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0147.746] SetFileTime (hFile=0x88, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0147.746] CloseHandle (hObject=0x88) returned 1 [0147.746] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\j5_KkjidEEuBAWomq.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\j5_kkjideeubawomq.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\j5_KkjidEEuBAWomq.wav. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\j5_kkjideeubawomq.wav. ")) returned 1 [0147.748] FindNextFileA (in: hFindFile=0x5be220, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0147.748] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0147.750] SetFileTime (hFile=0x88, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0147.750] CloseHandle (hObject=0x88) returned 1 [0147.750] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\kT33.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\kt33.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\kT33.mp3. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\kt33.mp3. ")) returned 1 [0147.752] FindNextFileA (in: hFindFile=0x5be220, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0147.752] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0147.755] SetFileTime (hFile=0x88, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0147.755] CloseHandle (hObject=0x88) returned 1 [0147.756] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\lbsQwIMLCqhd.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\lbsqwimlcqhd.avi"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\lbsQwIMLCqhd.avi. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\lbsqwimlcqhd.avi. ")) returned 1 [0147.758] FindNextFileA (in: hFindFile=0x5be220, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0147.758] lstrcmpA (lpString1=".", lpString2="LBvmQHI29Sf73eBGQfg3") returned -1 [0147.758] lstrcmpA (lpString1="..", lpString2="LBvmQHI29Sf73eBGQfg3") returned -1 [0147.758] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\LBvmQHI29Sf73eBGQfg3\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be160 [0147.758] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0147.758] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0147.758] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0147.758] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0147.758] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0147.758] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0147.759] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0147.760] CloseHandle (hObject=0x8c) returned 1 [0147.760] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\LBvmQHI29Sf73eBGQfg3\\0I0gcJ-6a9K F.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\lbvmqhi29sf73ebgqfg3\\0i0gcj-6a9k f.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\LBvmQHI29Sf73eBGQfg3\\0I0gcJ-6a9K F.wav. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\lbvmqhi29sf73ebgqfg3\\0i0gcj-6a9k f.wav. ")) returned 1 [0147.762] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0147.762] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0147.764] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0147.777] CloseHandle (hObject=0x8c) returned 1 [0147.777] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\LBvmQHI29Sf73eBGQfg3\\HAn69yxr nLWNq02.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\lbvmqhi29sf73ebgqfg3\\han69yxr nlwnq02.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\LBvmQHI29Sf73eBGQfg3\\HAn69yxr nLWNq02.jpg. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\lbvmqhi29sf73ebgqfg3\\han69yxr nlwnq02.jpg. ")) returned 1 [0147.781] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0147.781] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0147.782] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0147.782] CloseHandle (hObject=0x8c) returned 1 [0147.782] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\LBvmQHI29Sf73eBGQfg3\\ia9.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\lbvmqhi29sf73ebgqfg3\\ia9.flv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\LBvmQHI29Sf73eBGQfg3\\ia9.flv. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\lbvmqhi29sf73ebgqfg3\\ia9.flv. ")) returned 1 [0147.784] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0147.784] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0147.785] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0147.785] CloseHandle (hObject=0x8c) returned 1 [0147.785] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\LBvmQHI29Sf73eBGQfg3\\JjkXYh.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\lbvmqhi29sf73ebgqfg3\\jjkxyh.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\LBvmQHI29Sf73eBGQfg3\\JjkXYh.png. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\lbvmqhi29sf73ebgqfg3\\jjkxyh.png. ")) returned 1 [0147.786] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0147.786] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0147.787] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0147.787] CloseHandle (hObject=0x8c) returned 1 [0147.787] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\LBvmQHI29Sf73eBGQfg3\\NPHmzD.pdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\lbvmqhi29sf73ebgqfg3\\nphmzd.pdf"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\LBvmQHI29Sf73eBGQfg3\\NPHmzD.pdf. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\lbvmqhi29sf73ebgqfg3\\nphmzd.pdf. ")) returned 1 [0147.789] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0147.789] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0147.790] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0147.790] CloseHandle (hObject=0x8c) returned 1 [0147.790] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\LBvmQHI29Sf73eBGQfg3\\sGEuCdxh5qxdq.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\lbvmqhi29sf73ebgqfg3\\sgeucdxh5qxdq.flv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\LBvmQHI29Sf73eBGQfg3\\sGEuCdxh5qxdq.flv. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\lbvmqhi29sf73ebgqfg3\\sgeucdxh5qxdq.flv. ")) returned 1 [0147.791] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0147.791] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0147.792] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0147.792] CloseHandle (hObject=0x8c) returned 1 [0147.792] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\LBvmQHI29Sf73eBGQfg3\\sHp6mWDb.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\lbvmqhi29sf73ebgqfg3\\shp6mwdb.flv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\LBvmQHI29Sf73eBGQfg3\\sHp6mWDb.flv. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\lbvmqhi29sf73ebgqfg3\\shp6mwdb.flv. ")) returned 1 [0147.794] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0147.794] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0147.794] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0 [0147.794] FindClose (in: hFindFile=0x5be160 | out: hFindFile=0x5be160) returned 1 [0147.794] FindNextFileA (in: hFindFile=0x5be220, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0147.794] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0147.795] SetFileTime (hFile=0x88, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0147.795] CloseHandle (hObject=0x88) returned 1 [0147.795] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NqD7fCROKdtbnhxQ.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\nqd7fcrokdtbnhxq.xlsx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NqD7fCROKdtbnhxQ.xlsx. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\nqd7fcrokdtbnhxq.xlsx. ")) returned 1 [0147.797] FindNextFileA (in: hFindFile=0x5be220, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0147.797] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0147.797] FindNextFileA (in: hFindFile=0x5be220, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0147.797] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0147.798] SetFileTime (hFile=0x88, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0147.798] CloseHandle (hObject=0x88) returned 1 [0147.798] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\oNpBdljsTRj.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\onpbdljstrj.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\oNpBdljsTRj.mp3. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\onpbdljstrj.mp3. ")) returned 1 [0147.800] FindNextFileA (in: hFindFile=0x5be220, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0147.800] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0147.800] FindNextFileA (in: hFindFile=0x5be220, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0147.800] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0147.801] SetFileTime (hFile=0x88, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0147.801] CloseHandle (hObject=0x88) returned 1 [0147.801] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\pWjLNlld 2cZdJ97ja6R.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\pwjlnlld 2czdj97ja6r.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\pWjLNlld 2cZdJ97ja6R.jpg. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\pwjlnlld 2czdj97ja6r.jpg. ")) returned 1 [0147.802] FindNextFileA (in: hFindFile=0x5be220, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0147.803] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0147.803] FindNextFileA (in: hFindFile=0x5be220, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0147.803] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0147.804] SetFileTime (hFile=0x88, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0147.805] CloseHandle (hObject=0x88) returned 1 [0147.805] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RPoMw4_I2m75LE208So.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rpomw4_i2m75le208so.flv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RPoMw4_I2m75LE208So.flv. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rpomw4_i2m75le208so.flv. ")) returned 1 [0147.806] FindNextFileA (in: hFindFile=0x5be220, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0147.806] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0147.808] SetFileTime (hFile=0x88, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0147.808] CloseHandle (hObject=0x88) returned 1 [0147.808] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\rVYgJ3SONp7G.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rvygj3sonp7g.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\rVYgJ3SONp7G.jpg. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rvygj3sonp7g.jpg. ")) returned 1 [0147.811] FindNextFileA (in: hFindFile=0x5be220, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0147.811] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0147.811] FindNextFileA (in: hFindFile=0x5be220, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0147.811] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0147.813] SetFileTime (hFile=0x88, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0147.813] CloseHandle (hObject=0x88) returned 1 [0147.813] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\u5MkXTTAQEUi9.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\u5mkxttaqeui9.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\u5MkXTTAQEUi9.jpg. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\u5mkxttaqeui9.jpg. ")) returned 1 [0147.814] FindNextFileA (in: hFindFile=0x5be220, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0147.814] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0147.816] SetFileTime (hFile=0x88, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0147.816] CloseHandle (hObject=0x88) returned 1 [0147.816] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Ulx86BGa3o17eHI.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ulx86bga3o17ehi.mp4"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Ulx86BGa3o17eHI.mp4. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ulx86bga3o17ehi.mp4. ")) returned 1 [0147.818] FindNextFileA (in: hFindFile=0x5be220, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0147.818] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0147.819] SetFileTime (hFile=0x88, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0147.819] CloseHandle (hObject=0x88) returned 1 [0147.819] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\UNo5nZ8p8Z.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\uno5nz8p8z.mp4"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\UNo5nZ8p8Z.mp4. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\uno5nz8p8z.mp4. ")) returned 1 [0147.820] FindNextFileA (in: hFindFile=0x5be220, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0147.821] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0147.821] FindNextFileA (in: hFindFile=0x5be220, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0147.821] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0147.822] SetFileTime (hFile=0x88, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0147.822] CloseHandle (hObject=0x88) returned 1 [0147.822] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WGRt.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\wgrt.avi"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WGRt.avi. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\wgrt.avi. ")) returned 1 [0147.823] FindNextFileA (in: hFindFile=0x5be220, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0147.823] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0147.825] SetFileTime (hFile=0x88, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0147.825] CloseHandle (hObject=0x88) returned 1 [0147.825] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\YlQ6idcRcudl1wE.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ylq6idcrcudl1we.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\YlQ6idcRcudl1wE.wav. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ylq6idcrcudl1we.wav. ")) returned 1 [0147.826] FindNextFileA (in: hFindFile=0x5be220, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0147.827] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0147.828] SetFileTime (hFile=0x88, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0147.828] CloseHandle (hObject=0x88) returned 1 [0147.828] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\yqIHYMBd_Jp9i27_x.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\yqihymbd_jp9i27_x.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\yqIHYMBd_Jp9i27_x.wav. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\yqihymbd_jp9i27_x.wav. ")) returned 1 [0147.830] FindNextFileA (in: hFindFile=0x5be220, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0147.830] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0147.831] SetFileTime (hFile=0x88, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0147.831] CloseHandle (hObject=0x88) returned 1 [0147.831] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\zXQx6kKEDSq65trnA.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\zxqx6kkedsq65trna.gif"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\zXQx6kKEDSq65trnA.gif. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\zxqx6kkedsq65trna.gif. ")) returned 1 [0147.832] FindNextFileA (in: hFindFile=0x5be220, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 0 [0147.832] FindClose (in: hFindFile=0x5be220 | out: hFindFile=0x5be220) returned 1 [0147.832] FindNextFileA (in: hFindFile=0x5be1e0, lpFindFileData=0xaf4e8 | out: lpFindFileData=0xaf4e8) returned 1 [0147.832] lstrcmpA (lpString1=".", lpString2="Documents") returned -1 [0147.832] lstrcmpA (lpString1="..", lpString2="Documents") returned -1 [0147.832] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\*.*", lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 0x5be220 [0147.832] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0147.832] FindNextFileA (in: hFindFile=0x5be220, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0147.833] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0147.833] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0147.833] FindNextFileA (in: hFindFile=0x5be220, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0147.833] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0147.834] SetFileTime (hFile=0x88, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0147.834] CloseHandle (hObject=0x88) returned 1 [0147.834] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\-tnNfBex7mqgiThQ.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\-tnnfbex7mqgithq.xlsx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\-tnNfBex7mqgiThQ.xlsx. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\-tnnfbex7mqgithq.xlsx. ")) returned 1 [0147.836] FindNextFileA (in: hFindFile=0x5be220, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0147.836] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0147.836] FindNextFileA (in: hFindFile=0x5be220, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0147.836] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0147.838] SetFileTime (hFile=0x88, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0147.838] CloseHandle (hObject=0x88) returned 1 [0147.838] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\5nyCGZFEbR.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\5nycgzfebr.docx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\5nyCGZFEbR.docx. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\5nycgzfebr.docx. ")) returned 1 [0147.839] FindNextFileA (in: hFindFile=0x5be220, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0147.839] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0147.840] SetFileTime (hFile=0x88, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0147.840] CloseHandle (hObject=0x88) returned 1 [0147.840] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\5o_0ov2PrpTq-Hs.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\5o_0ov2prptq-hs.xlsx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\5o_0ov2PrpTq-Hs.xlsx. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\5o_0ov2prptq-hs.xlsx. ")) returned 1 [0147.841] FindNextFileA (in: hFindFile=0x5be220, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0147.841] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0147.843] SetFileTime (hFile=0x88, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0147.843] CloseHandle (hObject=0x88) returned 1 [0147.843] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\6uZldM.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\6uzldm.xlsx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\6uZldM.xlsx. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\6uzldm.xlsx. ")) returned 1 [0147.845] FindNextFileA (in: hFindFile=0x5be220, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0147.845] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0147.846] SetFileTime (hFile=0x88, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0147.846] CloseHandle (hObject=0x88) returned 1 [0147.846] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\AiQSU bki.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\aiqsu bki.pptx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\AiQSU bki.pptx. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\aiqsu bki.pptx. ")) returned 1 [0147.848] FindNextFileA (in: hFindFile=0x5be220, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0147.848] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0147.848] FindNextFileA (in: hFindFile=0x5be220, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0147.848] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0147.849] SetFileTime (hFile=0x88, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0147.850] CloseHandle (hObject=0x88) returned 1 [0147.850] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\CBI_3.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\cbi_3.pptx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\CBI_3.pptx. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\cbi_3.pptx. ")) returned 1 [0147.851] FindNextFileA (in: hFindFile=0x5be220, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0147.851] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0147.852] FindNextFileA (in: hFindFile=0x5be220, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0147.852] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0147.853] SetFileTime (hFile=0x88, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0147.853] CloseHandle (hObject=0x88) returned 1 [0147.853] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\DV8a0q-.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\dv8a0q-.docx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\DV8a0q-.docx. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\dv8a0q-.docx. ")) returned 1 [0147.855] FindNextFileA (in: hFindFile=0x5be220, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0147.855] lstrcmpA (lpString1=".", lpString2="fIwoj0KgTcI7") returned -1 [0147.855] lstrcmpA (lpString1="..", lpString2="fIwoj0KgTcI7") returned -1 [0147.855] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fIwoj0KgTcI7\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be160 [0147.856] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0147.856] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0147.856] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0147.856] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0147.856] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0147.856] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0147.857] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0147.857] CloseHandle (hObject=0x8c) returned 1 [0147.857] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fIwoj0KgTcI7\\82kn_GJnK77zOElf.pdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\fiwoj0kgtci7\\82kn_gjnk77zoelf.pdf"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fIwoj0KgTcI7\\82kn_GJnK77zOElf.pdf. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\fiwoj0kgtci7\\82kn_gjnk77zoelf.pdf. ")) returned 1 [0147.858] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0147.858] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0147.859] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0147.859] CloseHandle (hObject=0x8c) returned 1 [0147.859] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fIwoj0KgTcI7\\89FoRDNId-.xls" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\fiwoj0kgtci7\\89fordnid-.xls"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fIwoj0KgTcI7\\89FoRDNId-.xls. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\fiwoj0kgtci7\\89fordnid-.xls. ")) returned 1 [0147.860] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0147.860] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0147.861] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0147.861] CloseHandle (hObject=0x8c) returned 1 [0147.861] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fIwoj0KgTcI7\\aSXrcW1Lgbdq.doc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\fiwoj0kgtci7\\asxrcw1lgbdq.doc"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fIwoj0KgTcI7\\aSXrcW1Lgbdq.doc. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\fiwoj0kgtci7\\asxrcw1lgbdq.doc. ")) returned 1 [0147.863] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0147.863] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0147.863] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0147.863] CloseHandle (hObject=0x8c) returned 1 [0147.864] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fIwoj0KgTcI7\\bHx_T9GNKL1OT.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\fiwoj0kgtci7\\bhx_t9gnkl1ot.pptx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fIwoj0KgTcI7\\bHx_T9GNKL1OT.pptx. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\fiwoj0kgtci7\\bhx_t9gnkl1ot.pptx. ")) returned 1 [0147.864] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0147.864] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0147.864] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0147.864] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0147.866] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0147.866] CloseHandle (hObject=0x8c) returned 1 [0147.866] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fIwoj0KgTcI7\\RqW1BdC.odt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\fiwoj0kgtci7\\rqw1bdc.odt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fIwoj0KgTcI7\\RqW1BdC.odt. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\fiwoj0kgtci7\\rqw1bdc.odt. ")) returned 1 [0147.867] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0147.867] lstrcmpA (lpString1=".", lpString2="SZiFFy") returned -1 [0147.867] lstrcmpA (lpString1="..", lpString2="SZiFFy") returned -1 [0147.867] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fIwoj0KgTcI7\\SZiFFy\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0147.867] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0147.867] FindNextFileA (in: hFindFile=0x5be260, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0147.867] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0147.867] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0147.867] FindNextFileA (in: hFindFile=0x5be260, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0147.867] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0147.868] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0147.869] CloseHandle (hObject=0x90) returned 1 [0147.869] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fIwoj0KgTcI7\\SZiFFy\\1_tFjjnncfM146Ye.doc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\fiwoj0kgtci7\\sziffy\\1_tfjjnncfm146ye.doc"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fIwoj0KgTcI7\\SZiFFy\\1_tFjjnncfM146Ye.doc. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\fiwoj0kgtci7\\sziffy\\1_tfjjnncfm146ye.doc. ")) returned 1 [0147.871] FindNextFileA (in: hFindFile=0x5be260, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0147.871] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0147.871] FindNextFileA (in: hFindFile=0x5be260, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0147.871] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0147.872] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0147.872] CloseHandle (hObject=0x90) returned 1 [0147.872] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fIwoj0KgTcI7\\SZiFFy\\Iuybio5Cn-um8.ppt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\fiwoj0kgtci7\\sziffy\\iuybio5cn-um8.ppt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fIwoj0KgTcI7\\SZiFFy\\Iuybio5Cn-um8.ppt. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\fiwoj0kgtci7\\sziffy\\iuybio5cn-um8.ppt. ")) returned 1 [0147.874] FindNextFileA (in: hFindFile=0x5be260, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0147.874] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0147.875] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0147.875] CloseHandle (hObject=0x90) returned 1 [0147.875] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fIwoj0KgTcI7\\SZiFFy\\l225SHbbchPUIQpFP_1q.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\fiwoj0kgtci7\\sziffy\\l225shbbchpuiqpfp_1q.docx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fIwoj0KgTcI7\\SZiFFy\\l225SHbbchPUIQpFP_1q.docx. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\fiwoj0kgtci7\\sziffy\\l225shbbchpuiqpfp_1q.docx. ")) returned 1 [0147.876] FindNextFileA (in: hFindFile=0x5be260, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0147.876] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0147.876] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0147.877] CloseHandle (hObject=0x90) returned 1 [0147.877] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fIwoj0KgTcI7\\SZiFFy\\SiaB.xls" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\fiwoj0kgtci7\\sziffy\\siab.xls"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fIwoj0KgTcI7\\SZiFFy\\SiaB.xls. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\fiwoj0kgtci7\\sziffy\\siab.xls. ")) returned 1 [0147.877] FindNextFileA (in: hFindFile=0x5be260, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0147.877] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0147.879] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0147.879] CloseHandle (hObject=0x90) returned 1 [0147.879] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fIwoj0KgTcI7\\SZiFFy\\w057SDnXc.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\fiwoj0kgtci7\\sziffy\\w057sdnxc.pptx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fIwoj0KgTcI7\\SZiFFy\\w057SDnXc.pptx. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\fiwoj0kgtci7\\sziffy\\w057sdnxc.pptx. ")) returned 1 [0147.881] FindNextFileA (in: hFindFile=0x5be260, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 1 [0147.881] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0147.881] FindNextFileA (in: hFindFile=0x5be260, lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0 [0147.881] FindClose (in: hFindFile=0x5be260 | out: hFindFile=0x5be260) returned 1 [0147.881] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0147.881] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0147.882] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0147.882] CloseHandle (hObject=0x8c) returned 1 [0147.882] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fIwoj0KgTcI7\\YGTP.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\fiwoj0kgtci7\\ygtp.xlsx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fIwoj0KgTcI7\\YGTP.xlsx. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\fiwoj0kgtci7\\ygtp.xlsx. ")) returned 1 [0147.885] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 1 [0147.885] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0147.888] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0147.888] CloseHandle (hObject=0x8c) returned 1 [0147.889] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fIwoj0KgTcI7\\Z-A8vsmAvp1Yjts.ppt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\fiwoj0kgtci7\\z-a8vsmavp1yjts.ppt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fIwoj0KgTcI7\\Z-A8vsmAvp1Yjts.ppt. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\fiwoj0kgtci7\\z-a8vsmavp1yjts.ppt. ")) returned 1 [0147.890] FindNextFileA (in: hFindFile=0x5be160, lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0 [0147.890] FindClose (in: hFindFile=0x5be160 | out: hFindFile=0x5be160) returned 1 [0147.890] FindNextFileA (in: hFindFile=0x5be220, lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 1 [0147.890] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0147.891] SetFileTime (hFile=0x88, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0147.891] CloseHandle (hObject=0x88) returned 1 [0147.891] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fxdBRP49R7q6PRxfRu.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\fxdbrp49r7q6prxfru.docx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fxdBRP49R7q6PRxfRu.docx. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\fxdbrp49r7q6prxfru.docx. ")) returned 1 [0147.893] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0147.893] SetFileTime (hFile=0x88, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0147.893] CloseHandle (hObject=0x88) returned 1 [0147.893] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\jQmdt.odt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\jqmdt.odt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\jQmdt.odt. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\jqmdt.odt. ")) returned 1 [0147.894] lstrcmpA (lpString1=".", lpString2="My Music") returned -1 [0147.894] lstrcmpA (lpString1="..", lpString2="My Music") returned -1 [0147.894] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Music\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0xffffffff [0147.895] lstrcmpA (lpString1=".", lpString2="My Pictures") returned -1 [0147.895] lstrcmpA (lpString1="..", lpString2="My Pictures") returned -1 [0147.895] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Pictures\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0xffffffff [0147.895] lstrcmpA (lpString1=".", lpString2="My Shapes") returned -1 [0147.895] lstrcmpA (lpString1="..", lpString2="My Shapes") returned -1 [0147.895] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be160 [0147.896] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0147.896] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0147.896] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0147.896] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0147.896] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0147.896] lstrcmpA (lpString1=".", lpString2="_private") returned -1 [0147.896] lstrcmpA (lpString1="..", lpString2="_private") returned -1 [0147.896] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\_private\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0147.896] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0147.896] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0147.896] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0147.896] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0147.897] lstrcmpA (lpString1=".", lpString2="My Videos") returned -1 [0147.897] lstrcmpA (lpString1="..", lpString2="My Videos") returned -1 [0147.897] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Videos\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0xffffffff [0147.897] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0147.898] SetFileTime (hFile=0x88, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0147.898] CloseHandle (hObject=0x88) returned 1 [0147.898] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\oqLv__d.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\oqlv__d.pptx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\oqLv__d.pptx. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\oqlv__d.pptx. ")) returned 1 [0147.900] lstrcmpA (lpString1=".", lpString2="Outlook Files") returned -1 [0147.900] lstrcmpA (lpString1="..", lpString2="Outlook Files") returned -1 [0147.900] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be160 [0147.900] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0147.900] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0147.900] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0147.900] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0147.900] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0147.901] SetFileTime (hFile=0x88, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0147.902] CloseHandle (hObject=0x88) returned 1 [0147.902] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\P-frcIM.odt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\p-frcim.odt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\P-frcIM.odt. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\p-frcim.odt. ")) returned 1 [0147.903] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0147.904] SetFileTime (hFile=0x88, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0147.904] CloseHandle (hObject=0x88) returned 1 [0147.904] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\p2X1Y0f7.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\p2x1y0f7.xlsx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\p2X1Y0f7.xlsx. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\p2x1y0f7.xlsx. ")) returned 1 [0147.906] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0147.906] SetFileTime (hFile=0x88, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0147.907] CloseHandle (hObject=0x88) returned 1 [0147.907] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\pBHs Vi.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\pbhs vi.docx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\pBHs Vi.docx. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\pbhs vi.docx. ")) returned 1 [0147.908] lstrcmpA (lpString1=".", lpString2="Ry5Vpzka0XeWLa") returned -1 [0147.908] lstrcmpA (lpString1="..", lpString2="Ry5Vpzka0XeWLa") returned -1 [0147.908] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Ry5Vpzka0XeWLa\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be160 [0147.908] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0147.908] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0147.908] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0147.908] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0147.908] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0147.908] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0147.908] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0147.910] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0147.910] CloseHandle (hObject=0x8c) returned 1 [0147.910] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Ry5Vpzka0XeWLa\\ZHw7Jzq1d6tCJ1b8G.xls" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\ry5vpzka0xewla\\zhw7jzq1d6tcj1b8g.xls"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Ry5Vpzka0XeWLa\\ZHw7Jzq1d6tCJ1b8G.xls. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\ry5vpzka0xewla\\zhw7jzq1d6tcj1b8g.xls. ")) returned 1 [0147.911] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0147.912] SetFileTime (hFile=0x88, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0147.912] CloseHandle (hObject=0x88) returned 1 [0147.912] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\SCt_wghu6xy 6XODAiS.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\sct_wghu6xy 6xodais.docx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\SCt_wghu6xy 6XODAiS.docx. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\sct_wghu6xy 6xodais.docx. ")) returned 1 [0147.913] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0147.914] SetFileTime (hFile=0x88, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0147.914] CloseHandle (hObject=0x88) returned 1 [0147.914] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\T83bYfV.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\t83byfv.xlsx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\T83bYfV.xlsx. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\t83byfv.xlsx. ")) returned 1 [0147.915] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0147.915] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0147.916] SetFileTime (hFile=0x88, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0147.916] CloseHandle (hObject=0x88) returned 1 [0147.916] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\UOiuwW7bPx7_Ya0Hv.ppt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\uoiuww7bpx7_ya0hv.ppt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\UOiuwW7bPx7_Ya0Hv.ppt. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\uoiuww7bpx7_ya0hv.ppt. ")) returned 1 [0147.917] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0147.917] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0147.918] SetFileTime (hFile=0x88, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0147.918] CloseHandle (hObject=0x88) returned 1 [0147.918] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\vWbva3C.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\vwbva3c.xlsx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\vWbva3C.xlsx. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\vwbva3c.xlsx. ")) returned 1 [0147.921] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0147.922] SetFileTime (hFile=0x88, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0147.922] CloseHandle (hObject=0x88) returned 1 [0147.922] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\_6Z9kZAKn3.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\_6z9kzakn3.pptx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\_6Z9kZAKn3.pptx. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\_6z9kzakn3.pptx. ")) returned 1 [0147.923] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0147.924] SetFileTime (hFile=0x88, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0147.924] CloseHandle (hObject=0x88) returned 1 [0147.924] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\_sH86PEt1vIfrcLsgF7.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\_sh86pet1vifrclsgf7.pptx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\_sH86PEt1vIfrcLsgF7.pptx. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\_sh86pet1vifrclsgf7.pptx. ")) returned 1 [0147.925] lstrcmpA (lpString1=".", lpString2="Downloads") returned -1 [0147.925] lstrcmpA (lpString1="..", lpString2="Downloads") returned -1 [0147.925] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\*.*", lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 0x5be220 [0147.925] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0147.925] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0147.925] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0147.925] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0147.925] lstrcmpA (lpString1=".", lpString2="Favorites") returned -1 [0147.925] lstrcmpA (lpString1="..", lpString2="Favorites") returned -1 [0147.926] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\*.*", lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 0x5be220 [0147.926] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0147.926] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0147.926] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0147.926] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0147.926] lstrcmpA (lpString1=".", lpString2="Links") returned -1 [0147.926] lstrcmpA (lpString1="..", lpString2="Links") returned -1 [0147.926] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be160 [0147.926] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0147.926] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0147.926] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0147.926] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0147.926] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0147.926] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0147.926] lstrcmpA (lpString1=".", lpString2="Microsoft Websites") returned -1 [0147.926] lstrcmpA (lpString1="..", lpString2="Microsoft Websites") returned -1 [0147.926] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be160 [0148.163] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0148.163] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0148.163] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0148.163] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0148.163] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0148.163] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0148.164] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0148.164] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0148.164] lstrcmpA (lpString1=".", lpString2="MSN Websites") returned -1 [0148.164] lstrcmpA (lpString1="..", lpString2="MSN Websites") returned -1 [0148.164] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be160 [0148.398] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0148.398] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0148.398] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0148.398] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0148.579] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0148.579] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0148.579] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0148.579] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0148.579] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0148.580] lstrcmpA (lpString1=".", lpString2="Windows Live") returned -1 [0148.580] lstrcmpA (lpString1="..", lpString2="Windows Live") returned -1 [0148.580] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be160 [0148.753] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0148.753] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0148.753] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0148.753] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0148.753] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0148.753] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0148.753] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0148.754] lstrcmpA (lpString1=".", lpString2="Links") returned -1 [0148.754] lstrcmpA (lpString1="..", lpString2="Links") returned -1 [0148.754] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\*.*", lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 0x5be220 [0148.754] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0148.754] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0148.754] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0148.754] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0148.754] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0148.755] SetFileTime (hFile=0x88, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0148.755] CloseHandle (hObject=0x88) returned 1 [0148.756] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Desktop.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\links\\desktop.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Desktop.lnk. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\links\\desktop.lnk. ")) returned 1 [0148.757] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0148.891] SetFileTime (hFile=0x88, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0148.892] CloseHandle (hObject=0x88) returned 1 [0148.892] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Downloads.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\links\\downloads.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Downloads.lnk. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\links\\downloads.lnk. ")) returned 1 [0148.897] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0148.900] SetFileTime (hFile=0x88, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0148.900] CloseHandle (hObject=0x88) returned 1 [0148.900] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\RecentPlaces.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\links\\recentplaces.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\RecentPlaces.lnk. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\links\\recentplaces.lnk. ")) returned 1 [0148.903] lstrcmpA (lpString1=".", lpString2="Local Settings") returned -1 [0148.903] lstrcmpA (lpString1="..", lpString2="Local Settings") returned -1 [0148.904] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Local Settings\\*.*", lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 0xffffffff [0148.904] lstrcmpA (lpString1=".", lpString2="Music") returned -1 [0148.904] lstrcmpA (lpString1="..", lpString2="Music") returned -1 [0148.904] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\*.*", lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 0x5be220 [0148.904] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0148.905] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0148.905] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0148.905] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0148.907] SetFileTime (hFile=0x88, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0148.908] CloseHandle (hObject=0x88) returned 1 [0148.908] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\-I_DhO6G.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\-i_dho6g.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\-I_DhO6G.wav. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\-i_dho6g.wav. ")) returned 1 [0148.911] lstrcmpA (lpString1=".", lpString2="0Hi8oEKPbZG3U4d2x") returned -1 [0148.911] lstrcmpA (lpString1="..", lpString2="0Hi8oEKPbZG3U4d2x") returned -1 [0148.911] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\0Hi8oEKPbZG3U4d2x\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be160 [0148.911] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0148.911] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0148.911] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0148.911] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0148.914] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0148.915] CloseHandle (hObject=0x8c) returned 1 [0148.916] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\0Hi8oEKPbZG3U4d2x\\g-3s8rkFbeAlj5pA.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\0hi8oekpbzg3u4d2x\\g-3s8rkfbealj5pa.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\0Hi8oEKPbZG3U4d2x\\g-3s8rkFbeAlj5pA.mp3. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\0hi8oekpbzg3u4d2x\\g-3s8rkfbealj5pa.mp3. ")) returned 1 [0148.919] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0148.919] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0148.920] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0148.921] CloseHandle (hObject=0x8c) returned 1 [0148.921] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\0Hi8oEKPbZG3U4d2x\\jmkDV0b.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\0hi8oekpbzg3u4d2x\\jmkdv0b.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\0Hi8oEKPbZG3U4d2x\\jmkDV0b.mp3. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\0hi8oekpbzg3u4d2x\\jmkdv0b.mp3. ")) returned 1 [0148.924] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0148.926] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0148.926] CloseHandle (hObject=0x8c) returned 1 [0148.927] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\0Hi8oEKPbZG3U4d2x\\kNYvGGgAANL.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\0hi8oekpbzg3u4d2x\\knyvgggaanl.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\0Hi8oEKPbZG3U4d2x\\kNYvGGgAANL.wav. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\0hi8oekpbzg3u4d2x\\knyvgggaanl.wav. ")) returned 1 [0148.929] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0148.930] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0148.938] CloseHandle (hObject=0x8c) returned 1 [0148.938] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\0Hi8oEKPbZG3U4d2x\\Rd2lrRkuka2Q.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\0hi8oekpbzg3u4d2x\\rd2lrrkuka2q.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\0Hi8oEKPbZG3U4d2x\\Rd2lrRkuka2Q.wav. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\0hi8oekpbzg3u4d2x\\rd2lrrkuka2q.wav. ")) returned 1 [0148.941] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0148.941] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0148.943] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0148.943] CloseHandle (hObject=0x8c) returned 1 [0148.944] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\0Hi8oEKPbZG3U4d2x\\XsnV_S.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\0hi8oekpbzg3u4d2x\\xsnv_s.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\0Hi8oEKPbZG3U4d2x\\XsnV_S.mp3. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\0hi8oekpbzg3u4d2x\\xsnv_s.mp3. ")) returned 1 [0148.946] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0148.946] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0148.947] SetFileTime (hFile=0x88, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0148.947] CloseHandle (hObject=0x88) returned 1 [0148.947] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\4nqj2o1sEIxFVo9.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\4nqj2o1seixfvo9.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\4nqj2o1sEIxFVo9.wav. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\4nqj2o1seixfvo9.wav. ")) returned 1 [0148.950] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0148.952] SetFileTime (hFile=0x88, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0148.953] CloseHandle (hObject=0x88) returned 1 [0148.953] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\5yyYJo94lkjLFfM8.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\5yyyjo94lkjlffm8.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\5yyYJo94lkjLFfM8.mp3. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\5yyyjo94lkjlffm8.mp3. ")) returned 1 [0148.955] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0148.956] SetFileTime (hFile=0x88, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0148.957] CloseHandle (hObject=0x88) returned 1 [0148.957] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\8fbYuaMhBOyVxPh TjKm.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\8fbyuamhboyvxph tjkm.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\8fbYuaMhBOyVxPh TjKm.mp3. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\8fbyuamhboyvxph tjkm.mp3. ")) returned 1 [0148.959] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0148.960] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0148.961] SetFileTime (hFile=0x88, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0148.962] CloseHandle (hObject=0x88) returned 1 [0148.962] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\A4nXKUH.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\a4nxkuh.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\A4nXKUH.mp3. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\a4nxkuh.mp3. ")) returned 1 [0148.964] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0148.965] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0148.965] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0148.966] SetFileTime (hFile=0x88, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0148.966] CloseHandle (hObject=0x88) returned 1 [0148.966] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\ISmQxqrN.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\ismqxqrn.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\ISmQxqrN.mp3. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\ismqxqrn.mp3. ")) returned 1 [0148.968] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0148.970] SetFileTime (hFile=0x88, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0148.970] CloseHandle (hObject=0x88) returned 1 [0148.970] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\j7QZIW.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\j7qziw.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\j7QZIW.wav. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\j7qziw.wav. ")) returned 1 [0148.972] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0148.973] SetFileTime (hFile=0x88, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0148.973] CloseHandle (hObject=0x88) returned 1 [0148.973] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\kmL0QKA.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\kml0qka.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\kmL0QKA.mp3. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\kml0qka.mp3. ")) returned 1 [0148.975] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0148.977] SetFileTime (hFile=0x88, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0148.977] CloseHandle (hObject=0x88) returned 1 [0148.977] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\kng0ZqFQg P5rOF.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\kng0zqfqg p5rof.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\kng0ZqFQg P5rOF.wav. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\kng0zqfqg p5rof.wav. ")) returned 1 [0148.979] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0148.979] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0148.981] SetFileTime (hFile=0x88, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0148.981] CloseHandle (hObject=0x88) returned 1 [0148.981] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\PB1rKTV8u2jmE4Mih.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\pb1rktv8u2jme4mih.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\PB1rKTV8u2jmE4Mih.wav. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\pb1rktv8u2jme4mih.wav. ")) returned 1 [0148.983] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0148.984] SetFileTime (hFile=0x88, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0148.985] CloseHandle (hObject=0x88) returned 1 [0148.985] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\qIVqr.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\qivqr.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\qIVqr.wav. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\qivqr.wav. ")) returned 1 [0148.986] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0148.988] SetFileTime (hFile=0x88, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0148.988] CloseHandle (hObject=0x88) returned 1 [0148.988] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\r4odlWw.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\r4odlww.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\r4odlWw.wav. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\r4odlww.wav. ")) returned 1 [0148.990] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0148.991] SetFileTime (hFile=0x88, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0148.991] CloseHandle (hObject=0x88) returned 1 [0148.991] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\rTSjkExtzb-7oIY.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\rtsjkextzb-7oiy.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\rTSjkExtzb-7oIY.wav. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\rtsjkextzb-7oiy.wav. ")) returned 1 [0148.992] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0148.994] SetFileTime (hFile=0x88, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0148.994] CloseHandle (hObject=0x88) returned 1 [0148.994] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\SSSqGh1qmgk.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\sssqgh1qmgk.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\SSSqGh1qmgk.wav. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\sssqgh1qmgk.wav. ")) returned 1 [0148.995] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0148.996] SetFileTime (hFile=0x88, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0148.996] CloseHandle (hObject=0x88) returned 1 [0148.997] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\usF3.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\usf3.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\usF3.wav. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\usf3.wav. ")) returned 1 [0148.998] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0148.999] SetFileTime (hFile=0x88, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0148.999] CloseHandle (hObject=0x88) returned 1 [0148.999] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\ZavfnZ4tWesZnF7NSkH.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\zavfnz4twesznf7nskh.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\ZavfnZ4tWesZnF7NSkH.mp3. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\zavfnz4twesznf7nskh.mp3. ")) returned 1 [0149.001] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0149.002] SetFileTime (hFile=0x88, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0149.002] CloseHandle (hObject=0x88) returned 1 [0149.002] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\zdRZuY_.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\zdrzuy_.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\zdRZuY_.mp3. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\zdrzuy_.mp3. ")) returned 1 [0149.004] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0149.005] SetFileTime (hFile=0x88, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0149.005] CloseHandle (hObject=0x88) returned 1 [0149.005] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\_W0KG49mLLZ4dLk0c 4.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\_w0kg49mllz4dlk0c 4.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\_W0KG49mLLZ4dLk0c 4.mp3. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\_w0kg49mllz4dlk0c 4.mp3. ")) returned 1 [0149.007] lstrcmpA (lpString1=".", lpString2="My Documents") returned -1 [0149.007] lstrcmpA (lpString1="..", lpString2="My Documents") returned -1 [0149.007] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\My Documents\\*.*", lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 0xffffffff [0149.007] lstrcmpA (lpString1=".", lpString2="NetHood") returned -1 [0149.007] lstrcmpA (lpString1="..", lpString2="NetHood") returned -1 [0149.007] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\NetHood\\*.*", lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 0xffffffff [0149.007] PeekMessageA (in: lpMsg=0xaf4c4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf4c4) returned 0 [0149.007] PeekMessageA (in: lpMsg=0xaf4c4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf4c4) returned 0 [0149.007] PeekMessageA (in: lpMsg=0xaf4c4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf4c4) returned 0 [0149.008] PeekMessageA (in: lpMsg=0xaf4c4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf4c4) returned 0 [0149.008] PeekMessageA (in: lpMsg=0xaf4c4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf4c4) returned 0 [0149.008] PeekMessageA (in: lpMsg=0xaf4c4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf4c4) returned 0 [0149.008] PeekMessageA (in: lpMsg=0xaf4c4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf4c4) returned 0 [0149.008] lstrcmpA (lpString1=".", lpString2="Pictures") returned -1 [0149.008] lstrcmpA (lpString1="..", lpString2="Pictures") returned -1 [0149.008] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\*.*", lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 0x5be220 [0149.008] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0149.008] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0149.008] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0149.008] lstrcmpA (lpString1=".", lpString2="0YILzG") returned -1 [0149.008] lstrcmpA (lpString1="..", lpString2="0YILzG") returned -1 [0149.008] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\0YILzG\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be160 [0149.009] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0149.009] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0149.009] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0149.009] lstrcmpA (lpString1=".", lpString2="9dk-99") returned -1 [0149.009] lstrcmpA (lpString1="..", lpString2="9dk-99") returned -1 [0149.009] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\0YILzG\\9dk-99\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0149.009] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0149.009] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0149.009] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0149.009] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0149.010] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0149.011] CloseHandle (hObject=0x90) returned 1 [0149.011] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\0YILzG\\9dk-99\\0xU5G.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\0yilzg\\9dk-99\\0xu5g.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\0YILzG\\9dk-99\\0xU5G.jpg. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\0yilzg\\9dk-99\\0xu5g.jpg. ")) returned 1 [0149.012] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0149.013] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0149.013] CloseHandle (hObject=0x90) returned 1 [0149.014] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\0YILzG\\9dk-99\\4t li.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\0yilzg\\9dk-99\\4t li.bmp"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\0YILzG\\9dk-99\\4t li.bmp. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\0yilzg\\9dk-99\\4t li.bmp. ")) returned 1 [0149.015] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0149.016] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0149.016] CloseHandle (hObject=0x90) returned 1 [0149.016] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\0YILzG\\9dk-99\\AdGZSRwkjFa4ek.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\0yilzg\\9dk-99\\adgzsrwkjfa4ek.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\0YILzG\\9dk-99\\AdGZSRwkjFa4ek.png. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\0yilzg\\9dk-99\\adgzsrwkjfa4ek.png. ")) returned 1 [0149.018] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0149.020] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0149.020] CloseHandle (hObject=0x90) returned 1 [0149.020] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\0YILzG\\9dk-99\\fjli4uzIstTI9x.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\0yilzg\\9dk-99\\fjli4uzistti9x.bmp"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\0YILzG\\9dk-99\\fjli4uzIstTI9x.bmp. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\0yilzg\\9dk-99\\fjli4uzistti9x.bmp. ")) returned 1 [0149.022] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0149.023] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0149.023] CloseHandle (hObject=0x90) returned 1 [0149.023] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\0YILzG\\9dk-99\\gwFpPFGy1QM.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\0yilzg\\9dk-99\\gwfppfgy1qm.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\0YILzG\\9dk-99\\gwFpPFGy1QM.jpg. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\0yilzg\\9dk-99\\gwfppfgy1qm.jpg. ")) returned 1 [0149.025] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0149.026] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0149.026] CloseHandle (hObject=0x90) returned 1 [0149.026] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\0YILzG\\9dk-99\\KK-cwaVz_9GpQhswtqeq.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\0yilzg\\9dk-99\\kk-cwavz_9gpqhswtqeq.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\0YILzG\\9dk-99\\KK-cwaVz_9GpQhswtqeq.png. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\0yilzg\\9dk-99\\kk-cwavz_9gpqhswtqeq.png. ")) returned 1 [0149.028] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0149.030] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0149.030] CloseHandle (hObject=0x90) returned 1 [0149.030] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\0YILzG\\9dk-99\\maVSd7.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\0yilzg\\9dk-99\\mavsd7.gif"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\0YILzG\\9dk-99\\maVSd7.gif. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\0yilzg\\9dk-99\\mavsd7.gif. ")) returned 1 [0149.032] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0149.033] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0149.033] CloseHandle (hObject=0x90) returned 1 [0149.033] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\0YILzG\\9dk-99\\Usus-WgPkxXuFZy.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\0yilzg\\9dk-99\\usus-wgpkxxufzy.gif"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\0YILzG\\9dk-99\\Usus-WgPkxXuFZy.gif. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\0yilzg\\9dk-99\\usus-wgpkxxufzy.gif. ")) returned 1 [0149.035] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0149.036] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0149.036] CloseHandle (hObject=0x8c) returned 1 [0149.036] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\0YILzG\\cjwwU48s.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\0yilzg\\cjwwu48s.bmp"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\0YILzG\\cjwwU48s.bmp. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\0yilzg\\cjwwu48s.bmp. ")) returned 1 [0149.037] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0149.039] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0149.039] CloseHandle (hObject=0x8c) returned 1 [0149.039] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\0YILzG\\N1K8E eH.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\0yilzg\\n1k8e eh.gif"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\0YILzG\\N1K8E eH.gif. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\0yilzg\\n1k8e eh.gif. ")) returned 1 [0149.042] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0149.045] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0149.045] CloseHandle (hObject=0x8c) returned 1 [0149.045] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\0YILzG\\qrmPbyt.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\0yilzg\\qrmpbyt.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\0YILzG\\qrmPbyt.png. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\0yilzg\\qrmpbyt.png. ")) returned 1 [0149.046] lstrcmpA (lpString1=".", lpString2="v2RQpQ7cS0cMnw9I1w") returned -1 [0149.046] lstrcmpA (lpString1="..", lpString2="v2RQpQ7cS0cMnw9I1w") returned -1 [0149.046] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\0YILzG\\v2RQpQ7cS0cMnw9I1w\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0149.047] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0149.047] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0149.047] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0149.047] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0149.048] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0149.048] CloseHandle (hObject=0x90) returned 1 [0149.048] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\0YILzG\\v2RQpQ7cS0cMnw9I1w\\15R26OlnzJjUVs6G6.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\0yilzg\\v2rqpq7cs0cmnw9i1w\\15r26olnzjjuvs6g6.gif"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\0YILzG\\v2RQpQ7cS0cMnw9I1w\\15R26OlnzJjUVs6G6.gif. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\0yilzg\\v2rqpq7cs0cmnw9i1w\\15r26olnzjjuvs6g6.gif. ")) returned 1 [0149.049] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0149.050] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0149.050] CloseHandle (hObject=0x90) returned 1 [0149.050] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\0YILzG\\v2RQpQ7cS0cMnw9I1w\\193Ls.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\0yilzg\\v2rqpq7cs0cmnw9i1w\\193ls.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\0YILzG\\v2RQpQ7cS0cMnw9I1w\\193Ls.jpg. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\0yilzg\\v2rqpq7cs0cmnw9i1w\\193ls.jpg. ")) returned 1 [0149.051] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0149.053] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0149.053] CloseHandle (hObject=0x90) returned 1 [0149.053] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\0YILzG\\v2RQpQ7cS0cMnw9I1w\\lFoeLgWwfglH2CDts.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\0yilzg\\v2rqpq7cs0cmnw9i1w\\lfoelgwwfglh2cdts.bmp"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\0YILzG\\v2RQpQ7cS0cMnw9I1w\\lFoeLgWwfglH2CDts.bmp. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\0yilzg\\v2rqpq7cs0cmnw9i1w\\lfoelgwwfglh2cdts.bmp. ")) returned 1 [0149.075] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0149.076] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0149.076] CloseHandle (hObject=0x90) returned 1 [0149.076] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\0YILzG\\v2RQpQ7cS0cMnw9I1w\\oNgwfeg0B0m5r5MP Z9c.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\0yilzg\\v2rqpq7cs0cmnw9i1w\\ongwfeg0b0m5r5mp z9c.gif"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\0YILzG\\v2RQpQ7cS0cMnw9I1w\\oNgwfeg0B0m5r5MP Z9c.gif. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\0yilzg\\v2rqpq7cs0cmnw9i1w\\ongwfeg0b0m5r5mp z9c.gif. ")) returned 1 [0149.078] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0149.079] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0149.080] CloseHandle (hObject=0x90) returned 1 [0149.080] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\0YILzG\\v2RQpQ7cS0cMnw9I1w\\pbO0A0mgpSWW6ibdP.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\0yilzg\\v2rqpq7cs0cmnw9i1w\\pbo0a0mgpsww6ibdp.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\0YILzG\\v2RQpQ7cS0cMnw9I1w\\pbO0A0mgpSWW6ibdP.png. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\0yilzg\\v2rqpq7cs0cmnw9i1w\\pbo0a0mgpsww6ibdp.png. ")) returned 1 [0149.082] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0149.083] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0149.084] CloseHandle (hObject=0x90) returned 1 [0149.084] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\0YILzG\\v2RQpQ7cS0cMnw9I1w\\s36l8il.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\0yilzg\\v2rqpq7cs0cmnw9i1w\\s36l8il.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\0YILzG\\v2RQpQ7cS0cMnw9I1w\\s36l8il.jpg. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\0yilzg\\v2rqpq7cs0cmnw9i1w\\s36l8il.jpg. ")) returned 1 [0149.086] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0149.087] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0149.087] CloseHandle (hObject=0x90) returned 1 [0149.087] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\0YILzG\\v2RQpQ7cS0cMnw9I1w\\Thye.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\0yilzg\\v2rqpq7cs0cmnw9i1w\\thye.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\0YILzG\\v2RQpQ7cS0cMnw9I1w\\Thye.png. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\0yilzg\\v2rqpq7cs0cmnw9i1w\\thye.png. ")) returned 1 [0149.089] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0149.090] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0149.104] CloseHandle (hObject=0x90) returned 1 [0149.104] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\0YILzG\\v2RQpQ7cS0cMnw9I1w\\XHLFFW769C.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\0yilzg\\v2rqpq7cs0cmnw9i1w\\xhlffw769c.bmp"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\0YILzG\\v2RQpQ7cS0cMnw9I1w\\XHLFFW769C.bmp. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\0yilzg\\v2rqpq7cs0cmnw9i1w\\xhlffw769c.bmp. ")) returned 1 [0149.105] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0149.106] SetFileTime (hFile=0x88, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0149.107] CloseHandle (hObject=0x88) returned 1 [0149.107] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\8O9Ij3Qj.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\8o9ij3qj.bmp"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\8O9Ij3Qj.bmp. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\8o9ij3qj.bmp. ")) returned 1 [0149.108] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0149.109] SetFileTime (hFile=0x88, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0149.109] CloseHandle (hObject=0x88) returned 1 [0149.109] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\BRTtZW3ccmj5U4wr10.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\brttzw3ccmj5u4wr10.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\BRTtZW3ccmj5U4wr10.png. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\brttzw3ccmj5u4wr10.png. ")) returned 1 [0149.111] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0149.111] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0149.112] SetFileTime (hFile=0x88, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0149.112] CloseHandle (hObject=0x88) returned 1 [0149.112] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\eK1Cx1C.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\ek1cx1c.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\eK1Cx1C.jpg. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\ek1cx1c.jpg. ")) returned 1 [0149.114] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0149.115] SetFileTime (hFile=0x88, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0149.115] CloseHandle (hObject=0x88) returned 1 [0149.115] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\HciVrC.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\hcivrc.gif"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\HciVrC.gif. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\hcivrc.gif. ")) returned 1 [0149.117] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0149.118] SetFileTime (hFile=0x88, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0149.118] CloseHandle (hObject=0x88) returned 1 [0149.118] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\MpL0k.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\mpl0k.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\MpL0k.png. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\mpl0k.png. ")) returned 1 [0149.119] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0149.120] SetFileTime (hFile=0x88, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0149.120] CloseHandle (hObject=0x88) returned 1 [0149.121] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\SY61.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\sy61.bmp"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\SY61.bmp. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\sy61.bmp. ")) returned 1 [0149.123] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0149.124] SetFileTime (hFile=0x88, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0149.124] CloseHandle (hObject=0x88) returned 1 [0149.124] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\uIdQZzg2ULcVrGTQrM3S.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\uidqzzg2ulcvrgtqrm3s.gif"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\uIdQZzg2ULcVrGTQrM3S.gif. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\uidqzzg2ulcvrgtqrm3s.gif. ")) returned 1 [0149.125] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0149.126] SetFileTime (hFile=0x88, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0149.127] CloseHandle (hObject=0x88) returned 1 [0149.127] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\xa70y5ONjqb.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\xa70y5onjqb.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\xa70y5ONjqb.png. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\xa70y5onjqb.png. ")) returned 1 [0149.128] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0149.130] SetFileTime (hFile=0x88, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0149.130] CloseHandle (hObject=0x88) returned 1 [0149.130] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\YKlOR7B_4.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\yklor7b_4.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\YKlOR7B_4.jpg. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\yklor7b_4.jpg. ")) returned 1 [0149.132] lstrcmpA (lpString1=".", lpString2="PrintHood") returned -1 [0149.132] lstrcmpA (lpString1="..", lpString2="PrintHood") returned -1 [0149.132] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\PrintHood\\*.*", lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 0xffffffff [0149.132] lstrcmpA (lpString1=".", lpString2="Recent") returned -1 [0149.132] lstrcmpA (lpString1="..", lpString2="Recent") returned -1 [0149.132] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Recent\\*.*", lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 0xffffffff [0149.132] lstrcmpA (lpString1=".", lpString2="Saved Games") returned -1 [0149.132] lstrcmpA (lpString1="..", lpString2="Saved Games") returned -1 [0149.132] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games\\*.*", lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 0x5be220 [0149.133] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0149.133] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0149.133] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0149.133] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0149.133] lstrcmpA (lpString1=".", lpString2="Searches") returned -1 [0149.133] lstrcmpA (lpString1="..", lpString2="Searches") returned -1 [0149.133] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\*.*", lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 0x5be220 [0149.133] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0149.133] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0149.133] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0149.133] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0149.133] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0149.133] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0149.133] lstrcmpA (lpString1=".", lpString2="SendTo") returned -1 [0149.133] lstrcmpA (lpString1="..", lpString2="SendTo") returned -1 [0149.133] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\SendTo\\*.*", lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 0xffffffff [0149.134] lstrcmpA (lpString1=".", lpString2="Start Menu") returned -1 [0149.134] lstrcmpA (lpString1="..", lpString2="Start Menu") returned -1 [0149.134] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Start Menu\\*.*", lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 0xffffffff [0149.134] lstrcmpA (lpString1=".", lpString2="Templates") returned -1 [0149.134] lstrcmpA (lpString1="..", lpString2="Templates") returned -1 [0149.134] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Templates\\*.*", lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 0xffffffff [0149.134] lstrcmpA (lpString1=".", lpString2="Videos") returned -1 [0149.134] lstrcmpA (lpString1="..", lpString2="Videos") returned -1 [0149.134] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\*.*", lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 0x5be220 [0149.134] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0149.134] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0149.134] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0149.134] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0149.135] SetFileTime (hFile=0x88, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0149.135] CloseHandle (hObject=0x88) returned 1 [0149.135] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\60JBa6.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\60jba6.flv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\60JBa6.flv. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\60jba6.flv. ")) returned 1 [0149.137] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0149.138] lstrcmpA (lpString1=".", lpString2="W7UAmvB2 E fkwuz6p") returned -1 [0149.138] lstrcmpA (lpString1="..", lpString2="W7UAmvB2 E fkwuz6p") returned -1 [0149.138] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\W7UAmvB2 E fkwuz6p\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be160 [0149.138] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0149.138] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0149.138] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0149.138] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0149.139] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0149.140] CloseHandle (hObject=0x8c) returned 1 [0149.140] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\W7UAmvB2 E fkwuz6p\\b6mZJvu8Yj0.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\w7uamvb2 e fkwuz6p\\b6mzjvu8yj0.mp4"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\W7UAmvB2 E fkwuz6p\\b6mZJvu8Yj0.mp4. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\w7uamvb2 e fkwuz6p\\b6mzjvu8yj0.mp4. ")) returned 1 [0149.142] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0149.143] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0149.144] CloseHandle (hObject=0x8c) returned 1 [0149.144] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\W7UAmvB2 E fkwuz6p\\jRd g.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\w7uamvb2 e fkwuz6p\\jrd g.mp4"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\W7UAmvB2 E fkwuz6p\\jRd g.mp4. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\w7uamvb2 e fkwuz6p\\jrd g.mp4. ")) returned 1 [0149.146] lstrcmpA (lpString1=".", lpString2="TEP K9pgsvupx0kaO") returned -1 [0149.146] lstrcmpA (lpString1="..", lpString2="TEP K9pgsvupx0kaO") returned -1 [0149.146] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\W7UAmvB2 E fkwuz6p\\TEP K9pgsvupx0kaO\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0149.147] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0149.147] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0149.147] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0149.147] lstrcmpA (lpString1=".", lpString2="HC7Y5SE-m") returned -1 [0149.147] lstrcmpA (lpString1="..", lpString2="HC7Y5SE-m") returned -1 [0149.147] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\W7UAmvB2 E fkwuz6p\\TEP K9pgsvupx0kaO\\HC7Y5SE-m\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0149.147] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0149.147] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0149.147] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0149.147] lstrcmpA (lpString1=".", lpString2="1RN39nFJiwKC") returned -1 [0149.147] lstrcmpA (lpString1="..", lpString2="1RN39nFJiwKC") returned -1 [0149.147] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\W7UAmvB2 E fkwuz6p\\TEP K9pgsvupx0kaO\\HC7Y5SE-m\\1RN39nFJiwKC\\*.*", lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 0x5be2e0 [0149.147] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0149.148] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0149.148] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0149.148] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0149.149] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0149.149] CloseHandle (hObject=0x98) returned 1 [0149.149] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\W7UAmvB2 E fkwuz6p\\TEP K9pgsvupx0kaO\\HC7Y5SE-m\\1RN39nFJiwKC\\-ad v8qJXko5PBvD.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\w7uamvb2 e fkwuz6p\\tep k9pgsvupx0kao\\hc7y5se-m\\1rn39nfjiwkc\\-ad v8qjxko5pbvd.mkv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\W7UAmvB2 E fkwuz6p\\TEP K9pgsvupx0kaO\\HC7Y5SE-m\\1RN39nFJiwKC\\-ad v8qJXko5PBvD.mkv. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\w7uamvb2 e fkwuz6p\\tep k9pgsvupx0kao\\hc7y5se-m\\1rn39nfjiwkc\\-ad v8qjxko5pbvd.mkv. ")) returned 1 [0149.152] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0149.157] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0149.158] CloseHandle (hObject=0x98) returned 1 [0149.158] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\W7UAmvB2 E fkwuz6p\\TEP K9pgsvupx0kaO\\HC7Y5SE-m\\1RN39nFJiwKC\\kXEhU3Sozs.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\w7uamvb2 e fkwuz6p\\tep k9pgsvupx0kao\\hc7y5se-m\\1rn39nfjiwkc\\kxehu3sozs.mkv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\W7UAmvB2 E fkwuz6p\\TEP K9pgsvupx0kaO\\HC7Y5SE-m\\1RN39nFJiwKC\\kXEhU3Sozs.mkv. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\w7uamvb2 e fkwuz6p\\tep k9pgsvupx0kao\\hc7y5se-m\\1rn39nfjiwkc\\kxehu3sozs.mkv. ")) returned 1 [0149.161] lstrcmpA (lpString1=".", lpString2="64VXuX") returned -1 [0149.161] lstrcmpA (lpString1="..", lpString2="64VXuX") returned -1 [0149.161] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\W7UAmvB2 E fkwuz6p\\TEP K9pgsvupx0kaO\\HC7Y5SE-m\\64VXuX\\*.*", lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 0x5be2e0 [0149.161] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0149.161] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0149.162] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0149.162] lstrcmpA (lpString1=".", lpString2="0fie7MvEycUEykcbBu") returned -1 [0149.162] lstrcmpA (lpString1="..", lpString2="0fie7MvEycUEykcbBu") returned -1 [0149.162] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\W7UAmvB2 E fkwuz6p\\TEP K9pgsvupx0kaO\\HC7Y5SE-m\\64VXuX\\0fie7MvEycUEykcbBu\\*.*", lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 0x5be320 [0149.162] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0149.162] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0149.162] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0149.162] PeekMessageA (in: lpMsg=0xaece4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaece4) returned 0 [0149.165] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0149.165] CloseHandle (hObject=0x9c) returned 1 [0149.165] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\W7UAmvB2 E fkwuz6p\\TEP K9pgsvupx0kaO\\HC7Y5SE-m\\64VXuX\\0fie7MvEycUEykcbBu\\dCnncT.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\w7uamvb2 e fkwuz6p\\tep k9pgsvupx0kao\\hc7y5se-m\\64vxux\\0fie7mveycueykcbbu\\dcnnct.avi"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\W7UAmvB2 E fkwuz6p\\TEP K9pgsvupx0kaO\\HC7Y5SE-m\\64VXuX\\0fie7MvEycUEykcbBu\\dCnncT.avi. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\w7uamvb2 e fkwuz6p\\tep k9pgsvupx0kao\\hc7y5se-m\\64vxux\\0fie7mveycueykcbbu\\dcnnct.avi. ")) returned 1 [0149.171] PeekMessageA (in: lpMsg=0xaece4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaece4) returned 0 [0149.173] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0149.174] CloseHandle (hObject=0x9c) returned 1 [0149.174] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\W7UAmvB2 E fkwuz6p\\TEP K9pgsvupx0kaO\\HC7Y5SE-m\\64VXuX\\0fie7MvEycUEykcbBu\\lXUA3o.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\w7uamvb2 e fkwuz6p\\tep k9pgsvupx0kao\\hc7y5se-m\\64vxux\\0fie7mveycueykcbbu\\lxua3o.mkv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\W7UAmvB2 E fkwuz6p\\TEP K9pgsvupx0kaO\\HC7Y5SE-m\\64VXuX\\0fie7MvEycUEykcbBu\\lXUA3o.mkv. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\w7uamvb2 e fkwuz6p\\tep k9pgsvupx0kao\\hc7y5se-m\\64vxux\\0fie7mveycueykcbbu\\lxua3o.mkv. ")) returned 1 [0149.177] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0149.179] SetFileTime (hFile=0x98, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0149.179] CloseHandle (hObject=0x98) returned 1 [0149.180] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\W7UAmvB2 E fkwuz6p\\TEP K9pgsvupx0kaO\\HC7Y5SE-m\\64VXuX\\7 QBiPQwdYoYoC.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\w7uamvb2 e fkwuz6p\\tep k9pgsvupx0kao\\hc7y5se-m\\64vxux\\7 qbipqwdyoyoc.flv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\W7UAmvB2 E fkwuz6p\\TEP K9pgsvupx0kaO\\HC7Y5SE-m\\64VXuX\\7 QBiPQwdYoYoC.flv. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\w7uamvb2 e fkwuz6p\\tep k9pgsvupx0kao\\hc7y5se-m\\64vxux\\7 qbipqwdyoyoc.flv. ")) returned 1 [0149.182] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0149.183] lstrcmpA (lpString1=".", lpString2="Oe3m1hdBKm") returned -1 [0149.183] lstrcmpA (lpString1="..", lpString2="Oe3m1hdBKm") returned -1 [0149.183] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\W7UAmvB2 E fkwuz6p\\TEP K9pgsvupx0kaO\\HC7Y5SE-m\\64VXuX\\Oe3m1hdBKm\\*.*", lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 0x5be320 [0149.183] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0149.183] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0149.183] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0149.183] PeekMessageA (in: lpMsg=0xaece4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaece4) returned 0 [0149.183] PeekMessageA (in: lpMsg=0xaece4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaece4) returned 0 [0149.183] PeekMessageA (in: lpMsg=0xaece4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaece4) returned 0 [0149.184] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0149.185] CloseHandle (hObject=0x9c) returned 1 [0149.185] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\W7UAmvB2 E fkwuz6p\\TEP K9pgsvupx0kaO\\HC7Y5SE-m\\64VXuX\\Oe3m1hdBKm\\AeYAXn1vPSA13hhlo.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\w7uamvb2 e fkwuz6p\\tep k9pgsvupx0kao\\hc7y5se-m\\64vxux\\oe3m1hdbkm\\aeyaxn1vpsa13hhlo.avi"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\W7UAmvB2 E fkwuz6p\\TEP K9pgsvupx0kaO\\HC7Y5SE-m\\64VXuX\\Oe3m1hdBKm\\AeYAXn1vPSA13hhlo.avi. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\w7uamvb2 e fkwuz6p\\tep k9pgsvupx0kao\\hc7y5se-m\\64vxux\\oe3m1hdbkm\\aeyaxn1vpsa13hhlo.avi. ")) returned 1 [0149.187] PeekMessageA (in: lpMsg=0xaece4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaece4) returned 0 [0149.188] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0149.188] CloseHandle (hObject=0x9c) returned 1 [0149.188] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\W7UAmvB2 E fkwuz6p\\TEP K9pgsvupx0kaO\\HC7Y5SE-m\\64VXuX\\Oe3m1hdBKm\\hrz53Er_BD_I.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\w7uamvb2 e fkwuz6p\\tep k9pgsvupx0kao\\hc7y5se-m\\64vxux\\oe3m1hdbkm\\hrz53er_bd_i.avi"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\W7UAmvB2 E fkwuz6p\\TEP K9pgsvupx0kaO\\HC7Y5SE-m\\64VXuX\\Oe3m1hdBKm\\hrz53Er_BD_I.avi. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\w7uamvb2 e fkwuz6p\\tep k9pgsvupx0kao\\hc7y5se-m\\64vxux\\oe3m1hdbkm\\hrz53er_bd_i.avi. ")) returned 1 [0149.190] lstrcmpA (lpString1=".", lpString2="MX2NbigS") returned -1 [0149.190] lstrcmpA (lpString1="..", lpString2="MX2NbigS") returned -1 [0149.191] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\W7UAmvB2 E fkwuz6p\\TEP K9pgsvupx0kaO\\HC7Y5SE-m\\64VXuX\\Oe3m1hdBKm\\MX2NbigS\\*.*", lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 0x5be360 [0149.191] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0149.191] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0149.191] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0149.191] PeekMessageA (in: lpMsg=0xaeb94, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaeb94) returned 0 [0149.192] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0149.192] CloseHandle (hObject=0xa0) returned 1 [0149.193] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\W7UAmvB2 E fkwuz6p\\TEP K9pgsvupx0kaO\\HC7Y5SE-m\\64VXuX\\Oe3m1hdBKm\\MX2NbigS\\6uXHe5 X6AO0_U_pl.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\w7uamvb2 e fkwuz6p\\tep k9pgsvupx0kao\\hc7y5se-m\\64vxux\\oe3m1hdbkm\\mx2nbigs\\6uxhe5 x6ao0_u_pl.flv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\W7UAmvB2 E fkwuz6p\\TEP K9pgsvupx0kaO\\HC7Y5SE-m\\64VXuX\\Oe3m1hdBKm\\MX2NbigS\\6uXHe5 X6AO0_U_pl.flv. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\w7uamvb2 e fkwuz6p\\tep k9pgsvupx0kao\\hc7y5se-m\\64vxux\\oe3m1hdbkm\\mx2nbigs\\6uxhe5 x6ao0_u_pl.flv. ")) returned 1 [0149.195] PeekMessageA (in: lpMsg=0xaeb94, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaeb94) returned 0 [0149.198] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0149.198] CloseHandle (hObject=0xa0) returned 1 [0149.198] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\W7UAmvB2 E fkwuz6p\\TEP K9pgsvupx0kaO\\HC7Y5SE-m\\64VXuX\\Oe3m1hdBKm\\MX2NbigS\\9SpDS7OruKmntE.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\w7uamvb2 e fkwuz6p\\tep k9pgsvupx0kao\\hc7y5se-m\\64vxux\\oe3m1hdbkm\\mx2nbigs\\9spds7orukmnte.mkv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\W7UAmvB2 E fkwuz6p\\TEP K9pgsvupx0kaO\\HC7Y5SE-m\\64VXuX\\Oe3m1hdBKm\\MX2NbigS\\9SpDS7OruKmntE.mkv. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\w7uamvb2 e fkwuz6p\\tep k9pgsvupx0kao\\hc7y5se-m\\64vxux\\oe3m1hdbkm\\mx2nbigs\\9spds7orukmnte.mkv. ")) returned 1 [0149.200] PeekMessageA (in: lpMsg=0xaeb94, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaeb94) returned 0 [0149.201] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0149.202] CloseHandle (hObject=0xa0) returned 1 [0149.202] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\W7UAmvB2 E fkwuz6p\\TEP K9pgsvupx0kaO\\HC7Y5SE-m\\64VXuX\\Oe3m1hdBKm\\MX2NbigS\\BPyZbr8Oh6BW.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\w7uamvb2 e fkwuz6p\\tep k9pgsvupx0kao\\hc7y5se-m\\64vxux\\oe3m1hdbkm\\mx2nbigs\\bpyzbr8oh6bw.mkv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\W7UAmvB2 E fkwuz6p\\TEP K9pgsvupx0kaO\\HC7Y5SE-m\\64VXuX\\Oe3m1hdBKm\\MX2NbigS\\BPyZbr8Oh6BW.mkv. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\w7uamvb2 e fkwuz6p\\tep k9pgsvupx0kao\\hc7y5se-m\\64vxux\\oe3m1hdbkm\\mx2nbigs\\bpyzbr8oh6bw.mkv. ")) returned 1 [0149.203] lstrcmpA (lpString1=".", lpString2="Ji0g1ikEO3UGmO154xM") returned -1 [0149.203] lstrcmpA (lpString1="..", lpString2="Ji0g1ikEO3UGmO154xM") returned -1 [0149.204] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\W7UAmvB2 E fkwuz6p\\TEP K9pgsvupx0kaO\\HC7Y5SE-m\\64VXuX\\Oe3m1hdBKm\\MX2NbigS\\Ji0g1ikEO3UGmO154xM\\*.*", lpFindFileData=0xaea68 | out: lpFindFileData=0xaea68) returned 0x5be3a0 [0149.204] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0149.204] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0149.204] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0149.204] PeekMessageA (in: lpMsg=0xaea44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaea44) returned 0 [0149.205] SetFileTime (hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0149.205] CloseHandle (hObject=0xa4) returned 1 [0149.205] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\W7UAmvB2 E fkwuz6p\\TEP K9pgsvupx0kaO\\HC7Y5SE-m\\64VXuX\\Oe3m1hdBKm\\MX2NbigS\\Ji0g1ikEO3UGmO154xM\\38R5-eeHaDW Bavl.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\w7uamvb2 e fkwuz6p\\tep k9pgsvupx0kao\\hc7y5se-m\\64vxux\\oe3m1hdbkm\\mx2nbigs\\ji0g1ikeo3ugmo154xm\\38r5-eehadw bavl.avi"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\W7UAmvB2 E fkwuz6p\\TEP K9pgsvupx0kaO\\HC7Y5SE-m\\64VXuX\\Oe3m1hdBKm\\MX2NbigS\\Ji0g1ikEO3UGmO154xM\\38R5-eeHaDW Bavl.avi. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\w7uamvb2 e fkwuz6p\\tep k9pgsvupx0kao\\hc7y5se-m\\64vxux\\oe3m1hdbkm\\mx2nbigs\\ji0g1ikeo3ugmo154xm\\38r5-eehadw bavl.avi. ")) returned 1 [0149.207] PeekMessageA (in: lpMsg=0xaea44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaea44) returned 0 [0149.208] SetFileTime (hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0149.209] CloseHandle (hObject=0xa4) returned 1 [0149.209] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\W7UAmvB2 E fkwuz6p\\TEP K9pgsvupx0kaO\\HC7Y5SE-m\\64VXuX\\Oe3m1hdBKm\\MX2NbigS\\Ji0g1ikEO3UGmO154xM\\a6HBeB5duKFJVHD.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\w7uamvb2 e fkwuz6p\\tep k9pgsvupx0kao\\hc7y5se-m\\64vxux\\oe3m1hdbkm\\mx2nbigs\\ji0g1ikeo3ugmo154xm\\a6hbeb5dukfjvhd.mkv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\W7UAmvB2 E fkwuz6p\\TEP K9pgsvupx0kaO\\HC7Y5SE-m\\64VXuX\\Oe3m1hdBKm\\MX2NbigS\\Ji0g1ikEO3UGmO154xM\\a6HBeB5duKFJVHD.mkv. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\w7uamvb2 e fkwuz6p\\tep k9pgsvupx0kao\\hc7y5se-m\\64vxux\\oe3m1hdbkm\\mx2nbigs\\ji0g1ikeo3ugmo154xm\\a6hbeb5dukfjvhd.mkv. ")) returned 1 [0149.210] PeekMessageA (in: lpMsg=0xaea44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaea44) returned 0 [0149.211] SetFileTime (hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0149.211] CloseHandle (hObject=0xa4) returned 1 [0149.211] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\W7UAmvB2 E fkwuz6p\\TEP K9pgsvupx0kaO\\HC7Y5SE-m\\64VXuX\\Oe3m1hdBKm\\MX2NbigS\\Ji0g1ikEO3UGmO154xM\\CqorE.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\w7uamvb2 e fkwuz6p\\tep k9pgsvupx0kao\\hc7y5se-m\\64vxux\\oe3m1hdbkm\\mx2nbigs\\ji0g1ikeo3ugmo154xm\\cqore.avi"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\W7UAmvB2 E fkwuz6p\\TEP K9pgsvupx0kaO\\HC7Y5SE-m\\64VXuX\\Oe3m1hdBKm\\MX2NbigS\\Ji0g1ikEO3UGmO154xM\\CqorE.avi. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\w7uamvb2 e fkwuz6p\\tep k9pgsvupx0kao\\hc7y5se-m\\64vxux\\oe3m1hdbkm\\mx2nbigs\\ji0g1ikeo3ugmo154xm\\cqore.avi. ")) returned 1 [0149.213] PeekMessageA (in: lpMsg=0xaea44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaea44) returned 0 [0149.214] SetFileTime (hFile=0xa4, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0149.214] CloseHandle (hObject=0xa4) returned 1 [0149.214] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\W7UAmvB2 E fkwuz6p\\TEP K9pgsvupx0kaO\\HC7Y5SE-m\\64VXuX\\Oe3m1hdBKm\\MX2NbigS\\Ji0g1ikEO3UGmO154xM\\m7H2KZXC 4zShOXn.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\w7uamvb2 e fkwuz6p\\tep k9pgsvupx0kao\\hc7y5se-m\\64vxux\\oe3m1hdbkm\\mx2nbigs\\ji0g1ikeo3ugmo154xm\\m7h2kzxc 4zshoxn.mp4"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\W7UAmvB2 E fkwuz6p\\TEP K9pgsvupx0kaO\\HC7Y5SE-m\\64VXuX\\Oe3m1hdBKm\\MX2NbigS\\Ji0g1ikEO3UGmO154xM\\m7H2KZXC 4zShOXn.mp4. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\w7uamvb2 e fkwuz6p\\tep k9pgsvupx0kao\\hc7y5se-m\\64vxux\\oe3m1hdbkm\\mx2nbigs\\ji0g1ikeo3ugmo154xm\\m7h2kzxc 4zshoxn.mp4. ")) returned 1 [0149.216] PeekMessageA (in: lpMsg=0xaeb94, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaeb94) returned 0 [0149.217] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0149.217] CloseHandle (hObject=0xa0) returned 1 [0149.217] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\W7UAmvB2 E fkwuz6p\\TEP K9pgsvupx0kaO\\HC7Y5SE-m\\64VXuX\\Oe3m1hdBKm\\MX2NbigS\\LKzHE.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\w7uamvb2 e fkwuz6p\\tep k9pgsvupx0kao\\hc7y5se-m\\64vxux\\oe3m1hdbkm\\mx2nbigs\\lkzhe.mkv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\W7UAmvB2 E fkwuz6p\\TEP K9pgsvupx0kaO\\HC7Y5SE-m\\64VXuX\\Oe3m1hdBKm\\MX2NbigS\\LKzHE.mkv. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\w7uamvb2 e fkwuz6p\\tep k9pgsvupx0kao\\hc7y5se-m\\64vxux\\oe3m1hdbkm\\mx2nbigs\\lkzhe.mkv. ")) returned 1 [0149.218] PeekMessageA (in: lpMsg=0xaeb94, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaeb94) returned 0 [0149.219] SetFileTime (hFile=0xa0, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0149.219] CloseHandle (hObject=0xa0) returned 1 [0149.219] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\W7UAmvB2 E fkwuz6p\\TEP K9pgsvupx0kaO\\HC7Y5SE-m\\64VXuX\\Oe3m1hdBKm\\MX2NbigS\\tBbjZlgnU-Zww8Y.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\w7uamvb2 e fkwuz6p\\tep k9pgsvupx0kao\\hc7y5se-m\\64vxux\\oe3m1hdbkm\\mx2nbigs\\tbbjzlgnu-zww8y.avi"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\W7UAmvB2 E fkwuz6p\\TEP K9pgsvupx0kaO\\HC7Y5SE-m\\64VXuX\\Oe3m1hdBKm\\MX2NbigS\\tBbjZlgnU-Zww8Y.avi. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\w7uamvb2 e fkwuz6p\\tep k9pgsvupx0kao\\hc7y5se-m\\64vxux\\oe3m1hdbkm\\mx2nbigs\\tbbjzlgnu-zww8y.avi. ")) returned 1 [0149.220] PeekMessageA (in: lpMsg=0xaece4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaece4) returned 0 [0149.221] SetFileTime (hFile=0x9c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0149.222] CloseHandle (hObject=0x9c) returned 1 [0149.222] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\W7UAmvB2 E fkwuz6p\\TEP K9pgsvupx0kaO\\HC7Y5SE-m\\64VXuX\\Oe3m1hdBKm\\TPbOaMD20h92bHBRh.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\w7uamvb2 e fkwuz6p\\tep k9pgsvupx0kao\\hc7y5se-m\\64vxux\\oe3m1hdbkm\\tpboamd20h92bhbrh.mkv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\W7UAmvB2 E fkwuz6p\\TEP K9pgsvupx0kaO\\HC7Y5SE-m\\64VXuX\\Oe3m1hdBKm\\TPbOaMD20h92bHBRh.mkv. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\w7uamvb2 e fkwuz6p\\tep k9pgsvupx0kao\\hc7y5se-m\\64vxux\\oe3m1hdbkm\\tpboamd20h92bhbrh.mkv. ")) returned 1 [0149.224] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0149.224] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0149.224] PeekMessageA (in: lpMsg=0xaef84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaef84) returned 0 [0149.226] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0149.226] CloseHandle (hObject=0x94) returned 1 [0149.226] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\W7UAmvB2 E fkwuz6p\\TEP K9pgsvupx0kaO\\HC7Y5SE-m\\memi.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\w7uamvb2 e fkwuz6p\\tep k9pgsvupx0kao\\hc7y5se-m\\memi.flv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\W7UAmvB2 E fkwuz6p\\TEP K9pgsvupx0kaO\\HC7Y5SE-m\\memi.flv. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\w7uamvb2 e fkwuz6p\\tep k9pgsvupx0kao\\hc7y5se-m\\memi.flv. ")) returned 1 [0149.227] PeekMessageA (in: lpMsg=0xaef84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaef84) returned 0 [0149.229] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0149.229] CloseHandle (hObject=0x94) returned 1 [0149.229] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\W7UAmvB2 E fkwuz6p\\TEP K9pgsvupx0kaO\\HC7Y5SE-m\\olzW.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\w7uamvb2 e fkwuz6p\\tep k9pgsvupx0kao\\hc7y5se-m\\olzw.mkv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\W7UAmvB2 E fkwuz6p\\TEP K9pgsvupx0kaO\\HC7Y5SE-m\\olzW.mkv. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\w7uamvb2 e fkwuz6p\\tep k9pgsvupx0kao\\hc7y5se-m\\olzw.mkv. ")) returned 1 [0149.230] PeekMessageA (in: lpMsg=0xaef84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaef84) returned 0 [0149.232] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0149.232] CloseHandle (hObject=0x94) returned 1 [0149.232] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\W7UAmvB2 E fkwuz6p\\TEP K9pgsvupx0kaO\\HC7Y5SE-m\\Z8zX.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\w7uamvb2 e fkwuz6p\\tep k9pgsvupx0kao\\hc7y5se-m\\z8zx.avi"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\W7UAmvB2 E fkwuz6p\\TEP K9pgsvupx0kaO\\HC7Y5SE-m\\Z8zX.avi. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\w7uamvb2 e fkwuz6p\\tep k9pgsvupx0kao\\hc7y5se-m\\z8zx.avi. ")) returned 1 [0149.234] PeekMessageA (in: lpMsg=0xaef84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaef84) returned 0 [0149.235] SetFileTime (hFile=0x94, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0149.235] CloseHandle (hObject=0x94) returned 1 [0149.235] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\W7UAmvB2 E fkwuz6p\\TEP K9pgsvupx0kaO\\HC7Y5SE-m\\_lIyXa.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\w7uamvb2 e fkwuz6p\\tep k9pgsvupx0kao\\hc7y5se-m\\_liyxa.flv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\W7UAmvB2 E fkwuz6p\\TEP K9pgsvupx0kaO\\HC7Y5SE-m\\_lIyXa.flv. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\w7uamvb2 e fkwuz6p\\tep k9pgsvupx0kao\\hc7y5se-m\\_liyxa.flv. ")) returned 1 [0149.236] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0149.237] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0149.237] CloseHandle (hObject=0x90) returned 1 [0149.237] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\W7UAmvB2 E fkwuz6p\\TEP K9pgsvupx0kaO\\vCVPL 3NRLlZlSbP.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\w7uamvb2 e fkwuz6p\\tep k9pgsvupx0kao\\vcvpl 3nrllzlsbp.avi"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\W7UAmvB2 E fkwuz6p\\TEP K9pgsvupx0kaO\\vCVPL 3NRLlZlSbP.avi. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\w7uamvb2 e fkwuz6p\\tep k9pgsvupx0kao\\vcvpl 3nrllzlsbp.avi. ")) returned 1 [0149.239] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0149.239] SetFileTime (hFile=0x90, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0149.240] CloseHandle (hObject=0x90) returned 1 [0149.240] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\W7UAmvB2 E fkwuz6p\\TEP K9pgsvupx0kaO\\xcItu.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\w7uamvb2 e fkwuz6p\\tep k9pgsvupx0kao\\xcitu.mp4"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\W7UAmvB2 E fkwuz6p\\TEP K9pgsvupx0kaO\\xcItu.mp4. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\w7uamvb2 e fkwuz6p\\tep k9pgsvupx0kao\\xcitu.mp4. ")) returned 1 [0149.241] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0149.241] lstrcmpA (lpString1=".", lpString2="XqD28X") returned -1 [0149.241] lstrcmpA (lpString1="..", lpString2="XqD28X") returned -1 [0149.241] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\XqD28X\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be160 [0149.241] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0149.241] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0149.241] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0149.241] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0149.242] SetFileTime (hFile=0x8c, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0149.243] CloseHandle (hObject=0x8c) returned 1 [0149.243] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\XqD28X\\7whz1Vn5TZzaCukZlM.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\xqd28x\\7whz1vn5tzzacukzlm.mkv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\XqD28X\\7whz1Vn5TZzaCukZlM.mkv. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\xqd28x\\7whz1vn5tzzacukzlm.mkv. ")) returned 1 [0149.244] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0149.244] PeekMessageA (in: lpMsg=0xaf374, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf374) returned 0 [0149.245] SetFileTime (hFile=0x88, lpCreationTime=0x40752e, lpLastAccessTime=0x407536, lpLastWriteTime=0x40753e) returned 1 [0149.245] CloseHandle (hObject=0x88) returned 1 [0149.245] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Y90Cwmn9Msh.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\y90cwmn9msh.mp4"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Y90Cwmn9Msh.mp4. " (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\y90cwmn9msh.mp4. ")) returned 1 [0149.246] lstrcmpA (lpString1=".", lpString2="All Users") returned -1 [0149.246] lstrcmpA (lpString1="..", lpString2="All Users") returned -1 [0149.246] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\*.*", lpFindFileData=0xaf4e8 | out: lpFindFileData=0xaf4e8) returned 0x5be1e0 [0149.246] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0149.246] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0149.246] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0149.246] lstrcmpA (lpString1=".", lpString2="Adobe") returned -1 [0149.246] lstrcmpA (lpString1="..", lpString2="Adobe") returned -1 [0149.246] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Adobe\\*.*", lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 0x5be220 [0149.247] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0149.247] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0149.247] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0149.247] lstrcmpA (lpString1=".", lpString2="Acrobat") returned -1 [0149.247] lstrcmpA (lpString1="..", lpString2="Acrobat") returned -1 [0149.247] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Adobe\\Acrobat\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be160 [0149.247] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0149.247] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0149.247] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0149.247] lstrcmpA (lpString1=".", lpString2="10.0") returned -1 [0149.247] lstrcmpA (lpString1="..", lpString2="10.0") returned -1 [0149.247] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0149.247] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0149.247] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0149.247] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0149.247] lstrcmpA (lpString1=".", lpString2="Replicate") returned -1 [0149.247] lstrcmpA (lpString1="..", lpString2="Replicate") returned -1 [0149.247] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0149.248] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0149.248] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0149.248] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0149.248] lstrcmpA (lpString1=".", lpString2="Security") returned -1 [0149.248] lstrcmpA (lpString1="..", lpString2="Security") returned -1 [0149.248] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\*.*", lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 0x5be2e0 [0149.248] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0149.248] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0149.248] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0149.248] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0149.248] lstrcmpA (lpString1=".", lpString2="ARM") returned -1 [0149.248] lstrcmpA (lpString1="..", lpString2="ARM") returned -1 [0149.248] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Adobe\\ARM\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be160 [0149.248] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0149.248] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0149.248] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0149.248] lstrcmpA (lpString1=".", lpString2="Reader_10.0.0") returned -1 [0149.248] lstrcmpA (lpString1="..", lpString2="Reader_10.0.0") returned -1 [0149.248] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0149.249] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0149.249] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0149.249] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0149.249] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0149.249] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0149.249] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0149.250] lstrcmpA (lpString1=".", lpString2="Application Data") returned -1 [0149.250] lstrcmpA (lpString1="..", lpString2="Application Data") returned -1 [0149.250] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Application Data\\*.*", lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 0xffffffff [0149.250] lstrcmpA (lpString1=".", lpString2="Desktop") returned -1 [0149.250] lstrcmpA (lpString1="..", lpString2="Desktop") returned -1 [0149.250] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Desktop\\*.*", lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 0xffffffff [0149.250] lstrcmpA (lpString1=".", lpString2="Documents") returned -1 [0149.250] lstrcmpA (lpString1="..", lpString2="Documents") returned -1 [0149.250] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Documents\\*.*", lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 0xffffffff [0149.250] lstrcmpA (lpString1=".", lpString2="Favorites") returned -1 [0149.250] lstrcmpA (lpString1="..", lpString2="Favorites") returned -1 [0149.250] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Favorites\\*.*", lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 0xffffffff [0149.250] lstrcmpA (lpString1=".", lpString2="Microsoft") returned -1 [0149.251] lstrcmpA (lpString1="..", lpString2="Microsoft") returned -1 [0149.251] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\*.*", lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 0x5be220 [0149.251] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0149.251] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0149.251] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0149.251] lstrcmpA (lpString1=".", lpString2="Assistance") returned -1 [0149.251] lstrcmpA (lpString1="..", lpString2="Assistance") returned -1 [0149.251] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be160 [0149.251] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0149.251] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0149.251] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0149.251] lstrcmpA (lpString1=".", lpString2="Client") returned -1 [0149.251] lstrcmpA (lpString1="..", lpString2="Client") returned -1 [0149.251] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0149.251] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0149.251] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0149.251] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0149.251] lstrcmpA (lpString1=".", lpString2="1.0") returned -1 [0149.251] lstrcmpA (lpString1="..", lpString2="1.0") returned -1 [0149.251] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0149.251] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0149.251] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0149.251] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0149.252] lstrcmpA (lpString1=".", lpString2="en-US") returned -1 [0149.252] lstrcmpA (lpString1="..", lpString2="en-US") returned -1 [0149.252] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\*.*", lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 0x5be2e0 [0149.252] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0149.252] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0149.252] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0149.252] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0149.252] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0149.252] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0149.252] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0149.253] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0149.253] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0149.253] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0149.253] lstrcmpA (lpString1=".", lpString2="Crypto") returned -1 [0149.253] lstrcmpA (lpString1="..", lpString2="Crypto") returned -1 [0149.253] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be160 [0149.254] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0149.254] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0149.254] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0149.254] lstrcmpA (lpString1=".", lpString2="DSS") returned -1 [0149.254] lstrcmpA (lpString1="..", lpString2="DSS") returned -1 [0149.254] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0149.254] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0149.254] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0149.254] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0149.254] lstrcmpA (lpString1=".", lpString2="MachineKeys") returned -1 [0149.254] lstrcmpA (lpString1="..", lpString2="MachineKeys") returned -1 [0149.254] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\MachineKeys\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0149.254] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0149.254] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0149.254] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0149.254] lstrcmpA (lpString1=".", lpString2="Keys") returned -1 [0149.254] lstrcmpA (lpString1="..", lpString2="Keys") returned -1 [0149.255] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\Keys\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0149.255] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0149.255] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0149.255] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0149.255] lstrcmpA (lpString1=".", lpString2="RSA") returned -1 [0149.255] lstrcmpA (lpString1="..", lpString2="RSA") returned -1 [0149.255] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0149.255] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0149.255] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0149.255] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0149.255] lstrcmpA (lpString1=".", lpString2="MachineKeys") returned -1 [0149.255] lstrcmpA (lpString1="..", lpString2="MachineKeys") returned -1 [0149.255] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0149.256] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0149.256] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0149.256] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0149.256] lstrcmpA (lpString1=".", lpString2="S-1-5-18") returned -1 [0149.256] lstrcmpA (lpString1="..", lpString2="S-1-5-18") returned -1 [0149.256] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0149.256] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0149.256] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0149.256] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0149.256] PeekMessageA (in: lpMsg=0xaef84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaef84) returned 0 [0149.256] PeekMessageA (in: lpMsg=0xaef84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaef84) returned 0 [0149.256] lstrcmpA (lpString1=".", lpString2="Device Stage") returned -1 [0149.256] lstrcmpA (lpString1="..", lpString2="Device Stage") returned -1 [0149.256] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be160 [0149.257] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0149.257] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0149.257] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0149.257] lstrcmpA (lpString1=".", lpString2="Device") returned -1 [0149.257] lstrcmpA (lpString1="..", lpString2="Device") returned -1 [0149.257] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0149.257] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0149.257] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0149.257] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0149.257] lstrcmpA (lpString1=".", lpString2="{113527a4-45d4-4b6f-b567-97838f1b04b0}") returned -1 [0149.257] lstrcmpA (lpString1="..", lpString2="{113527a4-45d4-4b6f-b567-97838f1b04b0}") returned -1 [0149.257] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0149.258] lstrcmpA (lpString1=".", lpString2=".") returned 0 [0149.258] lstrcmpA (lpString1=".", lpString2="..") returned -1 [0149.258] lstrcmpA (lpString1="..", lpString2="..") returned 0 [0149.258] PeekMessageA (in: lpMsg=0xaef84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaef84) returned 0 [0149.258] PeekMessageA (in: lpMsg=0xaef84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaef84) returned 0 [0149.258] PeekMessageA (in: lpMsg=0xaef84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaef84) returned 0 [0149.258] PeekMessageA (in: lpMsg=0xaef84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaef84) returned 0 [0149.259] PeekMessageA (in: lpMsg=0xaef84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaef84) returned 0 [0149.259] lstrcmpA (lpString1=".", lpString2="{8702d817-5aad-4674-9ef3-4d3decd87120}") returned -1 [0149.259] lstrcmpA (lpString1="..", lpString2="{8702d817-5aad-4674-9ef3-4d3decd87120}") returned -1 [0149.259] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0149.260] PeekMessageA (in: lpMsg=0xaef84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaef84) returned 0 [0149.260] PeekMessageA (in: lpMsg=0xaef84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaef84) returned 0 [0149.260] PeekMessageA (in: lpMsg=0xaef84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaef84) returned 0 [0149.261] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0149.261] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0149.263] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US\\*.*", lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 0x5be2e0 [0149.264] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0149.264] PeekMessageA (in: lpMsg=0xaef84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaef84) returned 0 [0149.264] PeekMessageA (in: lpMsg=0xaef84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaef84) returned 0 [0149.264] PeekMessageA (in: lpMsg=0xaef84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaef84) returned 0 [0149.265] PeekMessageA (in: lpMsg=0xaef84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaef84) returned 0 [0149.265] PeekMessageA (in: lpMsg=0xaef84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaef84) returned 0 [0149.265] PeekMessageA (in: lpMsg=0xaef84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaef84) returned 0 [0149.265] PeekMessageA (in: lpMsg=0xaef84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaef84) returned 0 [0149.265] PeekMessageA (in: lpMsg=0xaef84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaef84) returned 0 [0149.265] PeekMessageA (in: lpMsg=0xaef84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaef84) returned 0 [0149.266] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0149.267] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US\\*.*", lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 0x5be2e0 [0149.267] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0149.267] PeekMessageA (in: lpMsg=0xaef84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaef84) returned 0 [0149.268] PeekMessageA (in: lpMsg=0xaef84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaef84) returned 0 [0149.268] PeekMessageA (in: lpMsg=0xaef84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaef84) returned 0 [0149.268] PeekMessageA (in: lpMsg=0xaef84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaef84) returned 0 [0149.268] PeekMessageA (in: lpMsg=0xaef84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaef84) returned 0 [0149.268] PeekMessageA (in: lpMsg=0xaef84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaef84) returned 0 [0149.268] PeekMessageA (in: lpMsg=0xaef84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaef84) returned 0 [0149.268] PeekMessageA (in: lpMsg=0xaef84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaef84) returned 0 [0149.268] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\DeviceSync\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be160 [0149.271] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\DRM\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be160 [0149.272] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\DRM\\Server\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0149.272] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\eHome\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be160 [0149.272] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\eHome\\logs\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0149.273] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Event Viewer\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be160 [0149.273] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0149.273] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0149.273] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be160 [0149.273] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0149.273] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0149.274] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Media Player\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be160 [0149.274] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\MF\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be160 [0149.274] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0149.274] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0149.274] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\MSDN\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be160 [0149.274] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\MSDN\\8.0\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0149.274] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\NetFramework\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be160 [0149.275] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\NetFramework\\BreadcrumbStore\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0149.275] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be160 [0149.275] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Connections\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0149.275] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0149.276] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0149.276] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0149.276] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be160 [0149.276] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0149.276] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0149.276] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0149.276] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0149.276] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0149.276] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0149.276] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0149.277] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0149.277] PeekMessageA (in: lpMsg=0xaef84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaef84) returned 0 [0149.277] PeekMessageA (in: lpMsg=0xaef84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaef84) returned 0 [0149.278] PeekMessageA (in: lpMsg=0xaef84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaef84) returned 0 [0149.278] PeekMessageA (in: lpMsg=0xaef84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaef84) returned 0 [0149.278] PeekMessageA (in: lpMsg=0xaef84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaef84) returned 0 [0149.278] PeekMessageA (in: lpMsg=0xaef84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaef84) returned 0 [0149.278] PeekMessageA (in: lpMsg=0xaef84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaef84) returned 0 [0149.278] PeekMessageA (in: lpMsg=0xaef84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaef84) returned 0 [0149.278] PeekMessageA (in: lpMsg=0xaef84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaef84) returned 0 [0149.278] PeekMessageA (in: lpMsg=0xaef84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaef84) returned 0 [0149.278] PeekMessageA (in: lpMsg=0xaef84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaef84) returned 0 [0149.278] PeekMessageA (in: lpMsg=0xaef84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaef84) returned 0 [0149.278] PeekMessageA (in: lpMsg=0xaef84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaef84) returned 0 [0149.278] PeekMessageA (in: lpMsg=0xaef84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaef84) returned 0 [0149.278] PeekMessageA (in: lpMsg=0xaef84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaef84) returned 0 [0149.278] PeekMessageA (in: lpMsg=0xaef84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaef84) returned 0 [0149.279] PeekMessageA (in: lpMsg=0xaef84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaef84) returned 0 [0149.279] PeekMessageA (in: lpMsg=0xaef84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaef84) returned 0 [0149.279] PeekMessageA (in: lpMsg=0xaef84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaef84) returned 0 [0149.279] PeekMessageA (in: lpMsg=0xaef84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaef84) returned 0 [0149.279] PeekMessageA (in: lpMsg=0xaef84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaef84) returned 0 [0149.279] PeekMessageA (in: lpMsg=0xaef84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaef84) returned 0 [0149.279] PeekMessageA (in: lpMsg=0xaef84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaef84) returned 0 [0149.279] PeekMessageA (in: lpMsg=0xaef84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaef84) returned 0 [0149.279] PeekMessageA (in: lpMsg=0xaef84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaef84) returned 0 [0149.279] PeekMessageA (in: lpMsg=0xaef84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaef84) returned 0 [0149.279] PeekMessageA (in: lpMsg=0xaef84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaef84) returned 0 [0149.280] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0149.281] PeekMessageA (in: lpMsg=0xaef84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaef84) returned 0 [0149.284] PeekMessageA (in: lpMsg=0xaef84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaef84) returned 0 [0149.284] PeekMessageA (in: lpMsg=0xaef84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaef84) returned 0 [0149.284] PeekMessageA (in: lpMsg=0xaef84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaef84) returned 0 [0149.284] PeekMessageA (in: lpMsg=0xaef84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaef84) returned 0 [0149.284] PeekMessageA (in: lpMsg=0xaef84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaef84) returned 0 [0149.284] PeekMessageA (in: lpMsg=0xaef84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaef84) returned 0 [0149.284] PeekMessageA (in: lpMsg=0xaef84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaef84) returned 0 [0149.284] PeekMessageA (in: lpMsg=0xaef84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaef84) returned 0 [0149.285] PeekMessageA (in: lpMsg=0xaef84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaef84) returned 0 [0149.285] PeekMessageA (in: lpMsg=0xaef84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaef84) returned 0 [0149.285] PeekMessageA (in: lpMsg=0xaef84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaef84) returned 0 [0149.285] PeekMessageA (in: lpMsg=0xaef84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaef84) returned 0 [0149.285] PeekMessageA (in: lpMsg=0xaef84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaef84) returned 0 [0149.285] PeekMessageA (in: lpMsg=0xaef84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaef84) returned 0 [0149.285] PeekMessageA (in: lpMsg=0xaef84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaef84) returned 0 [0149.285] PeekMessageA (in: lpMsg=0xaef84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaef84) returned 0 [0149.285] PeekMessageA (in: lpMsg=0xaef84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaef84) returned 0 [0149.285] PeekMessageA (in: lpMsg=0xaef84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaef84) returned 0 [0149.285] PeekMessageA (in: lpMsg=0xaef84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaef84) returned 0 [0149.285] PeekMessageA (in: lpMsg=0xaef84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaef84) returned 0 [0149.285] PeekMessageA (in: lpMsg=0xaef84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaef84) returned 0 [0149.285] PeekMessageA (in: lpMsg=0xaef84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaef84) returned 0 [0149.286] PeekMessageA (in: lpMsg=0xaef84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaef84) returned 0 [0149.286] PeekMessageA (in: lpMsg=0xaef84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaef84) returned 0 [0149.286] PeekMessageA (in: lpMsg=0xaef84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaef84) returned 0 [0149.286] PeekMessageA (in: lpMsg=0xaef84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaef84) returned 0 [0149.286] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be160 [0149.287] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0149.287] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0149.287] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0149.287] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be160 [0149.287] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\Outbound\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0149.288] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\PublishedData\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0149.288] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0149.288] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\StateData\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0149.288] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0149.288] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0149.288] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0149.288] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0149.288] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\Temp\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0149.288] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0149.288] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0149.288] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be160 [0149.289] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0149.289] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0149.289] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\*.*", lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 0x5be2e0 [0149.289] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Config\\*.*", lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 0x5be320 [0149.289] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\GatherLogs\\*.*", lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 0x5be320 [0149.289] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\GatherLogs\\SystemIndex\\*.*", lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 0x5be360 [0149.290] PeekMessageA (in: lpMsg=0xaeb94, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaeb94) returned 0 [0149.290] PeekMessageA (in: lpMsg=0xaeb94, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaeb94) returned 0 [0149.290] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0149.290] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0149.290] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0149.290] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0149.290] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\*.*", lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 0x5be320 [0149.290] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\*.*", lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 0x5be360 [0149.290] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\*.*", lpFindFileData=0xaea68 | out: lpFindFileData=0xaea68) returned 0x5be3a0 [0149.291] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\CiFiles\\*.*", lpFindFileData=0xae918 | out: lpFindFileData=0xae918) returned 0x5be3e0 [0149.291] PeekMessageA (in: lpMsg=0xae8f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xae8f4) returned 0 [0149.291] PeekMessageA (in: lpMsg=0xae8f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xae8f4) returned 0 [0149.291] PeekMessageA (in: lpMsg=0xae8f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xae8f4) returned 0 [0149.291] PeekMessageA (in: lpMsg=0xae8f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xae8f4) returned 0 [0149.291] PeekMessageA (in: lpMsg=0xae8f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xae8f4) returned 0 [0149.292] PeekMessageA (in: lpMsg=0xae8f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xae8f4) returned 0 [0149.292] PeekMessageA (in: lpMsg=0xae8f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xae8f4) returned 0 [0149.292] PeekMessageA (in: lpMsg=0xae8f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xae8f4) returned 0 [0149.292] PeekMessageA (in: lpMsg=0xae8f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xae8f4) returned 0 [0149.292] PeekMessageA (in: lpMsg=0xae8f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xae8f4) returned 0 [0149.292] PeekMessageA (in: lpMsg=0xae8f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xae8f4) returned 0 [0149.292] PeekMessageA (in: lpMsg=0xae8f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xae8f4) returned 0 [0149.292] PeekMessageA (in: lpMsg=0xae8f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xae8f4) returned 0 [0149.293] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\PropMap\\*.*", lpFindFileData=0xaea68 | out: lpFindFileData=0xaea68) returned 0x5be3a0 [0149.293] PeekMessageA (in: lpMsg=0xaea44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaea44) returned 0 [0149.293] PeekMessageA (in: lpMsg=0xaea44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaea44) returned 0 [0149.293] PeekMessageA (in: lpMsg=0xaea44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaea44) returned 0 [0149.293] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\SecStore\\*.*", lpFindFileData=0xaea68 | out: lpFindFileData=0xaea68) returned 0x5be3a0 [0149.293] PeekMessageA (in: lpMsg=0xaea44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaea44) returned 0 [0149.293] PeekMessageA (in: lpMsg=0xaea44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaea44) returned 0 [0149.293] PeekMessageA (in: lpMsg=0xaea44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaea44) returned 0 [0149.294] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0149.294] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Temp\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0149.294] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be160 [0149.294] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0149.294] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0149.295] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0149.295] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0149.295] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0149.295] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0149.295] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0149.295] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0149.295] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0149.295] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0149.295] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0149.295] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0149.296] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0149.296] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0149.296] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0149.296] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0149.296] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0149.296] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0149.296] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0149.296] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0149.296] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0149.296] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0149.296] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0149.296] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0149.296] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0149.297] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0149.297] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0149.297] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0149.297] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0149.297] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0149.297] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0149.297] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0149.297] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0149.297] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0149.297] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0149.297] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0149.298] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0149.298] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0149.298] PeekMessageA (in: lpMsg=0xaf224, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf224) returned 0 [0149.298] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Vault\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be160 [0149.299] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\VISIO\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be160 [0149.299] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be160 [0149.299] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AIT\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0149.299] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0149.300] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0149.300] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0149.300] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0149.300] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0149.300] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0149.300] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0149.300] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0149.300] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0149.300] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0149.301] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\DeviceMetadataStore\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0149.301] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\DeviceMetadataStore\\en-US\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0149.301] PeekMessageA (in: lpMsg=0xaef84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaef84) returned 0 [0149.302] PeekMessageA (in: lpMsg=0xaef84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaef84) returned 0 [0149.302] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\DRM\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0149.302] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\DRM\\Cache\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0149.302] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\GameExplorer\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0149.303] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Power Efficiency Diagnostics\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0149.303] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0149.303] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0149.303] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0149.303] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0149.303] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0149.303] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0149.303] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0149.304] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0149.304] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0149.304] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0149.304] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0149.304] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0149.304] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0149.304] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0149.304] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0149.304] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0149.304] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0149.305] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0149.305] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Sqm\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0149.305] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Sqm\\Manifest\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0149.305] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Sqm\\Sessions\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0149.306] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Sqm\\Upload\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0149.306] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0149.306] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0149.306] PeekMessageA (in: lpMsg=0xaf0d4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaf0d4) returned 0 [0149.306] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0149.307] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\*.*", lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 0x5be2e0 [0149.307] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\*.*", lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 0x5be320 [0149.307] PeekMessageA (in: lpMsg=0xaece4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaece4) returned 0 [0149.307] PeekMessageA (in: lpMsg=0xaece4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaece4) returned 0 [0149.307] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0149.307] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0149.308] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0149.308] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0149.308] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0149.308] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0149.308] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0149.308] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0149.308] PeekMessageA (in: lpMsg=0xaee34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0xaee34) returned 0 [0149.308] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\*.*", lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 0x5be320 [0149.310] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Tablet PC\\*.*", lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 0x5be320 [0149.310] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\*.*", lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 0x5be320 [0149.311] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\*.*", lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 0x5be2e0 [0149.312] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Games\\*.*", lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 0x5be2e0 [0149.312] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\*.*", lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 0x5be2e0 [0149.313] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\*.*", lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 0x5be2e0 [0149.313] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\*.*", lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 0x5be2e0 [0149.313] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools\\*.*", lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 0x5be320 [0149.315] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\SharePoint\\*.*", lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 0x5be2e0 [0149.316] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\*.*", lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 0x5be2e0 [0149.316] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Tablet PC\\*.*", lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 0x5be2e0 [0149.317] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Templates\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0149.319] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\WER\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0149.320] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\WER\\ReportArchive\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0149.320] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\WER\\ReportQueue\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0149.321] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be160 [0149.321] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0149.321] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Backup\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0149.321] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Updates\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0149.322] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\{D2B0B133-42ED-44D3-809A-46EBB62BA863}\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0149.322] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\LocalCopy\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0149.322] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Quarantine\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0149.323] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0149.323] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0149.323] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\CacheManager\\*.*", lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 0x5be2e0 [0149.324] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Results\\*.*", lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 0x5be2e0 [0149.324] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Results\\Resource\\*.*", lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 0x5be320 [0149.324] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Service\\*.*", lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 0x5be2e0 [0149.325] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Store\\*.*", lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 0x5be2e0 [0149.325] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Support\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0149.325] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be160 [0149.325] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0149.327] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\ActivityLog\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0149.327] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0149.327] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\en-US\\*.*", lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 0x5be2e0 [0149.328] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Inbox\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0149.328] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Queue\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0149.329] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\SentItems\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0149.329] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\VirtualInbox\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0149.329] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\VirtualInbox\\en-US\\*.*", lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 0x5be2e0 [0149.329] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSScan\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0149.330] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\WwanSvc\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be160 [0149.330] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\WwanSvc\\Profiles\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0149.330] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft Help\\*.*", lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 0x5be220 [0149.334] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Mozilla\\*.*", lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 0x5be220 [0149.334] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Mozilla\\logs\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be160 [0149.335] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Oracle\\*.*", lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 0x5be220 [0149.335] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\*.*", lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 0x5be220 [0149.336] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be160 [0149.336] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0149.336] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0149.336] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\x64\\*.*", lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 0x5be2e0 [0149.337] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be160 [0149.337] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0149.337] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0149.337] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\x64\\*.*", lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 0x5be2e0 [0149.338] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be160 [0149.338] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0149.338] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0149.338] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be160 [0149.339] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be160 [0149.339] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0149.339] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0149.340] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be160 [0149.341] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be160 [0149.341] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0149.341] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0149.341] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be160 [0149.342] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0149.342] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0149.342] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be160 [0149.343] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0149.343] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0149.344] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be160 [0149.345] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0149.345] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0149.345] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be160 [0149.346] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0149.346] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0149.346] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be160 [0149.346] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0149.347] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0149.347] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be160 [0149.347] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0149.347] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0149.348] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be160 [0149.348] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be160 [0149.348] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0149.349] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0149.349] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be160 [0149.350] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0149.350] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0149.351] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be160 [0149.351] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be160 [0149.352] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be160 [0149.353] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be160 [0149.353] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0149.353] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0149.354] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Start Menu\\*.*", lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 0xffffffff [0149.354] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Sun\\*.*", lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 0x5be160 [0149.354] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Sun\\Java\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be220 [0149.354] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Sun\\Java\\Java Update\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0149.355] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Templates\\*.*", lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 0xffffffff [0149.355] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\*.*", lpFindFileData=0xaf4e8 | out: lpFindFileData=0xaf4e8) returned 0x5be1e0 [0149.355] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\*.*", lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 0x5be160 [0149.356] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be220 [0149.357] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Application Data\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0xffffffff [0149.357] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\History\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0xffffffff [0149.357] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0149.523] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Credentials\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0149.525] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0152.421] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\*.*", lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 0x5be2e0 [0153.791] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\*.*", lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 0x5be2e0 [0153.791] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\*.*", lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 0x5be320 [0153.791] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0153.863] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\1NBUR4HR\\*.*", lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 0x5be2e0 [0153.864] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\6ASVN7J7\\*.*", lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 0x5be2e0 [0153.865] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\D68G7BIJ\\*.*", lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 0x5be2e0 [0153.866] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD\\*.*", lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 0x5be2e0 [0153.867] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Internet Explorer\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0153.933] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Internet Explorer\\brndlog.txt" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\internet explorer\\brndlog.txt"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Internet Explorer\\brndlog.txt. " (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\internet explorer\\brndlog.txt. ")) returned 1 [0153.934] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0154.179] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\*.*", lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 0x5be2e0 [0154.179] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\*.*", lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 0x5be320 [0154.180] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\*.*", lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 0x5be360 [0154.213] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0154.217] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Burn\\*.*", lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 0x5be2e0 [0154.217] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn\\*.*", lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 0x5be320 [0154.218] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Caches\\*.*", lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 0x5be2e0 [0154.218] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Explorer\\*.*", lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 0x5be2e0 [0154.362] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\GameExplorer\\*.*", lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 0x5be2e0 [0154.363] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\History\\*.*", lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 0x5be2e0 [0154.363] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\*.*", lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 0x5be320 [0154.364] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\*.*", lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 0x5be320 [0154.364] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Ringtones\\*.*", lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 0x5be2e0 [0154.364] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\*.*", lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 0x5be2e0 [0154.380] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\*.*", lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 0x5be320 [0154.382] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\MM5O9XQS\\*.*", lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 0x5be360 [0154.382] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\PMMR5K9K\\*.*", lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 0x5be360 [0154.383] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\RIJUQL1C\\*.*", lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 0x5be360 [0154.383] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\X9OHK109\\*.*", lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 0x5be360 [0154.383] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\*.*", lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 0x5be320 [0154.384] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\*.*", lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 0x5be320 [0154.384] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WER\\*.*", lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 0x5be2e0 [0154.384] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WER\\ERC\\*.*", lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 0x5be320 [0154.384] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WER\\ReportArchive\\*.*", lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 0x5be320 [0154.384] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0154.495] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\*.*", lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 0x5be2e0 [0154.495] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\new\\*.*", lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 0x5be320 [0154.735] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\*.*", lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 0x5be2e0 [0154.743] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.htm" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\bears.htm"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.htm. " (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\bears.htm. ")) returned 1 [0154.813] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.jpg" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\bears.jpg"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.jpg. " (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\bears.jpg. ")) returned 1 [0154.815] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.htm" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\garden.htm"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.htm. " (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\garden.htm. ")) returned 1 [0154.821] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.jpg" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\garden.jpg"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.jpg. " (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\garden.jpg. ")) returned 1 [0154.823] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Green Bubbles.htm" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\green bubbles.htm"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Green Bubbles.htm. " (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\green bubbles.htm. ")) returned 1 [0154.825] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\GreenBubbles.jpg" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\greenbubbles.jpg"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\GreenBubbles.jpg. " (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\greenbubbles.jpg. ")) returned 1 [0154.826] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Hand Prints.htm" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\hand prints.htm"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Hand Prints.htm. " (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\hand prints.htm. ")) returned 1 [0154.828] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\HandPrints.jpg" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\handprints.jpg"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\HandPrints.jpg. " (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\handprints.jpg. ")) returned 1 [0154.829] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Orange Circles.htm" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\orange circles.htm"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Orange Circles.htm. " (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\orange circles.htm. ")) returned 1 [0154.831] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\OrangeCircles.jpg" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\orangecircles.jpg"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\OrangeCircles.jpg. " (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\orangecircles.jpg. ")) returned 1 [0154.833] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.htm" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\peacock.htm"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.htm. " (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\peacock.htm. ")) returned 1 [0154.835] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.jpg" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\peacock.jpg"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.jpg. " (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\peacock.jpg. ")) returned 1 [0154.836] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.htm" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\roses.htm"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.htm. " (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\roses.htm. ")) returned 1 [0154.839] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.jpg" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\roses.jpg"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.jpg. " (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\roses.jpg. ")) returned 1 [0154.840] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Shades of Blue.htm" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\shades of blue.htm"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Shades of Blue.htm. " (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\shades of blue.htm. ")) returned 1 [0154.842] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\ShadesOfBlue.jpg" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\shadesofblue.jpg"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\ShadesOfBlue.jpg. " (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\shadesofblue.jpg. ")) returned 1 [0154.844] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Soft Blue.htm" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\soft blue.htm"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Soft Blue.htm. " (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\soft blue.htm. ")) returned 1 [0154.846] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\SoftBlue.jpg" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\softblue.jpg"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\SoftBlue.jpg. " (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\softblue.jpg. ")) returned 1 [0154.848] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.htm" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\stars.htm"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.htm. " (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\stars.htm. ")) returned 1 [0154.850] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.jpg" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\stars.jpg"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.jpg. " (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\stars.jpg. ")) returned 1 [0154.851] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Media\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0154.852] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\*.*", lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 0x5be2e0 [0154.852] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Sidebar\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0154.852] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Sidebar\\Gadgets\\*.*", lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 0x5be2e0 [0154.853] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Temp\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0154.853] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Temporary Internet Files\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0xffffffff [0154.853] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\LocalLow\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be220 [0154.854] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\LocalLow\\Microsoft\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0154.854] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0154.854] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\*.*", lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 0x5be2e0 [0154.855] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\*.*", lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 0x5be2e0 [0154.855] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be220 [0154.855] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Identities\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0154.856] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Identities\\{31810C36-5D23-4CCE-A3B4-316DED195C38}\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0154.856] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0154.858] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Credentials\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0154.858] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Crypto\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0154.858] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\*.*", lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 0x5be2e0 [0154.858] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0154.858] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\*.*", lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 0x5be2e0 [0154.861] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Shows Desktop.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\shows desktop.lnk"), lpNewFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Shows Desktop.lnk. " (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\shows desktop.lnk. ")) returned 1 [0154.861] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\*.*", lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 0x5be320 [0154.862] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\ImplicitAppShortcuts\\*.*", lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 0x5be360 [0154.862] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\*.*", lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 0x5be360 [0155.317] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Internet Explorer.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\internet explorer.lnk"), lpNewFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Internet Explorer.lnk. " (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\internet explorer.lnk. ")) returned 1 [0155.323] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Explorer.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\windows explorer.lnk"), lpNewFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Explorer.lnk. " (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\windows explorer.lnk. ")) returned 1 [0155.629] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Media Player.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\windows media player.lnk"), lpNewFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Media Player.lnk. " (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\windows media player.lnk. ")) returned 1 [0155.632] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Window Switcher.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\window switcher.lnk"), lpNewFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Window Switcher.lnk. " (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\window switcher.lnk. ")) returned 1 [0155.633] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Protect\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0155.633] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3111613574-2524581245-2586426736-500\\*.*", lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 0x5be2e0 [0155.894] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\SystemCertificates\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0155.895] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\*.*", lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 0x5be2e0 [0155.895] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\Certificates\\*.*", lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 0x5be320 [0155.895] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CRLs\\*.*", lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 0x5be320 [0155.895] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CTLs\\*.*", lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 0x5be320 [0155.895] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\*.*", lpFindFileData=0xaefa8 | out: lpFindFileData=0xaefa8) returned 0x5be2a0 [0155.897] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\*.*", lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 0x5be2e0 [0155.897] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\IECompatCache\\*.*", lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 0x5be2e0 [0155.898] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\IECompatCache\\Low\\*.*", lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 0x5be320 [0155.898] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\*.*", lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 0x5be2e0 [0155.899] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\Low\\*.*", lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 0x5be320 [0155.899] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\*.*", lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 0x5be2e0 [0156.056] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Network Shortcuts\\*.*", lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 0x5be2e0 [0156.056] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Printer Shortcuts\\*.*", lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 0x5be2e0 [0156.056] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\*.*", lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 0x5be2e0 [0156.056] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\Low\\*.*", lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 0x5be320 [0156.057] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\*.*", lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 0x5be2e0 [0156.057] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\*.*", lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 0x5be320 [0156.057] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\*.*", lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 0x5be320 [0156.140] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\*.*", lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 0x5be2e0 [0156.386] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Fax Recipient.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\sendto\\fax recipient.lnk"), lpNewFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Fax Recipient.lnk. " (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\sendto\\fax recipient.lnk. ")) returned 1 [0156.388] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\*.*", lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 0x5be2e0 [0156.388] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\*.*", lpFindFileData=0xaed08 | out: lpFindFileData=0xaed08) returned 0x5be320 [0156.389] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\*.*", lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 0x5be360 [0156.435] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\*.*", lpFindFileData=0xaea68 | out: lpFindFileData=0xaea68) returned 0x5be3a0 [0156.515] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Ease of Access.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\ease of access.lnk"), lpNewFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Ease of Access.lnk. " (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\ease of access.lnk. ")) returned 1 [0156.519] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Magnify.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\magnify.lnk"), lpNewFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Magnify.lnk. " (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\magnify.lnk. ")) returned 1 [0156.522] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Narrator.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\narrator.lnk"), lpNewFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Narrator.lnk. " (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\narrator.lnk. ")) returned 1 [0156.525] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\On-Screen Keyboard.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\on-screen keyboard.lnk"), lpNewFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\On-Screen Keyboard.lnk. " (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\on-screen keyboard.lnk. ")) returned 1 [0156.528] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Command Prompt.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\command prompt.lnk"), lpNewFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Command Prompt.lnk. " (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\command prompt.lnk. ")) returned 1 [0156.531] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Notepad.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\notepad.lnk"), lpNewFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Notepad.lnk. " (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\notepad.lnk. ")) returned 1 [0156.534] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Run.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\run.lnk"), lpNewFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Run.lnk. " (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\run.lnk. ")) returned 1 [0156.535] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\*.*", lpFindFileData=0xaea68 | out: lpFindFileData=0xaea68) returned 0x5be3a0 [0156.657] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\computer.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\computer.lnk"), lpNewFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\computer.lnk. " (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\computer.lnk. ")) returned 1 [0156.660] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Control Panel.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\control panel.lnk"), lpNewFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Control Panel.lnk. " (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\control panel.lnk. ")) returned 1 [0156.870] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Internet Explorer (No Add-ons).lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\internet explorer (no add-ons).lnk"), lpNewFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Internet Explorer (No Add-ons).lnk. " (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\internet explorer (no add-ons).lnk. ")) returned 1 [0157.263] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Private Character Editor.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\private character editor.lnk"), lpNewFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Private Character Editor.lnk. " (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\private character editor.lnk. ")) returned 1 [0158.136] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows Explorer.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\windows explorer.lnk"), lpNewFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows Explorer.lnk. " (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\windows explorer.lnk. ")) returned 1 [0158.138] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\*.*", lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 0x5be360 [0158.446] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Internet Explorer (64-bit).lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\internet explorer (64-bit).lnk"), lpNewFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Internet Explorer (64-bit).lnk. " (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\internet explorer (64-bit).lnk. ")) returned 1 [0159.294] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Internet Explorer.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\internet explorer.lnk"), lpNewFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Internet Explorer.lnk. " (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\internet explorer.lnk. ")) returned 1 [0159.295] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\*.*", lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 0x5be360 [0159.296] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Help.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\maintenance\\help.lnk"), lpNewFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Help.lnk. " (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\maintenance\\help.lnk. ")) returned 1 [0159.297] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\*.*", lpFindFileData=0xaebb8 | out: lpFindFileData=0xaebb8) returned 0x5be360 [0159.297] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\*.*", lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 0x5be2e0 [0159.297] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\*.*", lpFindFileData=0xaee58 | out: lpFindFileData=0xaee58) returned 0x5be2e0 [0159.779] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\TranscodedWallpaper.jpg" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\themes\\transcodedwallpaper.jpg"), lpNewFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\TranscodedWallpaper.jpg. " (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\themes\\transcodedwallpaper.jpg. ")) returned 1 [0159.781] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\Application Data\\*.*", lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 0xffffffff [0159.781] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\Contacts\\*.*", lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 0x5be160 [0159.781] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\Cookies\\*.*", lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 0xffffffff [0159.781] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\Desktop\\*.*", lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 0x5be160 [0159.782] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\Documents\\*.*", lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 0x5be160 [0159.783] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\Documents\\My Music\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0xffffffff [0159.783] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\Documents\\My Pictures\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0xffffffff [0159.783] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\Documents\\My Videos\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0xffffffff [0159.784] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\Downloads\\*.*", lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 0x5be160 [0159.784] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\Favorites\\*.*", lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 0x5be160 [0159.787] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\Favorites\\Links\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be220 [0159.787] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\Favorites\\Microsoft Websites\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be220 [0159.878] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\Favorites\\MSN Websites\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be220 [0159.904] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\Favorites\\Windows Live\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be220 [0159.943] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\Links\\*.*", lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 0x5be220 [0159.945] MoveFileA (lpExistingFileName="C:\\Users\\Default\\Links\\Desktop.lnk" (normalized: "c:\\users\\default\\links\\desktop.lnk"), lpNewFileName="C:\\Users\\Default\\Links\\Desktop.lnk. " (normalized: "c:\\users\\default\\links\\desktop.lnk. ")) returned 1 [0160.092] MoveFileA (lpExistingFileName="C:\\Users\\Default\\Links\\Downloads.lnk" (normalized: "c:\\users\\default\\links\\downloads.lnk"), lpNewFileName="C:\\Users\\Default\\Links\\Downloads.lnk. " (normalized: "c:\\users\\default\\links\\downloads.lnk. ")) returned 1 [0160.094] MoveFileA (lpExistingFileName="C:\\Users\\Default\\Links\\RecentPlaces.lnk" (normalized: "c:\\users\\default\\links\\recentplaces.lnk"), lpNewFileName="C:\\Users\\Default\\Links\\RecentPlaces.lnk. " (normalized: "c:\\users\\default\\links\\recentplaces.lnk. ")) returned 1 [0160.095] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\Local Settings\\*.*", lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 0xffffffff [0160.095] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\Music\\*.*", lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 0x5be160 [0160.095] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\My Documents\\*.*", lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 0xffffffff [0160.095] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\NetHood\\*.*", lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 0xffffffff [0160.096] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\Pictures\\*.*", lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 0x5be160 [0160.096] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\PrintHood\\*.*", lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 0xffffffff [0160.096] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\Recent\\*.*", lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 0xffffffff [0160.096] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\Saved Games\\*.*", lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 0x5be160 [0160.097] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\Searches\\*.*", lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 0x5be160 [0160.132] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\SendTo\\*.*", lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 0xffffffff [0160.132] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\Start Menu\\*.*", lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 0xffffffff [0160.132] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\Templates\\*.*", lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 0xffffffff [0160.132] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\Videos\\*.*", lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 0x5be220 [0160.134] FindFirstFileA (in: lpFileName="C:\\Users\\Default User\\*.*", lpFindFileData=0xaf4e8 | out: lpFindFileData=0xaf4e8) returned 0xffffffff [0160.134] FindFirstFileA (in: lpFileName="C:\\Users\\Public\\*.*", lpFindFileData=0xaf4e8 | out: lpFindFileData=0xaf4e8) returned 0x5be1e0 [0160.134] FindFirstFileA (in: lpFileName="C:\\Users\\Public\\Desktop\\*.*", lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 0x5be160 [0160.136] MoveFileA (lpExistingFileName="C:\\Users\\Public\\Desktop\\Adobe Reader X.lnk" (normalized: "c:\\users\\public\\desktop\\adobe reader x.lnk"), lpNewFileName="C:\\Users\\Public\\Desktop\\Adobe Reader X.lnk. " (normalized: "c:\\users\\public\\desktop\\adobe reader x.lnk. ")) returned 1 [0160.138] MoveFileA (lpExistingFileName="C:\\Users\\Public\\Desktop\\Google Chrome.lnk" (normalized: "c:\\users\\public\\desktop\\google chrome.lnk"), lpNewFileName="C:\\Users\\Public\\Desktop\\Google Chrome.lnk. " (normalized: "c:\\users\\public\\desktop\\google chrome.lnk. ")) returned 1 [0160.141] MoveFileA (lpExistingFileName="C:\\Users\\Public\\Desktop\\Mozilla Firefox.lnk" (normalized: "c:\\users\\public\\desktop\\mozilla firefox.lnk"), lpNewFileName="C:\\Users\\Public\\Desktop\\Mozilla Firefox.lnk. " (normalized: "c:\\users\\public\\desktop\\mozilla firefox.lnk. ")) returned 1 [0160.144] FindFirstFileA (in: lpFileName="C:\\Users\\Public\\Documents\\*.*", lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 0x5be160 [0160.144] FindFirstFileA (in: lpFileName="C:\\Users\\Public\\Documents\\My Music\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0xffffffff [0160.144] FindFirstFileA (in: lpFileName="C:\\Users\\Public\\Documents\\My Pictures\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0xffffffff [0160.144] FindFirstFileA (in: lpFileName="C:\\Users\\Public\\Documents\\My Videos\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0xffffffff [0160.144] FindFirstFileA (in: lpFileName="C:\\Users\\Public\\Downloads\\*.*", lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 0x5be160 [0160.145] FindFirstFileA (in: lpFileName="C:\\Users\\Public\\Favorites\\*.*", lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 0x5be160 [0160.145] FindFirstFileA (in: lpFileName="C:\\Users\\Public\\Libraries\\*.*", lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 0x5be160 [0160.145] FindFirstFileA (in: lpFileName="C:\\Users\\Public\\Music\\*.*", lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 0x5be220 [0160.145] FindFirstFileA (in: lpFileName="C:\\Users\\Public\\Music\\Sample Music\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be160 [0160.887] MoveFileA (lpExistingFileName="C:\\Users\\Public\\Music\\Sample Music\\Kalimba.mp3" (normalized: "c:\\users\\public\\music\\sample music\\kalimba.mp3"), lpNewFileName="C:\\Users\\Public\\Music\\Sample Music\\Kalimba.mp3. " (normalized: "c:\\users\\public\\music\\sample music\\kalimba.mp3. ")) returned 1 [0161.043] MoveFileA (lpExistingFileName="C:\\Users\\Public\\Music\\Sample Music\\Maid with the Flaxen Hair.mp3" (normalized: "c:\\users\\public\\music\\sample music\\maid with the flaxen hair.mp3"), lpNewFileName="C:\\Users\\Public\\Music\\Sample Music\\Maid with the Flaxen Hair.mp3. " (normalized: "c:\\users\\public\\music\\sample music\\maid with the flaxen hair.mp3. ")) returned 1 [0161.224] MoveFileA (lpExistingFileName="C:\\Users\\Public\\Music\\Sample Music\\Sleep Away.mp3" (normalized: "c:\\users\\public\\music\\sample music\\sleep away.mp3"), lpNewFileName="C:\\Users\\Public\\Music\\Sample Music\\Sleep Away.mp3. " (normalized: "c:\\users\\public\\music\\sample music\\sleep away.mp3. ")) returned 1 [0161.225] FindFirstFileA (in: lpFileName="C:\\Users\\Public\\Pictures\\*.*", lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 0x5be220 [0161.225] FindFirstFileA (in: lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be160 [0161.677] MoveFileA (lpExistingFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Chrysanthemum.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\chrysanthemum.jpg"), lpNewFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Chrysanthemum.jpg. " (normalized: "c:\\users\\public\\pictures\\sample pictures\\chrysanthemum.jpg. ")) returned 1 [0162.214] MoveFileA (lpExistingFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Desert.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\desert.jpg"), lpNewFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Desert.jpg. " (normalized: "c:\\users\\public\\pictures\\sample pictures\\desert.jpg. ")) returned 1 [0162.408] MoveFileA (lpExistingFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Hydrangeas.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\hydrangeas.jpg"), lpNewFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Hydrangeas.jpg. " (normalized: "c:\\users\\public\\pictures\\sample pictures\\hydrangeas.jpg. ")) returned 1 [0162.665] MoveFileA (lpExistingFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Jellyfish.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\jellyfish.jpg"), lpNewFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Jellyfish.jpg. " (normalized: "c:\\users\\public\\pictures\\sample pictures\\jellyfish.jpg. ")) returned 1 [0162.875] MoveFileA (lpExistingFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Koala.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\koala.jpg"), lpNewFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Koala.jpg. " (normalized: "c:\\users\\public\\pictures\\sample pictures\\koala.jpg. ")) returned 1 [0163.133] MoveFileA (lpExistingFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Lighthouse.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\lighthouse.jpg"), lpNewFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Lighthouse.jpg. " (normalized: "c:\\users\\public\\pictures\\sample pictures\\lighthouse.jpg. ")) returned 1 [0163.384] MoveFileA (lpExistingFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Penguins.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\penguins.jpg"), lpNewFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Penguins.jpg. " (normalized: "c:\\users\\public\\pictures\\sample pictures\\penguins.jpg. ")) returned 1 [0166.322] MoveFileA (lpExistingFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Tulips.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\tulips.jpg"), lpNewFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Tulips.jpg. " (normalized: "c:\\users\\public\\pictures\\sample pictures\\tulips.jpg. ")) returned 1 [0166.324] FindFirstFileA (in: lpFileName="C:\\Users\\Public\\Recorded TV\\*.*", lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 0x5be220 [0166.324] FindFirstFileA (in: lpFileName="C:\\Users\\Public\\Recorded TV\\Sample Media\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be160 [0166.325] FindFirstFileA (in: lpFileName="C:\\Users\\Public\\Videos\\*.*", lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 0x5be160 [0166.325] FindFirstFileA (in: lpFileName="C:\\Users\\Public\\Videos\\Sample Videos\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be220 [0166.670] MoveFileA (lpExistingFileName="C:\\Users\\Public\\Videos\\Sample Videos\\Wildlife.wmv" (normalized: "c:\\users\\public\\videos\\sample videos\\wildlife.wmv"), lpNewFileName="C:\\Users\\Public\\Videos\\Sample Videos\\Wildlife.wmv. " (normalized: "c:\\users\\public\\videos\\sample videos\\wildlife.wmv. ")) returned 1 [0166.671] FindFirstFileA (in: lpFileName="C:\\Windows\\*.*", lpFindFileData=0xaf638 | out: lpFindFileData=0xaf638) returned 0x5be1a0 [0166.672] FindFirstFileA (in: lpFileName="C:\\Windows\\addins\\*.*", lpFindFileData=0xaf4e8 | out: lpFindFileData=0xaf4e8) returned 0x5be1e0 [0166.672] FindFirstFileA (in: lpFileName="C:\\Windows\\AppCompat\\*.*", lpFindFileData=0xaf4e8 | out: lpFindFileData=0xaf4e8) returned 0x5be160 [0166.672] FindFirstFileA (in: lpFileName="C:\\Windows\\AppCompat\\Programs\\*.*", lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 0x5be1e0 [0166.673] FindFirstFileA (in: lpFileName="C:\\Windows\\AppPatch\\*.*", lpFindFileData=0xaf4e8 | out: lpFindFileData=0xaf4e8) returned 0x5be160 [0166.673] FindFirstFileA (in: lpFileName="C:\\Windows\\AppPatch\\AppPatch64\\*.*", lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 0x5be1e0 [0166.674] FindFirstFileA (in: lpFileName="C:\\Windows\\AppPatch\\Custom\\*.*", lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 0x5be1e0 [0166.675] FindFirstFileA (in: lpFileName="C:\\Windows\\AppPatch\\Custom\\Custom64\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be220 [0166.675] FindFirstFileA (in: lpFileName="C:\\Windows\\AppPatch\\en-US\\*.*", lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 0x5be1e0 [0166.675] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\*.*", lpFindFileData=0xaf4e8 | out: lpFindFileData=0xaf4e8) returned 0x5be160 [0166.675] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC\\*.*", lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 0x5be220 [0166.676] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC\\ADODB\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be1e0 [0166.677] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC\\ADODB\\7.0.3300.0__b03f5f7f11d50a3a\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0166.677] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC\\Extensibility\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be1e0 [0166.677] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC\\Extensibility\\7.0.3300.0__b03f5f7f11d50a3a\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0166.678] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC\\Microsoft.Ink\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be1e0 [0166.678] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC\\Microsoft.Ink\\1.0.2201.0__31bf3856ad364e35\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0166.678] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC\\Microsoft.Ink\\1.7.2600.2180__31bf3856ad364e35\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0166.678] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC\\Microsoft.mshtml\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be1e0 [0166.679] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC\\Microsoft.mshtml\\7.0.3300.0__b03f5f7f11d50a3a\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0166.679] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC\\Microsoft.StdFormat\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be1e0 [0166.680] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC\\Microsoft.StdFormat\\7.0.3300.0__b03f5f7f11d50a3a\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0166.680] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC\\MSDATASRC\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be1e0 [0166.680] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC\\MSDATASRC\\7.0.3300.0__b03f5f7f11d50a3a\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0166.681] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC\\stdole\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be1e0 [0166.682] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC\\stdole\\7.0.3300.0__b03f5f7f11d50a3a\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0166.682] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\*.*", lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 0x5be220 [0166.683] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\AuditPolicyGPManagedStubs.Interop\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be1e0 [0166.683] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\AuditPolicyGPManagedStubs.Interop\\6.1.0.0__31bf3856ad364e35\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0166.683] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\BDATunePIA\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be1e0 [0166.683] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\BDATunePIA\\6.1.0.0__31bf3856ad364e35\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0166.684] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\CustomMarshalers\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be1e0 [0166.684] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\CustomMarshalers\\2.0.0.0__b03f5f7f11d50a3a\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0166.684] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\ehexthost32\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be1e0 [0166.684] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\ehexthost32\\6.1.0.0__31bf3856ad364e35\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0166.685] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\ISymWrapper\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be1e0 [0166.685] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\ISymWrapper\\2.0.0.0__b03f5f7f11d50a3a\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0166.685] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\mcstoredb\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be1e0 [0166.686] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\mcstoredb\\6.1.0.0__31bf3856ad364e35\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0166.686] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\Microsoft.GroupPolicy.AdmTmplEditor\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be1e0 [0166.686] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\Microsoft.GroupPolicy.AdmTmplEditor\\6.1.0.0__31bf3856ad364e35\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0166.686] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\Microsoft.GroupPolicy.AdmTmplEditor.Resources\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be1e0 [0166.687] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\Microsoft.GroupPolicy.AdmTmplEditor.Resources\\6.1.0.0_en_31bf3856ad364e35\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0166.687] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\Microsoft.GroupPolicy.Interop\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be1e0 [0166.687] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\Microsoft.GroupPolicy.Interop\\2.0.0.0__31bf3856ad364e35\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0166.687] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\Microsoft.Ink\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be1e0 [0166.688] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\Microsoft.Ink\\6.1.0.0__31bf3856ad364e35\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0166.688] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\Microsoft.Interop.Security.AzRoles\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be1e0 [0166.688] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\Microsoft.Interop.Security.AzRoles\\2.0.0.0__31bf3856ad364e35\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0166.688] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be1e0 [0166.689] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop\\6.1.0.0__31bf3856ad364e35\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0166.689] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\Microsoft.Transactions.Bridge.Dtc\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be1e0 [0166.689] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\Microsoft.Transactions.Bridge.Dtc\\3.0.0.0__b03f5f7f11d50a3a\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0166.690] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\Microsoft.VisualStudio.Tools.Applications.InteropAdapter\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be1e0 [0166.691] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\Microsoft.VisualStudio.Tools.Applications.InteropAdapter\\8.0.0.0__b03f5f7f11d50a3a\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0166.691] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\Microsoft.Windows.Diagnosis.SDEngine\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be1e0 [0166.692] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\Microsoft.Windows.Diagnosis.SDEngine\\6.1.0.0__31bf3856ad364e35\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0166.692] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\MSBuild\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be1e0 [0166.692] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\MSBuild\\3.5.0.0__b03f5f7f11d50a3a\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0166.692] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\mscorlib\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be1e0 [0166.693] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0166.908] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\napcrypt\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be1e0 [0166.909] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\napcrypt\\6.1.0.0__31bf3856ad364e35\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0166.909] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\naphlpr\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be1e0 [0166.910] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\naphlpr\\6.1.0.0__31bf3856ad364e35\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0166.910] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\Policy.1.0.Microsoft.Ink\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be1e0 [0166.910] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\Policy.1.0.Microsoft.Ink\\6.1.0.0__31bf3856ad364e35\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0167.056] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\Policy.1.0.Microsoft.Interop.Security.AzRoles\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be1e0 [0167.057] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\Policy.1.0.Microsoft.Interop.Security.AzRoles\\6.1.7600.16385__31bf3856ad364e35\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0167.057] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\Policy.1.2.Microsoft.Interop.Security.AzRoles\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be1e0 [0167.057] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\Policy.1.2.Microsoft.Interop.Security.AzRoles\\6.1.7600.16385__31bf3856ad364e35\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0167.059] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\Policy.1.7.Microsoft.Ink\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be1e0 [0167.059] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\Policy.1.7.Microsoft.Ink\\6.1.0.0__31bf3856ad364e35\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0167.059] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\Policy.6.0.Microsoft.Ink\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be1e0 [0167.060] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\Policy.6.0.Microsoft.Ink\\6.1.0.0__31bf3856ad364e35\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0167.060] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\PresentationCore\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be1e0 [0167.061] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\PresentationCore\\3.0.0.0__31bf3856ad364e35\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0167.061] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\System.Data\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be1e0 [0167.061] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\System.Data\\2.0.0.0__b77a5c561934e089\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0167.062] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\System.Data.OracleClient\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be1e0 [0167.062] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\System.Data.OracleClient\\2.0.0.0__b77a5c561934e089\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0167.062] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\System.EnterpriseServices\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be1e0 [0167.062] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\System.EnterpriseServices\\2.0.0.0__b03f5f7f11d50a3a\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0167.063] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\System.Printing\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be1e0 [0167.063] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\System.Printing\\3.0.0.0__31bf3856ad364e35\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0167.063] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\System.Transactions\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be1e0 [0167.064] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\System.Transactions\\2.0.0.0__b77a5c561934e089\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0167.065] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\System.Web\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be1e0 [0167.065] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\System.Web\\2.0.0.0__b03f5f7f11d50a3a\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0167.065] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_64\\*.*", lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 0x5be220 [0167.067] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_64\\AuditPolicyGPManagedStubs.Interop\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be1e0 [0167.068] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_64\\AuditPolicyGPManagedStubs.Interop\\6.1.0.0__31bf3856ad364e35\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0167.068] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_64\\BDATunePIA\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be1e0 [0167.069] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_64\\BDATunePIA\\6.1.0.0__31bf3856ad364e35\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0167.069] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_64\\CustomMarshalers\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be1e0 [0167.070] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_64\\CustomMarshalers\\2.0.0.0__b03f5f7f11d50a3a\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0167.070] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_64\\ISymWrapper\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be1e0 [0167.070] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_64\\ISymWrapper\\2.0.0.0__b03f5f7f11d50a3a\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0167.071] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_64\\mcstoredb\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be1e0 [0167.071] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_64\\mcstoredb\\6.1.0.0__31bf3856ad364e35\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0167.072] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_64\\mcupdate\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be1e0 [0167.072] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_64\\mcupdate\\6.1.0.0__31bf3856ad364e35\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0167.072] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_64\\Mcx2Dvcs\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be1e0 [0167.073] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_64\\Mcx2Dvcs\\6.1.0.0__31bf3856ad364e35\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0167.073] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_64\\Microsoft-Windows-HomeGroupDiagnostic.NetListMgr.Interop\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be1e0 [0167.073] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_64\\Microsoft-Windows-HomeGroupDiagnostic.NetListMgr.Interop\\6.1.0.0__31bf3856ad364e35\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0167.074] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_64\\Microsoft.GroupPolicy.AdmTmplEditor\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be1e0 [0167.075] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_64\\Microsoft.GroupPolicy.AdmTmplEditor\\6.1.0.0__31bf3856ad364e35\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0167.075] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_64\\Microsoft.GroupPolicy.AdmTmplEditor.Resources\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be1e0 [0167.075] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_64\\Microsoft.GroupPolicy.AdmTmplEditor.Resources\\6.1.0.0_en_31bf3856ad364e35\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0167.076] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_64\\Microsoft.GroupPolicy.Interop\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be1e0 [0167.076] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_64\\Microsoft.GroupPolicy.Interop\\2.0.0.0__31bf3856ad364e35\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0167.077] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_64\\Microsoft.Ink\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be1e0 [0167.077] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_64\\Microsoft.Ink\\6.1.0.0__31bf3856ad364e35\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0167.078] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_64\\Microsoft.Interop.Security.AzRoles\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be1e0 [0167.078] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_64\\Microsoft.Interop.Security.AzRoles\\2.0.0.0__31bf3856ad364e35\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0167.079] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_64\\Microsoft.MediaCenter.Interop\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be1e0 [0167.079] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_64\\Microsoft.MediaCenter.Interop\\6.1.0.0__31bf3856ad364e35\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0167.079] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_64\\Microsoft.MediaCenter.iTV.Media\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be1e0 [0167.080] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_64\\Microsoft.MediaCenter.iTV.Media\\6.1.0.0__31bf3856ad364e35\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0167.080] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_64\\Microsoft.MediaCenter.Mheg\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be1e0 [0167.081] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_64\\Microsoft.MediaCenter.Mheg\\6.1.0.0__31bf3856ad364e35\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0167.081] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_64\\Microsoft.MediaCenter.Playback\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be1e0 [0167.085] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_64\\Microsoft.MediaCenter.Playback\\6.1.0.0__31bf3856ad364e35\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0167.085] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_64\\Microsoft.MediaCenter.TV.Tuners.Interop\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be1e0 [0167.085] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_64\\Microsoft.MediaCenter.TV.Tuners.Interop\\6.1.0.0__31bf3856ad364e35\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0167.085] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_64\\Microsoft.Office.Access.BusinessDataCatalog\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be1e0 [0167.086] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_64\\Microsoft.Office.Access.BusinessDataCatalog\\14.0.0.0__71e9bce111e9429c\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0167.087] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_64\\Microsoft.Office.BusinessData\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be1e0 [0167.088] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_64\\Microsoft.Office.BusinessData\\14.0.0.0__71e9bce111e9429c\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0167.088] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_64\\Microsoft.Office.InfoPath.Client.Internal.Host.Interop\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be1e0 [0167.089] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_64\\Microsoft.Office.InfoPath.Client.Internal.Host.Interop\\14.0.0.0__71e9bce111e9429c\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0167.090] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_64\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be1e0 [0167.091] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_64\\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop\\6.1.0.0__31bf3856ad364e35\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0167.091] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_64\\Microsoft.SharePoint.BusinessData.Administration.Client\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be1e0 [0167.092] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_64\\Microsoft.SharePoint.BusinessData.Administration.Client\\14.0.0.0__71e9bce111e9429c\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0167.093] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_64\\Microsoft.Transactions.Bridge.Dtc\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be1e0 [0167.093] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_64\\Microsoft.Transactions.Bridge.Dtc\\3.0.0.0__b03f5f7f11d50a3a\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0167.093] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_64\\Microsoft.Windows.Diagnosis.SDEngine\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be1e0 [0167.094] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_64\\Microsoft.Windows.Diagnosis.SDEngine\\6.1.0.0__31bf3856ad364e35\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0167.096] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_64\\MSBuild\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be1e0 [0167.097] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_64\\MSBuild\\3.5.0.0__b03f5f7f11d50a3a\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0167.097] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_64\\mscorlib\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be1e0 [0167.098] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_64\\mscorlib\\2.0.0.0__b77a5c561934e089\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0167.268] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_64\\napcrypt\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be1e0 [0167.269] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_64\\napcrypt\\6.1.0.0__31bf3856ad364e35\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0167.269] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_64\\naphlpr\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be1e0 [0167.270] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_64\\naphlpr\\6.1.0.0__31bf3856ad364e35\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0167.270] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_64\\Policy.1.0.Microsoft.Interop.Security.AzRoles\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be1e0 [0167.270] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_64\\Policy.1.0.Microsoft.Interop.Security.AzRoles\\6.1.7600.16385__31bf3856ad364e35\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0167.271] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_64\\Policy.1.2.Microsoft.Interop.Security.AzRoles\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be1e0 [0167.272] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_64\\Policy.1.2.Microsoft.Interop.Security.AzRoles\\6.1.7600.16385__31bf3856ad364e35\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0167.272] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_64\\Policy.6.0.Microsoft.Ink\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be1e0 [0167.272] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_64\\Policy.6.0.Microsoft.Ink\\6.1.0.0__31bf3856ad364e35\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0167.273] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_64\\PresentationCore\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be1e0 [0167.273] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_64\\PresentationCore\\3.0.0.0__31bf3856ad364e35\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0167.274] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_64\\System.Data\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be1e0 [0167.274] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_64\\System.Data\\2.0.0.0__b77a5c561934e089\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0167.274] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_64\\System.Data.OracleClient\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be1e0 [0167.275] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_64\\System.Data.OracleClient\\2.0.0.0__b77a5c561934e089\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0167.275] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_64\\System.EnterpriseServices\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be1e0 [0167.275] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_64\\System.EnterpriseServices\\2.0.0.0__b03f5f7f11d50a3a\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0167.276] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_64\\System.Printing\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be1e0 [0167.276] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_64\\System.Printing\\3.0.0.0__31bf3856ad364e35\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0167.277] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_64\\System.Transactions\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be1e0 [0167.277] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_64\\System.Transactions\\2.0.0.0__b77a5c561934e089\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0167.277] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_64\\System.Web\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be1e0 [0167.277] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_64\\System.Web\\2.0.0.0__b03f5f7f11d50a3a\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0167.278] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\*.*", lpFindFileData=0xaf398 | out: lpFindFileData=0xaf398) returned 0x5be220 [0167.280] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Accessibility\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be1e0 [0167.280] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Accessibility\\2.0.0.0__b03f5f7f11d50a3a\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0167.280] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\ComSvcConfig\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be1e0 [0167.281] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\ComSvcConfig\\3.0.0.0__b03f5f7f11d50a3a\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0167.281] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\cscompmgd\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be1e0 [0167.281] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\cscompmgd\\8.0.0.0__b03f5f7f11d50a3a\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0167.281] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\dfsvc\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be1e0 [0167.282] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\dfsvc\\2.0.0.0__b03f5f7f11d50a3a\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0167.282] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\ehCIR\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be1e0 [0167.282] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\ehCIR\\6.1.0.0__31bf3856ad364e35\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0167.283] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\ehexthost\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be1e0 [0167.283] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\ehexthost\\6.1.0.0__31bf3856ad364e35\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0167.283] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\ehiActivScp\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be1e0 [0167.283] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\ehiActivScp\\6.1.0.0__31bf3856ad364e35\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0167.284] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\ehiBmlDataCarousel\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be1e0 [0167.284] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\ehiBmlDataCarousel\\6.1.0.0__31bf3856ad364e35\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0167.284] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\ehiExtens\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be1e0 [0167.284] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\ehiExtens\\6.1.0.0__31bf3856ad364e35\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0167.285] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\ehiiTV\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be1e0 [0167.285] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\ehiiTV\\6.1.0.0__31bf3856ad364e35\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0167.285] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\ehiProxy\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be1e0 [0167.285] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\ehiProxy\\6.1.0.0__31bf3856ad364e35\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0167.286] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\ehiTVMSMusic\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be1e0 [0167.286] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\ehiTVMSMusic\\6.1.0.0__31bf3856ad364e35\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0167.286] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\ehiUPnP\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be1e0 [0167.286] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\ehiUPnP\\6.1.0.0__31bf3856ad364e35\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0167.287] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\ehiUserXp\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be1e0 [0167.288] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\ehiUserXp\\6.1.0.0__31bf3856ad364e35\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0167.288] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\ehiVidCtl\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be1e0 [0167.288] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\ehiVidCtl\\6.1.0.0__31bf3856ad364e35\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0167.289] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\ehiwmp\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be1e0 [0167.289] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\ehiwmp\\6.1.0.0__31bf3856ad364e35\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0167.289] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\ehiWUapi\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be1e0 [0167.289] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\ehiWUapi\\6.1.0.0__31bf3856ad364e35\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0167.290] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\ehRecObj\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be1e0 [0167.290] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\ehRecObj\\6.1.0.0__31bf3856ad364e35\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0167.290] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\ehshell\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be1e0 [0167.291] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\ehshell\\6.1.0.0__31bf3856ad364e35\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0167.291] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\EventViewer\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be1e0 [0167.291] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\EventViewer\\6.1.0.0__31bf3856ad364e35\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0167.291] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\EventViewer.Resources\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be1e0 [0167.292] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\EventViewer.Resources\\6.1.0.0_en_31bf3856ad364e35\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0167.292] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\IEExecRemote\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be1e0 [0167.293] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\IEExecRemote\\2.0.0.0__b03f5f7f11d50a3a\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0167.293] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\IEHost\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be1e0 [0167.293] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\IEHost\\2.0.0.0__b03f5f7f11d50a3a\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0167.294] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\IIEHost\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be1e0 [0167.294] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\IIEHost\\2.0.0.0__b03f5f7f11d50a3a\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0167.294] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\ipdmctrl\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be1e0 [0167.295] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\ipdmctrl\\11.0.0.0__71e9bce111e9429c\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0167.295] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\loadmxf\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be1e0 [0167.296] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\loadmxf\\6.1.0.0__31bf3856ad364e35\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0167.296] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\mcepg\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be1e0 [0167.296] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\mcepg\\6.1.0.0__31bf3856ad364e35\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0167.296] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\MCESidebarCtrl\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be1e0 [0167.297] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\MCESidebarCtrl\\6.1.0.0__31bf3856ad364e35\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0167.297] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\mcglidhostobj\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be1e0 [0167.298] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\mcglidhostobj\\6.1.0.0__31bf3856ad364e35\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0167.298] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\mcplayerinterop\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be1e0 [0167.298] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\mcplayerinterop\\6.1.0.0__31bf3856ad364e35\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0167.298] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\mcstore\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be1e0 [0167.298] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\mcstore\\6.1.0.0__31bf3856ad364e35\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0167.299] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.ApplicationId.Framework\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be1e0 [0167.299] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.ApplicationId.Framework\\6.1.0.0__31bf3856ad364e35\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0167.299] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.ApplicationId.Framework.Resources\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be1e0 [0167.299] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.ApplicationId.Framework.Resources\\6.1.0.0_en_31bf3856ad364e35\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0167.301] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.ApplicationId.RuleWizard\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be1e0 [0167.301] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.ApplicationId.RuleWizard\\6.1.0.0__31bf3856ad364e35\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0167.302] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.ApplicationId.RuleWizard.Resources\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be1e0 [0167.302] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.ApplicationId.RuleWizard.Resources\\6.1.0.0_en_31bf3856ad364e35\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0167.302] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.BackgroundIntelligentTransfer.Management\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be1e0 [0167.302] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.BackgroundIntelligentTransfer.Management\\1.0.0.0__31bf3856ad364e35\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0167.303] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.BackgroundIntelligentTransfer.Management.Resources\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be1e0 [0167.303] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.BackgroundIntelligentTransfer.Management.Resources\\1.0.0.0_en_31bf3856ad364e35\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0167.303] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Build.Conversion.v3.5\\*.*", lpFindFileData=0xaf248 | out: lpFindFileData=0xaf248) returned 0x5be1e0 [0167.303] FindFirstFileA (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.Build.Conversion.v3.5\\3.5.0.0__b03f5f7f11d50a3a\\*.*", lpFindFileData=0xaf0f8 | out: lpFindFileData=0xaf0f8) returned 0x5be260 [0192.779] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\alert_lrg.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\alert_lrg.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\alert_lrg.gif. " (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\alert_lrg.gif. ")) returned 1 [0192.828] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\ASPdotNET_logo.jpg" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\aspdotnet_logo.jpg"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\ASPdotNET_logo.jpg. " (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\aspdotnet_logo.jpg. ")) returned 1 [0192.831] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\aspx_file.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\aspx_file.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\aspx_file.gif. " (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\aspx_file.gif. ")) returned 1 [0192.964] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\branding_Full2.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\branding_full2.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\branding_Full2.gif. " (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\branding_full2.gif. ")) returned 1 [0192.975] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\darkBlue_GRAD.jpg" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\darkblue_grad.jpg"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\darkBlue_GRAD.jpg. " (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\darkblue_grad.jpg. ")) returned 1 [0192.976] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\deselectedTab_1x1.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\deselectedtab_1x1.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\deselectedTab_1x1.gif. " (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\deselectedtab_1x1.gif. ")) returned 1 [0192.991] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\folder.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\folder.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\folder.gif. " (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\folder.gif. ")) returned 1 [0192.993] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\gradient_onBlue.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\gradient_onblue.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\gradient_onBlue.gif. " (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\gradient_onblue.gif. ")) returned 1 [0192.994] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\gradient_onWhite.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\gradient_onwhite.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\gradient_onWhite.gif. " (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\gradient_onwhite.gif. ")) returned 1 [0192.996] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\headerGRADIENT_Tall.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\headergradient_tall.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\headerGRADIENT_Tall.gif. " (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\headergradient_tall.gif. ")) returned 1 [0193.223] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\help.jpg" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\help.jpg"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\help.jpg. " (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\help.jpg. ")) returned 1 [0193.513] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\HelpIcon_solid.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\helpicon_solid.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\HelpIcon_solid.gif. " (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\helpicon_solid.gif. ")) returned 1 [0193.516] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\image1.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\image1.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\image1.gif. " (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\image1.gif. ")) returned 1 [0193.518] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\image2.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\image2.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\image2.gif. " (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\image2.gif. ")) returned 1 [0193.682] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\requiredBang.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\requiredbang.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\requiredBang.gif. " (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\requiredbang.gif. ")) returned 1 [0193.878] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\security_watermark.jpg" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\security_watermark.jpg"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\security_watermark.jpg. " (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\security_watermark.jpg. ")) returned 1 [0193.999] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\selectedTab_1x1.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\selectedtab_1x1.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\selectedTab_1x1.gif. " (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\selectedtab_1x1.gif. ")) returned 1 [0194.001] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\selectedTab_leftCorner.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\selectedtab_leftcorner.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\selectedTab_leftCorner.gif. " (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\selectedtab_leftcorner.gif. ")) returned 1 [0194.003] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\selectedTab_rightCorner.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\selectedtab_rightcorner.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\selectedTab_rightCorner.gif. " (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\selectedtab_rightcorner.gif. ")) returned 1 [0194.091] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\topGradRepeat.jpg" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\topgradrepeat.jpg"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\topGradRepeat.jpg. " (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\topgradrepeat.jpg. ")) returned 1 [0194.171] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\unSelectedTab_leftCorner.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\unselectedtab_leftcorner.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\unSelectedTab_leftCorner.gif. " (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\unselectedtab_leftcorner.gif. ")) returned 1 [0194.174] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\unSelectedTab_rightCorner.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\unselectedtab_rightcorner.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\unSelectedTab_rightCorner.gif. " (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\unselectedtab_rightcorner.gif. ")) returned 1 [0194.260] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\yellowCORNER.gif" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\yellowcorner.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\yellowCORNER.gif. " (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\asp.netwebadminfiles\\images\\yellowcorner.gif. ")) returned 1 [0196.496] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ThirdPartyNotices.txt" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\thirdpartynotices.txt"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ThirdPartyNotices.txt. " (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\thirdpartynotices.txt. ")) returned 1 [0196.828] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\alert_lrg.gif" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\alert_lrg.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\alert_lrg.gif. " (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\alert_lrg.gif. ")) returned 1 [0196.845] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\alert_sml.gif" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\alert_sml.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\alert_sml.gif. " (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\alert_sml.gif. ")) returned 1 [0196.861] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\ASPdotNET_logo.jpg" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\aspdotnet_logo.jpg"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\ASPdotNET_logo.jpg. " (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\aspdotnet_logo.jpg. ")) returned 1 [0196.879] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\aspx_file.gif" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\aspx_file.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\aspx_file.gif. " (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\aspx_file.gif. ")) returned 1 [0196.889] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\branding_Full2.gif" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\branding_full2.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\branding_Full2.gif. " (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\branding_full2.gif. ")) returned 1 [0196.911] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\darkBlue_GRAD.jpg" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\darkblue_grad.jpg"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\darkBlue_GRAD.jpg. " (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\darkblue_grad.jpg. ")) returned 1 [0196.913] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\deselectedTab_1x1.gif" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\deselectedtab_1x1.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\deselectedTab_1x1.gif. " (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\deselectedtab_1x1.gif. ")) returned 1 [0196.923] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\folder.gif" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\folder.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\folder.gif. " (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\folder.gif. ")) returned 1 [0196.924] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\gradient_onBlue.gif" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\gradient_onblue.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\gradient_onBlue.gif. " (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\gradient_onblue.gif. ")) returned 1 [0196.926] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\gradient_onWhite.gif" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\gradient_onwhite.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\gradient_onWhite.gif. " (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\gradient_onwhite.gif. ")) returned 1 [0196.928] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\headerGRADIENT_Tall.gif" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\headergradient_tall.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\headerGRADIENT_Tall.gif. " (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\headergradient_tall.gif. ")) returned 1 [0196.935] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\help.jpg" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\help.jpg"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\help.jpg. " (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\help.jpg. ")) returned 1 [0196.938] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\HelpIcon_solid.gif" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\helpicon_solid.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\HelpIcon_solid.gif. " (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\helpicon_solid.gif. ")) returned 1 [0196.940] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\image1.gif" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\image1.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\image1.gif. " (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\image1.gif. ")) returned 1 [0196.948] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\image2.gif" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\image2.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\image2.gif. " (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\image2.gif. ")) returned 1 [0196.950] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\requiredBang.gif" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\requiredbang.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\requiredBang.gif. " (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\requiredbang.gif. ")) returned 1 [0196.951] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\security_watermark.jpg" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\security_watermark.jpg"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\security_watermark.jpg. " (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\security_watermark.jpg. ")) returned 1 [0196.958] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\selectedTab_1x1.gif" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\selectedtab_1x1.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\selectedTab_1x1.gif. " (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\selectedtab_1x1.gif. ")) returned 1 [0196.959] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\selectedTab_leftCorner.gif" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\selectedtab_leftcorner.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\selectedTab_leftCorner.gif. " (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\selectedtab_leftcorner.gif. ")) returned 1 [0196.961] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\selectedTab_rightCorner.gif" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\selectedtab_rightcorner.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\selectedTab_rightCorner.gif. " (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\selectedtab_rightcorner.gif. ")) returned 1 [0196.964] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\topGradRepeat.jpg" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\topgradrepeat.jpg"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\topGradRepeat.jpg. " (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\topgradrepeat.jpg. ")) returned 1 [0196.965] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\unSelectedTab_leftCorner.gif" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\unselectedtab_leftcorner.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\unSelectedTab_leftCorner.gif. " (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\unselectedtab_leftcorner.gif. ")) returned 1 [0196.966] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\unSelectedTab_rightCorner.gif" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\unselectedtab_rightcorner.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\unSelectedTab_rightCorner.gif. " (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\unselectedtab_rightcorner.gif. ")) returned 1 [0196.968] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\yellowCORNER.gif" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\yellowcorner.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ASP.NETWebAdminFiles\\Images\\yellowCORNER.gif. " (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\asp.netwebadminfiles\\images\\yellowcorner.gif. ")) returned 1 [0197.404] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\alert_lrg.gif" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\alert_lrg.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\alert_lrg.gif. " (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\alert_lrg.gif. ")) returned 1 [0197.412] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\ASPdotNET_logo.jpg" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\aspdotnet_logo.jpg"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\ASPdotNET_logo.jpg. " (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\aspdotnet_logo.jpg. ")) returned 1 [0197.415] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\aspx_file.gif" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\aspx_file.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\aspx_file.gif. " (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\aspx_file.gif. ")) returned 1 [0197.431] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\branding_Full2.gif" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\branding_full2.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\branding_Full2.gif. " (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\branding_full2.gif. ")) returned 1 [0197.460] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\darkBlue_GRAD.jpg" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\darkblue_grad.jpg"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\darkBlue_GRAD.jpg. " (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\darkblue_grad.jpg. ")) returned 1 [0197.462] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\deselectedTab_1x1.gif" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\deselectedtab_1x1.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\deselectedTab_1x1.gif. " (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\deselectedtab_1x1.gif. ")) returned 1 [0197.491] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\folder.gif" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\folder.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\folder.gif. " (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\folder.gif. ")) returned 1 [0197.493] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\gradient_onBlue.gif" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\gradient_onblue.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\gradient_onBlue.gif. " (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\gradient_onblue.gif. ")) returned 1 [0197.493] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\gradient_onWhite.gif" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\gradient_onwhite.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\gradient_onWhite.gif. " (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\gradient_onwhite.gif. ")) returned 1 [0197.495] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\headerGRADIENT_Tall.gif" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\headergradient_tall.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\headerGRADIENT_Tall.gif. " (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\headergradient_tall.gif. ")) returned 1 [0197.523] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\help.jpg" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\help.jpg"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\help.jpg. " (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\help.jpg. ")) returned 1 [0197.664] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\HelpIcon_solid.gif" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\helpicon_solid.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\HelpIcon_solid.gif. " (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\helpicon_solid.gif. ")) returned 1 [0197.667] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\image1.gif" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\image1.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\image1.gif. " (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\image1.gif. ")) returned 1 [0197.669] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\image2.gif" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\image2.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\image2.gif. " (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\image2.gif. ")) returned 1 [0197.915] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\requiredBang.gif" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\requiredbang.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\requiredBang.gif. " (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\requiredbang.gif. ")) returned 1 [0197.917] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\security_watermark.jpg" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\security_watermark.jpg"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\security_watermark.jpg. " (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\security_watermark.jpg. ")) returned 1 [0197.918] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\selectedTab_1x1.gif" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\selectedtab_1x1.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\selectedTab_1x1.gif. " (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\selectedtab_1x1.gif. ")) returned 1 [0197.918] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\selectedTab_leftCorner.gif" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\selectedtab_leftcorner.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\selectedTab_leftCorner.gif. " (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\selectedtab_leftcorner.gif. ")) returned 1 [0197.919] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\selectedTab_rightCorner.gif" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\selectedtab_rightcorner.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\selectedTab_rightCorner.gif. " (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\selectedtab_rightcorner.gif. ")) returned 1 [0198.057] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\topGradRepeat.jpg" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\topgradrepeat.jpg"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\topGradRepeat.jpg. " (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\topgradrepeat.jpg. ")) returned 1 [0198.059] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\unSelectedTab_leftCorner.gif" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\unselectedtab_leftcorner.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\unSelectedTab_leftCorner.gif. " (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\unselectedtab_leftcorner.gif. ")) returned 1 [0198.060] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\unSelectedTab_rightCorner.gif" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\unselectedtab_rightcorner.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\unSelectedTab_rightCorner.gif. " (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\unselectedtab_rightcorner.gif. ")) returned 1 [0198.063] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\yellowCORNER.gif" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\yellowcorner.gif"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ASP.NETWebAdminFiles\\Images\\yellowCORNER.gif. " (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\asp.netwebadminfiles\\images\\yellowcorner.gif. ")) returned 1 [0199.474] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\SetupCache\\v4.6.00081\\DHtmlHeader.html" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\setupcache\\v4.6.00081\\dhtmlheader.html"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\SetupCache\\v4.6.00081\\DHtmlHeader.html. " (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\setupcache\\v4.6.00081\\dhtmlheader.html. ")) returned 1 [0199.515] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\SetupCache\\v4.6.00081\\header.bmp" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\setupcache\\v4.6.00081\\header.bmp"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\SetupCache\\v4.6.00081\\header.bmp. " (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\setupcache\\v4.6.00081\\header.bmp. ")) returned 1 [0199.755] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\SetupCache\\v4.6.00081\\SplashScreen.bmp" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\setupcache\\v4.6.00081\\splashscreen.bmp"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\SetupCache\\v4.6.00081\\SplashScreen.bmp. " (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\setupcache\\v4.6.00081\\splashscreen.bmp. ")) returned 1 [0199.949] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\SetupCache\\v4.6.00081\\watermark.bmp" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\setupcache\\v4.6.00081\\watermark.bmp"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\SetupCache\\v4.6.00081\\watermark.bmp. " (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\setupcache\\v4.6.00081\\watermark.bmp. ")) returned 1 [0202.218] MoveFileA (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ThirdPartyNotices.txt" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\thirdpartynotices.txt"), lpNewFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ThirdPartyNotices.txt. " (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\thirdpartynotices.txt. ")) returned 1 [0203.408] MoveFileA (lpExistingFileName="C:\\Windows\\ShellNew\\EXCEL12.XLSX" (normalized: "c:\\windows\\shellnew\\excel12.xlsx"), lpNewFileName="C:\\Windows\\ShellNew\\EXCEL12.XLSX. " (normalized: "c:\\windows\\shellnew\\excel12.xlsx. ")) returned 1 [0203.420] MoveFileA (lpExistingFileName="C:\\Windows\\ShellNew\\PWRPNT12.PPTX" (normalized: "c:\\windows\\shellnew\\pwrpnt12.pptx"), lpNewFileName="C:\\Windows\\ShellNew\\PWRPNT12.PPTX. " (normalized: "c:\\windows\\shellnew\\pwrpnt12.pptx. ")) returned 1 [0203.984] MoveFileA (lpExistingFileName="C:\\Windows\\System32\\catroot2\\dberr.txt" (normalized: "c:\\windows\\system32\\catroot2\\dberr.txt"), lpNewFileName="C:\\Windows\\System32\\catroot2\\dberr.txt. " (normalized: "c:\\windows\\system32\\catroot2\\dberr.txt. ")) returned 1